File sharing method, electronic equipment and computer readable storage medium

Abstract

The invention is suitable for the technical field of terminals, and particularly relates to a file sharing method, electronic equipment and a computer readable storage medium. In the method, a first user can perform encrypted sharing of a to-be-shared file through a target group, and when encrypted sharing of the to-be-shared file is performed through the target group, the first user does not need to perform manual encryption on the to-be-shared file or perform permission configuration on the to-be-shared file, so that the user experience is improved. A first electronic device can automatically encrypt a to-be-shared file, and sends an encrypted first encrypted file to a first server. According to the embodiment of the invention, the first server can automatically authorize the access authority of the user in the target group to the to-be-shared file according to the authorization strategy corresponding to the target group, so that the authorization process can be simplified, the first user can conveniently manage and control the shared file, and the user experience is improved.

Description

Technical Field

[0001] The present application belongs to the field of terminal technology, and in particular relates to a file sharing method, an electronic device, and a computer-readable storage medium. Background Art

[0002] File sharing is common in daily work and life. To ensure the security of file sharing, files can be shared through controlled sharing technology. For example, when sharing files, users can first encrypt and configure permissions for the files, and then send the encrypted files to the recipient. After the recipient receives the file, he can verify the permissions according to the permissions configured by the user. After the verification is passed, the recipient can obtain the corresponding key to decrypt the file to obtain the file. However, this file sharing method requires users to encrypt and configure permissions for each file before sharing it. The operation process is cumbersome and the user experience is poor. Summary of the invention

[0003] The embodiments of the present application provide a file sharing method, an electronic device, and a computer-readable storage medium, which can solve the problems of cumbersome operation process of file encryption and permission configuration and poor user experience in the file sharing method of the prior art.

[0004] In a first aspect, an embodiment of the present application provides a file sharing method, which is applied to a first server, and the method includes:

[0005] The first server receives a first encrypted file sent by a first electronic device to a target group, the first encrypted file is encrypted by a first key, and the target group includes a first user associated with the first electronic device. The first server determines the authorization policy corresponding to the target group based on the identification information of the target group. The first server obtains a second encrypted file based on the first encrypted file, the first key and the authorization policy, and sends the second encrypted file to the second electronic device. The first server obtains a decryption request sent by the second electronic device, the decryption request is used to request decryption of the second encrypted file, and the second electronic device is associated with the second user. The first server determines that the second user is a user in the target group based on the second encrypted file. The first server sends the first key and the authorization policy to the second electronic device.

[0006] In the file sharing method provided above, the first user can encrypt and share the file to be shared through the target group. When encrypting and sharing the file to be shared through the target group, the first user does not need to manually encrypt the file to be shared, nor does he need to configure the permissions of the shared file. The first electronic device can automatically encrypt the file to be shared, and can send the encrypted first encrypted file to the first server. The first server can automatically authorize the users in the target group to have access rights to the shared file according to the authorization policy corresponding to the target group, which can not only simplify the authorization process, but also facilitate the first user to manage and control the shared files, and improve the user experience.

[0007] In a possible implementation, the first server obtains the second encrypted file based on the first encrypted file, the first key, and the authorization policy, including:

[0008] The first server encrypts the first key and the authorization policy to obtain an encrypted policy package, and adds the encrypted policy package to the first encrypted file to obtain a second encrypted file.

[0009] In the file sharing method provided by the implementation, in order to ensure that other users need to access the to-be-shared file shared by the first user to the target group according to the corresponding permissions and ensure the security of the to-be-shared file, after the first server obtains the first encrypted file corresponding to the to-be-shared file, it can encrypt the first key for encrypting the to-be-shared file and the authorization policy corresponding to the target group to obtain an encrypted policy package, and add the encrypted policy package to the first encrypted file to obtain a second encrypted file, so that other users cannot directly access the second encrypted file after obtaining the second encrypted file, and need to send a decryption request to the first server. When the first server receives the decryption request, it can verify whether other users have the right to access the to-be-shared file, and will only send the first key when other users have the right to access the to-be-shared file, so as to ensure the security of the to-be-shared file and improve the user experience.

[0010] In one example, before the first server determines the authorization policy corresponding to the target group according to the identification information of the target group, the method further includes:

[0011] The first server obtains the identification information of the target group, the information of the users included in the target group and the attribute information of the target group. The first server determines the authorization policy corresponding to the target group according to the information of the users included in the target group and the attribute information of the target group, and associates and saves the identification information of the target group and the authorization policy corresponding to the target group.

[0012] Optionally, the attribute information of the target group includes real-time permission information and historical permission information. The real-time permission information is used to represent the real-time access rights that users joining the target group have to files shared with the target group after joining the target group. The historical permission information is used to represent the historical access rights that users joining the target group have to files already existing in the target group when joining the target group.

[0013] Optionally, the authorization policy corresponding to the target group includes real-time access rights and / or historical access rights corresponding to each user in the target group.

[0014] In a possible implementation, the method further includes:

[0015] The first server obtains first notification information, which is notification information of the first user withdrawing the file to be shared. The first server updates the authorization policy corresponding to the target group according to the first notification information; wherein the updated authorization policy is used to cancel the real-time access rights and / or historical access rights of each user in the target group to the shared file.

[0016] In the file sharing method provided by the implementation, when the first user withdraws a file that has been shared to the target group (e.g., a file to be shared), the first electronic device may send a first notification message of withdrawing the file to be shared to the first server. After receiving the first notification message, the first server may update the authorization policy corresponding to the target group to delete the real-time access rights and / or historical access rights of each user in the target group to the file to be shared, thereby ensuring that after the first user withdraws the file to be shared, any second user in the target group will no longer be able to access the file to be shared.

[0017] In a possible implementation, the method further includes:

[0018] The first server obtains the second notification information, which is the notification information of the third user joining the target group. The first server updates the authorization policy corresponding to the target group according to the second notification information; wherein the updated authorization policy is used to authorize the third user to have real-time access rights and / or historical access rights to files in the target group.

[0019] In the file sharing method provided by this implementation, when a new user (i.e., a third user) joins the target group, the first server can automatically authorize the third user based on the attribute information of the target group. There is no need to manually authorize the third user, thereby simplifying the authorization process and improving the user experience.

[0020] In another possible implementation, the method further includes:

[0021] The first server obtains third notification information, which is notification information of the fourth user exiting the target group. The first server updates the authorization policy corresponding to the target group according to the third notification information; wherein the updated authorization policy is used to cancel the fourth user's real-time access rights and / or historical access rights to files in the target group.

[0022] In the file sharing method provided by the implementation, when a user (i.e., the fourth user) in the target group exits the target group, the first server can update the authorization policy corresponding to the target group, such as updating the member list corresponding to the current group, to delete the fourth user from the member list corresponding to the target group, and delete the real-time access rights and / or historical access rights corresponding to the fourth user, so that the fourth user no longer has any access rights to the real-time files and / or historical files in the target group. That is, after the fourth user exits the target group, the fourth user will lose the real-time access rights to the real-time files in the target group, and / or lose the historical access rights to the historical files in the target group, that is, the fourth user will no longer be able to access any file in the target group.

[0023] In another possible implementation, the method further includes:

[0024] The first server obtains fourth notification information, which is notification information for disbanding the target group. The first server updates the authorization policy corresponding to the target group according to the fourth notification information; wherein the updated authorization policy is used to cancel the real-time access rights and / or historical access rights of all users in the target group to each file in the target group.

[0025] In the file sharing method provided by the implementation, when the target group is dissolved, the first server can update the authorization policy corresponding to the target group, such as updating the member list corresponding to the target group, to delete all users from the member list corresponding to the target group, and to delete the real-time access rights and / or historical access rights corresponding to each user, so that each user in the target group no longer has any access rights to any real-time file and / or any historical file in the target group. That is, after the target group is dissolved, each user in the target group will not be able to open files that have been previously shared to the target group.

[0026] In a second aspect, an embodiment of the present application provides a file sharing method, which is applied to a first electronic device, where the first electronic device is associated with a first user, and the method includes:

[0027] When the first electronic device detects that the first user shares a file to be shared with a target group, the first electronic device obtains identification information of the file to be shared and the target group, where the file to be shared is an unencrypted file. The first electronic device encrypts the file to be shared using a first key to obtain a first encrypted file. The first electronic device sends the first encrypted file, the first key, and identification information of the target group to the first server.

[0028] In the file sharing method provided above, the first user can encrypt and share the file to be shared through the target group. When encrypting and sharing the file to be shared through the target group, the first user does not need to manually encrypt the file to be shared, nor does he need to configure the permissions of the shared file. The first electronic device can automatically encrypt the file to be shared, and can send the encrypted first encrypted file to the first server. The first server can automatically authorize the users in the target group to have access rights to the shared file according to the authorization policy corresponding to the target group, which can not only simplify the authorization process, but also facilitate the first user to manage and control the shared files, and improve the user experience.

[0029] In a possible implementation, the method further includes:

[0030] The first electronic device detects that the second user shares the target file to the target group. The first electronic device obtains the third encrypted file sent by the first server, the third encrypted file includes the second encrypted file, the second key and the authorization policy, and the second encrypted file is a file obtained by encrypting the target file with the second key. The first electronic device detects the first user's opening operation on the third encrypted file. The first electronic device sends a decryption request to the first server, and the decryption request is used to request decryption of the third encrypted file. The first electronic device obtains the second key and the authorization policy corresponding to the decryption request sent by the first server. The first electronic device decrypts the second encrypted file according to the second key, obtains the target file, and accesses the target file according to the authorization policy.

[0031] In the file sharing method provided by this implementation, when the second user shares the target file to the target group, the first electronic device can obtain the third encrypted file corresponding to the target file through the first server. When the first user wants to open the third encrypted file, the first electronic device needs to send a decryption request to the first server to decrypt the third encrypted file. When the first server receives the decryption request, it can verify whether the first user has the right to access the target file according to the authorization policy in the third encrypted file. When the first user has the right to access the target file, the first server will send the first key and authorization policy to the first electronic device, so that the first electronic device can access the target file according to the authorization policy, ensure the security of the target file, and improve the user experience.

[0032] Exemplarily, the first electronic device sends the first encrypted file, the first key, and identification information of the target group to the first server, including:

[0033] The first electronic device sends the first encrypted file, the first key and identification information of the target group to the second server, and instructs the second server to send the first encrypted file, the first key and identification information of the target group to the first server.

[0034] In the file sharing method provided in this example, the first electronic device can be communicatively connected to the second server, and the second server can be communicatively connected to the first server. That is, the first electronic device may not send information directly to the first server, but may send information to the first server through the second server, thereby ensuring the security of file sharing and improving user experience.

[0035] In one example, the method further includes:

[0036] The first electronic device obtains identification information of the target group, information of users included in the target group, and attribute information of the target group. The first electronic device sends the identification information of the target group, information of users included in the target group, and attribute information of the target group to the first server; or the first electronic device sends the identification information of the target group, information of users included in the target group, and attribute information of the target group to the second server, and instructs the second server to send the identification information of the target group, information of users included in the target group, and attribute information of the target group to the first server.

[0037] Optionally, the attribute information of the target group includes real-time permission information and historical permission information. The real-time permission information is used to represent the real-time access rights that users joining the target group have to files shared with the target group after joining the target group. The historical permission information is used to represent the historical access rights that users joining the target group have to files already existing in the target group when joining the target group.

[0038] Optionally, the authorization policy corresponding to the target group includes real-time access rights and / or historical access rights corresponding to each user in the target group.

[0039] In a possible implementation, the method further includes:

[0040] When the first electronic device detects that the first user withdraws the file to be shared, it sends a first notification message to the first server, or sends the first notification message to the second server to instruct the second server to send the first notification message to the first server. The first notification message is notification message of the first user withdrawing the file to be shared.

[0041] In another possible implementation, the method further includes:

[0042] When the first electronic device receives the information that the third user joins the target group, it sends the second notification information to the first server, or sends the second notification information to the second server to instruct the second server to send the second notification information to the first server. The second notification information is the notification information that the third user joins the target group.

[0043] In another possible implementation, the method further includes:

[0044] When the first electronic device receives the information that the fourth user has exited the target group, it sends the third notification information to the first server, or sends the third notification information to the second server to instruct the second server to send the third notification information to the first server. The third notification information is the notification information that the fourth user has exited the target group.

[0045] In another possible implementation, the method further includes:

[0046] When the first electronic device receives the information of disbanding the target group, it sends the fourth notification information to the first server, or sends the fourth notification information to the second server to instruct the second server to send the fourth notification information to the first server. The fourth notification information is the notification information of disbanding the target group.

[0047] In a third aspect, an embodiment of the present application provides a file sharing method, which is applied to a second electronic device, where the second electronic device is associated with a second user, and the method includes:

[0048] The second electronic device obtains the second encrypted file sent by the first server, the second encrypted file includes the first encrypted file, the first key and the authorization policy, the first encrypted file is a file obtained by encrypting the file to be shared by the first key, and the file to be shared is a file shared by the first user to the target group. The second electronic device detects the second user's opening operation on the second encrypted file. The second electronic device sends a decryption request to the first server, and the decryption request is used to request decryption of the second encrypted file. The second electronic device obtains the first key and the authorization policy corresponding to the decryption request sent by the first server. The second electronic device decrypts the first encrypted file according to the first key to obtain the file to be shared, and accesses the file to be shared according to the authorization policy.

[0049] In a fourth aspect, an embodiment of the present application provides a file sharing device, which is applied to a first server, and the device includes:

[0050] The first encrypted file acquisition module is used to receive a first encrypted file sent by a first electronic device to a target group, where the first encrypted file is encrypted by a first key, and the target group includes a first user associated with the first electronic device.

