Method and device for sharing user data of user account, equipment and medium

Abstract

The invention provides a method, a device, equipment and a medium for sharing user data of a user account. In one method, at a first client device logged in with a user account, a first data key associated with the user account and a first encrypted data key generated based on the first data key are obtained. And encrypting first user data of the user account by using the first data key to obtain first encrypted user data. And generating first shared user data based on the first encrypted user data and the first encrypted data key. The first shared user data is transmitted to a server device connected to the first client device in order to share the first user data via the server device to a second client device connected to the server device. The data sharing process may be performed based on a user account logging in the client device. In this way, the security of the user data sharing process can be improved, and the operation complexity can be reduced.

Description

Technical Field

[0001] Exemplary implementations of the present disclosure generally relate to data sharing, and more particularly, to methods, apparatuses, devices, and computer-readable storage media for sharing user data of user accounts. Background Art

[0002] With the development of computer technology, data can be shared between multiple devices. In the process of data sharing, unsecured networks may be involved, leading to risks such as data leakage. At this time, it is expected that data can be transmitted in a more secure and effective way to reduce the risk of illegal access to data. Summary of the invention

[0003] In a first aspect of the present disclosure, a method for sharing user data of a user account is provided. In the method, at a first client device logged in using a user account, a first data key associated with the user account and a first encrypted data key generated based on the first data key are obtained. The first user data of the user account is encrypted using the first data key to obtain first encrypted user data. Based on the first encrypted user data and the first encrypted data key, first shared user data is generated. The first shared user data is transmitted to a server device connected to the first client device so as to share the first user data with a second client device connected to the server device via the server device.

[0004] In a second aspect of the present disclosure, a device for sharing user data of a user account is provided. The device includes: an acquisition module configured to acquire a first data key associated with a user account and a first encrypted data key generated based on the first data key at a first client device logged in using the user account; an encryption module configured to encrypt the first user data of the user account using the first data key to obtain the first encrypted user data; a generation module configured to generate first shared user data based on the first encrypted user data and the first encrypted data key; and a transmission module configured to transmit the first shared user data to a server device connected to the first client device, so as to share the first user data with a second client device connected to the server device via the server device.

[0005] In a third aspect of the present disclosure, an electronic device is provided. The electronic device includes: at least one processing unit; and at least one memory, the at least one memory is coupled to the at least one processing unit and stores instructions for execution by the at least one processing unit, and when the instructions are executed by the at least one processing unit, the electronic device executes the method according to the first aspect of the present disclosure.

[0006] In a fourth aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the processor implements the method according to the first aspect of the present disclosure.

[0007] It should be understood that the content described in this content section is not intended to limit the key features or important features of the implementation of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easy to understand through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] In the following, in conjunction with the accompanying drawings and with reference to the following detailed description, the above and other features, advantages and aspects of various implementations of the present disclosure will become more apparent. In the accompanying drawings, the same or similar figure labels represent the same or similar elements, wherein:

[0009] Figure 1 A block diagram showing an application environment according to an exemplary implementation of the present disclosure is shown;

[0010] Figure 2 A block diagram illustrating sharing user data of a user account according to some implementations of the present disclosure is shown;

[0011] Figure 3 A block diagram illustrating various types of user data that may be shared according to some implementations of the present disclosure;

[0012] Figure 4 A block diagram for determining a data key via a key server according to some implementations of the present disclosure is shown;

[0013] Figure 5 A block diagram illustrating a process for generating a ciphertext version of shared user data based on user data according to some implementations of the present disclosure;

[0014] Figure 6 A block diagram illustrating a process for decrypting shared user data to obtain user data according to some implementations of the present disclosure;

[0015] Figure 7 A block diagram for sharing user data among multiple client devices according to some implementations of the present disclosure is shown;

[0016] Figure 8 A flowchart illustrating a method for sharing user data of a user account according to some implementations of the present disclosure;

[0017] Fig. 9 A block diagram illustrating an apparatus for sharing user data of a user account according to some implementations of the present disclosure; and

[0018] Fig.10 A block diagram of a device capable of implementing multiple implementations of the present disclosure is shown. DETAILED DESCRIPTION

[0019] The implementation of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain implementations of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be interpreted as being limited to the implementations described herein. On the contrary, these implementations are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and implementations of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0020] In the description of the implementation methods of the present disclosure, the term "including" and similar terms should be understood as open inclusion, that is, "including but not limited to". The term "based on" should be understood as "based at least in part on". The term "an implementation" or "the implementation" should be understood as "at least one implementation". The term "some implementations" should be understood as "at least some implementations". The following may also include other explicit and implicit definitions. As used herein, the term "model" can represent the association relationship between various data. For example, the above-mentioned association relationship can be obtained based on a variety of technical solutions currently known and / or to be developed in the future.

