Data sharing method and related equipment

Abstract

The invention discloses a data sharing method, which is characterized in that a system-level file encryption control sharing function can be provided for a sender and sender equipment, a certain application is not required to be installed on the sender equipment, and the sender can select a file to be shared from a system through the sender equipment and set an authority control strategy; sending the information to a receiver device through one or more different sending modes; for a receiver, a receiver device can provide a data management and control function, the receiver can receive and open the shared file through the receiver device, and the system can dynamically adjust permissions of different functions of an application access system based on a permission control strategy set in the file, for example, the permissions of different functions of the application access system. A receiving party can be controlled to be incapable of performing operations such as copying, screen capturing and printing on the file, and an attacker cannot perform the operations on the file even if attacking an application for opening the file. In this way, the scene support degree, safety, eco-friendliness and the like are all improved, and the user experience is better.

Description

Technical Field

[0001] The present application relates to the field of terminal technology, and in particular to a data sharing method and related equipment. Background Art

[0002] With the rapid development of terminal technology, user 1 can share documents, pictures and other data to user 2's terminal device through terminal devices such as smart phones and tablets. There are some data that user 1 may not want user 2 to leak. Usually, user 1 will verbally ask user 2 not to forward this data, but this verbal instruction method has limited effect. User 2 can still forward, print, copy, take screenshots and other operations on this data at will, which has poor security and user experience. Summary of the invention

[0003] The embodiment of the present application provides a data sharing method, which can provide system-level file encryption management and sharing functions and data management functions, improve scene support, security, eco-friendliness, etc., and provide a better user experience.

[0004] In a first aspect, an embodiment of the present application provides a data sharing method, applied to a first electronic device, the method comprising: the first electronic device determines that a first file is selected; in response to an operation of sharing the first file on a first interface, the first electronic device sends the first file to a second electronic device associated with the first user; wherein the first electronic device is used to set a first permission for the first file, and the first permission takes effect for multiple applications on the first electronic device when sending the first file, and the first permission is used to indicate that the first user is authorized to perform one or more operations on the first file.

[0005] The first electronic device may be, for example, the electronic device 100 (sender device), the second electronic device may be, for example, the electronic device 200 (receiver device), the first file is a file to be shared, which may include but is not limited to pictures, documents, audio and video, and the first interface may be, for example, Figure 3B or Figure 3C or Fig. 10C In the interface shown, the first user is the recipient, which can be an individual or a group.

[0006] By implementing the method provided in the first aspect, the electronic device can support users to use system functions to configure to whom the file is sent and what permissions the file recipient has (such as read-only permissions, editable permissions, etc.), without the upper-level application needing to be aware of it, thereby improving eco-friendliness and providing a better user experience.

[0007] In one possible implementation, the method further includes: before the first electronic device sends the first file to the second electronic device associated with the first user, the first electronic device displays at least one item of a device list, an application list, and a user list on an interface, and the interface is a first interface or a second interface; the first electronic device sends the first file to the second electronic device associated with the first user, specifically including: in response to an operation of selecting the second electronic device in the device list, the first electronic device sends the first file to the second electronic device associated with the first user; or, in response to an operation of selecting the first application in the application list, the first electronic device sends the first file to the second electronic device associated with the first user through the first application; or, in response to an operation of selecting the first user in the user list, the first electronic device sends the first file to the second electronic device associated with the first user.

[0008] The second interface may be, for example, Fig. 5F In the interface shown, the device list may include one or more devices (eg Fig. 5F The application list may include one or more applications (such as Fig. 5F The user list can include one or more users (for example, Fig. 5F Options for Alice, Alee) shown.

[0009] There are two ways for a first electronic device to send a first file to a second electronic device associated with a first user through a first application: a first way is that the first application first determines the first user, and then determines the device associated with the first user based on the first user, and finally sends the first file to the device; a second way is that the first application directly determines the recipient device and sends the first file to the device.

[0010] In this way, electronic devices can support users to share files in different ways, which is highly flexible and improves user experience.

[0011] In one possible implementation, a first electronic device sends a first file to a second electronic device associated with a first user, specifically including: in response to an operation of sharing the first file triggered on an interface, the first electronic device sends the first file to the second electronic device associated with the first user, and the interface is an interface for conducting a conversation with the first user.

[0012] The above interface can be, for example, Fig. 10A or Fig. 10C The interface shown.

[0013] In this way, electronic devices can support users to share files with system-set permissions within applications (such as communication applications), thereby solving the problem that permission settings initiated within applications must be implemented by the application alone. If other applications want to control file permissions, they need to implement it repeatedly.

[0014] In a possible implementation, the first permission is set for the first file before the operation of sharing the first file; or, the first permission is set for the first file after the operation of sharing the first file and is sent to the second electronic device associated with the first user.

[0015] That is to say, the electronic device can support the user to set permissions for the file first and then perform a sharing operation, or it can support the user to perform a sharing operation first, which can trigger the electronic device to set permissions for the file and send the file.

[0016] In one possible implementation, the method further includes: in response to an operation of sharing the first file on the first interface, the first electronic device sends the first file to a third electronic device associated with the second user; wherein the first electronic device is used to set a second permission for the first file, and the second permission takes effect for multiple applications on the first electronic device when sending the first file, and the second permission is used to indicate that the second user is authorized to perform one or more operations on the first file.

[0017] The second permission may be the same as or different from the first permission.

[0018] In this way, for the same file, the electronic device can set corresponding permissions for multiple users respectively.

[0019] In one possible implementation, the method further includes: the first electronic device determines that the second file is selected; in response to the operation of sharing the second file on the first interface, the first electronic device sends the second file to the second electronic device associated with the first user; wherein the first electronic device is used to set a third permission for the second file, and the third permission takes effect for multiple applications on the first electronic device when sending the second file, and the third permission is used to indicate that the first user is authorized to perform one or more operations on the second file.

[0020] The third permission may be the same as or different from the first permission.

[0021] In this way, for different files, the electronic device can set corresponding permissions for the same user.

[0022] In one possible implementation, the first user belongs to a first group, which also includes a third user. The method also includes: in response to an operation of sharing a first file on a first interface, the first electronic device sends the first file to a fourth electronic device associated with the third user, and the first permission is also used to indicate that the third user is authorized to perform one or more operations on the first file; or, in response to an operation of sharing the first file on the first interface, the first electronic device sends the first file to a fourth electronic device associated with the third user; wherein the first electronic device is also used to set a fourth permission for the first file, and the fourth permission takes effect for multiple applications on the first electronic device when sending the first file, and the fourth permission is used to indicate that the third user is authorized to perform one or more operations on the first file.

[0023] In this way, when the recipient belongs to a certain group, the electronic device can set permissions for group members in the group in a unified manner, or can set permissions for group members in the group separately.

[0024] In a possible implementation, before the first electronic device sends the first file to the second electronic device associated with the first user, the method further includes: the first electronic device logs in to a first account, where the first account belongs to an account of a fourth user.

[0025] The fourth user is the sender, so after logging into the account, the receiver can know who is the sender of the first file.

[0026] In a possible implementation, before the first electronic device sends the first file to the second electronic device associated with the first user, the method further includes: the first electronic device obtains credentials corresponding to the first user; and the first electronic device encrypts the first file based on the credentials.

[0027] In this way, electronic devices can encrypt files before sending them to improve security.

[0028] In a possible implementation, the credentials are obtained by the first electronic device on a server, or the credentials are obtained locally by the first electronic device, or the credentials are obtained by the first electronic device on a second electronic device.

[0029] In one possible implementation, the first electronic device is used to set a first permission for a first file, specifically including: the first electronic device is used to write field information of the first permission in the first file; or, the first electronic device is used to send a first message to a server, the first message including field information of the first permission and identification information of the first file, and the first message is used to instruct the server to save the association between the field information of the first permission and the identification information of the first file.

[0030] In one possible implementation, the first permission includes read-only permission, or editable permission, or forwarding permission, and the editable permission includes one or more of editing permission, save permission, screenshot permission, screen recording permission, printing permission, and copy permission.

[0031] In the embodiment of the present application, the forwarding permission may be within the definition scope of the above-mentioned first permission, or may not be within the definition scope of the above-mentioned first permission (that is, the forwarding permission and the first permission may be parallel).

[0032] In a possible implementation manner, the first file includes sensitive information.

[0033] In one possible implementation, the credentials corresponding to the first user are associated with the identity corresponding to the first user; the identity corresponding to the first user is manually input by the user, or selected by the user in the address book of the first electronic device, or obtained by the first electronic device on the second electronic device.

[0034] In a possible implementation, the first electronic device sets the first permission for the first file, specifically including: the first electronic device displays a first prompt message, the first prompt message is used to prompt a user whether to agree to set the first permission for the first file; if it is confirmed that the user agrees to set the first permission for the first file, the first electronic device sets the first permission for the first file.

[0035] The first prompt information may be, for example, Figure 7B The prompt information shown.

[0036] In a second aspect, an embodiment of the present application provides a data sharing method, which is applied to a second electronic device, the method comprising: the second electronic device receives a first file sent by a first electronic device, the first file is controlled by a first permission, and the first permission is effective when multiple applications on the second electronic device perform operations within the scope of the first permission control on the first file, and the multiple applications include the first application; the second electronic device obtains a first operation on the first file in the first application; in response to the first operation, if the second electronic device determines that the first operation is one or more operations indicated by the first permission that the first user is authorized to perform on the first file, the second electronic device responds to the first operation.

[0037] The first application may be a system application or a third-party application.

[0038] By implementing the method provided in the second aspect, the electronic device can provide data control functions, the recipient can receive and open the shared file through the electronic device, and the system can dynamically adjust the application's access rights to different system functions based on the permission control policy set in the file. For example, the recipient can be controlled to be unable to perform secondary forwarding, copying, screenshots, printing and other operations on the file. Even if the attacker attacks the application that opens the file, he cannot perform the above operations on the file. In this way, the scene support, security, and eco-friendliness are all improved, and the user experience will be better.

[0039] In one possible implementation, before the second electronic device determines that the first operation is one or more operations that the first user indicated by the first permission is authorized to perform on the first file, the method further includes: the second electronic device determines that the user performing the first operation is a first user who is authenticated to have operation permission on the first file.

[0040] That is to say, only when the user associated with the account logged in by the receiving device is the recipient of the first file specified by the sender, the receiving device can further determine whether the first operation is one or more operations that the first user is authorized to perform on the first file as indicated by the first permission.

[0041] In one possible implementation, the second electronic device determines that the user performing the first operation is a first user who has been authenticated and has operation authority over the first file, specifically including: the second electronic device determines that the account logged into the second electronic device is the account of the first user; or, the second electronic device determines that the biometric characteristics of the user performing the first operation are consistent with the biometric characteristics of the first user; or, the second electronic device receives a first message sent by a third electronic device, the first message is used to indicate that the user performing the first operation is a first user who has been authenticated and has operation authority over the first file, and the third electronic device is associated with the second electronic device.

[0042] In this way, the electronic device can authenticate the recipient in different ways, which is convenient and flexible and improves the user experience.

[0043] In one possible implementation, the method further includes: when the second electronic device determines that the first operation does not belong to one or more operations indicated by the first permission that the first user is authorized to perform on the first file, the second electronic device displays a first prompt message, and the first prompt message is used to prompt the user that the second electronic device refuses to respond to the first operation.

[0044] The first prompt information may be, for example, Fig.11G or Fig.11H or Fig.11I The prompt information shown.

[0045] In a possible implementation, the method further includes: in response to an operation of sharing the first file, the second electronic device sends the first file to a third electronic device associated with the first user.

[0046] In this way, the electronic device can support the user to forward the first file to other electronic devices associated with the electronic device.

[0047] In a possible implementation, the method further includes: in response to an operation of sharing the first file, the second electronic device sends the first file to a fourth electronic device associated with the second user.

[0048] In this way, the electronic device can support the user to forward the first file to electronic devices associated with other users.

[0049] In a possible implementation, when the first file is forwarded by the second electronic device, the first file is set to a third permission, and the authorization scope of the third permission does not exceed the authorization scope of the first permission.

[0050] That is to say, when a file is forwarded for the second time, the authorization scope of the permission set for the file can be smaller than the authorization scope of the permission when it is forwarded for the first time. For example, read-only permission can be set when forwarding for the second time. In this way, security can be improved.

[0051] In a possible implementation, the method further includes: the second electronic device sends a second message to the first electronic device, where the second message is used to indicate that the first electronic device authorizes the first user to perform a second operation on the first file, and the second operation does not belong to one or more operations indicated by the first permission that the first user is authorized to perform on the first file.

[0052] In this way, when the receiving device performs an unauthorized operation on a file, the sending device can be notified to perform re-authorization.

[0053] In a possible implementation, the method further includes: the second electronic device sending a third message to the first electronic device, where the third message is used to indicate that the first electronic device authorizes the first user to perform a forwarding operation on the first file.

[0054] In this way, when the receiving device performs a forwarding operation on the first file, the sending device can notify the receiving device to authorize the receiving device to perform the forwarding operation on the file.

[0055] In a possible implementation, the first file is an encrypted file, and before the second electronic device responds to the first operation, the method further includes: the second electronic device obtains credentials corresponding to the first user; and the second electronic device decrypts the first file based on the credentials.