[0051] The authorization policy determination module is used to determine the authorization policy corresponding to the target group according to the identification information of the target group.

[0052] The second encrypted file acquisition module is used to obtain a second encrypted file based on the first encrypted file, the first key and the authorization policy, and send the second encrypted file to the second electronic device.

[0053] The decryption request acquisition module is used to acquire a decryption request sent by a second electronic device, where the decryption request is used to request decryption of a second encrypted file, and the second electronic device is associated with a second user.

[0054] The second user determination module is used to determine that the second user is a user in the target group according to the second encrypted file.

[0055] The authorization policy sending module is used to send the first key and the authorization policy to the second electronic device.

[0056] In a possible implementation, the second encrypted file acquisition module is further used to encrypt the first key and the authorization policy to obtain an encrypted policy package, and add the encrypted policy package to the first encrypted file to obtain the second encrypted file.

[0057] In one example, the apparatus further comprises:

[0058] The attribute information acquisition module is used to acquire the identification information of the target group, the information of the users included in the target group, and the attribute information of the target group.

[0059] The authorization policy saving module is used to determine the authorization policy corresponding to the target group according to the information of the users included in the target group and the attribute information of the target group, and to associate and save the identification information of the target group and the authorization policy corresponding to the target group.

[0060] Optionally, the attribute information of the target group includes real-time permission information and historical permission information. The real-time permission information is used to represent the real-time access rights that users joining the target group have to files shared with the target group after joining the target group. The historical permission information is used to represent the historical access rights that users joining the target group have to files already existing in the target group when joining the target group.

[0061] Optionally, the authorization policy corresponding to the target group includes real-time access rights and / or historical access rights corresponding to each user in the target group.

[0062] In a possible implementation, the device further includes:

[0063] The first notification information acquisition module is used to acquire first notification information, where the first notification information is notification information of the first user withdrawing the file to be shared.

[0064] The first authorization policy updating module is used to update the authorization policy corresponding to the target group according to the first notification information; wherein the updated authorization policy is used to cancel the real-time access rights and / or historical access rights of each user in the target group to the shared file.

[0065] In a possible implementation, the device further includes:

[0066] The second notification information acquisition module is used to acquire second notification information, where the second notification information is notification information that the third user joins the target group.

[0067] The second authorization policy updating module is used to update the authorization policy corresponding to the target group according to the second notification information; wherein the updated authorization policy is used to authorize the third user to have real-time access rights and / or historical access rights to files in the target group.

[0068] In another possible implementation, the device further includes:

[0069] The third notification information acquisition module is used to acquire third notification information, where the third notification information is notification information that the fourth user exits the target group.

[0070] The third authorization policy updating module is used to update the authorization policy corresponding to the target group according to the third notification information; wherein the updated authorization policy is used to cancel the fourth user's real-time access rights and / or historical access rights to files in the target group.

[0071] In another possible implementation, the device further includes:

[0072] The fourth notification information acquisition module is used to acquire fourth notification information, where the fourth notification information is notification information for disbanding the target group.

[0073] The fourth authorization policy updating module is used to update the authorization policy corresponding to the target group according to the fourth notification information; wherein the updated authorization policy is used to cancel the real-time access rights and / or historical access rights of all users in the target group to each file in the target group.

[0074] In a fifth aspect, an embodiment of the present application provides a file sharing device, which is applied to a first electronic device, the first electronic device is associated with a first user, and the device includes:

[0075] The identification information acquisition module is used to acquire identification information of the file to be shared and the target group when detecting that the first user shares the file to be shared to the target group, and the file to be shared is an unencrypted file.

[0076] The file encryption module is used to encrypt the file to be shared by using a first key to obtain a first encrypted file.

[0077] The file sending module is used to send the first encrypted file, the first key and the identification information of the target group to the first server.

[0078] In a possible implementation, the device further includes:

[0079] The file detection module is used to detect that the second user shares the target file to the target group.

[0080] The file acquisition module is used to acquire the third encrypted file sent by the first server, wherein the third encrypted file includes the second encrypted file, the second key and the authorization policy, and the second encrypted file is a file obtained by encrypting the target file with the second key.

[0081] The opening operation detection module is used to detect the opening operation of the third encrypted file by the first user.

[0082] The decryption request sending module is used to send a decryption request to the first server, where the decryption request is used to request decryption of the third encrypted file.

[0083] The authorization policy acquisition module is used to acquire the second key and authorization policy corresponding to the decryption request sent by the first server.

[0084] The file access module is used to decrypt the second encrypted file according to the second key to obtain the target file, and access the target file according to the authorization policy.

[0085] Exemplarily, the file sending module is further used to send the first encrypted file, the first key and identification information of the target group to the second server, and instruct the second server to send the first encrypted file, the first key and identification information of the target group to the first server.

[0086] In one example, the apparatus further comprises:

[0087] An attribute information acquisition module, used to acquire identification information of a target group, information of users included in the target group, and attribute information of the target group;

[0088] An attribute information sending module is used to send the identification information of the target group, the information of the users included in the target group, and the attribute information of the target group to the first server; or to send the identification information of the target group, the information of the users included in the target group, and the attribute information of the target group to the second server, and instruct the second server to send the identification information of the target group, the information of the users included in the target group, and the attribute information of the target group to the first server.

[0089] Optionally, the attribute information of the target group includes real-time permission information and historical permission information. The real-time permission information is used to represent the real-time access rights that users joining the target group have to files shared with the target group after joining the target group. The historical permission information is used to represent the historical access rights that users joining the target group have to files already existing in the target group when joining the target group.

[0090] Optionally, the authorization policy corresponding to the target group includes real-time access rights and / or historical access rights corresponding to each user in the target group.

[0091] In a possible implementation, the device further includes:

[0092] The first notification information sending module is used to send the first notification information to the first server or the second server when detecting the operation of the first user withdrawing the file to be shared, so as to instruct the second server to send the first notification information to the first server. The first notification information is the notification information of the first user withdrawing the file to be shared.

[0093] In another possible implementation, the device further includes:

[0094] The second notification information sending module is used to send the second notification information to the first server or to send the second notification information to the second server upon receiving the information that the third user joins the target group, so as to instruct the second server to send the second notification information to the first server. The second notification information is the notification information that the third user joins the target group.

[0095] In another possible implementation, the device further includes:

[0096] The third notification information sending module is used to send the third notification information to the first server or send the third notification information to the second server when receiving the information that the fourth user exits the target group, so as to instruct the second server to send the third notification information to the first server. The third notification information is the notification information that the fourth user exits the target group.

[0097] In another possible implementation, the device further includes:

[0098] The fourth notification information sending module is used to send the fourth notification information to the first server or the second server when receiving the information of disbanding the target group, so as to instruct the second server to send the fourth notification information to the first server. The fourth notification information is the notification information of disbanding the target group.

[0099] In a sixth aspect, an embodiment of the present application provides a file sharing device, which is applied to a second electronic device, and the second electronic device is associated with a second user, and the device includes:

[0100] The encrypted file acquisition module is used to obtain a second encrypted file sent by the first server. The second encrypted file includes the first encrypted file, the first key and the authorization policy. The first encrypted file is a file obtained by encrypting the file to be shared using the first key. The file to be shared is a file shared by the first user to the target group.

[0101] The opening operation detection module is used to detect the opening operation of the second encrypted file by the second user.

[0102] The decryption request sending module is used to send a decryption request to the first server, where the decryption request is used to request decryption of the second encrypted file.

[0103] The authorization policy acquisition module is used to acquire the first key and authorization policy corresponding to the decryption request sent by the first server.

[0104] The file access module is used to decrypt the first encrypted file according to the first key to obtain the file to be shared, and access the file to be shared according to the authorization policy.

[0105] In a seventh aspect, an embodiment of the present application provides a file sharing system, including a first electronic device, a second electronic device and a first server, the first electronic device is associated with a first user, the second electronic device is associated with a second user, and the first user and the second user are users in a target group;

[0106] A first electronic device, used to execute the steps of the file sharing method described in any one of the second aspects above;

[0107] A first server, configured to execute the steps of the file sharing method described in any one of the first aspects above;

[0108] The second electronic device is used to execute the steps in the file sharing method described in the third aspect.

[0109] In an eighth aspect, an embodiment of the present application provides a server, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the electronic device implements the file sharing method described in any one of the first aspects above.

[0110] In the ninth aspect, an embodiment of the present application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the electronic device implements the file sharing method described in any one of the second or third aspects above.

[0111] In the tenth aspect, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a computer, the computer implements the file sharing method described in any one of the first aspect, or implements the file sharing method described in any one of the second aspect, or implements the file sharing method described in any one of the third aspect.

[0112] In the eleventh aspect, an embodiment of the present application provides a computer program product. When the computer program product is run on an electronic device, the electronic device executes the file sharing method described in any one of the first aspect, or implements the file sharing method described in any one of the second aspect, or implements the file sharing method described in any one of the third aspect.

[0113] It can be understood that the beneficial effects of the third to eleventh aspects mentioned above can be found in the relevant descriptions in the first or second aspect mentioned above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0114] Figure 1 is a structural schematic diagram of an electronic device provided in an embodiment of the present application;

[0115] Figure 2 is a schematic diagram of the software architecture of the electronic device provided in the embodiment of the present application;

[0116] Figure 3 This is a schematic diagram of a file sharing system to which the file sharing method provided in the embodiment of the present application is applicable. Figure 1 ;

[0117] Figure 4 This is an example of an application scenario provided by the embodiment of the present application. Figure 1 ;

[0118] Figure 5 This is an example of an application scenario provided by the embodiment of the present application. Figure 2 ;

[0119] Figure 6 It is a flowchart of a software sharing method provided by an embodiment of the present application;

[0120] Figure 7 is a schematic block diagram of a second electronic device provided in an embodiment of the present application;

[0121] Figure 8 This is a schematic diagram of a file sharing system to which the file sharing method provided in the embodiment of the present application is applicable. Figure 2 ;

[0122] Fig. 9 It is a flowchart of a software sharing method provided in another embodiment of the present application. DETAILED DESCRIPTION

[0123] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or combinations thereof.

[0124] It should also be understood that the term “and / or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0125] As used in the specification and appended claims of this application, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce [described condition or event] is detected" or "in response to detecting [described condition or event]", depending on the context.

[0126] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0127] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0128] In addition, the “plurality” mentioned in the embodiments of the present application should be interpreted as two or more.

[0129] The steps involved in the file sharing method provided in the embodiments of the present application are only examples, and not all steps are mandatory steps, or not all information or messages are mandatory, and can be increased or decreased as needed during use. The same step or steps or messages with the same function in the embodiments of the present application can be referenced and learned from each other in different embodiments.

[0130] The business scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. A person of ordinary skill in the art will appreciate that, with the evolution of network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0131] File sharing is common in daily work and life. To ensure the security of file sharing, files can be shared through controlled sharing technology. For example, when sharing files, users can first encrypt and configure permissions for the files, and then send the encrypted files to the recipient. After the recipient receives the file, he can verify the permissions according to the permissions configured by the user. After the verification is passed, the recipient can obtain the corresponding decryption key to decrypt the file to obtain the file. However, this file sharing method requires users to encrypt and configure permissions for each file before sharing it. The operation process is cumbersome and the user experience is poor.

[0132] To solve the above problems, the embodiments of the present application provide a file sharing method, an electronic device and a computer-readable storage medium. In the method, when it is detected that the first user sends a file to be shared through a target group, the first electronic device can obtain the identification information of the file to be shared and the target group, and encrypt the file to be shared by using a first key to obtain a first encrypted file. Subsequently, the first electronic device can send the first encrypted file, the first key and the identification information of the target group to the first server. The first server can determine the authorization policy corresponding to the target group according to the identification information of the target group, and obtain the second encrypted file according to the first encrypted file, the first key and the authorization policy, so as to send the second encrypted file to the second electronic device. When the second electronic device detects the opening operation of the second user, the opening operation is used to request to open the second encrypted file, and the second electronic device can send a decryption request to the first server. After the first server receives the decryption request, if it is determined that the second user is a user in the target group according to the authorization policy in the second encrypted file, the first server sends the authorization policy and the first key to the second electronic device. The second electronic device decrypts the first encrypted file by using the first key to obtain the file to be shared, and controls the second user's access to the shared file according to the authorization policy.

[0133] That is, in the embodiment of the present application, the first user can encrypt and share the file to be shared through the target group. When encrypting and sharing the file to be shared through the target group, the first user does not need to manually encrypt the file to be shared, nor does he need to configure permissions for the shared file. The first electronic device can automatically encrypt the file to be shared, and the first server can automatically authorize users in the target group to have access rights to the shared file based on the authorization policy corresponding to the target group. This not only simplifies the authorization process, but also makes it convenient for the first user to manage and control the shared files, thereby improving the user experience.

[0134] In the embodiments of the present application, the electronic device (for example, the first electronic device or the second electronic device) may be a mobile phone, a tablet computer, a wearable device, a vehicle-mounted device, an augmented reality (AR) / virtual reality (VR) device, a laptop computer, an ultra-mobile personal computer (UMPC), a netbook, a personal digital assistant (PDA), a desktop computer, etc. The embodiments of the present application do not impose any restrictions on the specific type of the electronic device.

[0135] The following first introduces the electronic device (eg, the first electronic device or the second electronic device) involved in the embodiments of the present application. Figure 1 , Figure 1 A schematic structural diagram of an electronic device 100 is shown.