[0021] It is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

[0022] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0023] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can autonomously choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0024] As an optional but non-limiting implementation, in response to receiving an active request from the user, the prompt information is sent to the user in a manner such as a pop-up window, in which the prompt information can be presented in text form. In addition, the pop-up window can also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0025] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0026] The term "in response to" as used herein refers to a state in which a corresponding event occurs or a condition is satisfied. It will be understood that the timing of executing a subsequent action executed in response to the event or condition is not necessarily strongly related to the time when the event occurs or the condition is satisfied. For example, in some cases, the subsequent action may be executed immediately when the event occurs or the condition is satisfied; while in other cases, the subsequent action may be executed some time after the event occurs or the condition is satisfied.

[0027] Example Environment

[0028] Figure 1 FIG. 1 is a block diagram of an application environment 100 according to an exemplary implementation of the present disclosure. Figure 1 As shown, application environment 100 may include multiple devices, for example, server device 110 may be connected to multiple client devices 120, 122, ..., and 124 via network 130. User 150 may use user account 140 to log in to any of the multiple client devices 120, 122, ..., and 124.

[0029] The user 150 can perform a desired operation on the logged-in client device to modify the user data 160 associated with the user account 140 of the user 150. During the modification of the user data 160, the latest user data 160 can be uploaded to the server device 110 in real time, so as to generate shared user data that can be shared between the various client devices 120, 122, ..., and 124 at the server device 110. When the user uses the user account 140 to log in at other client devices (e.g., client device 122), the server device 110 can transmit the shared user data to the client device 122. At this time, no matter which client device is logged in using the user account 140, the latest user data can be accessed at the logged-in client device via the server device 110.

[0030] However, each client device, network 130, and server device 110 may be attacked by malicious programs during operation, which may lead to the risk of illegal access to user data 160. At this time, it is expected that user data can be shared in a safer and more effective manner to reduce the risk of illegal access to user data.

[0031] Overview of the process of user data sharing

[0032] At present, data protection technical solutions have been proposed. For example, the user 160 can set a password for the user data 160 to be transmitted, and use the password to encrypt / decrypt the transmitted data. However, when the user 160 logs in on other client devices, the password has to be entered again, which requires the user 160 to perform additional operations. Furthermore, since the password is difficult to remember and errors may occur during the input process, the user experience of sharing data based on the password is not ideal.

[0033] In order to at least partially address the deficiencies in the prior art, according to an exemplary implementation of the present disclosure, a method for sharing user data of a user account is proposed. Figure 2 An overview of an exemplary implementation of the present disclosure is described. Figure 2 A block diagram 200 is shown for sharing user data 160 of a user account 140 according to some implementations of the present disclosure. Figure 2 As shown, the user account 140 may be used to log in at the client device 120. At the client device 120, a first data key 210 associated with the user account 140 and a first encrypted data key 212 generated based on the first data key 210 may be obtained.

[0034] For ease of distinction, the client device 120 may be referred to as a first client device. The prefix "first" may be used to distinguish various objects associated with the first client device, such as first user data, first data key, first encrypted data key, first encrypted user data, first shared user data, etc. It will be understood that the first data key 210 herein may be a key used to encrypt the first user data 220, and the first encrypted data key 212 may be an encrypted version of the first data key 210, for example, a version obtained using a variety of encryption techniques.

[0035] Further, the first user data 220 of the user account 140 may be encrypted using the first data key 210 to obtain first encrypted user data 222. In other words, the first encrypted user data 222 is an encrypted version of the first user data 220. The first shared user data 230 may be generated based on the first encrypted user data 220 and the first encrypted data key 212. Then, the first shared user data 230 may be sent to the server device 110 connected to the client device 120, so as to share the first user data 220 with other client devices 122, ..., and 124 (e.g., referred to as second client devices) connected to the server device 110 via the server device 110.

[0036] It will be understood that at the client device 120, the first user data 220 is a plain text version, and outside the client device 120 (for example, at the server device 110 or at a network device through which the transmission passes), the first user data 220 is represented by the first shared user data 230 and is in a cipher text version. Since other devices other than the client device 120 do not have the first data key 210, they cannot decrypt the first user data 220 in the cipher text version. In this way, security in the user data sharing process can be ensured, thereby reducing the risk of data leakage.

[0037] Detailed process of user data sharing

[0038] The summary process of user data sharing has been described, and more details about data sharing will be described below. According to an exemplary implementation of the present disclosure, the user data to be shared may include multiple types, for example, including but not limited to: setting data for setting each client device (the setting data may include at least one of the following: system setting data of the operating system of the client device, application setting data of the application installed at the client device); and document data generated by using the application installed at the client device.

[0039] See first Figure 3 Describes the specific content of user data that can be shared between various client devices. Figure 3 Block diagram 300 illustrates various types of user data that may be shared according to some implementations of the present disclosure. Figure 3 As shown, the system setting data 310 may be system setting data for setting the operating system of the client device, such as volume setting 312, Bluetooth setting 314, etc. The system setting data 310 generally relates to various preferences of the user when operating the client device, and such setting data is generally simpler and less sensitive. Therefore, a simpler encryption method may be used when sharing, such as using a key with fewer bits for encryption, etc.

[0040] The application setting data 320 may be used to set the applications installed at the client device. Assuming that a browser application, an input method application, etc. are installed at the client, the application setting data 320 may include: a favorites setting 312 for setting the browser application, a word library setting for setting the input method application, etc. Compared with the system setting data 310, the content sensitivity of the application setting data 320 is usually higher and may include private data. At this time, a medium-security encryption method may be used for the application setting data 320.