[0056] In a possible implementation manner, a first identifier is displayed on the second electronic device, and the first identifier is used to indicate that the first file is an encrypted file.

[0057] The first identifier may be, for example, Fig.11A The identifier of document 1 shown (i.e., the icons of all encrypted files are the same encryption icon) may also be, for example, Fig. 11B The identification of document 1 is shown (i.e., the encryption icon is superimposed on the exclusive icon).

[0058] In a possible implementation manner, the first permission is obtained by the second electronic device from the first file; or, the first permission is obtained by the second electronic device from a server.

[0059] In a possible implementation, the first permission includes read-only permission, or editable permission, or forwarding permission, and the editable permission includes one or more of save as permission, screenshot permission, screen recording permission, print permission, and copy permission.

[0060] In a third aspect, an embodiment of the present application provides an electronic device, comprising one or more processors and one or more memories; wherein the one or more memories are coupled to the one or more processors, and the one or more memories are used to store computer program code, and the computer program code comprises computer instructions, and when the one or more processors execute the computer instructions, the electronic device executes the method described in any possible implementation of the first aspect or the second aspect above.

[0061] In a fourth aspect, an embodiment of the present application provides a computer storage medium, which stores a computer program, wherein the computer program includes program instructions. When the program instructions are executed on an electronic device, the electronic device executes the method described in any possible implementation of the first aspect or the second aspect.

[0062] In a fifth aspect, an embodiment of the present application provides a computer program product. When the computer program product runs on a computer, it enables the computer to execute the method described in any possible implementation of the first aspect or the second aspect above. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 It is a schematic diagram of a software structure provided in an embodiment of the present application;

[0064] Figure 2A It is a schematic diagram of the architecture of a communication system provided by an embodiment of the present application;

[0065] Figure 2B is a schematic diagram of a software structure of an electronic device 100 provided in an embodiment of the present application;

[0066] Figure 2C is a schematic diagram of a software structure of an electronic device 200 provided in an embodiment of the present application;

[0067] Figure 3A-3C It is a schematic diagram of a user interface involved in a scenario of initiating data sharing through a system provided in an embodiment of the present application;

[0068] Figure 4A-4C is another group of user interface schematic diagrams involved in a scenario of initiating data sharing through a system provided in an embodiment of the present application;

[0069] Figure 5A-5F is another group of user interface schematic diagrams involved in a scenario of initiating data sharing through a system provided in an embodiment of the present application;

[0070] Figure 6A-6C It is a schematic diagram of a group of electronic devices 100 provided in an embodiment of the present application obtaining credentials of a recipient;

[0071] Figure 7A-7B is another group of user interface schematic diagrams involved in a scenario of initiating data sharing through a system provided in an embodiment of the present application;

[0072] Figure 8A-8J is another group of user interface schematic diagrams involved in a scenario of initiating data sharing through a system provided in an embodiment of the present application;

[0073] Figure 9A-9D is another group of user interface schematic diagrams involved in a scenario of initiating data sharing through a system provided in an embodiment of the present application;

[0074] Figures 10A-10D It is a schematic diagram of a user interface involved in a scenario of initiating data sharing through a communication application provided in an embodiment of the present application;

[0075] Figures 11A-11I A schematic diagram of a user interface involved in a scenario of receiving and opening a shared file through a system provided in an embodiment of the present application;

[0076] Fig.12 This is a schematic diagram of a flow chart for controlling network, Bluetooth and other functions provided by an embodiment of the present application;

[0077] Fig.13 This is a flow chart of controlling functions such as printing and copying provided by an embodiment of the present application;

[0078] Fig.14 This is a schematic diagram of a process for controlling functions such as screenshots provided by an embodiment of the present application;

[0079] Figure 15A-15B A user interface diagram for receiving and opening a shared file through a communication application provided in an embodiment of the present application;

[0080] Fig.16 This is a flow chart of a data sharing method provided in an embodiment of the present application;

[0081] Fig.17 This is a flowchart of another method for data sharing provided in an embodiment of the present application;

[0082] Fig.18 It is a schematic diagram of the hardware structure of an electronic device 100 provided in an embodiment of the present application. DETAILED DESCRIPTION

[0083] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. In the description of the embodiments of the present application, unless otherwise specified, " / " means or, for example, A / B can mean A or B; "and / or" in the text is only a description of the association relationship of the associated objects, indicating that there can be three relationships, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, "multiple" means two or more than two.

[0084] It should be understood that the terms "first", "second", etc. in the specification, claims and drawings of the present application are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or devices.

[0085] Reference to "embodiments" in this application means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described in this application may be combined with other embodiments.

[0086] The term "user interface (UI)" in the following embodiments of the present application refers to a medium interface for interaction and information exchange between an application or operating system and a user, which realizes the conversion between the internal form of information and the form acceptable to the user. The user interface is a source code written in a specific computer language such as Java and extensible markup language (XML). The interface source code is parsed and rendered on an electronic device, and finally presented as content that can be recognized by the user. The commonly used form of user interface is a graphical user interface (GUI), which refers to a user interface related to computer operation displayed in a graphical manner. It can be a visual interface element such as text, icons, buttons, menus, tabs, text boxes, dialog boxes, status bars, navigation bars, widgets, etc. displayed on the display screen of an electronic device.

[0087] Currently, the function of controlled sharing of files can be realized in some office document applications. Usually, the sending device can encrypt the file to be shared in the office document application, specify a specific recipient to decrypt the file, and set specific permissions for the file (such as read-only, editable, etc.). The receiving device can open the shared file in the office document application, and the application can parse the file content and execute the permissions set for the file.

[0088] For example, see Figure 1 The above-mentioned office document application can be one of the multiple applications installed on the electronic device. The application can include a controlled sharing software toolkit, which can include a credential management module and a policy parsing module. The credential management module can be used to obtain and save user credentials, and the policy parsing module can be used to parse the file permission policy.

[0089] There are also some problems with controlled sharing of files through the above-mentioned office document applications. For example, in terms of scenario support, it usually only supports specific document encryption sharing scenarios, which is relatively limited. For another example, in terms of security (such as credential management, permission management), when the application is hooked, the user's credentials may be leaked through the credential management module. In addition, the permissions set for the file are parsed through the policy parsing module, and the permission control relies on deep customization and interception of the application. When the application is hooked, the permission control point may become invalid. For another example, in terms of eco-friendliness, the controlled sharing function is highly dependent on the adaptation of each application. The receiving device can only use one application to open the shared file (for example, the permission control method implemented in a certain application has not been adapted by other applications, then only this one application can open the file with added permission settings), and the experience is poor.

[0090] Based on the above problems, the embodiment of the present application provides a data sharing method. For the sender, the electronic device 100 (sender device) can provide a system-level file encryption control sharing function, which does not rely on the electronic device 100 to install a certain application. The sender can select the file to be shared from the system (such as pictures, documents, etc.) through the electronic device 100, and set the permission control strategy, and send it to the receiver's device through one or more different sending methods; for the receiver, the electronic device 200 (receiver device) can provide a data control function, and the receiver can receive and open the shared file through the electronic device 200. The system can dynamically adjust the application's permission to access different functions of the system based on the permission control strategy set in the file. For example, the receiver can be controlled to be unable to perform secondary forwarding, copying, screenshots, printing, etc. on the file. Even if the attacker attacks the application that opens the file, he cannot perform the above operations on the file. In this way, the scene support, security, and eco-friendliness are all improved, and the user experience will be better.

[0091] Below, a communication system provided by an embodiment of the present application is first introduced.

[0092] Figure 2A A communication system provided by an embodiment of the present application is exemplified.

[0093] See also Figure 2A The communication system may include: an electronic device 100 (sender device), an electronic device 200 (receiver device), and a server 300.

[0094] Among them, the electronic device 100 and the electronic device 200 are both terminal devices and can be of various types, which is not limited in the embodiments of the present application.

[0095] For example, the electronic device 100, i.e., the sending device (or sharing device), can be a mobile phone, a large screen, a tablet, a personal computer (PC), a car machine, a watch, a bracelet, a virtual reality device (VR) / augmented reality device (AR), etc.

[0096] In an embodiment of the present application, the electronic device 100 can provide a system-level file encryption management and sharing function, which does not rely on the electronic device 100 to install a certain application. For details, please refer to the relevant content in the subsequent embodiments.

[0097] For example, the electronic device 200, i.e., the receiving device, can be a mobile phone, a large screen, a tablet, a PC, a car computer, a watch, a bracelet, VR / AR, etc.

[0098] In an embodiment of the present application, the electronic device 200 can provide a data management function. The system can dynamically adjust the application's access permissions to different system functions based on the permission management policy set in the shared file. For details, please refer to the relevant content in the subsequent embodiments.

[0099] The server 300 may be a traditional server or a cloud server, which is not limited in the embodiment of the present application.

[0100] In the embodiment of the present application, the server 300 can be used to store a mapping relationship table between user identities and credentials.

[0101] The electronic device 100 in the communication system can establish a wired connection or other wireless connection with the electronic device 200, such as a Bluetooth communication connection, a wireless local area network (WLAN) such as a wireless fidelity point to point (Wi-Fi P2P) connection, a nearfield communication (NFC) connection, an infrared technology (IR) connection, a remote connection (such as a remote connection established through a server), etc., or, it can also be connected and communicated by combining any of the above methods.

[0102] The electronic device 100 and the electronic device 200 in the communication system may be configured with different software operating systems (OS), including but not limited to Etc. Among them, The electronic device 100 and the electronic device 200 may also be configured with the same software operating system, for example, they may both be configured with

[0103] It should be understood that Figure 2A This is only a schematic diagram of the architecture of the communication system and should not be construed as limiting the present application. The embodiment of the present application does not limit the number of electronic devices 100, electronic devices 200, and servers 300 included in the communication system.

[0104] The following introduces the software architecture of the electronic device 100 provided in the embodiment of the present application.

[0105] Figure 2B The software architecture of the electronic device 100 is exemplarily shown.

[0106] See also Figure 2BThe electronic device 100 may include one or more applications (such as gallery / file management applications), a file permission management service module, a system sharing service module, and a communication module such as Bluetooth / WIFI.

[0107] The one or more applications may be system applications or third-party applications.

[0108] In some examples, the upper layer application may not include applications such as gallery / file management, for example, the upper layer application may be an application that can access, share, and perform other operations on files in applications such as gallery / file management.

[0109] In some other examples, the upper layer applications may also include applications such as gallery / file management.

[0110] Among them, applications such as gallery / file management can be used to provide file access entry, provide file selector, receive file selection events, provide file path, display files, etc.

[0111] The file rights management service module can be used to encrypt files, generate file rights control policies, and so on.

[0112] The file authority management service module may include a file encryption module and a control strategy generation module.

[0113] Among them, the file encryption module can be used to obtain credentials for the specified recipient identity, receive the file's permission control policy, use the credentials to encrypt the file's content and the file's permission control policy, generate file ciphertext with permission control policy, and so on.

[0114] Among them, the control policy generation module can be used to receive the user's permission control configuration operation on the file to generate the file's permission control policy, and so on.

[0115] The system sharing service module can be used to provide system-level data sharing functions.

[0116] Communication modules such as Bluetooth / WIFI can be used to provide communication functions for the electronic device 100. For example, the electronic device 100 can send files to be shared to the electronic device 200 via communication modules such as Bluetooth / WIFI.

[0117] Understandably, Figure 2B This is merely exemplary and should not impose any limitation on the software architecture of the electronic device 100 in the embodiment of the present application.

[0118] The software architecture of the electronic device 200 provided in the embodiment of the present application is introduced below.

[0119] Figure 2CThe software architecture of the electronic device 200 is exemplarily shown.

[0120] See also Figure 2C The electronic device 200 may include upper-layer applications (such as office document applications), a file management module, an application permission management service module, a file permission management service module, an application management module, network / Bluetooth / storage and other service modules, screenshot / recording applications, printing / copying and other service modules, and a window management service module.

[0121] The upper layer application can be used to open a file (e.g., a file shared by the electronic device 100). The upper layer application can be a system application or a third-party application. For example, the upper layer application can be an office document application or an application such as a gallery or a file management application.

[0122] The file management module (eg, a file management application) may be used to provide a file path, determine file attributes (eg, determine whether a file is a controlled shared file), and so on.

[0123] The application permission management service module can be used to provide system-wide permission management capabilities and permission management judgment capabilities when an application uses one or more functions. In an embodiment of the present application, it can also be used to provide dynamic permission setting capabilities when an application opens a file and dynamic management and control capabilities when an application performs an operation. It can also be used to receive permission control policies configured by the application management module for a certain application identifier (for example, application identifier 11), and so on.

[0124] The file rights management service module can be used to decrypt received files, parse, configure, store, read and perform other operations on file rights control policies, etc.

[0125] The file authority management service module may include a file decryption module, a control policy parsing module, a control policy configuration module, a control policy storage module, and a control policy reading module.

[0126] Among them, the file decryption module can be used to obtain credentials based on the recipient's identity, decrypt the file ciphertext (such as decrypting the file content, decrypting the file's permission control policy), and so on.

[0127] Among them, the control policy analysis module can be used to analyze the permission control policy of the decrypted file, generate analysis results, and so on.