[0136] The electronic device 100 may include a processor 110, an external memory interface 120, an internal memory 121, a universal serial bus (USB) interface 130, an antenna 1, an antenna 2, a mobile communication module 140, a wireless communication module 150, a sensor module 160, and a display screen 170, etc. The sensor module 160 may include a pressure sensor 160A, a touch sensor 160B, etc.

[0137] It is to be understood that the structure illustrated in the embodiment of the present application does not constitute a specific limitation on the electronic device 100. In other embodiments of the present application, the electronic device 100 may include more or fewer components than shown in the figure, or combine some components, or split some components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0138] The processor 110 may include one or more processing units, for example, the processor 110 may include an application processor (AP), a modem processor, a graphics processor (GPU), an image signal processor (ISP), a controller, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU), etc. Different processing units may be independent devices or integrated into one or more processors.

[0139] The controller can generate operation control signals according to the instruction operation code and timing signal to complete the control of instruction fetching and execution.

[0140] The processor 110 may also be provided with a memory for storing instructions and data. In some embodiments, the memory in the processor 110 is a cache memory. The memory may store instructions or data that the processor 110 has just used or cyclically used. If the processor 110 needs to use the instruction or data again, it may be directly called from the memory. This avoids repeated access, reduces the waiting time of the processor 110, and thus improves the efficiency of the system.

[0141] In some embodiments, the processor 110 may include one or more interfaces. The interface may include an inter-integrated circuit (I2C) interface, an inter-integrated circuit sound (I2S) interface, a pulse code modulation (PCM) interface, a universal asynchronous receiver / transmitter (UART) interface, a mobile industry processor interface (MIPI), a general-purpose input / output (GPIO) interface, a subscriber identity module (SIM) interface, and / or a universal serial bus (USB) interface, etc.

[0142] The I2C interface is a bidirectional synchronous serial bus, including a serial data line (SDA) and a serial clock line (SCL). In some embodiments, the processor 110 may include multiple groups of I2C buses. The processor 110 may be coupled to the touch sensor 160B and the like through different I2C bus interfaces. For example, the processor 110 may be coupled to the touch sensor 160B through the I2C interface, so that the processor 110 communicates with the touch sensor 160B through the I2C bus interface, thereby realizing the touch function of the electronic device 100.

[0143] The MIPI interface can be used to connect the processor 110 with peripheral devices such as the display screen 170. The MIPI interface includes a display serial interface (DSI), etc. In some embodiments, the processor 110 and the display screen 170 communicate via the DSI interface to implement the display function of the electronic device 100.

[0144] The GPIO interface can be configured by software. The GPIO interface can be configured as a control signal or as a data signal. In some embodiments, the GPIO interface can be used to connect the processor 110 with the display screen 170, the wireless communication module 150, the sensor module 160, etc. The GPIO interface can also be configured as an I2C interface, an I2S interface, a UART interface, a MIPI interface, etc.

[0145] The USB interface 130 is an interface that complies with the USB standard specification, and may be a Mini USB interface, a Micro USB interface, a USB Type C interface, etc. The USB interface 130 may be used to transmit data between the electronic device 100 and a peripheral device. The interface may also be used to connect other electronic devices, such as an AR device, etc.

[0146] It is understandable that the interface connection relationship between the modules illustrated in the embodiment of the present application is only a schematic illustration and does not constitute a structural limitation on the electronic device 100. In other embodiments of the present application, the electronic device 100 may also adopt different interface connection methods in the above embodiments, or a combination of multiple interface connection methods.

[0147] The wireless communication function of the electronic device 100 can be implemented through the antenna 1, the antenna 2, the mobile communication module 140, the wireless communication module 150, the modem processor and the baseband processor.

[0148] Antenna 1 and antenna 2 are used to transmit and receive electromagnetic wave signals. Each antenna in electronic device 100 can be used to cover a single or multiple communication frequency bands. Different antennas can also be reused to improve the utilization of antennas. For example, antenna 1 can be reused as a diversity antenna for a wireless local area network. In some other embodiments, the antenna can be used in combination with a tuning switch.

[0149] The mobile communication module 140 can provide solutions for wireless communications including 2G / 3G / 4G / 5G, etc., applied to the electronic device 100. The mobile communication module 140 may include at least one filter, a switch, a power amplifier, a low noise amplifier (LNA), etc. The mobile communication module 140 can receive electromagnetic waves from the antenna 1, and filter, amplify, and process the received electromagnetic waves, and transmit them to the modulation and demodulation processor for demodulation. The mobile communication module 140 can also amplify the signal modulated by the modulation and demodulation processor, and convert it into electromagnetic waves for radiation through the antenna 1. In some embodiments, at least some of the functional modules of the mobile communication module 140 can be set in the processor 110. In some embodiments, at least some of the functional modules of the mobile communication module 140 can be set in the same device as at least some of the modules of the processor 110.

[0150] The modem processor may include a modulator and a demodulator. The modulator is used to modulate the low-frequency baseband signal to be sent into a medium-high frequency signal. The demodulator is used to demodulate the received electromagnetic wave signal into a low-frequency baseband signal. The demodulator then transmits the demodulated low-frequency baseband signal to the baseband processor for processing. After the low-frequency baseband signal is processed by the baseband processor, it is passed to the application processor. The application processor displays an image or video through the display screen 170. In some embodiments, the modem processor may be an independent device. In other embodiments, the modem processor may be independent of the processor 110 and be set in the same device as the mobile communication module 140 or other functional modules.

[0151] The wireless communication module 150 can provide wireless communication solutions including wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) networks), bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), infrared (IR), etc., which are applied to the electronic device 100. The wireless communication module 150 can be one or more devices integrating at least one communication processing module. The wireless communication module 150 receives electromagnetic waves via the antenna 2, modulates the frequency of the electromagnetic wave signal and performs filtering, and sends the processed signal to the processor 110. The wireless communication module 150 can also receive the signal to be sent from the processor 110, modulate the frequency of the signal, amplify it, and convert it into electromagnetic waves for radiation through the antenna 2.

[0152] In some embodiments, the antenna 1 of the electronic device 100 is coupled to the mobile communication module 140, and the antenna 2 is coupled to the wireless communication module 150, so that the electronic device 100 can communicate with the network and other devices through wireless communication technology. The wireless communication technology may include global system for mobile communications (GSM), general packet radio service (GPRS), code division multiple access (CDMA), wideband code division multiple access (WCDMA), time-division code division multiple access (TD-CDMA), long term evolution (LTE), BT, GNSS, WLAN, NFC, FM, and / or IR technology. The GNSS may include a global positioning system (GPS), a global navigation satellite system (GLONASS), a Beidou navigation satellite system (BDS), a quasi-zenith satellite system (QZSS) and / or a satellite based augmentation system (SBAS).

[0153] The electronic device 100 implements the display function through a GPU, a display screen 170, and an application processor. The GPU is a microprocessor for image processing, which connects the display screen 170 and the application processor. The GPU is used to perform mathematical and geometric calculations for graphics rendering. The processor 110 may include one or more GPUs, which execute program instructions to generate or change display information.

[0154] The display screen 170 is used to display images, videos, etc. The display screen 170 includes a display panel. The display panel can be a liquid crystal display (LCD), an organic light-emitting diode (OLED), an active-matrix organic light emitting diode or an active-matrix organic light emitting diode (AMOLED), a flexible light-emitting diode (FLED), Miniled, MicroLed, Micro-oLed, a quantum dot light-emitting diode (QLED), etc. In some embodiments, the electronic device 100 may include 1 or N display screens 170, where N is a positive integer greater than 1.

[0155] The digital signal processor is used to process digital signals, and can process not only digital image signals but also other digital signals. For example, when the electronic device 100 is selecting a frequency point, the digital signal processor is used to perform Fourier transform on the frequency point energy.

[0156] Video codecs are used to compress or decompress digital videos. The electronic device 100 may support one or more video codecs. Thus, the electronic device 100 may play or record videos in a variety of coding formats, such as Moving Picture Experts Group (MPEG) 1, MPEG2, MPEG3, MPEG4, etc.

[0157] NPU is a neural network (NN) computing processor. By drawing on the structure of biological neural networks, such as the transmission mode between neurons in the human brain, it can quickly process input information and can also continuously self-learn. Through NPU, applications such as intelligent cognition of electronic device 100 can be realized, such as image recognition, face recognition, voice recognition, text understanding, etc.

[0158] The external memory interface 120 can be used to connect an external memory card, such as a Micro SD card, to expand the storage capacity of the electronic device 100. The external memory card communicates with the processor 110 through the external memory interface 120 to implement a data storage function, such as storing music, video and other files in the external memory card.

[0159] The internal memory 121 can be used to store computer executable program codes, which include instructions. The internal memory 121 may include a program storage area and a data storage area. Among them, the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc. The data storage area may store data created during the use of the electronic device 100 (such as audio data, a phone book, etc.), etc. In addition, the internal memory 121 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, a universal flash storage (UFS), etc. The processor 110 executes various functional applications and data processing of the electronic device 100 by running instructions stored in the internal memory 121, and / or instructions stored in a memory provided in the processor.

[0160] The pressure sensor 160A is used to sense the pressure signal and can convert the pressure signal into an electrical signal. In some embodiments, the pressure sensor 160A can be set on the display screen 170. There are many types of pressure sensors 160A, such as resistive pressure sensors, inductive pressure sensors, capacitive pressure sensors, etc. The capacitive pressure sensor can be a parallel plate including at least two conductive materials. When a force acts on the pressure sensor 160A, the capacitance between the electrodes changes. The electronic device 100 determines the intensity of the pressure according to the change in capacitance. When a touch operation acts on the display screen 170, the electronic device 100 detects the touch operation intensity according to the pressure sensor 160A. The electronic device 100 can also calculate the touch position according to the detection signal of the pressure sensor 160A. In some embodiments, touch operations acting on the same touch position but with different touch operation intensities can correspond to different operation instructions. For example: when a touch operation with a touch operation intensity less than the first pressure threshold acts on the short message application icon, an instruction to view the short message is executed. When a touch operation with a touch operation intensity greater than or equal to the first pressure threshold acts on the short message application icon, an instruction to create a new short message is executed.

[0161] The touch sensor 160B is also called a "touch control device". The touch sensor 160B can be arranged on the display screen 170, and the touch sensor 160B and the display screen 170 form a touch screen, also called a "touch control screen". The touch sensor 160B is used to detect touch operations acting on or near it. The touch sensor can pass the detected touch operation to the application processor to determine the type of touch event. Visual output related to the touch operation can be provided through the display screen 170. In other embodiments, the touch sensor 160B can also be arranged on the surface of the electronic device 100, which is different from the position of the display screen 170.

[0162] The software system of the electronic device 100 may adopt a layered architecture, an event-driven architecture, a micro-core architecture, a micro-service architecture, or a cloud architecture. For example, the software system of the electronic device 100 may adopt an Android operating system (OS), a Harmony OS, or an IOS with a layered architecture. The embodiment of the present application takes the Android system with a layered architecture as an example to exemplify the software structure of the electronic device 100.

[0163] Figure 2 It is a software structure block diagram of the electronic device 100 according to an embodiment of the present application.

[0164] The layered architecture divides the software into several layers, each with clear roles and division of labor. The layers communicate with each other through software interfaces. In some embodiments, the Android system is divided into four layers, from top to bottom: the application layer, the application framework layer, the Android runtime and system library, and the kernel layer.

[0165] The application layer can include a series of application packages.

[0166] like Figure 2 As shown, the application package may include camera, gallery, calendar, call, map, navigation, WLAN, Bluetooth, music, video, short message and other applications.

[0167] The application framework layer provides an application programming interface (API) and a programming framework for the applications in the application layer. The application framework layer includes some predefined functions.

[0168] like Figure 2 As shown, the application framework layer may include a window manager, a content provider, a view system, a phone manager, a resource manager, a notification manager, and the like.

[0169] The window manager is used to manage window programs. The window manager can obtain the display screen size, determine whether there is a status bar, lock the screen, capture the screen, etc.

[0170] Content providers are used to store and retrieve data and make it accessible to applications. The data may include videos, images, audio, calls made and received, browsing history and bookmarks, phone books, etc.

[0171] The view system includes visual controls, such as controls for displaying text, controls for displaying images, etc. The view system can be used to build applications. A display interface can be composed of one or more views. For example, a display interface including a text notification icon can include a view for displaying text and a view for displaying images.

[0172] The phone manager is used to provide communication functions of the electronic device 100, such as management of call status (including connecting, hanging up, etc.).

[0173] The resource manager provides various resources for applications, such as localized strings, icons, images, layout files, video files, and so on.

[0174] The notification manager enables applications to display notification information in the status bar. It can be used to convey notification-type messages and can disappear automatically after a short stay without user interaction. For example, the notification manager is used to notify download completion, message reminders, etc. The notification manager can also be a notification that appears in the system top status bar in the form of a chart or scroll bar text, such as notifications of applications running in the background, or a notification that appears on the screen in the form of a dialog window. For example, a text message is displayed in the status bar, a prompt sound is emitted, an electronic device vibrates, an indicator light flashes, etc.

[0175] Android Runtime includes core libraries and virtual machines. Android runtime is responsible for scheduling and management of the Android system.

[0176] The core library consists of two parts: one is the function that needs to be called by the Java language, and the other is the Android core library.

[0177] The application layer and the application framework layer run in a virtual machine. The virtual machine executes the Java files of the application layer and the application framework layer as binary files. The virtual machine is used to perform functions such as object life cycle management, stack management, thread management, security and exception management, and garbage collection.

[0178] The system library may include multiple functional modules, such as surface manager, media library, 3D graphics processing library (such as OpenGL ES), 2D graphics engine (such as SGL), etc.