[0041] Furthermore, the document data 330 may represent, for example, various documents generated by editing operations performed using various applications installed at the client device. Assuming that a text editing application, an image editing application, etc. are installed at the client device, the document data 330 may include text data 332 obtained using the text editing application, image data 334 obtained using the image editing application, etc. Generally speaking, the document data 330 is highly sensitive, and thus a more secure encryption method may be used for the document data 330 to prevent illegal data access.

[0042] According to an exemplary implementation of the present disclosure, the following Figure 3 The security level of various data can be set in the order shown. For example, the security level of system setting data 310 can be set to "low", the security level of application setting data 320 can be set to "medium", and the security level of document data 330 can be set to "high". Then, the corresponding key length can be selected based on the security level of various data. In this way, data security can be protected in an appropriate manner without excessively increasing the additional workload of data security protection.

[0043] According to an exemplary implementation of the present disclosure, a key server 410 may be provided to handle various tasks related to key generation and distribution. Figure 4 A block diagram 400 is shown for determining a data key via a key server 410 according to some implementations of the present disclosure. Figure 4 As shown, the key server 410 can maintain the master key of each user account. For example, the master key 412 can be the master key of the user account 140, and the key server 410 can determine whether the client device 120 has the right to use the master key 412 by verifying the login status of the client device 120 (for example, determining whether the user account currently logged in in the client device 120 is the user account 140).

[0044] According to an exemplary implementation of the present disclosure, the key server 410 can manage the master keys of each user account. Assuming that there are user accounts User1 and User2, the master keys MasterKey1 and MasterKey2 of the two user accounts can be stored at the key server 410, respectively. When it is detected that the user account User1 is being used to log in to the client device 120, the master key MasterKey1 is used to serve the client device 120, and when it is detected that the user account User2 is being used to log in to the client device 120, the master key MasterKey2 is used to serve the client device 120. At this time, the login status of the client device 120 will be the credential for accessing the key server 410.

[0045] First, the data encryption process is described. In the following, the encryption process will be described by taking the client device 120 as an example. Similar encryption processes can be performed at other client devices (e.g., client devices 122, 124, etc.). Figure 4 Describing more details of obtaining the data key and the encrypted data key, the client device 120 can access (e.g., via a network) a key server 410 connected to the client device 120 and transmit a request to the key server 410 to obtain the first data key 210 and the first encrypted data key 212.

[0046] The key server 410 may verify the login status of the client device 120. Specifically, if the key server 410 determines that the user account currently logged in in the client device 120 is the user account 140, the login status is verified as "valid"; if the key server 410 determines that the user account currently logged in in the client device 120 is not the user account 140, the login status is verified as "invalid". In the case where the login status is valid, the key server 410 may provide the first data key 210 and the first encrypted data key 212 associated with the user account 140 to the client device 120.

[0047] At this time, the client device 120 can receive the first data key 210 and the first encrypted data key 212 from the key server 410. In this way, the user at the client device 120 does not need to manually enter his or her identity authentication information or password, but can directly verify whether the client device 120 is authorized to use the corresponding service provided by the key server 410 based on the login status of the client device 120. In this way, the complexity of user operations at the client device 120 can be reduced, thereby providing a more user-friendly experience.

[0048] According to an exemplary implementation of the present disclosure, the first data key 210 may be generated by the key server 410. For example, the key server 410 may randomly generate the first data key 210, may generate the first data key 210 based on the security level of the data to be encrypted as described above, may generate the same or different first data key 210 for each user data to be encrypted, and so on.

[0049] It will be understood that the user data may have one or more data items, for example, volume settings 312, favorites settings 312, text data 332, and the like. A unique identifier may be used to represent each data item, and each data item may be continuously updated, at which point the data item at a certain point in time may be uniquely represented using the identifier and timestamp of the data item. According to an exemplary implementation of the present disclosure, for a certain data item, the same data key may always be used during the data sharing process. Alternatively and / or additionally, for a certain data item, different data keys may be used at different points in time.

[0050] In the case where the first data key 210 has been generated, the key server 410 may use the master key 412 of the user account 140 to encrypt the first data key 210, thereby obtaining the first encrypted data key 212. Further, the key server 410 may transmit the first data key 210 and the first encrypted data key 212 to the client device 120 so that the client device 120 performs the data encryption process. According to an exemplary implementation of the present disclosure, the key server 410 may be implemented using a key management service (KMS) that is currently known and / or to be developed in the future, and the first data key 210 and the first encrypted data key 212 may be transmitted in a variety of security methods based on currently known and / or to be developed in the future. For example, the transmission process may be performed using envelope encryption technology.

[0051] At this time, although the key server 410 has a plaintext version of the data key, the key server 410 does not have user data, so the plaintext version of the data key at the key server 410 does not pose a security threat to the user data. In this way, the client device 120 can use the received first data key 210 locally to perform the encryption process, and the encrypted user data is sent in ciphertext form, so there is no risk of data leakage. In terms of security, there is no plaintext on any network transmission, and attackers cannot crack user data. In terms of trust, the data key and shared user data are stored separately, that is, the data key is maintained by the key server, and the shared user data is maintained by the server device in the cloud. Both parties cannot access the complete data and therefore cannot crack the user data.