[0128] Among them, the control strategy configuration module can be used to provide configuration capabilities for parsing results, etc.

[0129] Among them, the control strategy storage module can be used to provide storage capabilities for analysis results, and so on.

[0130] Among them, the control strategy reading module can be used to read the analysis results, provide query capabilities for the analysis results, and so on.

[0131] The application management module can be used to launch applications, configure application permissions, and so on.

[0132] The application management module may include an application startup module and an application permission configuration module.

[0133] Among them, the application startup module can be used to start the application with an independent process based on the application result selected by the user, allocate an application identifier, etc.

[0134] Among them, the application permission configuration module can be used to determine whether the file is an encrypted controlled file, obtain the permission control policy for the file from the file permission management service module, and configure the permission control policy for the application identifier to the application permission management service module.

[0135] Network / Bluetooth / Storage and other service modules can be used to determine whether to allow access based on the permission control policy when the application initiates access to the network / Bluetooth / Storage and other service modules, etc. For example, if the current application is an application that does not open a controlled file (also called a normal application), it can be controlled or released based on the regular permission authorization record; for another example, if the current application is an application that opens a controlled file, it can be controlled or released based on the permission control policy dynamically configured when the file is opened.

[0136] The screenshot / recording application can be used to take screenshots and record screens of file contents, etc.

[0137] The print / copy service module is used to determine whether to allow access based on the permission control policy when an application initiates access to the print / copy service module. For example, if the current application is an application that does not open a controlled file, it can be directly released when there is no special restriction in the system; for another example, if the current application is an application that opens a controlled file, the decision result of whether to allow release can be obtained from the file permission management service module, and control or release can be performed based on the decision result.

[0138] The window management service module can be used to manage window programs. The window management service module can obtain the display screen size, capture the screen, etc.

[0139] Understandably, Figure 2C This is merely exemplary and should not impose any limitation on the software architecture of the electronic device 200 in the embodiment of the present application.

[0140] The data sharing method provided in the embodiments of the present application is described in detail below in conjunction with a series of exemplary user interfaces.

[0141] For the sender (or sharing party), in the embodiment of the present application, the electronic device 100 can support the user to initiate sharing through the system, and can also support the user to initiate sharing through a communication application.

[0142] For the recipient, in the embodiment of the present application, the electronic device 200 can support the user to receive and open the shared files through the system, and can also support the user to initiate sharing through a communication application to receive and open the shared files.

[0143] Scenario 1: Sharing via the system

[0144] See also Figure 3A , Figure 3A The exemplary user interface 310 may be a user interface for a user to select a file / folder in the system. The user interface 310 may include a file management list, one or more options (e.g., a share option 311, a copy option, a move option, a delete option, and more options), wherein the file management list may include one or more files (e.g., a document "appearance patent briefing book.txt", a picture "IMG_3392.jpg"), one or more folders (e.g., folder 1), and the share option 311 may be used to directly share the selected file / folder.

[0145] In an embodiment of the present application, the electronic device 100 can support a user to select files / folders in the system. The entry for selecting files / folders may include but is not limited to application entries such as gallery and file management that can display files. The operation for selecting files / folders may include but is not limited to long press operation, click operation, drag operation, etc. The number of selected files / folders may be one or more.

[0146] Taking the electronic device 100 as a mobile phone as an example, the electronic device 100 can support the user to select one or more files / folders through a long press operation. For example, continue to refer to Figure 3A , it can be seen that the document “Appearance Patent Briefing Book.txt” is in the selected state, that is, the user has selected the document “Appearance Patent Briefing Book.txt” as the file to be shared.

[0147] It is easy to understand that if the electronic device 100 is a PC, then one or more files / folders can be selected by using accessory devices such as a mouse and a keyboard.

[0148] Continue reading Figure 3A When the system of the electronic device 100 senses that the file / folder is in the selected state, the electronic device 100 may display the share option 311. The electronic device 100 may detect the user's operation (such as a click operation) on the share option 311, and in response to the operation, the electronic device 100 may display Figure 3B Window 320 is shown as an example.

[0149] See also Figure 3B , window 320 may include an encrypted sharing option 321 .

[0150] It is easy to understand that the user can trigger the electronic device 100 to execute the data sharing method provided in the embodiment of the present application by operating the encrypted sharing option 321 (such as a click operation).

[0151] For some examples, see Figure 3C When the system of the electronic device 100 senses that the file / folder is in a selected state, the electronic device 100 may also directly display the encrypted sharing option 321 .

[0152] In other examples, if the electronic device 100 is a PC, then when the system of the electronic device 100 senses that the file / folder is selected, the electronic device 100 may directly display the encrypted sharing option 321, and may also support the user to display the encrypted sharing option 321 by clicking the right mouse button or other menu bars.

[0153] In an embodiment of the present application, after detecting that the user operates the encrypted sharing option 321, the electronic device 100 can sense the login status of the local account. If the user has not logged in to the account, the electronic device 100 can guide the user to log in to the account through interface display. If the user has logged in to the account, the electronic device 100 can directly display the relevant user interface for subsequent data sharing without displaying the user interface for guiding the user to log in to the account.

[0154] For example, see Figure 4A If it is detected that the user has no logged-in account (such as a Huawei account), the electronic device 100 may display Figure 4A The exemplary window 410 may be used to support a user to log into an account by manually inputting a mobile phone number and a text message verification code.

[0155] In some examples, the electronic device 100 may also support the user to log in to the account by using other methods, for example, Figure 4B The fingerprint verification method shown in the example can be used to log in to the account; for example, Figure 4C For example, you can use the facial verification method shown in the example to log in to your account; for another example, you can use the account password login method to log in to your account; for another example, you can use the QR code scanning login method to log in to your account; and so on.

[0156] Optionally, if the electronic device 100 has verified the user's identity through the user account, or biometric features such as fingerprints / faces, and believes that the identity is credible before the user performs the encrypted sharing operation, it is not necessary to ask the user to enter the credential information again after the user selects encrypted sharing. Optionally, the user can also complete cross-device authentication through other associated devices, such as wearable devices, without the need to authenticate through the electronic device 100.

[0157] In the embodiment of the present application, after detecting that the user has logged into the account, the electronic device 100 may display a user interface for guiding the user to select the identity of the recipient. The identity may include but is not limited to the recipient's mobile phone number, email address, account ID, and other indexes that can be used to identify the user's identity.

[0158] The methods for selecting the recipient's identity include but are not limited to the following three:

[0159] Method 1: Manually enter the recipient's identity.

[0160] For example, see Figure 5A The electronic device 100 may display a window 510 , which may include an input box 511 , and the electronic device 100 may support the user to input the recipient's mobile phone number in the input box 511 .

[0161] In some examples, after detecting that the user has entered the recipient's mobile phone number, the electronic device 100 can identify whether the mobile phone number is bound to a Huawei account. If it is not bound to a Huawei account, the electronic device 100 can display Figure 5B The window 520 shown as an example may include a prompt message 521 (for example, "Huawei account not recognized, please re-enter"), and the prompt message 521 can be used to prompt the user to re-enter the mobile phone number bound to the Huawei account.

[0162] In an embodiment of the present application, the electronic device 100 may support a user to input the identity of one or more recipients.

[0163] Method 2: Select the recipient's ID in the address book

[0164] Continue reading Figure 5A The input box 511 may include an option 512, and the option 512 may be used to trigger the electronic device 100 to display a user interface related to the address book to support the user to select the identity of the recipient from the address book.

[0165] For example, the electronic device 100 may detect a user operation (eg, a click operation) on the option 512, and in response to the operation, the electronic device 100 may display Figure 5C The exemplary window 530 or Figure 5D In the exemplary window 540, window 530 or window 540 may include a recipient list, which may include information of one or more recipients (such as name, avatar, etc.), and the user may select the identity of the recipient by operating the recipient list (such as clicking).

[0166] In the embodiment of the present application, the electronic device 100 may support the user to select one or more recipient identities, for example, Figure 5E ,It can be seen that the user selected three recipients.

[0167] It should be noted that in the embodiment of the present application, the recipient may refer to a user or a group.

[0168] Method 3: Select the recipient's ID in the near-field device

[0169] The electronic device 100 can discover surrounding devices based on Bluetooth, WIFI or other near field communication methods, and can Fig. 5F The exemplary window 550 displays a device list 551, and the information displayed in the device list 551 may include, but is not limited to, one or more of the following: device name, user name, and avatar. The electronic device 100 may support the user to select a user device (i.e., a receiving device) that needs to be interacted with from the device list 551. Furthermore, the electronic device 100 may obtain the identity of the receiving device corresponding to the selected user device that needs to be interacted with through a near field communication method.

[0170] In an embodiment of the present application, after detecting the identity identifier of the recipient selected by the user, the electronic device 100 can obtain the identity credentials (public key or symmetric key) of the recipient based on the identity identifier of the recipient selected by the user.

[0171] The ways to obtain the recipient's identity credentials include but are not limited to the following three:

[0172] Method 1: Get it from the server

[0173] The server side (i.e., the cloud side) can store a mapping relationship table between the recipient's identity and credentials (for example, the mapping relationship table shown in Table 1), and the electronic device side (i.e., the terminal side) can upload the recipient's identity to the server side. The server side can determine the credentials corresponding to the identity based on the mapping relationship table between the recipient's identity and credentials, and send the credentials to the electronic device side.

[0174] For example, see Fig. 6AThe file permission management service module of the electronic device 100 can upload the identity 1 selected by the user to the file permission management service module of the server. The file permission management service module of the server can determine that the credential corresponding to the identity 1 is credential 1 based on the mapping relationship table between the recipient's identity and the credential, and send credential 1 to the electronic device 100.

[0175] Identification Credentials Identity 1 Credentials 1 Identity 2 Credentials 2

[0176] Table 1

[0177] Method 2: Get it locally

[0178] The electronic device side (i.e., the terminal side) can synchronize the mapping relationship table between the recipient's identity and credentials on the server side (i.e., the cloud side) and store it locally, and obtain the recipient's identity credentials locally based on the identity selected by the user and the mapping relationship table between the recipient's identity and credentials.

[0179] For example, see Figure 6B The file permission management service module of the server can send the mapping relationship table between the recipient's identity and credentials to the electronic device 100, and the file permission management service module of the electronic device 100 can store the mapping relationship table between the recipient's identity and credentials. Further, the file permission management service module of the electronic device 100 can query the credentials corresponding to the identity based on the identity selected by the user and the mapping relationship table between the recipient's identity and credentials.

[0180] Method 3: Obtaining from a near-field device

[0181] The electronic device 100 (sender device) can initiate a connection to the electronic device 200 through near field communication, and can obtain the identification and credentials of the recipient corresponding to the electronic device 200 (receiver device) based on the connection.

[0182] For example, see Figure 6C The file authority management service module of the electronic device 100 can obtain the identification and credentials of the recipient corresponding to the electronic device 200 stored in the file authority management service module of the electronic device 200 based on the near field connection.

[0183] In the embodiment of the present application, after obtaining the identity credentials of the recipient, the electronic device 100 can perform permission protection on the file selected by the user based on the credentials. The permission protection methods may include but are not limited to the following three methods:

[0184] Method 1: Only the "read-only" function of the file is provided by default

[0185] The electronic device 100 may set the permission of the file selected by the user to "read-only" permission or the permission range pre-configured by the user by default without requiring user confirmation. Fig. 7A After setting the "read-only" permission, the electronic device 100 can display relevant prompt information (such as "file encryption successful") to prompt the user that the file selected by the user has been encrypted.

[0186] Method 2: Prompt the user to confirm whether to add "read-only" permission, wait for the user to confirm, and then complete the encryption

[0187] For example, see Figure 7B , the electronic device 100 can display window 710, which can be used to prompt the user whether to confirm adding "read-only" permission to the selected file. After detecting that the user confirms adding "read-only" permission to the selected file (for example, the user clicks the "Yes" option in window 710), the electronic device 100 can add "read-only" permission to the file selected by the user to complete the encryption.

[0188] Method 3: Provide a permission setting panel to support users to set "read-only" and "editable" permissions independently, including but not limited to the following two methods:

[0189] Method (1)

[0190] For example, see Fig. 8A , the electronic device 100 can display a window 810, which may include a "read-only" permission option 811 and an "editable" permission option 812, wherein the "read-only" permission option 811 can be used to set the permission of the selected file to the "read-only" permission, and the "editable" permission option 812 can be used to set the permission of the selected file to the "editable" permission, wherein the "editable" permission may include but is not limited to editing, saving, printing, transferring, copying, screenshot, and recording.

[0191] In the embodiment of the present application, the same user cannot configure the file's permissions as "read-only" and "editable" at the same time. For example, if the electronic device 100 detects that the user chooses to set the file's permissions to "read-only" (for example, the user clicks on the "read-only" permission option 811), then the electronic device 100 can disable all operations that may cause the file content to be leaked (such as forwarding, copying, saving, screenshots, printing, etc.) and operations that damage the integrity of the file content (such as editing operations). In addition, the "editable" permission option 812 can also be automatically displayed in grayscale and is in an unselectable state, without the need for the user to manually select it.