[0179] The surface manager is used to manage the display subsystem and provide the fusion of 2D and 3D layers for multiple applications.

[0180] The media library supports playback and recording of a variety of commonly used audio and video formats, as well as static image files, etc. The media library can support a variety of audio and video encoding formats, such as: MPEG4, H.264, MP3, AAC, AMR, JPG, PNG, etc.

[0181] The 3D graphics processing library is used to implement 3D graphics drawing, image rendering, compositing, and layer processing.

[0182] A 2D graphics engine is a drawing engine for 2D drawings.

[0183] The kernel layer is the layer between hardware and software. The kernel layer contains at least display driver, camera driver, audio driver, and sensor driver.

[0184] The file sharing method provided by the embodiment of the present application will be described in detail below with reference to the accompanying drawings and specific application scenarios. illustrate.

[0185] See also Figure 3 , Figure 3 A schematic diagram showing a file sharing system to which the file sharing method provided in the embodiment of the present application is applicable Figure 1 .

[0186] like Figure 3 As shown, the system may include a first electronic device 310, at least one second electronic device 320 ( Figure 3 Only one is shown in the figure) and the first server 330. Among them, the first electronic device 310 and the second electronic device 320 can be respectively connected to the first server 330 for communication. The first electronic device 310 can be an electronic device corresponding to the first user, for example, an electronic device belonging to the first user, and the first user can be a user who shares files. Each second electronic device 320 can be an electronic device corresponding to a second user, for example, an electronic device belonging to a second user, and the second user is a user who can obtain files shared by the first user.

[0187] It should be noted that the user described in the embodiments of the present application can be represented by an account, for example, an email account, an account in an instant messaging application, a mobile phone number or a work number. It should be understood that there is no strict distinction between the first user and the second user. In other words, for the same user, in some scenarios, it can be the first user, sharing files with other users; and in other scenarios, it can also be the second user, obtaining files shared by other users.

[0188] For example, in some scenarios, user A may be a user who shares a file with user B and user C, and user B and user C may be users who obtain the file shared by user A, that is, user A may be the first user, and user B and user C may be the second user. In other scenarios, user B may be a user who shares a file with user A and user C, and user A and user C may be users who obtain the file shared by user B, that is, user B may be the first user, and user A and user C may be the second user. In other scenarios, user C may be a user who shares a file with user A and user B, and user A and user B may be users who obtain the file shared by user C, that is, user C may be the first user, and user A and user B may be the second user.

[0189] Exemplarily, the first user and the second user may belong to the same target group, so that the first user can share files with multiple second users through the target group, thereby improving sharing efficiency. That is, when the first user needs to share a file with the second user, the first user can share the file to the target group. The second user can obtain the file shared by the first user through the target group.

[0190] It is understandable that the target group can be a group in any instant messaging application, and the present embodiment of the application does not specifically limit this. That is, the instant messaging application can be installed in the first electronic device 310 and the second electronic device 320, and the first user can log in to the instant messaging application in the first electronic device 310 to share files with the second user through the target group in the instant messaging application. The second user can log in to the instant messaging application in the second electronic device 320 to obtain the files shared by the first user through the target group in the instant messaging application.

[0191] It should be noted that the first user can be any user in the target group, and the second user can be a user in the target group other than the first user. In other words, each user in the target group can be a first user, sharing files with other users through the target group, or a second user, obtaining files shared by other users through the target group. That is, when a user in the target group (for example, user A) shares files with other users through the target group, user A can be the first user, and other users who obtain files shared by user A can be second users.

[0192] Optionally, the target group may be a group created by any user, and this embodiment of the present application does not impose any specific limitation on this.

[0193] The following will take the creation of a target group by a first user as an example to exemplarily illustrate the process of creating a target group. In this exemplary description, the target group is taken as a group in instant messaging application A as an example.

[0194] See also Figure 4 , Figure 4The application scenario provided by the embodiment of the present application is shown Figure 1 .

[0195] The first electronic device 310 may be installed with an instant messaging application A. When the first user wants to create a target group, for example, when the first user needs to share a file with multiple users at the same time, the first user may open and log in to the instant messaging application A in the first electronic device 310. After the first user logs in to the instant messaging application A, the first electronic device 310 may display the home page of the instant messaging application A in the display interface. It should be understood that the home page may include a group creation button. The first user may click the group creation button to create a target group.

[0196] like Figure 4 As shown, after the first electronic device 310 detects a click operation on the group creation button, a group creation interface 400 may be displayed in the display interface. The group creation interface 400 may include a group name input box 401 and an administrator (i.e., a user who manages the target group) input box 402, so that the name of the target group can be set through the group name input box 401, and the administrator of the target group can be set through the administrator input box 402.

[0197] like Figure 4 As shown, the group creation interface 400 may include a user input box 403. The first user may set the users in the target group through the user input box 403, that is, select one or more users to add to the target group, so that the target group may include the first user and one or more second users.

[0198] like Figure 4 As shown, the group creation interface 400 may further include an attribute input box 404. The first user may set the attribute information of the target group through the attribute input box 404.

[0199] Optionally, the group creation interface 400 may further include a search box 405 , and the first user may search for users through the search box 405 to add to the target group.

[0200] In a possible implementation, the attribute information may include real-time permission information. The real-time permission information is used to characterize the access rights (hereinafter referred to as access rights A) that each user in the target group has to the real-time files shared by other users to the target group. That is, access rights A refers to the real-time access rights that each user in the target group has to the real-time files shared by other users.

[0201] It is understandable that, for a user in the target group, the real-time files in the target group may refer to files shared to the target group by other users after the user joins the target group. For different users, the real-time files in the target group may be the same or different.

[0202] That is, the real-time permission information can be used to represent the access rights that a user who joins the target group has to files shared to the target group by other users after the user joins the target group.

[0203] For example, when the first user creates a target group, the first user can add user A and user B to the target group, that is, the users in the target group can include user A and user B.

[0204] Assume that at time T0 after the target group is created, the first user shares files A and B with the target group. At time T1, user C joins the target group. At time T2, the first user shares files C and D with the target group. Among them, time T0 is earlier than time T1, and time T1 is earlier than time T2.

[0205] Therefore, for user A and user B, the real-time files in the target group may include file A, file B, file C, and file D. For user C, the real-time files in the target group may include file C and file D.

[0206] Optionally, the access permission A may include one or more of full control permission, read-only permission, read-write permission, copy permission, print permission, save as permission, and download permission. For example, the access permission A may be read-only permission. For example, the access permission A may be read-write permission. For example, the access permission A may include read-only permission and download permission. For example, the access permission A may include read-write permission, copy permission, and download permission, etc.

[0207] In some examples, the real-time files in the target group may be local files; or, the real-time files in the target group may also be cloud files stored in a server.

[0208] In some examples, the real-time files in the target group may be encrypted files. For example, based on different configured permissions, different users may perform corresponding operations on the real-time files in the target group.

[0209] In some examples, the method can be applied to scenarios such as enterprise or campus LAN, for example, enterprise employees access encrypted files sent by other employees in the LAN. In daily office scenarios, when the same system or different systems of different devices support each other, the method can also be used to open encrypted files. For example, computer A encrypts file B and sends file B to computer C or mobile phone D through a target group, wherein the users associated with computer A, the users associated with computer C, and the users associated with mobile phone D can all be users of the target group, and computer C or mobile phone D can open file B based on this method. The system of computer A and the system of computer C can be the same or different. The system of mobile phone D can be connected to the system of computer A or computer C, for example, using or adding the same or similar underlying architecture to support the implementation of this method.

[0210] In some examples, when the access permission A is full control permission, it means that the users in the target group can fully control the real-time files in the target group. For example, the users in the target group can view, modify, copy, print, save as, or download the real-time files in the target group.

[0211] When the access permission A includes read-only permission, it means that the users in the target group can only perform read operations on the real-time files in the target group. In other words, the users in the target group can only view the real-time files in the target group, but cannot modify the real-time files in the target group.

[0212] When the access permission A includes read and write permissions, it means that the users in the target group can perform read and write operations on the real-time files in the target group. In other words, the users in the target group can not only view the real-time files in the target group, but also modify the real-time files in the target group.

[0213] When the access permission A includes the copy permission, it means that users in the target group can copy the real-time files in the target group.

[0214] When the access permission A includes the printing permission, it means that the users in the target group can print the real-time files in the target group.

[0215] When the access permission A includes the Save As permission, it means that users in the target group can save the real-time files in the target group.

[0216] When the access permission A includes the download permission, it means that users in the target group can download real-time files in the target group.

[0217] It is understandable that, for any file in the target group, the access permission that the user who shares the file has to the file can be directly defaulted to full control permission.

[0218] Exemplarily, when the target group includes multiple users, each user may have the same access authority A or may have different access authorities A.

[0219] Optionally, the user who creates the target group (hereinafter referred to as the group owner) can set unified real-time permission information in the attribute information of the target group when creating the target group, or the group owner or administrator can set unified real-time permission information in the attribute information of the target group after the target group is created. In this case, the access permission A of each user to the real-time files in the target group can be determined according to the real-time permission information, so that each user in the target group can have the same access permission A to the real-time files in the target group.

[0220] For example, when the first user creates a target group, or after the first user creates a target group, the first user can set unified real-time permission information in the attribute information, for example, the real-time permission information can be set to read and write. Therefore, the access rights A that each user in the target group has for the real-time files in the target group can be read and write permissions.

[0221] Optionally, when adding each user to the target group, the group owner or administrator may respectively set the real-time permission information corresponding to each user, so that each user in the target group may have different access rights A to the real-time files in the target group.

[0222] For example, when user A joins the target group, the group owner can set the real-time permission information corresponding to user A to read and write; when user B joins the target group, the group owner can set the real-time permission information corresponding to user B to read-only; when user C joins the target group, the group owner can set the real-time permission information corresponding to user C to read and write, and so on.

[0223] Therefore, the access permission A that user A and user C have for the real-time files in the target group can be read-write permission, that is, user A and user C can view the real-time files in the target group and can also modify the real-time files in the target group. The access permission A that user B has for the real-time files in the target group can be read-only permission, that is, user B can only view the real-time files in the target group but cannot modify the real-time files in the target group.

[0224] In another possible implementation, the attribute information may also include historical permission information. The historical permission information is used to characterize the access rights that users in the target group have to historical files in the target group (hereinafter referred to as access rights B). It is understandable that, for a certain user, the historical files in the target group refer to the files that other users have shared with the target group before the user joins the target group. Among them, for different users, the historical files in the target group may be the same or different. In other words, the historical permission information can be used to characterize the historical access rights that users who have just joined the target group have to the files already existing in the target group when they join the target group.

[0225] For example, before user A joins the target group, the files shared to the target group by other users include file A and file B, and before user B joins the target group, the files shared to the target group by other users also include file A and file B. Then, for user A and user B, the historical files in the target group may include file A and file B.

[0226] For example, before user A joins the target group, the files shared to the target group by other users include file A and file B, and before user B joins the target group, the files shared to the target group by other users include file A, file B, and file C. Then, for user A, the historical files in the target group may include file A and file B, and for user B, the historical files in the target group may include file A, file B, and file C.

[0227] Optionally, access permission B may include one or more of full control permission, read-only permission, read-write permission, copy permission, print permission, save as permission, and download permission, or access permission B may be empty or none. For example, access permission B may be read-only permission. For example, access permission B may be read-write permission. For example, access permission B may include read-only permission and download permission. For example, access permission B may include read-write permission, copy permission, and download permission. For example, access permission B may be empty or none.

[0228] In some examples, when access permission B includes read-only permission, it means that users in the target group can only read historical files in the target group. In other words, for files that other users have shared with the target group before a user joins the target group, the user can only view them but cannot modify them.

[0229] When access permission B includes read and write permissions, it means that users in the target group can read and write historical files in the target group. In other words, before a user joins the target group, the user can view and modify the files that other users have shared with the target group.

[0230] When access permission B is empty or None, it means that users in the target group do not have any access permissions to the historical files in the target group. In other words, before a user joins the target group, the user has no permission to view, modify, or download the files that other users have shared with the target group.

[0231] For example, after the first user creates a target group, the first user can share file A and file B with the target group at time T0. Assume that at time T1, user A joins the target group. At time T2, the first user shares file C and file D with the target group. At time T3, user B joins the target group. Among them, time T0 is earlier than time T1, time T1 is earlier than time T2, and time T2 is earlier than time T3. Therefore, for user A, the historical files in the target group may include file A and file B, and for user B, the historical files in the target group may include file A, file B, file C, and file D.

[0232] When the access permission B is determined to be read-only according to the historical permission information in the attribute information, it means that users in the target group can view the historical files in the target group. That is, user A can view file A and file B, and user B can view any file among file A, file B, file C and file D.

[0233] When the access permission B is determined to be read-write permission according to the historical permission information in the attribute information, it means that users in the target group can view the historical files in the target group and can also modify the historical files in the target group. That is, user A can view files A and B, and can also modify files A and B, and user B can view any file among files A, B, C and D, and can also modify any file among files A, B, C and D.

[0234] When it is determined according to the historical permission information in the attribute information that the access permission B includes the download permission, it means that users in the target group can download historical files in the target group. That is, user A can download file A and file B, and user B can download any file among file A, file B, file C and file D.

[0235] When the access permission B is determined to be empty or non-existent according to the historical permission information in the attribute information, it means that the users in the target group do not have any permission to the historical files in the target group. That is, user A does not have any access permission to file A and file B, and user B does not have any access permission to any of file A, file B, file C, and file D.