[0052] In the following, see Figure 5 Describes other details of the encryption process. Figure 5 A block diagram 500 is shown of a process for generating a ciphertext version of shared user data based on user data according to some implementations of the present disclosure. Figure 5As shown, the client device 120 may request 510 to obtain a data key (e.g., represented as DataKey) and an encrypted data key (e.g., represented as EncryptedDataKey) from the key server 410. The key server 410 may verify (e.g., as described above with reference to FIG. Figure 4 The key server 410 may determine the login status of the client device 120 in the manner described above. If the login status is valid, the operation process may continue, and the data key DataKey and the encrypted data key EncryptedDataKey may be generated 514. The key server 410 may transmit 516 the generated data key DataKey and the encrypted data key EncryptedDataKey to the client device 120.

[0053] When the client device 120 receives the data key DataKey and the encrypted data key EncryptedDataKey, it can use the data key DataKey to encrypt 518 the user data (e.g., represented as Data) locally at the client device 120 to obtain encrypted user data (represented as EncryptedData). At this time, the encrypted user data is a ciphertext version of the user data. When the ciphertext version is transmitted over the network, the risk of illegal data access is avoided because various devices in the network do not have the data key.

[0054] According to an exemplary implementation of the present disclosure, encrypted user data and an encrypted data key may be used to generate shared user data for sharing among various client devices. Figure 5 As shown, the client device 120 can splice 520 the encrypted user data EncryptedData and the encrypted data key EncryptedDataKey to obtain shared user data (e.g., represented as SharedData). According to an exemplary implementation of the present disclosure, the splicing process can be performed in a variety of ways, for example, the encrypted data key can be placed at the head position, tail position, or middle position of the spliced ​​data, etc.

[0055] Further, the client device 120 may transmit 522 the shared user data to the server device 110 so as to share the shared user data SharedData between other client devices (eg, client devices 122 and 124 , etc.) logged in using the same user account 140 via the server device 110 .

[0056] According to an exemplary implementation of the present disclosure, when it is detected that the client device 120 is logged in using the user account 140, the above-mentioned data encryption and sharing process can be automatically started. For example, the process described above can be periodically performed to synchronize the latest user data at the client device 120 to the server device 110. In this way, no additional manual operation is required at the client device 120 that provides shared user data to start the encryption and sharing process, but a safe, reliable and encrypted data sharing process can be automatically performed when it is verified that the login status of the client device 120 is valid.

[0057] Already seen Figure 5 The details of the encryption process are described. According to an exemplary implementation of the present disclosure, the decryption process can be performed at one or more client devices (e.g., client devices 120, 122, 124, etc.) logged in using the user account 140. Figure 6 For more information describing the data decryption process, Figure 6 A block diagram 600 is shown of a process for decrypting shared user data to obtain user data according to some implementations of the present disclosure. Figure 6 As shown, the server device 110 can transmit 610 the shared user data SharedData to the client device 122. Here, the shared user data SharedData is Figure 5 The client device 120 shown in is transmitted to the server device 110, and the shared user data SharedData includes encrypted user data EncryptedData and encrypted data key EncryptedDataKey. At this time, the encrypted user data EncryptedData and the encrypted data key EncryptedDataKey are both ciphertext versions, so there will be no data leakage during the transmission process.

[0058] Upon receiving the shared user data SharedData, the client device 122 may extract 612 the encrypted user data EncryptedData and the encrypted data key EncryptedDataKey in a predetermined format. The extraction operation here is the reverse operation of the splicing operation described above, for example, the above data may be extracted from a predetermined location. Subsequently, the client device 122 may transmit 614 the encrypted data key EncryptedDataKey to the key server 410 and request a plain text version of the data key. The key server 410 may verify whether the login status of the client device 122 is valid.

[0059] Specifically, if the key server 410 determines that the user account currently logged in in the client device 122 is the user account 140, the login status is verified as "valid"; if the key server 410 determines that the user account currently logged in in the client device 122 is not the user account 140, the login status is verified as "invalid". In the case where the login status is valid, the key server 410 can use the master key of the user account 140 to perform 618 a decryption operation on the encrypted data key EncryptedDataKey to obtain the data key DataKey (that is, the plaintext version of the data key).

[0060] Further, the key server 410 may transmit 620 the data key DataKey to the client device 122 (e.g., via envelope encryption technology). Upon receiving the data key DataKey, the client device 122 may use the data key DataKey to decrypt 622 the encrypted user data EncryptedData extracted, thereby obtaining a plaintext version of the user data Data. At this point, at the client device 122 that performs the decryption operation, no additional manual operation is required for the decryption process, but rather the client device 122 may be directly verified to have the right to obtain the data key based on the login status of the client device 122. In this way, the data decryption operation may be automatically performed, thereby enabling user data sharing between multiple client devices (e.g., client device 120 and client device 122, etc.) logged in with the same user account 140 in a manner that is transparent to the user.