[0192] Method (2)

[0193] For example, see Figure 8B , the electronic device 100 may display a window 820, which may include a "read-only" permission option 821, one or more detailed configuration options of "editable" permissions (such as a save option 822, a print option 823, a transfer option 824, and a copy option 825), and the electronic device 100 may support the user to perform operations (such as click operations) on one or more detailed configuration options of the "editable" permissions to select the operations that the configuration receiving device can perform on the file.

[0194] It is easy to understand that if there are multiple receivers, Fig. 8A and Figure 8B In the illustrated embodiment, the permissions of files are set uniformly.

[0195] In some examples, if there are multiple recipients (e.g., multiple independent users, multiple group members in a group), the electronic device 100 can also set different permissions for the file for different recipients, that is, the "read-only" permission and "editable" permission of the file can be set for the specified user. In the case where the recipients are multiple independent users, the electronic device 100 can set file permissions for these multiple independent users respectively; in the case where the recipient is a group, the electronic device 100 can set file permissions for multiple group members in the group respectively; in the case where the recipient is a group, the electronic device 100 can also uniformly set file permissions for all group members of the group. In this case, group members can share the same credentials, that is, one group identifier corresponds to one credential. The process of obtaining credentials can refer to the aforementioned related content and will not be repeated here.

[0196] Optionally, see Figure 8C , the electronic device 100 may display a window 830, which may be used to prompt the user to enter one or more recipient account information to specify the recipient of the encrypted file.

[0197] For example, see Fig.8D , the electronic device may display window 840, which may include option 841 and option 842, wherein option 841 may be used to set "read-only" permission for the file for the specified user, and option 842 may be used to set "editable" permission for the file for the specified user.

[0198] For example, see Fig. 8EThe electronic device may also display window 850, which may include option 851, option 852, option 853, option 854, and option 855, wherein option 851 may be used to set the "read-only" permission of the file for the specified user, option 852 may be used to set the save permission in the "editable" permission of the file for the specified user, option 853 may be used to set the print permission in the "editable" permission of the file for the specified user, option 854 may be used to set the transmission permission in the "editable" permission of the file for the specified user, and option 855 may be used to set the copy permission in the "editable" permission of the file for the specified user.

[0199] For the setting of the specified user, taking the setting of the "read-only" permission of the file for the specified user as an example, the electronic device 100 can detect the user's Fig.8D Option 841 or Fig. 8E The electronic device 100 may display the option 851 shown in FIG. Fig.8F The exemplary window 860 shown in FIG. 860 may display one or more recipients selected by the user. The electronic device 100 may support the user to select one or more recipients to set permissions. For example, see FIG. Figure 8G , it can be seen that user Alice and group family are selected, that is, user Alice and group family are selected as the designated users of the "read-only" permission for the file, and user Alice and group family have the "read-only" permission for the file. It is easy to understand that setting the "editable" permission for a file for a designated user is similar to setting the "read-only" permission for a file for a designated user, and will not be repeated here.

[0200] Easy to understand, Figure 8G In the embodiment shown, for the group family, the permissions set for each member of the group are the same. In some examples, the electronic device 100 may also support the user to set corresponding permissions for each member of the group. Fig.8F , also taking the "read-only" permission as an example, the electronic device 100 may detect the user's operation on option 861 (eg, a click operation), and in response to the operation, the electronic device 100 may display Figure 8H The exemplary window 870 may include one or more group members in the group family (e.g., group member 1, group member 2, group member 3, group member 4). The electronic device 100 may support the user to select one or more group members to set permissions. For example, see Fig.8I, it can be seen that group member 1 is in the selected state, that is, group member 1 is the designated user selected as the "read-only" user of the file, and group member 1 has the "read-only" permission of the file.

[0201] In an embodiment of the present application, if the user has selected multiple files, the electronic device 100 can support the user to perform permission protection on these multiple files separately, and can also support the user to merge multiple files into one independent file and then perform permission protection on it uniformly.

[0202] In some examples, for files of the same type, the permission protection method can be the same, so that for multiple files of the same type, the user can uniformly set permissions for them, simplifying user operations. Figure 8J The files selected by the user can be divided into two types of files (e.g., type 1 files and type 2 files). The user can trigger the electronic device 100 to perform permission protection on the files by clicking on type 1 files or type 2 files. The specific process can refer to the relevant content of the aforementioned permission protection, which will not be repeated here.

[0203] The following introduces a possible specific implementation mechanism of permission protection.

[0204] After detecting the permission protection attribute (e.g., read-only, editable, etc.) selected by the user, the electronic device 100 can encapsulate the permission protection attribute configured by the user into a field description as the permission definition of the file. Furthermore, the electronic device 100 can encrypt the file content and the permission definition based on the identity credentials of the recipient. The encryption method may include but is not limited to the following two methods:

[0205] Method 1:

[0206] Insert the permission definition into the file content, encrypt the overall result after insertion (that is, the file content and the permission definition as a whole), and use the ciphertext as the new file content.

[0207] Method 2:

[0208] The permission definition and file content are encrypted separately, and the ciphertext is used as the new file content. The ciphertext of the permission definition is written into the file's metadata.

[0209] In some examples, the permission definition may not be accompanied by the file associated with it. For example, the electronic device 100 may upload the permission definition and the ID of the file associated with it to the server, and the server may save a mapping table between the permission definition and the file ID. After receiving the file, the subsequent recipient may obtain the permission definition corresponding to the file from the server.

[0210] For encrypted files, the file name suffix can be changed or not.

[0211] When changing the file name suffix, a dedicated suffix (such as .a) can be set. For example, the original file can be file1.docx, and after the file permission definition and file content encryption, it can be file1.docx.a. It is easy to understand that the above suffix .a is only an example and should not constitute a limitation.

[0212] Without changing the suffix of the file name, for example, the original file may be file1.docx, which is still file1.docx after encryption. The encrypted file content may include the permission definition ciphertext and file content ciphertext of the file.

[0213] After encryption is completed, an encryption result can be generated. The encryption result may include the encrypted file and the index corresponding to the encrypted file. The index corresponding to the encrypted file may include but is not limited to the file path, file address, file handle, etc., which can be used to obtain file information.

[0214] In the embodiment of the present application, after encryption is completed, the electronic device 100 may display Fig.9A The exemplary window 910 may include a prompt message 911 and an option 912, wherein the prompt message 911 may be used to prompt the user that the file has been encrypted and the file can be saved to a specified path, and the option 912 may be used to save the file to a specified path. After the user clicks option 912, the electronic device 100 may be triggered to display the storage path, and the user may manually select a new storage path to trigger the electronic device 100 to store the file with the set permission protection to the path.

[0215] In some examples, after encryption is completed, the electronic device 100 may also store the file in a default path, such as XXX path, and may display Fig. 9B The exemplary window 920 shown may include relevant prompt information to prompt the user to store the file in the XXX path.

[0216] In the embodiment of the present application, after the permission-protected file (i.e., the encrypted file) is stored, the electronic device 100 can support the user to perform a sharing operation on the file. The sharing operation can include but is not limited to the following two methods:

[0217] Method 1:

[0218] After the permission-protected file is stored, the electronic device 100 can directly obtain the path or other types of indexes of the file locally and initiate sharing. The sharing methods may include but are not limited to the following two methods:

[0219] Method (1): Near-field sharing based on the system’s built-in sharing service

[0220] For example, see Fig. 5F The electronic device 100 can display a device list 551, and support the user to select a device in the device list 551 as a recipient device, so that the above-mentioned permission-protected file can be sent to the recipient device to complete the sharing.

[0221] Method (2): Share via apps

[0222] For example, see Fig. 5F The electronic device 100 may display an application list 552, which may include one or more applications capable of file sharing. The electronic device 100 may support the user to select an application in the application list 552 to share the file to the recipient device.

[0223] It is easy to understand that the above two sharing methods are only exemplary, and the sharing method of the above permission-protected files can be consistent with the sharing method of ordinary files, which is not limited in the embodiments of the present application.

[0224] Method 2:

[0225] After the permission-protected file is stored, the electronic device 100 can support the user to reselect the file in the new storage path corresponding to the file and initiate sharing. It is easy to understand that the method of selecting and sharing a permission-protected file can be the same as the method of selecting and sharing a normal file, and the embodiment of the present application does not limit this.

[0226] For example, see Fig. 9C , it can be seen that the document "Appearance Patent Briefing Book.txt" is a file that has been saved and protected by permissions. It is in the selected state. The user clicks Fig. 9C The sharing option in can trigger the electronic device 100 to share the file.

[0227] In some examples, when the electronic device 100 detects that a file protected by rights is selected, it can display Fig.9D The exemplary window 940 may be used to display the authorized users of the file and the permissions the authorized users have (eg, user A has “read-only” permission, and user B has “editable” permission).

[0228] For some examples, see Fig.9DThe electronic device 100 can support the user to add new authorized users to the above-mentioned files that have been protected by permissions. For example, the user can click the "Add new authorized user" option to trigger the electronic device 100 to perform relevant steps for adding new authorized users. The process of adding new authorized users can refer to the aforementioned selection of the recipient identity and permission protection related content, which will not be repeated here.

[0229] It can be seen from the above scenario one that by implementing the method provided in the embodiment of the present application, there is no need to initiate the encryption setting of the file in the application. It is only necessary to select the file in the system application entrance with a preview function such as file management and gallery, and the system will trigger the encrypted sharing of the file (for example, display the encrypted sharing option). The electronic device can support users to use system functions to configure to whom the file is sent and what permissions the file recipient has (for example, "read-only" permission, "editable" permission). The upper-level application does not need to perceive the encryption of the file, thereby improving ecological friendliness and providing a better user experience.

[0230] Scenario 2: Sharing via a communication app

[0231] In an embodiment of the present application, the electronic device 100 can support the user to select files through a communication tool with a sending function (such as a communication application such as chat, email, etc.) and initiate file sharing.

[0232] For example, see Fig. 10A , Fig. 10A The user interface 1010 shown may be a chat interface provided by a chat application, and the chat interface may be a chat interface between a user of the electronic device 100 and user Lily. It is easy to understand that user Lily may be the recipient of the file. The electronic device 100 may support the user to select an option for sending files such as pictures and documents, and the option may be in any form, which is not limited in the embodiments of the present application.

[0233] For example, see Sending a picture. Fig. 10A If the user wants to send a picture to Lily, the electronic device 100 can detect the user's operation on the album option, and in response to the operation, the electronic device 100 can display Fig. 10B The user interface 1020 shown as an example may include a preview picture list 1021 , and the preview picture list 1021 may include one or more pictures (eg, picture 1, picture 2).

[0234] In an embodiment of the present application, the system can provide a file selection function for the application. When the system senses that the file is selected, it can display an encrypted sharing option on the interface. The option can be displayed at any position on the interface, and the embodiment of the present application does not limit this.

[0235] For example, see Fig. 10B , the electronic device 100 may detect an operation of the user selecting one or more pictures (eg, clicking on picture 1), and in response to the operation, the electronic device 100 may display Fig. 10C Encrypted sharing option 1021 is shown as an example.

[0236] It is easy to understand that the function of supporting the user to select one or more pictures can be a function within the application, and the function of displaying the encrypted sharing option 1021 can be a function within the system.

[0237] In an embodiment of the present application, after detecting the user's operation (such as a click operation) on the encrypted sharing option 1021, the electronic device 100 can start the permission setting process. The permission setting process can refer to the relevant content in the aforementioned scenario one (including the selection of the recipient identity and the relevant content of permission protection), which will not be repeated here.

[0238] In some examples, based on the user identity reading function provided by the current communication application, the electronic device 100 can obtain the identity of the recipient on the current interface. Further, it can obtain the corresponding credentials based on the identity and perform permission protection on the files selected by the user based on the credentials. The specific process can refer to the relevant content in the aforementioned scenario one and will not be repeated here.

[0239] After completing the file permission setting, the electronic device 100 can support the user to send the file to the receiving device. Fig. 10C , the electronic device 100 can detect the user's operation on the sending option (such as a click operation), and in response to the operation, the electronic device 100 can send the picture 1 with set permissions to the recipient device (such as Lily's device).

[0240] In some examples, the system can sense the selected state of a file. When a file is in the selected state, after obtaining user authorization, the system can scan the file to obtain the information contained in the file. When the file contains personal information (such as a portrait, ID number, bank card number, etc.), the electronic device 100 displays an encrypted sharing option. Fig. 10B , assuming that picture 1 does not contain personal information, and picture 2 contains personal information, if the user selects picture 1 but not picture 2, then the electronic device 100 may not display the encrypted sharing option, see Fig. 10DIf the user selects picture 2 after selecting picture 1, the electronic device 100 may display an encrypted sharing option. Optionally, the encrypted sharing control may be located at the same level as controls such as photo albums and video calls. When the user clicks the encrypted sharing control, the selection and encrypted sharing of files are triggered; wherein the path for selecting files to be encrypted and shared may be a dedicated path for encrypted sharing files or a selection path shared with general files. After the user selects encrypted sharing, the encryption operation is completed in a user-unaware manner and the files are shared.

