Data protection method, terminal, system, storage medium and computer program product

Abstract

The invention provides a data protection method, a terminal, a system, a storage medium and a computer program product. The method comprises the steps that a first client and a second client establish pipeline connection through a server; the first client sends a shared data access request to the second client through the pipeline connection; wherein the shared data is encrypted data; and the first client receives the first key information corresponding to the shared data sent by the second client through the pipeline connection, and decrypts and accesses the shared data by using the first key information. According to the embodiment of the invention, in the process of controlling the permission of the first client to use the shared data through the second client, the message is transmitted through the pipeline connection and cannot be recorded by the cache of each terminal, so that the message cannot be monitored and tampered, and the communication security between the first client and the second client is ensured.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to a data protection method, terminal, system, storage medium and computer program product. Background Art

[0002] The security protection of shared confidential data accessed by computers is a matter of great concern to people, and the secure encryption of shared confidential data is the most effective means of data security protection. However, files encrypted by traditional encryption technology must be decrypted before they can be used. According to confidentiality specifications, when viewing an encrypted file, it must go through the process of decrypting it into plain text, viewing the plain text, and deleting the plain text. If an encrypted file needs to be modified, it is necessary to go through the process of decrypting the ciphertext, modifying the plain text, saving the plain text, and encrypting the plain text. The extra work caused by file encryption and decryption will slow down the computer and reduce the user experience. In the process of using the application, it is inevitable to involve the issue of whether it is confidential. There is no relatively complete system solution for the behavior control of confidential data. Therefore, it is necessary to provide a data protection method to ensure the interaction security between the computer and the mobile client. Summary of the invention

[0003] In view of at least one of the above technical problems existing in the prior art, this application is proposed. According to one aspect of this application, a data protection method is provided, which is applied to a first client, and the method includes:

[0004] The first client and the second client establish a pipeline connection through the server;

[0005] The first client sends a shared data access request to the second client through the pipeline connection; wherein the shared data is encrypted data;

[0006] The first client receives the first key information corresponding to the shared data sent by the second client through the pipeline connection, and uses the first key information to decrypt and access the shared data.

[0007] In some embodiments, the pipe connection includes a connection between the second client and a first pipe, and a connection between the first client and a second pipe; the first pipe is used by the second client to send messages to the first client, and is used by the first client to read messages; the second pipe is used by the first client to send messages to the second client, and is used by the second client to read messages.

[0008] In some embodiments, the first client and the second client establish a pipeline connection through the server, including:

[0009] The first client generates a first graphic code so that the second client authorizes the establishment of the pipeline connection by scanning the first graphic code.

[0010] In some embodiments, the first client and the second client establish a pipeline connection through the server, including:

[0011] The first client applies for a first pipeline from the server, and receives a universal unique identification code of the first pipeline returned by the server;

[0012] The first client generates a first graphic code so that the second client is authorized to use the universal unique identifier to log in to the first pipe through the first graphic code, and writes a confirmation message to the first pipe in a first data format; wherein the first graphic code includes the universal unique identifier and the first data format;

[0013] The first client polls and reads the confirmation message at a first preset time interval, and removes the confirmation message from the first pipeline within a second preset time interval; wherein the confirmation message represents the connection status between the second client and the first pipeline;

[0014] The first client polls and reads the connection message at a first preset time interval to obtain authorization to use the second pipe, and removes the connection message from the first pipe at a second preset time interval; wherein the second pipe is applied for by the second client to the server; the connection message includes a second data format, and the second data format is used by the first client to write a message to the second pipe;

[0015] The first client writes notifications of having removed the confirmation message and the connection message into the second pipe in the second data format, so that the second client obtains the connection status between the first client and the second pipe through the notifications.

[0016] In some embodiments, wherein

[0017] If the confirmation message or the connection message is not removed from the first pipeline by the first client within the second preset time interval, the confirmation message or the connection message will be re-delivered to the first pipeline by the server.

[0018] In some embodiments, the first client sends the shared data access request to the second client through the pipe connection, including:

[0019] The first client writes the shared data access request to the second pipe in a second data format, so that the second client obtains the shared data access request when polling the second pipe.

[0020] In some embodiments, the first client receives the first key information corresponding to the shared data sent by the second client through the pipeline connection, and uses the first key information to decrypt and access the shared data, including:

[0021] The first client polls the first pipeline at a first preset time interval to receive response data sent by the second client;

[0022] The first client obtains the permission to access the shared data based on the response data, and accesses the shared data based on the permission; wherein the response data includes any one of the following: plain text of the first key used to decrypt the shared data, ciphertext obtained by encrypting the plain text with the transmission key, key information used to generate the first key, or ciphertext obtained by encrypting the key information with the transmission key;

[0023] The first client removes the response data in the first pipeline within a second preset time interval.