[0061] will understand, although Figure 6 The decryption process performed at the client device 122 is described, alternatively and / or additionally, a similar encryption process and / or decryption process may be performed at each client device. Figure 5 At the client device 120 that performs the encryption process, the same as Figure 6 Specifically, at the client device 120, shared user data may be received from the server device 110. Here, the received shared user data may be, for example, data transmitted to the server device 110 by a second client device (e.g., client devices 122, 124, etc.) different from the client device 120. At this time, the second client device should also be logged in using the user account 140.

[0062] For ease of description, the prefix "second" can be used to distinguish various objects associated with the second client device, such as second shared user data, second encrypted user data, second encrypted data key, second data key, second user data, and so on. According to an exemplary implementation of the present disclosure, the second shared user data may be concatenated data generated at the second client device in the manner described above, and may include second encrypted user data and a second encrypted data key. At this time, the second encrypted user data may be obtained by encrypting the second user data using the second data key, and the second encrypted data key may be obtained by encrypting the second data key using the master key of the user account. In this way, various data exist in ciphertext format, thereby improving data security.

[0063] In the case where the second shared user data has been received, the client device 122 can extract the second encrypted user data and the second encrypted data key from the second shared user data. Specifically, the second encrypted user data and the second encrypted data key can be extracted from the specified positions respectively according to the splicing format. Further, the client device 122 can obtain the second data key for decrypting the second encrypted user data into the second user data based on the second encrypted data key.

[0064] You can follow a similar Figure 6 The second data key can be obtained in the manner shown. Specifically, the client device 120 can transmit a request for decrypting the second encrypted data key to the key server 410 connected to the first client device. The key server 410 can verify the login status of the client device 120. If it is determined that the login status of the client device 120 is verified as valid by the key server 410, the client device 120 can receive the second data key from the key server 410. Here, the second data key is obtained by the key server 410 decrypting the second encrypted data key using the master key of the user account 140. Further, the client device 120 can decrypt the second encrypted user data using the second data key to obtain the second user data. At this point, the client device 120 can complete the decryption process and obtain the shared user data from other client devices.

[0065] According to an exemplary implementation of the present disclosure, the first user data and the second user data herein may involve the same or different data items. For example, the first user data may be text data generated after logging in using the user account 140 at the client device 120, and the second user data may be text data updated after logging in using the user account 140 at the client device 122. That is, the second user data may be an updated version of the first user data. In this way, when logging in using the same user account 140, no matter which client device updates the text data, the latest version of the user data can be automatically obtained at other client devices. In this way, user data sharing can be achieved in a manner that is transparent to the user.

[0066] It will be understood that the second user data is updated at the client device 122 logged in using the user account, and at this time, it does not matter whether the user at each client device is the same user, but only the login status of each client device is concerned, that is, whether the same user account 140 is used to log in. At this time, the login status is the user account 140 used, which will be used as the only credential for user data sharing and data encryption / decryption, thereby simplifying the complexity of user operations and improving data security.

[0067] According to an exemplary implementation of the present disclosure, user data can be continuously updated at each client device, and the latest user data can be shared between each client. For example, the interaction between the user and the user data can be continuously detected at each client, and the user data can be updated based on the interaction. Further, the process of encrypting and transmitting the ciphertext version of the latest user data to the server device can be triggered when a predetermined condition is met (e.g., reaching a predetermined time interval, detecting a change in the user data, detecting that the amount of data changed reaches a predetermined threshold, etc.). In this way, data sharing between various client devices logged in using the same user account 140 can be achieved in a manner that is transparent to the user.

[0068] According to an exemplary implementation of the present disclosure, at the client 120, an interaction with the first user data may be detected, and the first user data may be updated to the third user data based on the received interaction. Figure 5 For example, for different updated versions of the same data item, the third user data may be encrypted using the same data key (e.g., the first data key) to obtain third encrypted user data; based on the third encrypted user data and the first encrypted data key, third shared user data may be generated; and further, the third shared user data may be transmitted to the server device.

[0069] According to an exemplary implementation of the present disclosure, for different update versions of the same data item, different data keys (e.g., third data keys) may be used to encrypt third user data to obtain third encrypted user data; third shared user data may be generated based on the third encrypted user data and the first encrypted data key; and the third shared user data may be transmitted to the server device. In this way, by using different keys for different update versions, the risk of key leakage due to reuse of keys may be avoided, thereby improving security in the data sharing process.

[0070] According to an exemplary implementation of the present disclosure, user data can be continuously updated. Figure 7 Describes more details for sharing data. Figure 7 A block diagram 700 for sharing user data between multiple client devices according to some implementations of the present disclosure is shown. Figure 7 As shown, user data can be updated at each client device 120, 122, ..., 124 logged in using the same user account 140, and the data sharing process is performed using the encryption and / or decryption process described above. Each client device can transmit the ciphertext version of the latest user data to the server device 110 as a shared user data storage 710. Each client device logged in using the user account 140 can access the shared user data 710 to update the local user data to the latest version.