[0241] It can be seen from the above scenario 2 that by implementing the method provided in the embodiment of the present application, after selecting a file in an application (system application or third-party application), the system triggers file encryption sharing (for example, displaying the encryption sharing option), and the electronic device can support users to use system functions to configure to whom the file is sent and what permissions the file recipient has (for example, "read-only" permission, "editable" permission). The upper-level application does not need to perceive the encryption of the file, which improves ecological friendliness and provides a better user experience. In this way, the problem that data encryption and permission settings must be implemented separately by the application when initiating data encryption and permission settings in the upper-level application can be solved, and if other applications want to perform permission control on files, they need to be implemented repeatedly.

[0242] Scenario 3: Receive and open the shared file through the system

[0243] In the embodiment of the present application, the electronic device 200 can receive the encrypted file shared by the electronic device 100 through different receiving channels (such as near-field sharing, communication application sharing).

[0244] See also Fig.11A , Fig.11A The exemplary user interface 1110 may be used as a user interface for a user to select a file / folder in the system. The user interface 1110 may include a file management list, and the file management list may include one or more files (e.g., document 1, document 2, document 3), and one or more folders. The user interface for a user to select a file / folder in the system may be provided by an application with a file display function, such as a file management application or a gallery application.

[0245] In some examples, an encrypted file may have an icon for identifying it as an encrypted file. The icon may be displayed in the following ways, including but not limited to:

[0246] Method 1:

[0247] The icons of encrypted files in all formats (such as doc, jpg, etc.) are the same encryption icon, for example Fig.11A The icon of document 1 shown is a lock icon.

[0248] Method 2:

[0249] Encrypted files of different formats display the original format's exclusive icon, and the encryption icon is superimposed on the exclusive icon, for example Fig. 11B In the document 1 shown, a lock icon is superimposed on the icon of the doc file.

[0250] In an embodiment of the present application, the user's operation of selecting a file / folder may include but is not limited to a long press operation, a click operation, etc., and the number of selected files / folders may be one or more.

[0251] For example, see Fig. 11B , the user can select the encrypted file Document 1 by clicking.

[0252] In an embodiment of the present application, after the electronic device 200 detects that the user selects a file, the system of the electronic device 200 can sense that the file is in a selected state. Further, the system can parse the type of the file and determine whether the file is a controlled encrypted shared file (also referred to as an encrypted file or a controlled file).

[0253] Exemplarily, when the above-mentioned file has a specific file name suffix, the system can parse whether the file is a controlled encrypted shared file based on the suffix.

[0254] Exemplarily, when the above-mentioned file does not have a specific file name suffix, the system can parse the file content and determine the "controlled encrypted shared file attribute" feature of the file. Parsing the file content may include but is not limited to: parsing the permission configuration field from the file content and parsing the permission configuration field from the file metadata.

[0255] In the embodiment of the present application, after the electronic device 200 detects that the user selects a file, the system of the electronic device 200 can determine the user's current account login status. If the user has no login account, the electronic device 200 can guide the user to log in to the account by displaying an interface. For example, refer to Fig. 11C The electronic device 200 can support the user to log in to the account by manually entering the mobile phone number and the SMS verification code. Not limited to this, the account can also be logged in by other methods (such as face verification, fingerprint verification, etc.).

[0256] In the embodiment of the present application, after detecting the user login account, the electronic device 200 can obtain the decryption credentials associated with the account, and the acquisition method may include but is not limited to the following two methods:

[0257] Method 1: Get it from the server

[0258] A mapping relationship table between identity identifiers (associated with the above-mentioned login account) and credentials can be stored on the server. The electronic device 200 can upload the identity identifier of the user of the electronic device 200 (i.e., the user who has logged in to the account) to the server. The server can determine the credentials corresponding to the identity identifier based on the mapping relationship table between the identity identifier and the credentials, and send the credentials to the electronic device 200.

[0259] Method 2: Get it locally

[0260] The electronic device 200 can synchronize the mapping relationship table between the identity identifier and the credentials on the server and store it locally, and obtain the credentials locally based on the mapping relationship table between the identity identifier and the credentials.

[0261] In the embodiment of the present application, if the user who has logged in to the account is the same as the designated recipient of the controlled encrypted shared file, the electronic device 200 can open the file, for example, display Fig.11D The user interface 1130 after opening the file is shown; if the user who has logged in to the account is inconsistent with the recipient specified by the controlled encrypted shared file, the electronic device 200 cannot open the file. For example, the electronic device 200 may display Fig.11E The window 1140 shown may include relevant prompt information to prompt the user that he does not have the authority to open the file.

[0262] In an embodiment of the present application, for a user who has the authority to open a controlled encrypted shared file, the system of the electronic device 200 can determine which application to use to open the file.

[0263] In some examples, the electronic device 200 can use a default application to open the file without the user manually selecting which application to use to open the file. For example, after detecting that the user chooses to open the file, the electronic device 200 can, for example Fig.11D As shown, the file is opened directly using the default application to display the file contents.

[0264] In other examples, the electronic device 200 may provide a display panel for the list of applications installed in the system to support the user to independently select which application to use to open the file. Fig.11F After detecting that the user chooses to open the file, the electronic device 200 may display a window 1150, which may include an application list, and the application list may include one or more applications (e.g., application 1, application 2, application 3, application 4). The user may manually select an application to trigger the electronic device 200 to pull up the application and open the file in the application to display the file content. The one or more applications may be system applications or third-party applications installed by the user.

[0265] It is easy to understand that if the application selected by the user does not have the ability to open the original document type (for example, the user chooses to use a picture editing application to open an encrypted .doc file), then the electronic device 200 can display relevant prompt information to prompt the user that the application cannot open this file (for example, displaying an error message "Cannot open .doc file").

[0266] In the embodiment of the present application, if the above-mentioned controlled encrypted shared file is configured with "read-only" permission, the user can only read the file after opening it, and cannot initiate other operations on the file (such as printing, saving, screenshot, etc.). As a possible implementation method, the user device can provide system-level interception, which does not need to care about the capabilities and control scope of the third-party application, and enhances data control. Among them, the system-level interception method can include but is not limited to the following three:

[0267] Method 1: The system displays a prompt message (or error message), and the system intercepts the above operations (such as printing, saving, screenshots, etc.)

[0268] For example, when it is detected that the user performs a copy operation on the file, the electronic device 200 may display Fig.11G The window 1160 shown may include prompt information 1161 , and the prompt information 1161 may be used to prompt the user that the user can only read the file but cannot initiate a copy operation on the file.

[0269] For example, when it is detected that the user performs a save operation on the file, the electronic device 200 may display Fig.11H The window 1170 shown may include prompt information 1171 , and the prompt information 1171 may be used to prompt the user that the user can only read the file but cannot initiate a save operation on the file.

[0270] For example, when it is detected that the user performs a screenshot operation on the file, the electronic device 200 may display Fig.11I The window 1180 shown may include prompt information 1181 , and the prompt information 1181 may be used to prompt the user that the user can only read the file but cannot initiate a screenshot operation on the file.

[0271] Method 2: The system does not display prompt information (or error information), and the system only intercepts the above operations (such as printing, saving, screenshots, etc.) in the background.

[0272] Method 3: The system does not display a prompt message (or error message). The system intercepts the above operations (such as printing, saving, screenshots, etc.) in the background. The system provides an interception notification, and the application implements the interception notification prompt.

[0273] It is easy to understand that when the user uses the same application to open other files that are not protected by permissions and performs the above operations such as copying and printing, the electronic device 200 may not perform the interception operation.

[0274] Exemplarily, different control functions can be divided into the following three different modes of functions, and the details can be referred to the contents in Table 2 below.

[0275]

[0276]

[0277] Table 2

[0278] The following describes the control flow when the functions in the above three different modes are executed.

[0279] 1. Network and Bluetooth control process

[0280] Fig.12 The specific process of controlling network, Bluetooth and other functions provided by an embodiment of the present application is exemplified.

[0281] like Fig.12 As shown, the process can be applied to the electronic device 200. The electronic device 200 may include a file management module, a controlled application (i.e., an application that opens a controlled file), an application management module, a file authority management service module, a network service module, a Bluetooth service module, and an application authority management service module. The specific steps are described in detail below:

[0282] S1201. The file management module requests the application management module to open a controlled file and start a controlled application.

[0283] S1202: The application management module instructs the file authority management service module to load a controlled file.

[0284] S1203, the file permission management service module decrypts the controlled file and the permission control policy, and parses the application permission policy set for the controlled file, including not allowing access to the network and Bluetooth.

[0285] S1204: The file authority management service module sends the decrypted controlled file path to the application management module.

[0286] S1205. The application management module allocates a controlled ID of the controlled application to the file authority management service module.

[0287] In some examples, the controlled ID may be an application identifier 11 .

[0288] S1206: The application management module sends the set permission control policy to the application permission management service module, including that the controlled application is not allowed to access the network and Bluetooth.

[0289] It is easy to understand that after receiving the decrypted controlled file path sent by the file permission management service module, the application management module can obtain the permission control policy of the controlled file under the path.

[0290] S1207. The application permission management service module records that the controlled application is not allowed to access the network or Bluetooth.

[0291] S1208. The application management module starts the controlled application and allocates a controlled ID.

[0292] In some examples, the application management module can launch the controlled application as an independent process.

[0293] S1209: The controlled application requests the network service module to connect to the Internet.

[0294] S1210: The network service module requests the application permission management service module for a permission control policy of the controlled application.

[0295] S1211. The application permission management service module sends the permission control policy of the controlled application to the network service module, including that the controlled application is not allowed to access the network.

[0296] S1212. The network service module denies the controlled application access to the network.

[0297] Specifically, after receiving the permission control policy of the controlled application sent by the application permission management service module, the network service module may deny the controlled application from accessing the network if it is determined based on the permission control policy that the controlled application is not allowed to access the network.

[0298] In some examples, the above steps S1209-S1212 are optional.

[0299] S1213: The controlled application requests a Bluetooth connection from the Bluetooth service module.

[0300] S1214: The Bluetooth service module requests the application permission management service module for the permission control policy of the controlled application.

[0301] S1215: The application permission management service module sends the permission control policy of the controlled application to the Bluetooth service module, including that the controlled application is not allowed to access Bluetooth.

[0302] S1216: The Bluetooth service module denies the controlled application access to Bluetooth.

[0303] Specifically, after receiving the permission control policy of the controlled application sent by the application permission management service module, the Bluetooth service module may deny the controlled application from accessing Bluetooth if it is determined based on the permission control policy that the controlled application is not allowed to access Bluetooth.

[0304] In some examples, the above steps S1213 to S1216 are optional.

[0305] It should be noted that the embodiment of the present application does not limit the execution time sequence of the above steps S1209-step S1212 and the above steps S1213-step S1216. For example, the above steps S1209-step S1212 may be executed before the above steps S1213-step S1216; for another example, the above steps S1209-step S1212 may be executed after the above steps S1213-step S1216.

[0306] It is easy to understand that the storage control process for controlled files is similar to the aforementioned network and Bluetooth control process. It can limit the application from accessing file storage. The specific process can refer to the relevant content of the aforementioned network and Bluetooth control process, which will not be repeated here.

[0307] 2. Printing and copying control process

[0308] Fig.13 The specific process of controlling functions such as printing and copying provided by an embodiment of the present application is exemplified.

[0309] like Fig.13 As shown, the process can be applied to the electronic device 200. The electronic device 200 may include a file management module, a controlled application (i.e., an application that opens a controlled file), an application management module, a file permission management service module, a printing service module, and a clipboard service module. The specific steps are described in detail below:

[0310] S1301. The file management module requests the application management module to open a controlled file and start a controlled application.

[0311] S1302: The application management module instructs the file authority management service module to load a controlled file.

[0312] S1303. The file permission management service module decrypts the controlled file and the permission control policy, and parses the application permission policy set for the controlled file, including not allowing access to printing and copying.

[0313] S1304: The file authority management service module sends the decrypted controlled file path to the application management module.

[0314] S1305. The application management module allocates a controlled ID of the controlled application to the file authority management service module.

[0315] In some examples, the controlled ID may be an application identifier 11 .

[0316] S1306. The file permission management service module records that the controlled application is not allowed to print or copy.

[0317] S1307. The application management module starts the controlled application and allocates a controlled ID.

[0318] In some examples, the application management module can launch the controlled application as an independent process.

[0319] S1308: The controlled application requests printing from the printing service module.

[0320] S1309: The printing service module requests the file authority management service module for the authority control policy of the controlled application.

[0321] S1310. The file permission management service module sends the permission control policy of the controlled application to the printing service module, including that the controlled application is not allowed to print.

[0322] S1311. The printing service module refuses printing by the controlled application.

[0323] Specifically, after receiving the permission control policy of the controlled application sent by the file permission management service module, the printing service module may refuse the controlled application from printing the controlled file if it is determined based on the permission control policy that the controlled application is not allowed to execute the printing operation.

[0324] In some examples, the above steps S1308-S1311 are optional.

[0325] S1312: The controlled application requests the clipboard service module to copy.

[0326] S1313: The clipboard service module requests the file permission management service module for the permission control policy of the controlled application.

[0327] S1314. The file permission management service module sends the permission control policy of the controlled application to the clipboard service module, including that the controlled application is not allowed to be copied.

[0328] S1315. The clipboard service module refuses copying by the controlled application.