[0236] In one example, the access permission B can be directly determined based on the historical permission information in the attribute information. That is, the historical permission information can directly represent one or more of the full control permission, read-only permission, read-write permission, copy permission, print permission, save as permission, and download permission, or the historical permission information can directly represent null or none.

[0237] For example, when the first user creates a target group, the real-time permission information can be set to information representing read-write permission, and the historical permission information can be set to information representing read-only permission. For example, the real-time permission information can be directly set to read-write, and the historical permission information can be set to read-only. For example, when 00 represents read-only permission, 01 represents read-write permission, and 02 represents download permission, the real-time permission information can be set to 01, the historical permission information can be set to 00, and so on.

[0238] In another example, the access permission B can be determined based on the historical permission information in the attribute information and the access permission A. Exemplarily, the historical permission information can be set to allow access or not allow access, or the historical permission information can be set to yes or no. When the historical permission information is set to not allow access or no, it means that the access permission B is empty or none, that is, the users in the target group do not have any access permissions to the historical files in the target group.

[0239] When the historical permission information is set to allow access or is, it means that the access permission B can be the same as the access permission A, that is, users in the target group can access historical files in the target group according to the access permission A.

[0240] For example, when the access permission A is a read-only permission, the access permission B may also be a read-only permission, that is, users in the target group can view historical files in the target group.

[0241] When the access permission A is read-write permission, the access permission B can also be read-write permission, that is, users in the target group can view the historical files in the target group and can also modify the historical files in the target group.

[0242] When the access permission A includes the copy permission, the access permission B may also include the copy permission, that is, users in the target group may copy the historical files in the target group.

[0243] Exemplarily, each user in the target group may have the same access permission B or different access permissions B for the historical files in the target group.

[0244] Optionally, when creating a target group, the group owner can set unified historical permission information in the attribute information of the target group, or after the target group is created, the group owner or administrator can set unified historical permission information in the attribute information of the target group. In this case, the access permission B that each user of the target group has to the historical files in the target group can be determined according to the historical permission information, so that each user in the target group can have the same access permission B to the historical files in the target group.

[0245] For example, when the first user creates a target group, or after the first user creates a target group, the first user can set unified historical permission information in the attribute information. For example, the historical permission information can be set to read-only. Therefore, the access permission B that each user in the target group has for the historical files in the target group can be read-only permission.

[0246] For example, when the first user creates a target group, or after the first user creates a target group, the first user can set unified real-time permission information and unified historical permission information in the attribute information. For example, the real-time permission information can be set to read and write, and the historical permission information can be set to allow access or yes. Therefore, the access rights B that each user in the target group has for the historical files in the target group can be read and write permissions.

[0247] Optionally, when each user joins the target group, the group owner or administrator may respectively set the historical permission information corresponding to each user, so that each user in the target group may have different access rights B to the historical files in the target group.

[0248] For example, after the target group is created, when user A joins the target group, the group owner can set the historical permission information corresponding to user A to read and write, when user B joins the target group, the group owner can set the historical permission information corresponding to user B to read-only, when user C joins the target group, the group owner can set the historical permission information corresponding to user C to read-only, etc. Therefore, the access permission B that user A has for the historical files in the target group can be read-write permission, and the access permission B that users B and C have for the historical files in the target group can be read-only permission.

[0249] For example, when creating a target group, the group owner can set unified real-time permission information in the attribute information, such as setting the real-time permission information to read and write. After the target group is created, when user A joins the target group, the group owner can set the historical permission information corresponding to user A to allow, when user B joins the target group, the group owner can set the historical permission information corresponding to user B to allow, when user C joins the target group, the group owner can set the historical permission information corresponding to user C to not allow, and so on. Therefore, the access permission B that user A and user B have to the historical files in the target group can be read and write permissions, and user C does not have any access permissions to the historical files in the target group.

[0250] The following is the access right B determined based on the historical access right information in the attribute information and the access right A, and the historical access right Taking the information of allowing access or not allowing access as an example, the process of modifying the attribute information of the target group is described exemplarily. bright.

[0251] It should be understood that in order to meet the different sharing needs of users, designated users in the target group (such as group owners or administrators, etc.) can modify the attribute information of the target group, that is, designated users can modify the real-time permission information in the attribute information, and / or can modify the historical permission information in the attribute information.

[0252] For example, when the first user creates a target group, the first user can set the real-time permission information in the attribute information to read and write, and can set the historical permission information in the attribute information to allow access, that is, both the access permission A and the access permission B can be read and write permissions. Subsequently, when the first user wants to modify the access permission A of other users in the target group to files in the target group, or wants to modify the access permission B of users newly added to the target group to historical files, the first user can modify the attribute information of the target group, for example, the real-time permission information in the attribute information can be modified to read-only, and / or the historical permission information in the attribute information can be modified to not allow access.

[0253] The above-mentioned designated user is the group owner or administrator of the target group for exemplary explanation only and should not be understood as a limitation on the embodiments of the present application. In the embodiments of the present application, the designated user can be specifically determined according to the actual scenario, and the embodiments of the present application do not impose any limitation on this. For example, all users in the target group can be determined as designated users.

[0254] In one example, modifying the real-time permission information in the attribute information can be effective for all files in the target group. That is, after modifying the real-time permission information, the access rights A that users in the target group have for any real-time file in the target group can be determined according to the modified real-time permission information. In other words, the access rights A that users in the target group have for real-time files that have been shared with the target group before modifying the real-time permission information and the access rights A that real-time files that have been shared with the target group after modifying the real-time permission information can all be determined according to the modified real-time permission information.

[0255] For example, when the first user creates a target group, the first user can set the real-time permission information in the attribute information to read and write, and can modify the real-time permission information in the attribute information to read-only at time T0. Assume that before time T0, the files that the first user has shared to the target group include file A, file B, and file C. After time T0, the files that the first user has shared to the target group include file D and file F.

[0256] Therefore, before time T0, the second user in the target group can view any file among file A, file B, and file C, and can also modify any file among file A, file B, and file C. However, after time T0, the second user in the target group can view any file among file A, file B, file C, file D, and file F, but cannot modify any file among file A, file B, file C, file D, and file F.

[0257] In another example, modifying the real-time permission information in the attribute information may be effective only for the files shared to the target group after the real-time permission information is modified. That is, the access rights A of the users in the target group to the real-time files that have been shared to the target group before the real-time permission information is modified can be determined based on the real-time permission information before the modification; and the access rights A of the real-time files shared to the target group after the real-time permission information is modified can be determined based on the real-time permission information after the modification.

[0258] For example, when the first user creates a target group, the first user can set the real-time permission information in the attribute information to read and write, and can modify the real-time permission information in the attribute information to read-only at time T0. Assume that before time T0, the files that the first user has shared to the target group include file A, file B, and file C. After time T0, the files that the first user has shared to the target group include file D and file F.

[0259] Therefore, after time T0, the second user in the target group can view any file among file A, file B and file C, and can also modify any file among file A, file B and file C. However, for file D and file F, the second user in the target group can only view but not modify.

[0260] In one example, modifying the historical permission information in the attribute information can be effective for all users. That is, before modifying the historical permission information in the attribute information, the access permission B that users who have joined the target group have for historical files, and after modifying the historical permission information, the access permission B that users who have newly joined the target group have for historical files can all be determined according to the modified historical permission information.

[0261] For example, when the first user creates a target group, the first user can set the real-time permission information in the attribute information to read-only, and can set the historical permission information to allow access. Assume that at time T0, the first user can share files A, B, and C to the target group.

[0262] At time T1, user A joins the target group. That is, for user A, the historical files in the target group (hereinafter referred to as historical files A) may include files A, B and C.

[0263] At time T2, the first user can share file D and file E to the target group. At time T3, the first user can modify the historical permission information in the attribute information to not allow access.

[0264] At time T4, user B joins the target group. That is, for user B, the historical files in the target group (hereinafter referred to as historical files B) may include file A, file B, file C, file D and file E.

[0265] Therefore, before time T3, the access permission B that user A has to historical file A is read-only permission, that is, user A can view any file among file A, file B, and file C. After time T3, user A does not have any access permission to historical file A, that is, user A does not have the right to access any file among file A, file B, and file C. For user B, since user B joins the target group after modifying the historical permission information, user B does not have any access permission to historical file B, that is, user B does not have the right to access any file among file A, file B, file C, file D, and file E.

[0266] In one example, modifying the historical permission information in the attribute information may be effective only for users who newly join the target group after the historical permission information is modified. That is, before modifying the historical permission information, the access rights B that users who have joined the target group have for historical files in the target group can be determined based on the historical permission information before the modification; after modifying the historical permission information, the access rights B that users who newly join the target group have for historical files in the target group can be determined based on the historical permission information after the modification.

[0267] For example, when creating a target group, the first user can set the real-time permission information in the attribute information to read and write, and can set the historical permission information to allow access. At time T0, the files shared by the first user to the target group include file A, file B, and file C. At time T1, user A joins the target group. At time T2, the first user can modify the historical permission information to not allow access. Among them, time T0 is earlier than time T1, and time T1 is earlier than time T2. For user A, the historical files in the target group may include file A, file B, and file C.

[0268] Assume that at time T3, the first user continues to share files D, E, and F to the target group. At time T4, user B joins the target group. Among them, time T4 is later than time T3, and time T3 is later than time T2. For user B, the historical files in the target group may include file A, file B, file C, file D, file E, and file F.

[0269] Since user A joins the target group before the first user modifies the historical permission information, that is, the access permission B that user A has to the historical files in the target group can be determined based on the historical permission information before the modification, therefore, the access permission B that user A has to the historical files in the target group is read-write permission. In other words, user A can not only view any file among file A, file B and file C, but also modify any file among file A, file B and file C.

[0270] Since user B joins the target group after the first user modifies the historical access information, that is, the access permission B that user B has to the historical files in the target group can be determined according to the modified historical permission information, therefore, user B does not have any access permission to the historical files in the target group. In other words, user B has no right to access any of file A, file B, file C, file D, file E, and file F.

[0271] Next, the process of saving the relevant information of the target group to the first server 330 after the target group is created is described. Detailed description.

[0272] It is understandable that when the first user shares a file with the second user through the target group, it is generally necessary to save the file shared by the first user through a server (such as the first server 330), and send the shared file to the second electronic device 320 corresponding to the second user through the first service 330. Therefore, after the first user creates a target group, the first electronic device 310 can send relevant information of the target group to the first server 330.

[0273] In some examples, the target group related information may include target group identification information, information of users included in the target group, and target group attribute information. The target group identification information may include identification information such as the name or number of the application to which the target group belongs, or may include identification information such as the name or number of the target group.

[0274] After receiving the relevant information of the target group, the first server 330 can determine the authorization policy corresponding to the target group based on the relevant information of the target group, such as the information of the users included in the target group and the attribute information of the target group, so as to manage the files in the target group according to the authorization policy corresponding to the target group, ensure the security of file sharing, and improve the user experience.

[0275] Optionally, the authorization policy may include a member list corresponding to the target group, and the access rights that each user in the member list has to files in the target group, for example, access rights A that each user has to real-time files in the target group, and / or access rights B to historical files in the target group.

[0276] For example, after the first user creates a target group in the first electronic device 310, the first electronic device 310 may send relevant information of the target group to the first server 330. Assume that the first user sets the real-time permission information in the attribute information to read-only and sets the historical permission information in the attribute information to allow access.

[0277] After the first server 330 obtains the relevant information of the target group, it can determine the authorization policy corresponding to the target group according to the relevant information of the target group, that is, it can be determined that the access rights A of each user in the target group to the real-time files in the target group and the access rights B of each user in the target group to the historical files in the target group are both read-only rights. In other words, each user in the target group can only view each file in the target group.

[0278] It should be understood that after a user (eg, the first user) in the target group modifies the attribute information of the target group, the first electronic device 310 may send the modified attribute information to the first server 330. The first server 330 may update the authorization policy corresponding to the target group according to the modified attribute information.

[0279] Exemplarily, when the first user shares a certain file (e.g., file A) to the target group, the first electronic device 310 may send file A (or the encrypted file corresponding to file A) and identification information of the target group to the first server 330. After receiving file A (or the encrypted file corresponding to file A) and identification information of the target group, the first server 330 may determine the target group to which file A (or the encrypted file corresponding to file A) belongs based on the identification information of the target group, and may associate file A (or the encrypted file corresponding to file A) with the target group for storage. The first server 330 may automatically authorize access rights to file A to each user in the target group based on the authorization policy corresponding to the target group, thereby simplifying the authorization process and improving the user experience.

[0280] In one example, when a new user (e.g., user A) joins the target group, any of the electronic devices corresponding to user A, the electronic devices corresponding to the group owner, and the electronic devices corresponding to the administrator can send notification information (hereinafter referred to as notification information A) to the first server 330 that user A has joined the target group. After receiving the notification information A, the first server 330 can update the authorization policy corresponding to the target group. For example, the member list corresponding to the target group can be updated to add user A to the member list corresponding to the target group, and the access rights A and / or access rights B corresponding to user A can be granted according to the attribute information of the target group, so that user A can access the real-time files in the target group, and / or can access the historical files in the target group. In other words, after user A joins the target group, the first server 330 can automatically authorize user A according to the attribute information of the target group, without the need for the group owner or administrator to authorize the user, thereby simplifying the authorization process and improving the user experience.

[0281] In another example, when a user (e.g., user B) in the target group exits the target group, user B will lose access rights A to real-time files in the target group, and / or lose access rights B to historical files in the target group. That is, when user B exits the target group, any electronic device corresponding to user B, the electronic device corresponding to the group owner, and the electronic device corresponding to the administrator may send notification information (hereinafter referred to as notification information B) of user B exiting the target group to the first server 330.