[0071] By using the exemplary implementation of the present disclosure, during the data sharing process, it is possible to distinguish whether the user has the right to access the user data and the data key for encrypting / decrypting the user data based on the user account logged into the client device. In this way, the security of the user data sharing process can be improved and the operation complexity can be reduced.

[0072] Example Process

[0073] Figure 8 A flow chart of a method 800 for sharing user data of a user account according to some implementations of the present disclosure is shown. At box 810, at a first client device logged in using a user account, a first data key associated with the user account and a first encrypted data key generated based on the first data key are obtained. At box 820, the first user data of the user account is encrypted using the first data key to obtain first encrypted user data; at box 830, first shared user data is generated based on the first encrypted user data and the first encrypted data key; and at box 840, the first shared user data is transmitted to a server device connected to the first client device so as to share the first user data with a second client device connected to the server device via the server device.

[0074] According to an exemplary implementation of the present disclosure, obtaining the first data key and the first encrypted data key includes: transmitting a request for obtaining the first data key and the first encrypted data key to a key server connected to the first client device; and in response to the login status of the first client device being verified as valid by the key server, receiving the first data key and the first encrypted data key from the key server.

[0075] According to an exemplary implementation of the present disclosure, the first data key is generated by a key server, and the first encrypted data key is obtained by the key server encrypting the first data key using a master key of a user account.

[0076] According to an exemplary implementation of the present disclosure, generating the first shared user data includes: concatenating the first encrypted user data and the first encrypted data key to obtain the first shared user data.

[0077] According to an exemplary implementation of the present disclosure, the method 800 further includes: receiving second shared user data from a server device; extracting second encrypted user data and a second encrypted data key from the second shared user data; obtaining a second data key for decrypting the second encrypted user data into second user data based on the second encrypted data key; and decrypting the second encrypted user data using the second data key to obtain the second user data.

[0078] According to an exemplary implementation of the present disclosure, the second shared user data is transmitted to the server device by the second client device logged in using the user account.

[0079] According to an exemplary implementation of the present disclosure, the second shared user data includes second encrypted user data and a second encrypted data key, the second encrypted user data is obtained by encrypting the second user data using the second data key, and the second encrypted data key is obtained by encrypting the second data key using the master key of the user account.

[0080] According to an exemplary implementation of the present disclosure, the second user data is an updated version of the first user data.

[0081] According to an exemplary implementation of the present disclosure, the second user data is updated at the second client device logged in using the user account.

[0082] According to an exemplary implementation of the present disclosure, obtaining the second data key includes: transmitting a request for decrypting the second encrypted data key to a key server connected to the first client device; in response to the login status of the first client device being verified as valid by the key server, receiving the second data key from the key server, the second data key being obtained by the key server decrypting the second encrypted data key using the master key of the user account.

[0083] According to an exemplary implementation of the present disclosure, the method 800 further includes: in response to receiving an interaction with the first user data, updating the first user data to third user data; encrypting the third user data using the first data key to obtain third encrypted user data; generating third shared user data based on the third encrypted user data and the first encrypted data key; and transmitting the third shared user data to the server device.

[0084] According to an exemplary implementation of the present disclosure, the method 800 further includes: in response to receiving an interaction with the first user data, updating the first user data to third user data; encrypting the third user data using a third data key to obtain third encrypted user data; generating third shared user data based on the third encrypted user data and the first encrypted data key; and transmitting the third shared user data to the server device.

[0085] According to an exemplary implementation of the present disclosure, the first user data includes at least any one of the following: setting data for setting the first client device, the setting data including at least any one of the following: system setting data of the operating system of the first client device, application setting data of the application installed at the first client device; and document data generated using the application installed at the first client device.

[0086] Example devices and equipment

[0087] Fig. 9A block diagram of an apparatus 900 for sharing user data of a user account according to some implementations of the present disclosure is shown. The apparatus 900 includes: an acquisition module 910, configured to acquire a first data key associated with a user account and a first encrypted data key generated based on the first data key at a first client device logged in using the user account; an encryption module 920, configured to encrypt the first user data of the user account using the first data key to obtain the first encrypted user data; a generation module 930, configured to generate the first shared user data based on the first encrypted user data and the first encrypted data key; and a transmission module 940, configured to transmit the first shared user data to a server device connected to the first client device, so as to share the first user data with a second client device connected to the server device via the server device.

[0088] According to an exemplary implementation of the present disclosure, the acquisition module 910 includes: transmitting a request for obtaining a first data key and a first encrypted data key to a key server connected to a first client device; and receiving the first data key and the first encrypted data key from the key server in response to the login status of the first client device being verified as valid by the key server.

[0089] According to an exemplary implementation of the present disclosure, the first data key is generated by a key server, and the first encrypted data key is obtained by the key server encrypting the first data key using a master key of a user account.

[0090] According to an exemplary implementation of the present disclosure, the generation module 930 includes: concatenating the first encrypted user data and the first encrypted data key to obtain the first shared user data.

[0091] According to an exemplary implementation of the present disclosure, the apparatus 900 further includes: a receiving module configured to receive second shared user data from a server device; an extraction module configured to extract second encrypted user data and a second encrypted data key from the second shared user data; a key acquisition module configured to acquire a second data key for decrypting the second encrypted user data into second user data based on the second encrypted data key; and decrypting the second encrypted user data using the second data key to obtain the second user data.