[0329] Specifically, after receiving the permission control policy of the controlled application sent by the file permission management service module, the clipboard service module may deny the controlled application from copying the controlled file if it is determined based on the permission control policy that the controlled application is not allowed to perform the copy operation.

[0330] In some examples, the above steps S1312 to S1315 are optional.

[0331] It should be noted that the embodiment of the present application does not limit the execution time sequence of the above steps S1308-step S1311 and the above steps S1312-step S1315. For example, the above steps S1308-step S1311 may be executed before the above steps S1312-step S1315; for another example, the above steps S1308-step S1311 may be executed after the above steps S1312-step S1315.

[0332] 3. Screenshot Control Process

[0333] Fig.14 The specific process of controlling functions such as screenshots provided by an embodiment of the present application is exemplified.

[0334] like Fig.14 As shown, the process can be applied to the electronic device 200. The electronic device 200 may include a file management module, a screenshot application, a controlled application (i.e., an application that opens a controlled file), an application management module, a file permission management service module, and a window management service module. The specific steps are described in detail below:

[0335] S1401. The file management module requests the application management module to open a controlled file and start a controlled application.

[0336] S1402: The application management module requests the file permission management service module for a screenshot permission control policy associated with the controlled application.

[0337] It is easy to understand that before executing the above step S1402, the application management module can instruct the file permission management service module to load the controlled file and obtain the permission control policy of the controlled file.

[0338] S1403: The file permission management service module determines that the controlled application is not allowed to take screenshots.

[0339] It is easy to understand that the file permission management service module can determine whether the controlled application is allowed to perform a screenshot operation on the controlled file based on the obtained permission control policy of the controlled file.

[0340] S1404. The file permission management service module sends a screenshot permission control policy to the application management module, including that the controlled application is not allowed to take screenshots.

[0341] S1405. The application management module sends the set SecurityFlag of the controlled application to the window management service module.

[0342] It is easy to understand that, in the case where the controlled application is not allowed to perform a screenshot operation on the controlled file, the application management module can set the SecurityFlag of the controlled application.

[0343] S1406. The application management module starts the controlled application and allocates a controlled ID.

[0344] S1407: The window management service module records the SecurityFlag of the controlled application.

[0345] S1408: The screenshot application detects that the user initiates a screenshot.

[0346] S1409: The screenshot application requests the window management service module to take a screenshot.

[0347] S1410. The window management service module determines whether there is a SecurityFlag record of the controlled application.

[0348] S1411. The window management service module refuses to take a screenshot by the screenshot application.

[0349] Specifically, when the window management service module determines that there is a SecurityFlag record of the controlled application, the window management service module may refuse the screenshot application to perform a screenshot operation on the content of the controlled file displayed in the controlled application.

[0350] It is easy to understand that the screen recording control process for the controlled file is similar to the aforementioned network and Bluetooth control process. The specific process can refer to the relevant content of the aforementioned screenshot control process, which will not be repeated here.

[0351] Scene 3

[0352] Scenario 4: Receive and open a shared file through a communication app

[0353] The electronic device 200 can support the user to receive the encrypted files shared by the electronic device 100 through communication applications (such as chat, email and other applications).

[0354] For example, see Fig.15A , Fig.15A The user interface 1510 shown can be a chat interface provided by a chat application, which can be a chat interface between a user of the electronic device 200 and user Ann. It can be seen that the document XXX.doc is an encrypted file, and the sender of the file is Ann. The user can click on the above encrypted file to trigger the electronic device 200 to open the file.

[0355] In the embodiment of the present application, after detecting that the user clicks on the encrypted file, the electronic device 200 can determine whether the user has logged into the account specified by the recipient range of the file. If the user has not logged into the account specified by the recipient range of the file, the electronic device 200 can prompt the user to log in to the account. For example, the electronic device 200 can display the above Fig. 11C The window shown in the figure prompts the user to log in to the account; if the user logs in to the account specified by the recipient scope of the file, the electronic device 200 can determine which application to use to open the file. Similar to the above scenario three, the electronic device 200 can use the default application to open the file, or provide a display panel of the list of applications installed by the system to support the user to independently choose which application to use to open the file. In some examples, if the above communication application itself has a file browsing function, then the electronic device 200 can also open the file directly in the application.

[0356] It should be noted that the account specified in the recipient scope of the encrypted file may be different from or the same as the account system used in the communication application. In some examples, if the account specified in the encrypted file is a specified account of account system 2 (e.g., a Huawei account), then when the user uses an account of account system 1 (e.g., a chat account used by a chat application), when the user wants to open the file, the electronic device 200 may prompt the user to log in to the account of account system 2. In other examples, if the account of account system 1 (e.g., a chat account used by a chat application) is associated with the specified account of account system 2 (e.g., a Huawei account), when the user wants to open the file, the electronic device 200 may directly obtain the account association information logged in by the user, thereby further obtaining the specified account of account system 2, so that the electronic device 200 does not need to prompt the user to log in to the account of account system 2.

[0357] For some examples, see Fig.15A After detecting that the user clicks on the encrypted file, the electronic device 200 can automatically store the encrypted file locally. The subsequent user can refer to the description of the first opening of the file in the above-mentioned related content for opening the file, which will not be repeated here; or, after the first opening of the file, the subsequent opening is in accordance with the relevant business rules, for example, it can be directly opened again within a preset time, and re-authentication is required after the preset time.

[0358] For other examples, see Fig. 15B, the electronic device 200 may display a receiving option 1511 and a saving option 1512 in the user interface 1510. The receiving option 1511 may be used to receive the file and store it in a local default path, and the saving option 1512 may be used to receive the file and store it in a local user-specified path. The subsequent method for the user to open the file may refer to the aforementioned related content, which will not be repeated here.

[0359] Similar to the above scenario three, if the above encrypted file is configured with "read-only" permission, the user can only read the file after opening it, but cannot initiate other operations on the file (such as printing, saving, screenshot, etc.).

[0360] In the embodiment of the present application, the electronic device 100 (i.e., the sending device) encrypts the file and the electronic device 200 (i.e., the receiving device) decrypts the file, which may include but is not limited to the four methods in Table 5 below:

[0361]

[0362]

[0363] Table 5

[0364] In the embodiment of the present application, it is also possible to limit which devices of the recipient can open the file shared by the sender. The specific strategies may include but are not limited to the following three:

[0365] Strategy 1:

[0366] As long as the device is logged into the account specified by the recipient, the device can open the above file. For example, after the recipient receives the above file on the electronic device 200, it can forward it to the recipient's other devices and open the file on the other devices.

[0367] Strategy 2:

[0368] Only one device of the recipient (the device is logged in with the account specified by the recipient) is allowed to open the above file; or, when the number of the recipient's devices is less than a preset threshold, the recipient is allowed to open the above file on multiple devices (these multiple devices are all logged in with the same account specified by the recipient).

[0369] Strategy 3:

[0370] The device can open the above file only if it is logged in to the account specified by the recipient and meets the corresponding security conditions (for example, the lock screen is set, the device has a trusted execution environment, the device is not rooted, etc.).

[0371] In the embodiment of the present application, when the sender of the file grants the receiver the "editable" permission for the file, it is also possible to limit whether the receiver can perform a forwarding operation on the file. The specific policies may include but are not limited to the following four:

[0372] Strategy 1:

[0373] After receiving and storing the file locally, the receiving device can use the above-mentioned scenario one or scenario two to share the file with one or more users, or directly forward the file.

[0374] Strategy 2:

[0375] The receiving device can only view or edit the above files, and cannot share the above files with one or more users using the above scenario one or scenario two.

[0376] Strategy 3:

[0377] The receiving device can view or edit the above files, or forward them, but the recipient after forwarding only has "read-only" permission for the above files. If you want to obtain "editable" permission, you need to contact the sender to make relevant settings.

[0378] Strategy 4:

[0379] The receiving device can view or edit the above files, or forward them, but before forwarding, the sender needs to be notified and the sender re-initiates authorization. Only after authorization can the receiving device forward the above files.

[0380] Fig.16 The specific process of a data sharing method provided in an embodiment of the present application is exemplified.

[0381] like Fig.16 As shown, the method can be applied to the first electronic device. The specific steps of the method are described in detail below:

[0382] S1601: The first electronic device determines that a first file is selected.

[0383] S1602. In response to an operation of sharing a first file on a first interface, a first electronic device sends the first file to a second electronic device associated with a first user; wherein the first electronic device is used to set a first permission for the first file, and the first permission is effective for multiple applications on the first electronic device when the first file is sent, and the first permission is used to indicate that the first user is authorized to perform one or more operations on the first file.

[0384] The first electronic device is a sending device (for example, electronic device 100), the second electronic device is a receiving device (for example, electronic device 200), and the first file is a file to be shared, which may include but is not limited to pictures, documents, audio and video.

[0385] In one possible implementation, the method further includes: before the first electronic device sends the first file to the second electronic device associated with the first user, the first electronic device displays at least one item of a device list, an application list, and a user list on an interface, and the interface is the first interface or the second interface; the first electronic device sends the first file to the second electronic device associated with the first user, specifically including: in response to an operation of selecting the second electronic device in the device list, the first electronic device sends the first file to the second electronic device associated with the first user; or, in response to an operation of selecting the first application in the application list, the first electronic device sends the first file to the second electronic device associated with the first user through the first application; or, in response to an operation of selecting the first user in the user list, the first electronic device sends the first file to the second electronic device associated with the first user.

[0386] In a possible implementation, the first electronic device sends the first file to the second electronic device associated with the first user, specifically including: in response to an operation of sharing the first file triggered on an interface, the first electronic device sends the first file to the second electronic device associated with the first user, and the interface is an interface for conducting a conversation with the first user (for example, Fig. 10A interface shown).

[0387] In a possible implementation, the first permission is set for the first file before the operation of sharing the first file; or, the first permission is set for the first file after the operation of sharing the first file and is sent to the second electronic device associated with the first user.

[0388] In one possible implementation, the method further includes: in response to an operation of sharing the first file on the first interface, the first electronic device sends the first file to a third electronic device associated with the second user; wherein the first electronic device is used to set a second permission for the first file, and the second permission takes effect for multiple applications on the first electronic device when sending the first file, and the second permission is used to indicate that the second user is authorized to perform one or more operations on the first file.

[0389] In one possible implementation, the method further includes: the first electronic device determines that the second file is selected; in response to the operation of sharing the second file on the first interface, the first electronic device sends the second file to the second electronic device associated with the first user; wherein the first electronic device is used to set a third permission for the second file, and the third permission takes effect for multiple applications on the first electronic device when sending the second file, and the third permission is used to indicate that the first user is authorized to perform one or more operations on the second file.

[0390] In one possible implementation, the first user belongs to a first group, which also includes a third user. The method also includes: in response to an operation of sharing a first file on a first interface, the first electronic device sends the first file to a fourth electronic device associated with the third user, and the first permission is also used to indicate that the third user is authorized to perform one or more operations on the first file; or, in response to an operation of sharing the first file on the first interface, the first electronic device sends the first file to a fourth electronic device associated with the third user; wherein the first electronic device is also used to set a fourth permission for the first file, and the fourth permission takes effect for multiple applications on the first electronic device when sending the first file, and the fourth permission is used to indicate that the third user is authorized to perform one or more operations on the first file.

[0391] In a possible implementation, before the first electronic device sends the first file to the second electronic device associated with the first user, the method further includes: the first electronic device logs in to a first account, where the first account belongs to an account of a fourth user.

[0392] In a possible implementation, before the first electronic device sends the first file to the second electronic device associated with the first user, the method further includes: the first electronic device obtains credentials corresponding to the first user; and the first electronic device encrypts the first file based on the credentials.

[0393] In a possible implementation, the credentials are obtained by the first electronic device on a server, or the credentials are obtained locally by the first electronic device, or the credentials are obtained by the first electronic device on a second electronic device.

[0394] In one possible implementation, the first electronic device is used to set a first permission for a first file, specifically including: the first electronic device is used to write field information of the first permission in the first file; or, the first electronic device is used to send a first message to a server, the first message including field information of the first permission and identification information of the first file, and the first message is used to instruct the server to save the association between the field information of the first permission and the identification information of the first file.

[0395] In a possible implementation, the first permission includes read-only permission, or editable permission, or forwarding permission, and the editable permission includes one or more of save as permission, screenshot permission, screen recording permission, print permission, and copy permission.

[0396] In the embodiment of the present application, the forwarding permission may be within the definition scope of the above-mentioned first permission, or may not be within the definition scope of the above-mentioned first permission (that is, the forwarding permission and the first permission may be parallel).

[0397] In a possible implementation, the first file includes sensitive information (eg, portrait, ID number, bank card number, etc.).

[0398] Fig.17 The specific process of another data sharing method provided in an embodiment of the present application is exemplified.

[0399] like Fig.17 As shown, the method can be applied to the second electronic device. The specific steps of the method are described in detail below:

[0400] S1701. The second electronic device receives a first file sent by the first electronic device. The first file is controlled by a first permission. The first permission takes effect when multiple applications on the second electronic device perform operations within the scope of the first permission control (such as opening operations) on the first file. The multiple applications include the first application.

[0401] S1702: The second electronic device obtains a first operation on a first file in a first application.