[0282] After receiving the notification information B, the first server 330 may update the authorization policy corresponding to the target group. For example, the member list corresponding to the current group may be updated to delete user B from the member list corresponding to the target group, and delete the access rights A and / or access rights B corresponding to user B, so that user B no longer has any access rights to the real-time files and / or historical files in the target group.

[0283] In another example, when the first user withdraws a file (e.g., file A) that has been shared to the target group, the first electronic device 310 may send a notification message (hereinafter referred to as notification message C) to the first server 330 to withdraw file A. After receiving notification message C, the first server 330 may update the authorization policy corresponding to the target group. For example, the access rights A and / or access rights B of each user in the target group to file A may be deleted. That is, after the first user withdraws file A, any second user in the target group will not be able to access file A.

[0284] Optionally, after receiving the notification information C, the first server 330 may also delete the file A stored in the first server 330 , so that each user in the target group can no longer access the file A.

[0285] In another example, when the target group is dissolved, each user in the target group will lose access rights A to real-time files in the target group, and / or lose access rights B to historical files in the target group. In other words, any user in the target group will no longer have any access rights to any file in the target group. That is, after the target group is dissolved, each user in the target group will not be able to open files that have been shared to the target group.

[0286] Exemplarily, when the target group is dissolved, the electronic device corresponding to the user who dissolved the target group (e.g., the electronic device corresponding to the group owner or the electronic device corresponding to the administrator, etc.) may send a notification message (hereinafter referred to as notification message D) of the dissolution of the target group to the first server 330. After receiving the notification message D, the first server 330 may update the authorization policy corresponding to the target group. For example, the member list corresponding to the target group may be updated to delete all users from the member list corresponding to the target group, and delete the access rights A and / or access rights B corresponding to each user, so that each user in the target group no longer has any access rights to any real-time file and / or any historical file in the target group.

[0287] Optionally, after receiving the notification information D, the first server 330 may also delete all files associated with the target group in the first server 330 .

[0288] That is to say, in the embodiment of the present application, the permission time of the file shared by the target group is bound to the life cycle of the target group. That is, when a certain user belongs to a user in the target group, the access right A that the user can enjoy to the real-time file in the target group, and / or the access right B that the user can enjoy to the historical file in the target group can be automatically determined according to the attribute information of the target group. When the user exits the target group, the access right A enjoyed by the user to the real-time file in the target group can be automatically deleted, and / or the access right B enjoyed by the user to the historical file in the target group can be automatically deleted, so as to realize the file sharing channel and the file life cycle binding, so that when the first user shares a file with the second user, no manual authorization is required, which can not only simplify the authorization process, but also facilitate the first user to manage and control the shared files, and improve the user experience.

[0289] See also Figure 5 , Figure 5 The application scenario provided by the embodiment of the present application is shown Figure 2 This application scenario is illustrated by taking the example of the first user creating a target group.

[0290] like Figure 5 As shown, the first user can create a target group in the first electronic device 310, for example, can add user A, user B and user C to the target group, and can set the real-time permission information in the attribute information of the target group to read and write, and set the historical permission information to allow.

[0291] After creating the target group, the first user can share file A with the target group. After the first electronic device 310 detects that the first user has shared file A, it can send file A (or the encrypted file corresponding to file A) and identification information of the target group to the first server 330. The first server 330 can determine the target group to which file A (or the encrypted file corresponding to file A) belongs based on the identification information of the target group, and associate file A (or the encrypted file corresponding to file A) with the target group for storage. At the same time, the first server 330 can automatically authorize user A, user B, and user C to read and write permissions to file A based on the authorization policy corresponding to the target group, that is, user A, user B, and user C can all view file A and can also modify file A.

[0292] When any user among user A, user B and user C forwards file A to a user in a non-target group (for example, user D) after obtaining file A, since user D is not a user in the target group, user D does not have any access rights to file A, that is, user D will not be able to open file A.

[0293] When the first user withdraws the file A shared to the target group, the first electronic device 310 may send a notification message C of withdrawing the file A to the first server 330. After receiving the notification message C, the first server 330 may update the authorization policy corresponding to the target group. For example, the read and write permissions of the users A, B, and C in the target group to the file A may be deleted. That is, after the first user withdraws the file A, the users A, B, and C will not be able to view the file A or modify the file A.

[0294] Alternatively, when the first user disbands the target group, the first electronic device 310 may send a notification message D of disbanding the target group to the first server 330. After receiving the notification message D, the first server 330 may update the authorization policy corresponding to the target group. For example, the member list corresponding to the target group may be updated to delete user A, user B, and user C from the member list corresponding to the target group, and delete the read and write permissions of user A, user B, and user C to file A. That is, after the first user disbands the target group, user A, user B, and user C will not be able to view file A or modify file A.

[0295] The following is a detailed description of the process of encrypting files shared through the target group.

[0296] In one example, to ensure the security of file sharing, after a user (e.g., the first user) in the target group shares a file (e.g., file A) to the target group, the first electronic device 310 can automatically encrypt file A using a first key to obtain an encrypted file (hereinafter referred to as the first encrypted file) to achieve encrypted sharing of the file to be shared.

[0297] In another example, the process of automatically encrypting file A can also be performed by the first server 330. That is, after the first user shares file A to the target group, the first electronic device 310 can send file A to the first server 330. After the first server 330 obtains file A, it can automatically encrypt file A using the first key to obtain a first encrypted file.

[0298] That is to say, when any user in the target group shares a file through the target group, the first electronic device 310 or the first server 330 can automatically encrypt the file through the first key to achieve encrypted sharing of the file without the need for the user to manually encrypt the file, so that the user does not need to be aware of the cumbersome file encryption process at all, which greatly simplifies the file encryption sharing process and can effectively improve the user experience.

[0299] It should be noted that the embodiment of the present application does not impose any restrictions on the specific content of the first key, which can be determined according to the actual scenario. For example, the first key can be determined as a symmetric key according to the actual scenario, that is, the first electronic device 310 or the first server 330 can use the symmetric key to encrypt the shared file to obtain the first encrypted file.

[0300] It should be understood that files shared through the target group are not necessarily files that need to be encrypted for sharing. When files that do not need to be encrypted for sharing are encrypted, the efficiency of users obtaining files will be reduced, which will reduce the user experience.

[0301] Exemplarily, the first electronic device 310 can determine whether file A needs to be encrypted based on the selection operation of the first user, so that the first electronic device 310 or the first server 330 can automatically encrypt only the files that need to be encrypted, and do not encrypt the files that do not need to be encrypted, thereby ensuring that other users can obtain files that do not need to be encrypted quickly and improving the user experience.

[0302] Optionally, after the first electronic device 310 obtains the file A shared by the first user through the target group, it can display a prompt message in the display interface, wherein the prompt message is used to prompt the first user whether the file A needs to be shared encrypted.

[0303] When it is determined that the first user needs to encrypt and share file A, the first electronic device 310 can automatically encrypt file A using the first key to obtain a first encrypted file. Alternatively, the first electronic device 310 can send instruction information (hereinafter referred to as instruction information A) to the first server 330, and the instruction information A is used to instruct the first server 330 to encrypt file A. After obtaining the instruction information A, the first server 330 can automatically encrypt file A using the first key to obtain the first encrypted file.

[0304] When it is determined that the first user does not need to perform encrypted sharing of file A, the first electronic device 310 may not encrypt file A. Alternatively, the first electronic device 310 may not send instruction information A to the first server 330, or may send instruction information (hereinafter referred to as instruction information B) not to perform encrypted sharing to the first server 330. When the first server 330 does not obtain instruction information A, or when the first server 330 obtains instruction information B, file A may not be encrypted.

[0305] For example, when a first user wants to share file A through a target group, the first user may send file A to the target group.

[0306] After detecting that the first user sends file A to the target group, the first electronic device 310 may display a pop-up window in the display interface. The pop-up window may display a prompt message of "whether to encrypt and share the file". At the same time, the pop-up window may also display a "yes" button and a "no" button.

[0307] When the first user confirms that the encrypted sharing of file A is required, the first user may click a “Yes” button in the display interface.

[0308] After the first electronic device 310 detects the click operation on the "Yes" button, it can automatically encrypt the file A using the first key to obtain the first encrypted file. Alternatively, the first electronic device 310 can send the unencrypted file A and the indication information A to the first server 330. After receiving the file A and the indication information A, the first server 330 can automatically encrypt the file A using the first key to obtain the first encrypted file.

[0309] When the first user determines that encrypted sharing of file A is not necessary, the first user may click a “No” button in the display interface.

[0310] When the first electronic device 310 detects a click operation on the "No" button, the file A may not be encrypted. At this time, the first electronic device 310 may directly send the unencrypted file A to the first server 330. Alternatively, the first electronic device 310 may send the unencrypted file A and the indication information B to the first server 330. After the first server 330 obtains the indication information B, the file A may not be encrypted.

[0311] The following example takes the case where the files shared through the target group need to be encrypted. The process of sharing files is described in detail.

[0312] See also Figure 6 , Figure 6 FIG. 1 is a schematic flow chart of a file sharing method provided by an embodiment of the present application. Figure 6 As shown, the method may include:

[0313] S601: When detecting that a first user sends a file to be shared through a target group, the first electronic device 310 obtains identification information of the file to be shared and the target group.

[0314] It should be understood that the first user can be any user in the target group. That is, after the target group is created, any user in the target group can share files with other users through the target group, that is, any user in the target group can share the file to be shared to the target group. At this time, the user in the target group who shares the file to be shared can be the first user, and the users in the target group other than the first user can be the second user.

[0315] In some examples, the identification information of the target group may include identification information such as a name or number of an application to which the target group belongs, or may include identification information such as a name or number of the target group itself.

[0316] S602: The first electronic device 310 encrypts the file to be shared using a first key to obtain a first encrypted file.

[0317] In one example, when the file to be shared is an unencrypted file, in order to ensure the security of file sharing, after the first user shares the file to be shared to the target group, that is, after the first electronic device 310 obtains the file to be shared, the first electronic device 310 can automatically encrypt the file to be shared using the first key to obtain an encrypted file (hereinafter referred to as the first encrypted file) to achieve encrypted sharing of the file to be shared.

[0318] In another example, the process of automatically encrypting the file to be shared can also be performed by the first server 330. That is, when the file to be shared is an unencrypted file, after the first user shares the file to be shared to the target group, the first electronic device 310 can send the file to be shared to the first server 330. After the first server 330 obtains the file to be shared, it can automatically encrypt the file to be shared using the first key to obtain a first encrypted file.

[0319] It should be noted that the embodiment of the present application does not impose any restrictions on the specific content of the first key, which can be determined according to the actual scenario. For example, the first key can be determined as a symmetric key according to the actual scenario, that is, the first electronic device 310 or the first server 330 can use the symmetric key to encrypt the shared file to obtain the first encrypted file.

[0320] S603: The first electronic device 310 sends the first encrypted file, the first key, and identification information of the target group to the first server 330.

[0321] It should be understood that after the first electronic device 310 encrypts the file to be shared by using the first key to obtain the first encrypted file, the first electronic device 310 can send the first encrypted file and the first key to the first server 330. At the same time, the first electronic device 310 can also send the identification information of the target group to the first server 330, so that the first server 330 can determine the target group according to the identification information of the target group, thereby determining the second user who can obtain the file to be shared.

[0322] Optionally, the first electronic device 310 may directly send the file to be shared and the identification information of the target group to the first server 330. That is, after the first electronic device 310 obtains the file to be shared, it may not encrypt the file to be shared, but directly send the file to be shared and the identification information of the target group to the first server 330. After the first server 330 obtains the file to be shared, it may automatically encrypt the file to be shared using the first key.

[0323] S604: The first server 330 determines an authorization policy corresponding to the target group according to the identification information of the target group.

[0324] In some examples, the authorization policy corresponding to the target group is determined by the first server 330 according to the information of the users included in the target group and the attribute information of the target group. The authorization policy may include a member list corresponding to the target group, and the access rights of each user in the member list to the files in the target group, for example, the access rights A of each user to the real-time files in the target group, and / or the access rights B to the historical files in the target group.

[0325] It should be understood that the first server 330 may store authorization policies corresponding to multiple groups. After obtaining the identification information of the target group, the first server 330 may determine the authorization policy corresponding to the target group according to the identification information of the target group, and determine the second user who has access rights to the file to be shared according to the authorization policy corresponding to the target group, so that the sharing of the file to be shared may be controlled according to the access rights of each second user, thereby ensuring the security of the file to be shared.

[0326] S605. The first server 330 encrypts the authorization policy and the first key to obtain an encrypted policy package, and adds the encrypted policy package to the first encrypted file to obtain a second encrypted file.

[0327] Optionally, in order to control the sharing of the file to be shared, after the first server 330 obtains the first encrypted file, it can encrypt the authorization policy and the first key by the second key to obtain an encrypted policy package, and can add the encrypted policy package to the first encrypted file to obtain a second encrypted file. Subsequently, the first server 330 can send the second encrypted file to the second electronic device 320, so that when the second user opens the second encrypted file, it needs to request the first server 330 to decrypt the encrypted policy package to obtain the first key to decrypt the first encrypted file to obtain the file to be shared. After the first server 330 obtains the request to decrypt the encrypted policy package, it can perform a permission check on the second user to determine whether the second user can access the file to be shared, thereby controlling the sharing of the file to be shared.