[0092] According to an exemplary implementation of the present disclosure, the second shared user data is transmitted to the server device by the second client device logged in using the user account.

[0093] According to an exemplary implementation of the present disclosure, the second shared user data includes second encrypted user data and a second encrypted data key, the second encrypted user data is obtained by encrypting the second user data using the second data key, and the second encrypted data key is obtained by encrypting the second data key using the master key of the user account.

[0094] According to an exemplary implementation of the present disclosure, the second user data is an updated version of the first user data.

[0095] According to an exemplary implementation of the present disclosure, the second user data is updated at the second client device logged in using the user account.

[0096] According to an exemplary implementation of the present disclosure, a key acquisition module includes: a request module, configured to transmit a request for decrypting a second encrypted data key to a key server connected to a first client device; and a receiving module, configured to receive a second data key from the key server in response to the login status of the first client device being verified as valid by the key server, wherein the second data key is obtained by the key server decrypting the second encrypted data key using the master key of the user account.

[0097] According to an exemplary implementation of the present disclosure, the apparatus 900 further includes: an update module configured to update the first user data to third user data in response to receiving an interaction with the first user data; the encryption module 920 is further configured to encrypt the third user data using the first data key to obtain third encrypted user data; the generation module 930 is further configured to generate third shared user data based on the third encrypted user data and the first encryption data key; and the transmission module 940 is further configured to transmit the third shared user data to the server device.

[0098] According to an exemplary implementation of the present disclosure, the apparatus 900 further includes: an update module configured to update the first user data to third user data in response to receiving an interaction with the first user data; the encryption module is further configured to encrypt the third user data using a third data key to obtain third encrypted user data; the generation module is further configured to generate third shared user data based on the third encrypted user data and the first encryption data key; and the transmission module is further configured to transmit the third shared user data to the server device.

[0099] According to an exemplary implementation of the present disclosure, the first user data includes at least any one of the following: setting data for setting the first client device, the setting data including at least any one of the following: system setting data of the operating system of the first client device, application setting data of the application installed at the first client device; and document data generated using the application installed at the first client device.

[0100] Fig.10 1 shows a block diagram of a device 1000 capable of implementing multiple implementations of the present disclosure. It should be understood that Fig.10 The computing device 1000 shown is merely exemplary and should not constitute any limitation on the functionality and scope of the implementations described herein. Fig.10 The computing device 1000 shown may be used to implement the methods described above.

[0101] like Fig.10 As shown, computing device 1000 is in the form of a general-purpose computing device. Components of computing device 1000 may include, but are not limited to, one or more processors or processing units 1010, memory 1020, storage device 1030, one or more communication units 1040, one or more input devices 1050, and one or more output devices 1060. Processing unit 1010 may be an actual or virtual processor and is capable of performing various processes according to a program stored in memory 1020. In a multi-processor system, multiple processing units execute computer executable instructions in parallel to increase the parallel processing capabilities of computing device 1000.

[0102] The computing device 1000 typically includes a plurality of computer storage media. Such media may be any available media accessible to the computing device 1000, including but not limited to volatile and non-volatile media, removable and non-removable media. The memory 1020 may be a volatile memory (e.g., registers, caches, random access memory (RAM)), a non-volatile memory (e.g., a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), flash memory), or some combination thereof. The storage device 1030 may be a removable or non-removable medium, and may include a machine-readable medium, such as a flash drive, a disk, or any other medium, which may be capable of being used to store information and / or data (e.g., training data for training) and may be accessed within the computing device 1000.

[0103] The computing device 1000 may further include additional removable / non-removable, volatile / non-volatile storage media. Fig.10As shown in , a disk drive for reading or writing from a removable, non-volatile disk (e.g., a "floppy disk") and an optical drive for reading or writing from a removable, non-volatile optical disk may be provided. In these cases, each drive may be connected to the bus (not shown) by one or more data media interfaces. Memory 1020 may include a computer program product 1025 having one or more program modules that are configured to perform various methods or actions of various implementations of the present disclosure.

[0104] The communication unit 1040 enables communication with other computing devices via a communication medium. Additionally, the functions of the components of the computing device 1000 can be implemented in a single computing cluster or multiple computing machines that can communicate via a communication connection. Therefore, the computing device 1000 can operate in a networked environment using a logical connection with one or more other servers, a network personal computer (PC), or another network node.

[0105] Input device 1050 may be one or more input devices, such as a mouse, keyboard, tracking ball, etc. Output device 1060 may be one or more output devices, such as a display, a speaker, a printer, etc. Computing device 1000 may also communicate with one or more external devices (not shown) through communication unit 1040 as needed, such as storage devices, display devices, etc., communicate with one or more devices that allow a user to interact with computing device 1000, or communicate with any device that allows computing device 1000 to communicate with one or more other computing devices (e.g., a network card, a modem, etc.). Such communication may be performed via an input / output (I / O) interface (not shown).