[0402] S1703: In response to the first operation, if the second electronic device determines that the first operation is one or more operations indicated by the first permission that the first user is authorized to perform on the first file, the second electronic device responds to the first operation.

[0403] The second electronic device is a receiving device (e.g., electronic device 200), the first electronic device is a sending device (e.g., electronic device 100), the first file is a shared file, which may include but is not limited to pictures, documents, audio and video. The first operation may include but is not limited to viewing, saving, screenshot, recording, printing, copying, and forwarding.

[0404] In one possible implementation, before the second electronic device determines that the first operation is one or more operations that the first user indicated by the first permission is authorized to perform on the first file, the method further includes: the second electronic device determines that the user performing the first operation is a first user who is authenticated to have operation permission on the first file.

[0405] In one possible implementation, the second electronic device determines that the user performing the first operation is a first user who has been authenticated and has operation authority over the first file, specifically including: the second electronic device determines that the account logged into the second electronic device is the account of the first user; or, the second electronic device determines that the biometric characteristics of the user performing the first operation are consistent with the biometric characteristics of the first user; or, the second electronic device receives a first message sent by a third electronic device, the first message is used to indicate that the user performing the first operation is a first user who has been authenticated and has operation authority over the first file, and the third electronic device is associated with the second electronic device.

[0406] In one possible implementation, the method further includes: when the second electronic device determines that the first operation does not belong to one or more operations indicated by the first permission that the first user is authorized to perform on the first file, the second electronic device displays a first prompt message, and the first prompt message is used to prompt the user that the second electronic device refuses to respond to the first operation.

[0407] In a possible implementation, the method further includes: in response to an operation of sharing the first file, the second electronic device sends the first file to a third electronic device associated with the first user.

[0408] In a possible implementation, the method further includes: in response to an operation of sharing the first file, the second electronic device sends the first file to a fourth electronic device associated with the second user.

[0409] In a possible implementation, when the first file is forwarded by the second electronic device, the first file is set to a third permission, and the authorization scope of the third permission does not exceed the authorization scope of the first permission.

[0410] In a possible implementation, the method further includes: the second electronic device sends a second message to the first electronic device, where the second message is used to indicate that the first electronic device authorizes the first user to perform a second operation on the first file, and the second operation does not belong to one or more operations indicated by the first permission that the first user is authorized to perform on the first file.

[0411] In a possible implementation, the method further includes: the second electronic device sending a third message to the first electronic device, where the third message is used to indicate that the first electronic device authorizes the first user to perform a forwarding operation on the first file.

[0412] In a possible implementation, the first file is an encrypted file, and before the second electronic device responds to the first operation, the method further includes: the second electronic device obtains credentials corresponding to the first user; and the second electronic device decrypts the first file based on the credentials.

[0413] In a possible implementation manner, a first identifier is displayed on the second electronic device, and the first identifier is used to indicate that the first file is an encrypted file.

[0414] In a possible implementation manner, the first permission is obtained by the second electronic device from the first file; or, the first permission is obtained by the second electronic device from a server.

[0415] In a possible implementation, the first permission includes read-only permission, or editable permission, or forwarding permission, and the editable permission includes one or more of save as permission, screenshot permission, screen recording permission, print permission, and copy permission.

[0416] The following is a schematic structural diagram of an electronic device 100 provided in an embodiment of the present application.

[0417] Fig.18 The structure of an electronic device 100 provided in an embodiment of the present application is exemplarily shown.

[0418] like Fig.18 As shown, the electronic device 100 may include: a processor 110, an external memory interface 120, an internal memory 121, a universal serial bus (USB) interface 130, a charging management module 140, a power management module 141, a battery 142, an antenna 1, an antenna 2, a mobile communication module 150, a wireless communication module 160, an audio module 170, a speaker 170A, a receiver 170B, a microphone 170C, an earphone interface 170D, a sensor module 180, a button 190, a motor 191, an indicator 192, a camera 193, a display screen 194, and a subscriber identification module (SIM) card interface 195, etc. The sensor module 180 may include a pressure sensor 180A, a gyroscope sensor 180B, an air pressure sensor 180C, a magnetic sensor 180D, an acceleration sensor 180E, a distance sensor 180F, a proximity light sensor 180G, a fingerprint sensor 180H, a temperature sensor 180J, a touch sensor 180K, an ambient light sensor 180L, a bone conduction sensor 180M, etc.

[0419] It is to be understood that the structure illustrated in the embodiment of the present application does not constitute a specific limitation on the electronic device 100. In other embodiments of the present application, the electronic device 100 may include more or fewer components than shown in the figure, or combine some components, or split some components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0420] The processor 110 may include one or more processing units, for example, the processor 110 may include an application processor (AP), a modem processor, a graphics processor (GPU), an image signal processor (ISP), a controller, a memory, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU), etc. Different processing units may be independent devices or integrated into one or more processors.

[0421] The controller may be the nerve center and command center of the electronic device 100. The controller may generate an operation control signal according to the instruction operation code and the timing signal to complete the control of fetching and executing instructions.

[0422] The processor 110 may also be provided with a memory for storing instructions and data. In some embodiments, the memory in the processor 110 is a cache memory. The memory may store instructions or data that the processor 110 has just used or cyclically used. If the processor 110 needs to use the instruction or data again, it may be directly called from the memory. This avoids repeated access, reduces the waiting time of the processor 110, and thus improves the efficiency of the system.

[0423] In some embodiments, the processor 110 may include one or more interfaces. The interface may include an inter-integrated circuit (I2C) interface, an inter-integrated circuit sound (I2S) interface, a pulse code modulation (PCM) interface, a universal asynchronous receiver / transmitter (UART) interface, a mobile industry processor interface (MIPI), a general-purpose input / output (GPIO) interface, a subscriber identity module (SIM) interface, and / or a universal serial bus (USB) interface, etc.

[0424] The I2C interface is a bidirectional synchronous serial bus, including a serial data line (SDA) and a serial clock line (SCL). In some embodiments, the processor 110 may include multiple groups of I2C buses. The processor 110 may be coupled to the touch sensor 180K, the charger, the flash, the camera 193, etc. through different I2C bus interfaces. For example: the processor 110 may be coupled to the touch sensor 180K through the I2C interface, so that the processor 110 communicates with the touch sensor 180K through the I2C bus interface, thereby realizing the touch function of the electronic device 100.

[0425] The USB interface 130 is an interface that complies with the USB standard specification, and can be a Mini USB interface, a Micro USB interface, a USB Type C interface, etc. The USB interface 130 can be used to connect a charger to charge the electronic device 100, and can also be used to transfer data between the electronic device 100 and a peripheral device. It can also be used to connect headphones to play audio through the headphones. The interface can also be used to connect other terminal devices, such as AR devices, etc.

[0426] It is understandable that the interface connection relationship between the modules illustrated in the embodiment of the present application is only a schematic illustration and does not constitute a structural limitation on the electronic device 100. In other embodiments of the present application, the electronic device 100 may also adopt different interface connection methods in the above embodiments, or a combination of multiple interface connection methods.

[0427] The wireless communication function of the electronic device 100 can be implemented through the antenna 1, the antenna 2, the mobile communication module 150, the wireless communication module 160, the modem processor and the baseband processor.

[0428] Antenna 1 and antenna 2 are used to transmit and receive electromagnetic wave signals. Each antenna in electronic device 100 can be used to cover a single or multiple communication frequency bands. Different antennas can also be reused to improve the utilization of antennas. For example, antenna 1 can be reused as a diversity antenna for a wireless local area network. In some other embodiments, the antenna can be used in combination with a tuning switch.

[0429] The mobile communication module 150 can provide solutions for wireless communications including 2G / 3G / 4G / 5G, etc., applied to the electronic device 100. The mobile communication module 150 may include at least one filter, a switch, a power amplifier, a low noise amplifier (LNA), etc. The mobile communication module 150 can receive electromagnetic waves from the antenna 1, and filter, amplify, and process the received electromagnetic waves, and transmit them to the modulation and demodulation processor for demodulation. The mobile communication module 150 can also amplify the signal modulated by the modulation and demodulation processor, and convert it into electromagnetic waves for radiation through the antenna 1. In some embodiments, at least some of the functional modules of the mobile communication module 150 can be set in the processor 110. In some embodiments, at least some of the functional modules of the mobile communication module 150 can be set in the same device as at least some of the modules of the processor 110.

[0430] The modem processor may include a modulator and a demodulator. Among them, the modulator is used to modulate the low-frequency baseband signal to be sent into a medium-high frequency signal. The demodulator is used to demodulate the received electromagnetic wave signal into a low-frequency baseband signal. The demodulator then transmits the demodulated low-frequency baseband signal to the baseband processor for processing. After the low-frequency baseband signal is processed by the baseband processor, it is passed to the application processor. The application processor outputs a sound signal through an audio device (not limited to a speaker 170A, a receiver 170B, etc.), or displays an image or video through a display screen 194. In some embodiments, the modem processor may be an independent device. In other embodiments, the modem processor may be independent of the processor 110 and be set in the same device as the mobile communication module 150 or other functional modules.

[0431] The wireless communication module 160 can provide wireless communication solutions including wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) networks), bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), infrared (IR), etc., which are applied to the electronic device 100. The wireless communication module 160 can be one or more devices integrating at least one communication processing module. The wireless communication module 160 receives electromagnetic waves via the antenna 2, modulates the frequency of the electromagnetic wave signal and performs filtering, and sends the processed signal to the processor 110. The wireless communication module 160 can also receive the signal to be sent from the processor 110, modulate the frequency of it, amplify it, and convert it into electromagnetic waves for radiation through the antenna 2.

[0432] In some embodiments, the antenna 1 of the electronic device 100 is coupled to the mobile communication module 150, and the antenna 2 is coupled to the wireless communication module 160, so that the electronic device 100 can communicate with the network and other devices through wireless communication technology. The wireless communication technology may include global system for mobile communications (GSM), general packet radio service (GPRS), code division multiple access (CDMA), wideband code division multiple access (WCDMA), time-division code division multiple access (TD-SCDMA), long term evolution (LTE), BT, GNSS, WLAN, NFC, FM, and / or IR technology. The GNSS may include a global positioning system (GPS), a global navigation satellite system (GLONASS), a Beidou navigation satellite system (BDS), a quasi-zenith satellite system (QZSS) and / or a satellite based augmentation system (SBAS).

[0433] In an embodiment of the present application, the electronic device 100 can communicate with other electronic devices (such as the electronic device 200) via Bluetooth communication, WIFI communication, or other communication methods. For example, the electronic device 100 can send files that it wants to encrypt and share to the electronic device 200 via Bluetooth communication, WIFI communication, or other communication methods.

[0434] The electronic device 100 implements the display function through a GPU, a display screen 194, and an application processor. The GPU is a microprocessor for image processing, which connects the display screen 194 and the application processor. The GPU is used to perform mathematical and geometric calculations for graphics rendering. The processor 110 may include one or more GPUs that execute program instructions to generate or change display information.

[0435] The display screen 194 is used to display images, videos, etc. The display screen 194 includes a display panel. The display panel can be a liquid crystal display (LCD), an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode or an active-matrix organic light-emitting diode (AMOLED), a flexible light-emitting diode (FLED), Miniled, MicroLed, Micro-oLed, a quantum dot light-emitting diode (QLED), etc. In some embodiments, the electronic device 100 may include 1 or N display screens 194, where N is a positive integer greater than 1.

[0436] The digital signal processor is used to process digital signals, and can process not only digital image signals but also other digital signals. For example, when the electronic device 100 is selecting a frequency point, the digital signal processor is used to perform Fourier transform on the frequency point energy.

[0437] Video codecs are used to compress or decompress digital videos. The electronic device 100 may support one or more video codecs. Thus, the electronic device 100 may play or record videos in a variety of coding formats, such as Moving Picture Experts Group (MPEG) 1, MPEG2, MPEG3, MPEG4, etc.

[0438] The external memory interface 120 can be used to connect an external memory card, such as a Micro SD card, to expand the storage capacity of the electronic device 100. The external memory card communicates with the processor 110 through the external memory interface 120 to implement a data storage function, such as storing music, video and other files in the external memory card.

[0439] The internal memory 121 can be used to store computer executable program codes, which include instructions. The processor 110 executes various functional applications and data processing of the electronic device 100 by running the instructions stored in the internal memory 121. The internal memory 121 may include a program storage area and a data storage area. Among them, the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc. The data storage area may store data created during the use of the electronic device 100 (such as audio data, a phone book, etc.), etc. In addition, the internal memory 121 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, a universal flash storage (UFS), etc.

[0440] The pressure sensor 180A is used to sense the pressure signal and can convert the pressure signal into an electrical signal. In some embodiments, the pressure sensor 180A can be set on the display screen 194. There are many types of pressure sensors 180A, such as resistive pressure sensors, inductive pressure sensors, capacitive pressure sensors, etc. The capacitive pressure sensor can be a parallel plate including at least two conductive materials. When a force acts on the pressure sensor 180A, the capacitance between the electrodes changes. The electronic device 100 determines the intensity of the pressure according to the change in capacitance. When a touch operation acts on the display screen 194, the electronic device 100 detects the touch operation intensity according to the pressure sensor 180A. The electronic device 100 can also calculate the touch position according to the detection signal of the pressure sensor 180A. In some embodiments, touch operations acting on the same touch position but with different touch operation intensities can correspond to different operation instructions. For example: when a touch operation with a touch operation intensity less than the first pressure threshold acts on the short message application icon, an instruction to view the short message is executed. When a touch operation with a touch operation intensity greater than or equal to the first pressure threshold acts on the short message application icon, an instruction to create a new short message is executed.