[0328] It should be noted that the embodiment of the present application does not impose any restrictions on the specific content of the second key, which can be determined specifically according to the actual scenario. For example, the second key can be determined as the organization public key according to the actual scenario. That is, the first server 330 can encrypt the first key and the authorization policy by the organization public key to obtain an encrypted policy package. When decryption is required, the first service 330 can decrypt the encrypted policy package by the organization private key corresponding to the organization public key.

[0329] Exemplarily, after obtaining the encryption policy package, the first server 330 may add the encryption policy package to the header of the first encrypted file, or add the encryption policy package to the tail of the first encrypted file, etc. The specific location where the encryption policy package is added to the first encrypted file may be determined according to the actual scenario, and the embodiment of the present application does not impose any limitation on this.

[0330] It should be noted that the above-mentioned addition of the encryption policy package to the first encrypted file is only for exemplary explanation and should not be understood as a limitation on the embodiments of the present application. In the embodiments of the present application, the first server 330 may also directly send the encryption policy package and the first encrypted file as two independent files for association.

[0331] S606: The first server 330 sends the second encrypted file to the second electronic device 320.

[0332] It should be understood that after obtaining the second encrypted file, the first server 330 can send the second encrypted file to the second electronic device 320 to share the file to be shared with the second user.

[0333] Optionally, the first server 330 may also directly treat the encryption policy package and the first encrypted file as two independent files, associate the encryption policy package with the first encrypted file, and then send them to the second electronic device 320 respectively.

[0334] S607: The second electronic device 320 detects an opening operation performed by the second user, where the opening operation is used to request to open the second encrypted file.

[0335] S608 . The second electronic device 320 sends a decryption request to the first server 330 .

[0336] In some examples, after the second electronic device 320 obtains the second encrypted file, the second user can perform an open operation in the second electronic device 320 to open the second encrypted file. When the second electronic device 320 detects the user's open operation on the second encrypted file, the second electronic device 320 can send a decryption request to the first server 330, requesting to decrypt the encryption policy package to obtain the first key to decrypt the first encrypted file and obtain the file to be shared.

[0337] S609: When the first server 330 receives the decryption request, it decrypts the encrypted policy package in the second encrypted file to obtain the authorization policy and the first key.

[0338] S610. The first server 330 determines whether the second user is a user in the target group according to the authorization policy.

[0339] S611 : When it is determined that the second user is a user in the target group, the first server 330 sends an authorization policy and a first key to the second electronic device 320 .

[0340] It should be understood that after the first server 330 receives the decryption request from the second electronic device 320, the encryption policy package in the second encrypted file can be decrypted by the organization private key to obtain the first key and the authorization policy. Subsequently, the first server 330 can determine whether the second user is a user in the target group according to the authorization policy, that is, determine whether the second user has access rights to the shared file. When it is determined that the second user is a user in the target group, it can be determined that the second user has access rights to the shared file. At this time, the first server 330 can send the decrypted policy package (i.e., the first key and the authorization policy) to the second electronic device 320, so that the second electronic device 320 can decrypt the first encrypted file according to the first key, obtain the file to be shared, and can control the second user's access to the shared file according to the authorization policy. When it is determined that the second user is not a user in the target group, the first server 330 may not send the decrypted policy package (i.e., the first key and the authorization policy) to the second electronic device 320, so that the second electronic device 320 cannot open the first encrypted file.

[0341] S612: The second electronic device 320 decrypts the first encrypted file using the first key to obtain the file to be shared, and controls access to the file to be shared according to the authorization policy.

[0342] It should be understood that after the second electronic device 320 obtains the authorization policy and the first key, it can decrypt the first encrypted file using the first key to obtain the file to be shared, so that the second user can access the file to be shared. When the second user accesses the file to be shared, the second electronic device 320 can control the access operation of the second user according to the authorization policy.

[0343] For example, when it is determined according to the authorization policy that the second user only has read permission to the shared file, the second electronic device 320 can display the file to be shared and prohibit the second user from performing any operations such as modifying, downloading, copying, taking screenshots or saving the shared file, so that the second user can only view the file to be shared.

[0344] For example, after the second user closes the file to be shared, if the second user needs to access the file to be shared again, the second electronic device 320 needs to resend a decryption request to the first server 330 to request the decryption of the encryption policy package, so as to obtain the first key to decrypt the first encrypted file and obtain the file to be shared. In other words, for each access operation performed by the second user on the shared file, the second electronic device 320 needs to send a decryption request to the first server 330, so as to re-verify the second user's access rights to the shared file through the first server 330, thereby ensuring the security of the file to be shared.

[0345] In one example, to ensure the security of the file to be shared, when the second electronic device 320 decrypts and displays the first encrypted file using the first key, it can associate the read and / or write operations of the ciphertext (i.e., the first encrypted file) and the plaintext (i.e., the file to be shared) through the user space file system (filesystem in user space, fuse), and pull up a permission-controlled sandbox to access the file to be shared, manage and control the second user's access to the file to be shared, and ensure the security of the file to be shared.

[0346] For example, see Figure 7 , Figure 7 A schematic block diagram of a second electronic device provided in an embodiment of the present application is shown.

[0347] like Figure 7 As shown, the second electronic device 320 may include a user space 360, a kernel space 340 and a memory 350. The user space 360 ​​may include a first application 361 and a second application 362. The first application 361 may be an instant messaging application to which the target group belongs, or may be a system application, such as a file manager. The second application 362 may be a document application for displaying files, etc. The kernel space 340 may include a conversion module 341. The memory 350 may be used to store data, such as storing a first encrypted file.

[0348] When the second user wants to open the first encrypted file, the second user can click on the first encrypted file in the target group. After detecting the click operation on the first encrypted file, the first application 361 can send an operation to open the first encrypted file (hereinafter referred to as operation A) to the second application 362. At this time, the conversion module 341 located in the kernel space 340 can detect operation A and intercept operation A. Afterwards, the conversion module 341 can generate a link file and associate the link file with the first encrypted file. Subsequently, the conversion module 341 can send the link file to the second application 362.

[0349] The second application 362 can perform related operations (hereinafter referred to as operation B) on the link file in the permission-controlled sandbox. The permissions allowed by the second application 362 can be determined based on the second user's access rights A to the real-time files in the target group or the access rights B to the historical files. For example, when the file to be shared is a real-time file and the access rights A corresponding to the second user is a read-only permission, the second user can only view the file to be shared in the second application 362, and any other operations performed by the second user on the shared file in the second application 362 will be prohibited.

[0350] Due to the association between the link file and the first encrypted file, when the second application 362 performs operation B on the link file, operation B can be performed on the first encrypted file accordingly, and this conversion process is imperceptible to the second application 362.

[0351] Optionally, when operation B is a read operation, that is, after the second application 362 receives the link file, it can read the link file. At this time, the conversion module 341 can obtain the first encrypted file from the memory 350, and decrypt the first encrypted file using the first key to obtain the file to be shared, and display the file to be shared in the second application 362.

[0352] Optionally, when operation B is a write operation, that is, after receiving the link file, the second application 362 can perform a write operation in the link file. At this time, the conversion module 341 can convert the write operation into a write operation on the first encrypted file, and can store the written content in the memory 350.

[0353] Optionally, when operation B is a closing operation, that is, when the second user clicks the close control in the second application 362 to close the link file, the second application 362 can close the link file. At this time, the conversion module 341 can close the first encrypted file. When the link file is closed, the second electronic device 320 can destroy the sandbox and the conversion module, etc.

[0354] See also Figure 8 , Figure 8 A schematic diagram showing a file sharing system to which the file sharing method provided in the embodiment of the present application is applicable Figure 2 .

[0355] like Figure 8 As shown, the system may include a first electronic device 310, at least one second electronic device 320 ( Figure 8Only one is shown), a first server 830 and a second server 840. Among them, the first server 810 can be connected to the second server 820 in communication. The first electronic device 310 and the second electronic device 320 can both be connected to the first server 830 in communication, and the first electronic device 310 and the second electronic device 320 can also be connected to the second server 840 in communication. The first electronic device 310 can be an electronic device corresponding to the first user. Each second electronic device 320 can be an electronic device corresponding to the second user. The first user can be a user who shares files, and the second user can be a user who obtains files shared by the first user.

[0356] Optionally, the second server 840 may be a server for intermediate transmission of data shared between the first electronic device 310 and the second electronic device 320. For example, the second server 840 may be a server corresponding to the instant messaging application to which the target group belongs. The first server 830 may be a server for managing and controlling the file access operation of the second user, that is, the first server 830 may store information such as the authorization policy corresponding to the target group.

[0357] Exemplarily, when a user (e.g., the first user) shares a file (e.g., file A) to a target group, the first electronic device 310 may send file A (or an encrypted file corresponding to file A) and identification information of the target group to the second server 840. After receiving file A (or an encrypted file corresponding to file A) and identification information of the target group, the second server 840 may send file A (or an encrypted file corresponding to file A) and identification information of the target group to the first server 830. After receiving file A (or an encrypted file corresponding to file A) and identification information of the target group, the first server 830 may determine the target group to which file A (or an encrypted file corresponding to file A) belongs according to the identification information of the target group, and may automatically authorize access rights to file A to each user in the target group according to the authorization policy corresponding to the target group, thereby simplifying the authorization process and improving user experience.

[0358] In one example, when a new user (e.g., user A) joins the target group, any electronic device corresponding to user A, the electronic device corresponding to the group owner, and the electronic device corresponding to the administrator may send notification information A of user A joining the target group to the second server 840. After receiving the notification information A, the second server 840 may send the notification information A to the first server 830.

[0359] After receiving the notification information A, the first server 830 can update the authorization policy corresponding to the target group. For example, the member list corresponding to the target group can be updated to add user A to the member list corresponding to the target group, and the corresponding access rights A and / or access rights B can be granted to user A according to the attribute information of the target group, so that user A can access the real-time files in the target group and / or can access the historical files in the target group. That is, after user A joins the target group, the first server 830 can automatically authorize user A according to the attribute information of the target group, without the need for the group owner or administrator to authorize the user, thereby simplifying the authorization process and improving the user experience.

[0360] In another example, when a user (e.g., user B) in the target group exits the target group, user B will lose access rights A to real-time files in the target group, and / or lose access rights B to historical files in the target group. That is, when user B exits the target group, any electronic device corresponding to user B, the electronic device corresponding to the group owner, and the electronic device corresponding to the administrator may send notification information B of user B exiting the target group to the second server 840. After receiving notification information B, the second server 840 may send notification information B to the first server 830.

[0361] After receiving the notification information B, the first server 830 may update the authorization policy corresponding to the target group. For example, the member list corresponding to the current group may be updated to delete user B from the member list corresponding to the target group, and delete the access rights A and / or access rights B corresponding to user B, so that user B no longer has any access rights to the real-time files and / or historical files in the target group.

[0362] In another example, when the first user withdraws a file (e.g., file A) that has been shared to the target group, the first electronic device 310 may send notification information C to the second server 840 to withdraw file A. After receiving the notification information C, the second server 840 may delete file A stored in the second server 840 and may send notification information C to the first server 830.

[0363] After receiving the notification information C, the first server 830 may update the authorization policy corresponding to the target group. For example, the access permission A and / or access permission B of each user in the target group to file A may be deleted. That is, after the first user withdraws file A, any second user in the target group will not be able to access file A.

[0364] In another example, when the target group is dissolved, each user in the target group will lose access rights A to real-time files in the target group, and / or lose access rights B to historical files in the target group. In other words, any user in the target group will no longer have any access rights to any file in the target group. That is, after the target group is dissolved, each user in the target group will not be able to open files that have been shared to the target group.

[0365] Exemplarily, when the target group is disbanded, the electronic device corresponding to the user who disbands the target group (e.g., the electronic device corresponding to the group owner or the electronic device corresponding to the administrator, etc.) may send a notification message D of disbanding the target group to the second server 840. After receiving the notification message D, the second server 840 may send the notification message D to the first server 830.

[0366] After receiving the notification information D, the first server 830 may update the authorization policy corresponding to the target group. For example, the member list corresponding to the target group may be updated to delete all users from the member list corresponding to the target group, and delete the access rights A and / or access rights B corresponding to each user, so that each user in the target group no longer has any access rights to any real-time file and / or any historical file in the target group.

[0367] Optionally, after receiving the notification information D, the second server 840 may also delete all files associated with the target group in the second server 840 .

[0368] See also Fig. 9 , Fig. 9 A schematic flow chart of a file sharing method provided by another embodiment of the present application is shown. The method can be applied to Figure 8 The file sharing system shown in Figure 1 is Fig. 9 As shown, the method may include:

[0369] S901: When detecting that a first user sends a file to be shared through a target group, the first electronic device 310 obtains identification information of the file to be shared and the target group.

[0370] The specific content of S901 can refer to the related description in the aforementioned S601, which will not be repeated here.

[0371] S902: The first electronic device 310 sends the file to be shared and identification information of the target group to the second server 840.

[0372] It is understandable that after the first electronic device 310 obtains the file to be shared by the first user through the target group, it can directly send the file to be shared and the identification information of the target group to the second server 840. Alternatively, the first electronic device 310 can first encrypt the file to be shared using the first key to obtain a first encrypted file, and then send the first encrypted file and the identification information of the target group to the second server 840.

[0373] The following is an exemplary description using an example in which the first electronic device 310 directly sends the to-be-shared file and the identification information of the target group to the second server 840 .

[0374] S903. The second server 840 encrypts the file to be shared by using the first key to obtain a first encrypted file.

[0375] The specific content of S903 can refer to the related description in the aforementioned S602, which will not be repeated here.

[0376] S904: The second server 840 sends the first encrypted file, the first key, and identification information of the target group to the first server 830.