[0106] According to an exemplary implementation of the present disclosure, a computer-readable storage medium is provided, on which computer-executable instructions are stored, wherein the computer-executable instructions are executed by a processor to implement the method described above. According to an exemplary implementation of the present disclosure, a computer program product is also provided, the computer program product is tangibly stored on a non-transitory computer-readable medium and includes computer-executable instructions, and the computer-executable instructions are executed by a processor to implement the method described above. According to an exemplary implementation of the present disclosure, a computer program product is provided, on which a computer program is stored, and when the program is executed by a processor, the method described above is implemented.

[0107] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices, equipment, and computer program products implemented according to the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0108] These computer-readable program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processing unit of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0109] Computer-readable program instructions can be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operational steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, so that the instructions executed on the computer, other programmable data processing apparatus, or other device implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0110] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple implementations of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of a module, program segment or instruction includes one or more executable instructions for realizing the logical function of the specification. In some implementations as replacements, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be realized by a special hardware-based system that performs the function or action of the specification, or can be realized by a combination of special hardware and computer instructions.

[0111] The above descriptions of various implementations of the present disclosure are exemplary, non-exhaustive, and not limited to the disclosed implementations. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described implementations. The selection of terms used herein is intended to best explain the principles of the implementations, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the various implementations disclosed herein.

Claims

1. A method for sharing user data of a user account, comprising: At a first client device logged in using the user account, obtaining a first data key associated with the user account and a first encrypted data key generated based on the first data key; Encrypting first user data of the user account using the first data key to obtain first encrypted user data; generating first shared user data based on the first encrypted user data and the first encrypted data key; as well as The first shared user data is transmitted to a server device connected to the first client device, so as to share the first user data with a second client device connected to the server device via the server device.

2. The method according to claim 1, wherein obtaining the first data key and the first encrypted data key comprises: transmitting a request for obtaining the first data key and the first encrypted data key to a key server connected to the first client device; as well as In response to the login status of the first client device being verified as valid by the key server, the first data key and the first encrypted data key are received from the key server.

3. The method according to claim 2, wherein the first data key is generated by the key server, and the first encrypted data key is obtained by the key server encrypting the first data key using the master key of the user account.

4. The method according to claim 1, wherein generating the first shared user data comprises: The first encrypted user data and the first encrypted data key are concatenated to obtain the first shared user data.

5. The method according to claim 1, further comprising: receiving second shared user data from the server device; extracting second encrypted user data and a second encrypted data key from the second shared user data; obtaining, based on the second encrypted data key, a second data key for decrypting the second encrypted user data into second user data; as well as The second encrypted user data is decrypted using the second data key to obtain the second user data. The method according to claim 5 , wherein the second shared user data is transmitted to the server device by the second client device logged in using the user account.

7. The method according to claim 5, wherein the second shared user data includes the second encrypted user data and the second encrypted data key, the second encrypted user data is obtained by encrypting the second user data using the second data key, and the second encrypted data key is obtained by encrypting the second data key using the master key of the user account. The method of claim 7 , wherein the second user data is an updated version of the first user data. 9 . The method of claim 8 , wherein the second user data is updated at the second client device logged in using the user account.

10. The method according to claim 5, wherein obtaining the second data key comprises: transmitting a request for decrypting the second encrypted data key to a key server connected to the first client device; as well as In response to the login status of the first client device being verified as valid by the key server, a second data key is received from the key server, where the second data key is obtained by the key server decrypting the second encrypted data key using the master key of the user account.

11. The method according to claim 1, further comprising: In response to receiving an interaction with the first user data, updating the first user data to third user data; encrypting the third user data using the first data key to obtain third encrypted user data; generating third shared user data based on the third encrypted user data and the first encrypted data key; as well as The third shared user data is transmitted to the server device.

12. The method according to claim 1, further comprising: In response to receiving an interaction with the first user data, updating the first user data to third user data; encrypting the third user data using a third data key to obtain third encrypted user data; generating third shared user data based on the third encrypted user data and the first encrypted data key; as well as The third shared user data is transmitted to the server device.

13. The method according to claim 1, wherein the first user data comprises at least any one of the following: Setting data for setting the first client device, the setting data comprising at least any one of the following: system setting data of an operating system of the first client device, application setting data of an application installed at the first client device; and The document data is used to be generated by using an application installed at the first client device.

14. An apparatus for sharing user data of a user account, comprising: An acquisition module is configured to acquire, at a first client device logged in using the user account, a first data key associated with the user account and a first encrypted data key generated based on the first data key; an encryption module, configured to encrypt first user data of the user account using the first data key to obtain first encrypted user data; a generating module, configured to generate first shared user data based on the first encrypted user data and the first encrypted data key; as well as The transmission module is configured to transmit the first shared user data to a server device connected to the first client device, so as to share the first user data with a second client device connected to the server device via the server device.

15. An electronic device, comprising: at least one processing unit; as well as At least one memory, the at least one memory being coupled to the at least one processing unit and storing instructions for execution by the at least one processing unit, the instructions causing the electronic device to perform the method according to any one of claims 1 to 13 when executed by the at least one processing unit.

16. A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, causes the processor to implement the method according to any one of claims 1 to 13.

Images