[0441] The fingerprint sensor 180H is used to collect fingerprints. The electronic device 100 can use the collected fingerprint characteristics to implement fingerprint unlocking, access application locks, fingerprint photography, fingerprint call answering, etc.

[0442] The touch sensor 180K is also called a "touch panel". The touch sensor 180K can be set on the display screen 194, and the touch sensor 180K and the display screen 194 form a touch screen, also called a "touch screen". The touch sensor 180K is used to detect touch operations acting on or near it. The touch sensor can pass the detected touch operation to the application processor to determine the type of touch event. Visual output related to the touch operation can be provided through the display screen 194. In other embodiments, the touch sensor 180K can also be set on the surface of the electronic device 100, which is different from the position of the display screen 194.

[0443] The key 190 includes a power key, a volume key, etc. The key 190 may be a mechanical key or a touch key. The electronic device 100 may receive key input and generate key signal input related to user settings and function control of the electronic device 100.

[0444] Motor 191 can generate vibration prompts. Motor 191 can be used for incoming call vibration prompts, and can also be used for touch vibration feedback. For example, touch operations acting on different applications (such as taking pictures, audio playback, etc.) can correspond to different vibration feedback effects. For touch operations acting on different areas of the display screen 194, motor 191 can also correspond to different vibration feedback effects. Different application scenarios (for example: time reminders, receiving messages, alarm clocks, games, etc.) can also correspond to different vibration feedback effects. The touch vibration feedback effect can also support customization.

[0445] The indicator 192 may be an indicator light, which may be used to indicate the charging status, power changes, messages, missed calls, notifications, etc.

[0446] It should be understood that Fig.18 The electronic device 100 shown is only an example, and the electronic device 100 may have more Fig.18 More or fewer components may be shown, two or more components may be combined, or there may be a different configuration of components. Fig.18 The various components shown in the EMBODIMENTS 2000 may be implemented in hardware, software, or a combination of hardware and software, including one or more signal processing and / or application specific integrated circuits.

[0447] The structure of the electronic device 200 may be the same as or similar to that of the electronic device 100. For details about the structure of the electronic device 200, please refer to Fig.18 The textual description related to the structure of the electronic device 100 shown is not repeated here.

[0448] An embodiment of the present application provides a chip system, including: a processor, the processor is coupled to a memory, the memory is used to store programs or instructions, when the program or instructions are executed by the processor, the chip system implements the method in any of the above method embodiments.

[0449] Optionally, the processor in the chip system may be one or more. The processor may be implemented by hardware or by software. When implemented by hardware, the processor may be a logic circuit, an integrated circuit, etc. When implemented by software, the processor may be a general-purpose processor implemented by reading software code stored in a memory.

[0450] Optionally, the memory in the chip system may also be one or more. The memory may be integrated with the processor or may be separately arranged with the processor, which is not limited in the embodiments of the present application. Exemplarily, the memory may be a non-transient processor, such as a read-only memory ROM, which may be integrated with the processor on the same chip or may be arranged on different chips respectively. The embodiments of the present application do not specifically limit the type of memory and the arrangement of the memory and the processor.

[0451] Exemplarily, the chip system can be a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on chip (SoC), a central processor unit (CPU), a network processor (NP), a digital signal processor (DSP), a microcontroller unit (MCU), a programmable logic device (PLD) or other integrated chips.

[0452] It should be understood that each step in the above method embodiment can be completed by an integrated logic circuit of hardware in a processor or by instructions in the form of software. The method steps disclosed in the embodiments of the present application can be directly embodied as being executed by a hardware processor, or by a combination of hardware and software modules in a processor.

[0453] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state disk (SSD)), etc.

[0454] Those skilled in the art can understand that to implement all or part of the processes in the above-mentioned embodiments, the processes can be completed by computer programs to instruct related hardware, and the programs can be stored in computer-readable storage media. When the programs are executed, they can include the processes of the above-mentioned method embodiments. The aforementioned storage media include: ROM or random access memory RAM, magnetic disk or optical disk and other media that can store program codes.

[0455] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A data sharing method, applied to a first electronic device, characterized in that: The method comprises: The first electronic device obtains an operation of the first user; According to the operation of the first user, the first electronic device determines that the first file is selected; In response to an operation of sharing the first file on the first interface, the first electronic device sends the first file to a second electronic device associated with the first user; The first electronic device is used to set a first permission for the first file, and the first permission is effective for multiple applications on the first electronic device when sending the first file. The first permission is used to indicate that the first user is authorized to perform one or more operations on the first file.

2. The method according to claim 1, characterized in that The method further comprises: Before the first electronic device sends the first file to the second electronic device associated with the first user, the first electronic device displays at least one of a device list, an application list, and a user list on an interface, the interface being the first interface or the second interface; The step of sending, by the first electronic device, the first file to a second electronic device associated with the first user specifically includes: In response to an operation of selecting the second electronic device in the device list, the first electronic device sends the first file to the second electronic device associated with the first user; or, In response to an operation of selecting a first application in the application list, the first electronic device sends the first file to the second electronic device associated with the first user through the first application; or, In response to an operation of selecting the first user in the user list, the first electronic device sends the first file to the second electronic device associated with the first user.

3. The method according to claim 1, characterized in that The step of sending, by the first electronic device, the first file to a second electronic device associated with the first user specifically includes: In response to an operation of sharing the first file triggered in an interface, the first electronic device sends the first file to the second electronic device associated with the first user, and the interface is an interface for conducting a conversation with the first user.

4. The method according to any one of claims 1 to 3, characterized in that: The first permission is set for the first file before the operation of sharing the first file; or, The first file is set with the first permission after the operation of sharing the first file, and is sent to the second electronic device associated with the first user.

5. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: In response to an operation of sharing the first file on the first interface, the first electronic device sends the first file to a third electronic device associated with the second user; The first electronic device is used to set a second permission for the first file, and the second permission is effective for multiple applications on the first electronic device when sending the first file. The second permission is used to indicate that the second user is authorized to perform one or more operations on the first file.

6. The method according to any one of claims 1 to 5, characterized in that: The method further comprises: The first electronic device determines that the second file is selected; In response to an operation of sharing the second file on the first interface, the first electronic device sends the second file to a second electronic device associated with the first user; The first electronic device is used to set a third permission for the second file, and the third permission is effective for multiple applications on the first electronic device when sending the second file. The third permission is used to indicate that the first user is authorized to perform one or more operations on the second file.

7. The method according to any one of claims 1 to 6, characterized in that: The first user belongs to a first group, the first group also includes a third user, and the method further includes: In response to an operation of sharing the first file on the first interface, the first electronic device sends the first file to a fourth electronic device associated with the third user, and the first permission is further used to indicate that the third user is authorized to perform one or more operations on the first file; or, In response to an operation of sharing the first file on a first interface, the first electronic device sends the first file to the fourth electronic device associated with the third user; wherein the first electronic device is also used to set a fourth permission for the first file, and the fourth permission is effective for multiple applications on the first electronic device when sending the first file, and the fourth permission is used to indicate that the third user is authorized to perform one or more operations on the first file.

8. The method according to any one of claims 1 to 7, characterized in that: Before the first electronic device sends the first file to a second electronic device associated with the first user, the method further includes: The first electronic device logs in to a first account, and the first account belongs to an account of a fourth user.

9. The method according to any one of claims 1 to 8, characterized in that: Before the first electronic device sends the first file to a second electronic device associated with the first user, the method further includes: The first electronic device obtains credentials corresponding to the first user; The first electronic device encrypts the first file based on the credentials.

10. The method according to any one of claims 1 to 9, characterized in that: The credential is obtained by the first electronic device on a server, or the credential is obtained locally by the first electronic device, or the credential is obtained by the first electronic device on the second electronic device.

11. The method according to any one of claims 1 to 10, characterized in that: The first electronic device is used to set a first permission for the first file, specifically including: The first electronic device is used to write field information of the first permission into the first file; or, The first electronic device is used to send a first message to a server, wherein the first message includes field information of the first permission and identification information of the first file, and the first message is used to instruct the server to save the association between the field information of the first permission and the identification information of the first file.

12. The method according to any one of claims 1 to 11, characterized in that: The first permission includes read-only permission, or editable permission, or forwarding permission, and the editable permission includes one or more of editing permission, save as permission, screenshot permission, screen recording permission, printing permission, and copy permission.

13. The method according to any one of claims 1 to 12, characterized in that: The first file includes sensitive information.

14. A data sharing method, applied to a second electronic device, characterized in that: The method comprises: The second electronic device receives a first file sent by the first electronic device, the first file is controlled by a first permission, and the first permission is effective when multiple applications on the second electronic device perform operations within the control range of the first permission on the first file, the multiple applications including the first application; The second electronic device obtains, by the first user, a first operation on the first file in the first application; In response to the first operation, if the second electronic device determines that the first operation is one or more operations authorized to be performed on the first file as indicated by the first permission, the second electronic device responds to the first operation.

15. The method according to claim 14, characterized in that in, Before the second electronic device determines that the first operation is one or more operations authorized to be performed on the first file as indicated by the first permission, the method further includes: The second electronic device determines that the user who performs the first operation is the first user who has been authenticated to have operation authority over the first file; The second electronic device determines that the first operation is one or more operations authorized to be performed on the first file as indicated by the first permission, including: the second electronic device determines that the first operation is one or more operations authorized to be performed on the first file by the first user as indicated by the first permission.

16. The method according to claim 15, characterized in that The second electronic device determines that the user who performs the first operation is the first user who has been authenticated and has the operation authority for the first file, specifically including: The second electronic device determines that the account logged in by the second electronic device is the account of the first user; or, The second electronic device determines that a biometric characteristic of a user performing the first operation matches a biometric characteristic of the first user; or, The second electronic device receives a first message sent by a third electronic device, where the first message is used to indicate that a user performing the first operation is the first user who has been authenticated to have operation authority over the first file, and the third electronic device is associated with the second electronic device.

17. The method according to any one of claims 14 to 16, characterized in that: The method further comprises: When the second electronic device determines that the first operation does not belong to one or more operations indicated by the first permission that the first user is authorized to perform on the first file, the second electronic device displays a first prompt message, where the first prompt message is used to prompt the user that the second electronic device refuses to respond to the first operation.

18. The method according to any one of claims 14 to 17, characterized in that: The method further comprises: In response to the operation of sharing the first file, the second electronic device sends the first file to a third electronic device associated with the first user.

19. The method according to any one of claims 14 to 17, characterized in that: The method further comprises: In response to the operation of sharing the first file, the second electronic device sends the first file to a fourth electronic device associated with the second user.

20. The method according to any one of claims 14 to 19, characterized in that: When the first file is forwarded by the second electronic device, the first file is set to a third permission, and the authorization scope of the third permission does not exceed the authorization scope of the first permission.

21. The method according to any one of claims 14 to 20, characterized in that: The method further comprises: The second electronic device sends a second message to the first electronic device, where the second message is used to indicate that the first electronic device authorizes the first user to perform a second operation on the first file, and the second operation does not belong to the one or more operations indicated by the first permission that the first user is authorized to perform on the first file.

22. The method according to any one of claims 14 to 21, characterized in that: The method further comprises: The second electronic device sends a third message to the first electronic device, where the third message is used to instruct the first electronic device to authorize the first user to perform a forwarding operation on the first file.

23. The method according to any one of claims 14 to 22, characterized in that: The first file is an encrypted file, and before the second electronic device responds to the first operation, the method further includes: The second electronic device obtains the credentials corresponding to the first user; The second electronic device decrypts the first file based on the credential.

24. The method according to any one of claims 14 to 23, characterized in that: A first mark is displayed on the second electronic device, and the first mark is used to indicate that the first file is an encrypted file.

25. The method according to any one of claims 14 to 24, characterized in that: The first permission is obtained by the second electronic device from the first file; or, the first permission is obtained by the second electronic device from a server.

26. The method according to any one of claims 14 to 25, characterized in that: The first permission includes read-only permission, or editable permission, or forwarding permission, and the editable permission includes one or more of editing permission, save as permission, screenshot permission, screen recording permission, printing permission, and copy permission.

27. An electronic device, characterized in that: The electronic device includes one or more processors and one or more memories; wherein the one or more memories are coupled to the one or more processors, and the one or more memories are used to store computer program code, and the computer program code includes computer instructions, and when the one or more processors execute the computer instructions, the electronic device executes the method described in any one of claims 1-13 or 14-26.

28. A computer storage medium, characterized in that The computer storage medium stores a computer program, which includes program instructions. When the program instructions are executed on an electronic device, the electronic device executes the method as claimed in any one of claims 1 to 13 or 14 to 26.

29. A computer program product, when the computer program product is run on a computer, causes the computer to execute the method according to any one of claims 1 to 13 or 14 to 26.

Images