[0377] It should be understood that after obtaining the first encrypted file, the second server 840 may send the first encrypted file, the first key and the identification information of the target group to the first server 830 .

[0378] S905. The first server 830 determines an authorization policy corresponding to the target group according to the identification information of the target group.

[0379] The first server 830 determines the specific content of the authorization policy corresponding to the target group according to the identification information of the target group. The relevant description in the above S604, in which the first server 330 determines the authorization policy corresponding to the target group according to the identification information of the target group, will not be repeated here.

[0380] S906. The first server 830 encrypts the authorization policy and the first key to obtain an encrypted policy package, and adds the encrypted policy package to the first encrypted file to obtain a second encrypted file.

[0381] It should be understood that the specific content of S906 can refer to the relevant description in the aforementioned S605 and will not be repeated here.

[0382] S907 . The first server 830 sends the second encrypted file to the second electronic device 320 .

[0383] Among them, the specific content of S907 can refer to the relevant description in the aforementioned S606, which will not be repeated here.

[0384] S908: The second electronic device 320 detects an opening operation performed by the second user, where the opening operation is used to request to open the second encrypted file.

[0385] S909 . The second electronic device 320 sends a decryption request to the first server 830 .

[0386] It should be understood that the specific contents of S908 and S909 can refer to the related descriptions in the aforementioned S607 and S608, and will not be repeated here.

[0387] S910. When the first server 830 receives the decryption request, it decrypts the encrypted policy package in the second encrypted file to obtain the authorization policy and the first key.

[0388] S911. The first server 830 determines whether the second user is a user in the target group according to the authorization policy.

[0389] S912: When it is determined that the second user is a user in the target group, the first server 830 sends an authorization policy and a first key to the second electronic device 320.

[0390] S913. The second electronic device 320 decrypts the first encrypted file using the first key to obtain the file to be shared, and controls access to the file to be shared according to the authorization policy.

[0391] Among them, the specific contents of S910 to S913 can refer to the relevant descriptions in the aforementioned S609 to S612, and will not be repeated here.

[0392] It should be noted that the target group described above is a group in any instant messaging application for exemplary explanation only and should not be understood as a limitation on the embodiments of the present application. In the embodiments of the present application, the target group may also be a group in an email application. For example, when a user (such as a first user) encrypts and shares a file in the form of an email, the first user can set the permission information of the email in the first electronic device 310 and select the receiving user of the email. The first electronic device 310 can create a target group based on the receiving user, for example, the receiving user can be added to the target group, and the attribute information of the target group can be set according to the permission information. For example, the real-time permission information and / or historical permission information in the attribute information can be determined based on the permission information.

[0393] After creating the target group, the first electronic device 310 may send relevant information of the target group to the first server 330. The first server 330 may determine the authorization policy corresponding to the target group based on the relevant information of the target group, such as information of users included in the target group and attribute information of the target group, so as to manage the files in the target group according to the authorization policy corresponding to the target group, thereby ensuring the security of file sharing through emails and improving the user experience.

[0394] It should be understood that, similar to the target group being a group in any instant messaging application, when the first user sets the permission information of the email in the first electronic device 310, the same access rights can be set for all users, or different access rights can be set for different users. For example, different permissions can be set for different users based on the identity of the receiving user (such as recipient, cc or blind cc, etc.).

[0395] When the first user withdraws the email, the first electronic device 310 may send a notification message of withdrawing the email to the first server 330. After receiving the notification message, the first server 330 may update the authorization policy corresponding to the target group, for example, deleting the access rights of each user in the target group to the files in the email.

[0396] When the user who receives the email forwards the email to another user (for example, user A), when user A accesses the file in the email, the first server 330 can perform a permission check on user A. If user A is not in the target group, the first server 330 can determine that user A has no access to the file in the email, so the first server 330 may not send the corresponding key to the electronic device corresponding to user A, so that user A cannot access the file in the email.

[0397] For the content related to the target group being a group in the mail application, reference may be made to the description of the target group being a group in any instant messaging application, which will not be repeated here.

[0398] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0399] Corresponding to the file sharing method described in the above embodiment, the embodiment of the present application further provides a file sharing device, and each module of the device can correspond to each step of the file sharing method.

[0400] It should be noted that the information interaction, execution process, etc. between the above-mentioned devices / units are based on the same concept as the method embodiment of the present application. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0401] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0402] The present application also provides an electronic device, the electronic device comprising at least one memory, at least one processor, and a computer program stored in the at least one memory and executable on the at least one processor, wherein when the processor executes the computer program, the electronic device implements the steps in any of the above-mentioned method embodiments. Exemplarily, the structure of the electronic device can be as follows: Figure 1 shown.

[0403] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program. When the computer program is executed by a computer, the computer implements the steps in any of the above method embodiments.

[0404] An embodiment of the present application provides a computer program product. When the computer program product is executed on an electronic device, the electronic device implements the steps in any of the above method embodiments.

[0405] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable storage medium may at least include: any entity or device that can carry the computer program code to the device / electronic device, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electric carrier signal, a telecommunication signal, and a software distribution medium. For example, a USB flash drive, a mobile hard disk, a magnetic disk or an optical disk. In some jurisdictions, according to legislation and patent practice, a computer-readable storage medium cannot be an electric carrier signal and a telecommunication signal.

[0406] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0407] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0408] In the embodiments provided in the present application, it should be understood that the disclosed devices / electronic devices and methods can be implemented in other ways. For example, the device / electronic device embodiments described above are merely schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0409] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0410] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A file sharing method, characterized in that: Applied to a first server, the method comprises: The first server receives a first encrypted file sent by a first electronic device to a target group, the first encrypted file being encrypted by a first key, the target group including a first user associated with the first electronic device; The first server determines, according to the identification information of the target group, an authorization policy corresponding to the target group; The first server obtains a second encrypted file based on the first encrypted file, the first key and the authorization policy, and sends the second encrypted file to the second electronic device; The first server obtains a decryption request sent by the second electronic device, the decryption request is used to request decryption of the second encrypted file, and the second electronic device is associated with a second user; The first server determines, according to the second encrypted file, that the second user is a user in the target group; The first server sends the first key and the authorization policy to the second electronic device.

2. The method according to claim 1, characterized in that The first server obtains a second encrypted file based on the first encrypted file, the first key and the authorization policy, including: The first server encrypts the first key and the authorization policy to obtain an encrypted policy package, and adds the encrypted policy package to the first encrypted file to obtain the second encrypted file.

3. The method according to claim 1 or 2, characterized in that: Before the first server determines the authorization policy corresponding to the target group according to the identification information of the target group, the method further includes: The first server acquires identification information of the target group, information of users included in the target group, and attribute information of the target group; The first server determines the authorization policy corresponding to the target group according to the information of the users included in the target group and the attribute information of the target group, and stores the identification information of the target group and the authorization policy corresponding to the target group in an associated manner.

4. The method according to claim 3, characterized in that The attribute information of the target group includes real-time permission information and historical permission information. The real-time permission information is used to represent the real-time access rights that users who join the target group have for files shared with the target group after joining the target group, and the historical permission information is used to represent the historical access rights that users who join the target group have for files already existing in the target group when joining the target group.

5. The method according to claim 4, characterized in that The authorization policy corresponding to the target group includes real-time access rights and / or historical access rights corresponding to each user in the target group.

6. The method according to any one of claims 1 to 5, characterized in that The method further comprises: The first server obtains first notification information, where the first notification information is notification information of the first user withdrawing the to-be-shared file that has been shared to the target group; The first server updates the authorization policy corresponding to the target group according to the first notification information; wherein the updated authorization policy is used to cancel the real-time access permission and / or historical access permission of each user in the target group to the file to be shared.

7. The method according to any one of claims 1 to 6, characterized in that The method further comprises: The first server obtains second notification information, where the second notification information is notification information that a third user joins the target group; The first server updates the authorization policy corresponding to the target group according to the second notification information; wherein the updated authorization policy is used to authorize the third user to have real-time access rights and / or historical access rights to files in the target group.

8. The method according to any one of claims 1 to 7, characterized in that The method further comprises: The first server obtains third notification information, where the third notification information is notification information that the fourth user exits the target group; The first server updates the authorization policy corresponding to the target group according to the third notification information; wherein the updated authorization policy is used to cancel the fourth user's real-time access permission and / or historical access permission to files in the target group.

9. The method according to any one of claims 1 to 8, characterized in that The method further comprises: The first server acquires fourth notification information, where the fourth notification information is notification information for disbanding the target group; The first server updates the authorization policy corresponding to the target group according to the fourth notification information; wherein the updated authorization policy is used to cancel the real-time access rights and / or historical access rights of all users in the target group to each file in the target group.

10. A file sharing method, characterized in that: Applied to a first electronic device, the first electronic device is associated with a first user, and the method includes: When the first electronic device detects that the first user shares a file to be shared to a target group, the first electronic device acquires identification information of the file to be shared and the target group, where the file to be shared is an unencrypted file; The first electronic device encrypts the file to be shared using a first key to obtain a first encrypted file; The first electronic device sends the first encrypted file, the first key, and identification information of the target group to a first server.

11. The method according to claim 10, characterized in that The method further comprises: The first electronic device detects that a second user shares a target file to the target group; The first electronic device obtains a third encrypted file sent by the first server, wherein the third encrypted file includes a second encrypted file, a second key, and an authorization policy, and the second encrypted file is a file obtained by encrypting the target file using the second key; The first electronic device detects an opening operation of the third encrypted file by the first user; The first electronic device sends a decryption request to the first server, where the decryption request is used to request decryption of the third encrypted file; The first electronic device obtains the second key and the authorization policy corresponding to the decryption request sent by the first server; The first electronic device decrypts the second encrypted file according to the second key to obtain the target file, and accesses the target file according to the authorization policy.

12. The method according to claim 10 or 11, characterized in that: The first electronic device sends the first encrypted file, the first key, and identification information of the target group to the first server, including: The first electronic device sends the first encrypted file, the first key, and identification information of the target group to the second server, and instructs the second server to send the first encrypted file, the first key, and identification information of the target group to the first server.

13. The method according to any one of claims 10 to 12, characterized in that The method further comprises: The first electronic device acquires identification information of the target group, information of users included in the target group, and attribute information of the target group; The first electronic device sends the identification information of the target group, the information of the users included in the target group, and the attribute information of the target group to the first server; or, The first electronic device sends identification information of the target group, information of users included in the target group, and attribute information of the target group to the second server, and instructs the second server to send identification information of the target group, information of users included in the target group, and attribute information of the target group to the first server.

14. The method according to claim 13, characterized in that The attribute information of the target group includes real-time permission information and historical permission information. The real-time permission information is used to represent the real-time access rights that users who join the target group have for files shared with the target group after joining the target group, and the historical permission information is used to represent the historical access rights that users who join the target group have for files already existing in the target group when joining the target group.

15. The method according to claim 14, characterized in that The authorization policy corresponding to the target group includes real-time access rights and / or historical access rights corresponding to each user in the target group.

16. The method according to any one of claims 10 to 15, characterized in that The method further comprises: When the first electronic device detects that the first user withdraws the operation of sharing the file, the first electronic device sends a first notification message to the first server, or sends the first notification message to the second server to instruct the second server to send the first notification message to the first server; The first notification information is notification information that the first user withdraws the file to be shared.

17. The method according to any one of claims 10 to 16, characterized in that The method further comprises: When the first electronic device receives the information that the third user joins the target group, it sends the second notification information to the first server, or sends the second notification information to the second server, so as to instruct the second server to send the second notification information to the first server; The second notification information is notification information that the third user joins the target group.

18. The method according to any one of claims 10 to 17, characterized in that The method further comprises: When the first electronic device receives the information that the fourth user exits the target group, it sends the third notification information to the first server, or sends the third notification information to the second server, so as to instruct the second server to send the third notification information to the first server; The third notification information is notification information that the fourth user exits the target group.

19. The method according to any one of claims 10 to 18, characterized in that The method further comprises: When the first electronic device receives the information for disbanding the target group, it sends fourth notification information to the first server, or sends the fourth notification information to the second server, so as to instruct the second server to send the fourth notification information to the first server; The fourth notification information is notification information for disbanding the target group.

20. A file sharing method, characterized in that: Applied to a second electronic device, the second electronic device is associated with a second user, the method includes: The second electronic device obtains a second encrypted file sent by the first server, the second encrypted file including the first encrypted file, the first key and the authorization policy, the first encrypted file is a file obtained by encrypting the file to be shared by the first key, and the file to be shared is a file shared by the first user to the target group; The second electronic device detects an opening operation of the second encrypted file by a second user; The second electronic device sends a decryption request to the first server, where the decryption request is used to request decryption of the second encrypted file; The second electronic device obtains the first key and the authorization policy corresponding to the decryption request sent by the first server; The second electronic device decrypts the first encrypted file according to the first key to obtain the file to be shared, and accesses the file to be shared according to the authorization policy.

21. A file sharing system, characterized in that: The system comprises a first electronic device, a second electronic device and a first server, wherein the first electronic device is associated with a first user, the second electronic device is associated with a second user, and the first user and the second user are users in a target group; The first electronic device is used to execute the steps of the file sharing method according to any one of claims 10 to 19; The first server is used to execute the steps of the file sharing method according to any one of claims 1 to 9; The second electronic device is used to execute the steps in the file sharing method described in claim 20.

22. A server comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the electronic device implements the file sharing method according to any one of claims 1 to 9.

23. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the electronic device implements the file sharing method according to any one of claims 10 to 20.

24. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a computer, the computer is enabled to implement the file sharing method according to any one of claims 1 to 9 or claims 10 to 20.

Images