[0024] In some embodiments, the method further comprises:

[0025] After the first client polls the first pipeline at a first preset time interval, the first client stores the response data in a local memory;

[0026] The first client polls and reads the permission cancellation notification in the first pipeline;

[0027] The first client deletes the transmission key and / or the first key information stored in the local memory based on the notification of revoking the authority.

[0028] In some embodiments, the method further comprises:

[0029] The first client obtains a token sent by the second client through the first pipeline; wherein the token is applied for by the second client and is used for identity authentication when the first client or the second client sends a request to the server.

[0030] In some embodiments, the method further comprises:

[0031] The first client sends a first heartbeat packet to the second pipeline in the second data format at a first preset time interval, and polls the first pipeline at the first preset time interval to read a second heartbeat packet sent by the second client.

[0032] In some embodiments, the method further comprises:

[0033] The first client writes a notification of logging out of the second pipeline into the second pipeline, so that the second client can learn the exit status of the first client by polling the second pipeline.

[0034] In some embodiments, when the first client is offline, the pipeline connection is disconnected, and the first client generates a new first graphic code so that the second client rescans the new first graphic code to re-establish a new pipeline connection; and / or,

[0035] When the first client is in an online state and the second client is in an offline state, the universal unique identifier of the first pipe and the first data format are stored locally in the second client, so that the second client can maintain a pipe connection with the first client when switching to an online state.

[0036] In some embodiments, the method further comprises:

[0037] The first client generates a second graphic code, wherein the second graphic code includes a creation request, and the creation request is used to request to create a new shared folder;

[0038] The first client polls the first pipeline to obtain the second key information corresponding to the new shared folder; the second key information is written into the first pipeline by the second client in response to the creation request, and the creation request is obtained by the second client by scanning the second graphic code;

[0039] The first client creates a new shared file based on the second key information.

[0040] Another aspect of the present application embodiment provides a data protection method, which is applied to a second client, and the method includes:

[0041] The second client establishes a pipeline connection with the first client via the server;

[0042] The second client receives the shared data access request sent by the first client through the pipeline connection; wherein the shared data is encrypted data;

[0043] The second client sends the first key information corresponding to the shared data through the pipeline connection, so that the first client decrypts and accesses the shared data using the first key information.

[0044] In some embodiments, the pipeline connection includes a connection between the second client and the first pipeline, and a connection between the first client and the second pipeline; the first pipeline is used by the second client to send a message to the first client, and is used by the first client to read a message; the second pipeline is used by the first client to send a message to the second client, and is used by the second client to read a message

[0045] In some embodiments, the second client establishes a pipeline connection with the first client through the server, including:

[0046] The second client is authorized to establish the pipeline connection by scanning a first graphic code; wherein the first graphic code is generated by the first client.

[0047] In some embodiments, the second client establishes a pipeline connection with the first client through the server, including:

[0048] The second client is authorized to use the unique identification code to log in to the first pipeline by scanning the first graphic code, and writes a confirmation message to the first pipeline in a first data format, so that the first client knows the connection status between the second client and the first pipeline; wherein the first pipeline is applied for by the first client to the server, the universal unique identification code is used to log in to the first pipeline, and the first graphic code includes the universal unique identification code and the first data format; wherein the confirmation message will be removed from the first pipeline by the first client at a second preset time interval;

[0049] The second client applies for a second channel from the server, and receives a universal unique identifier corresponding to the second channel returned by the server;

[0050] The second client writes a connection message to the first pipe in the first data format, the connection message including a second data format; wherein the second data format is adopted by the first client to write a message to the second pipe, and the connection message will be removed from the first pipe by the first client at a second preset time interval;

[0051] The second client polls the second pipe to obtain a notification that the confirmation message and the connection message have been removed, and obtains a connection status between the first client and the second pipe through the notification.

[0052] In some embodiments, wherein

[0053] If the confirmation message or the connection message is not removed from the first pipeline by the first client within the second preset time interval, the confirmation message or the connection message will be re-delivered to the first pipeline by the server.

[0054] In some embodiments, the second client receives the shared data access request sent by the first client through the pipe connection, including:

[0055] The second client polls the second pipe at a first preset time interval to receive a shared data access request written by the first client in the second data format.

[0056] In some embodiments, the second client sends the first key information corresponding to the shared data through the pipe connection, so that the first client decrypts and accesses the shared data using the first key information, including:

[0057] The second client generates response data based on the shared data access request; wherein the response data includes any one of the following: plain text of the first key used to decrypt the shared data, ciphertext obtained by encrypting the plain text with the transmission key, key information used to generate the first key, or ciphertext obtained by encrypting the key information with the transmission key;

[0058] The second client writes the response data into the first pipe in a second data format so that the first client obtains permission to access the shared data based on the response data; wherein the response data in the first pipe will be removed by the first client within a second preset time interval.

[0059] In some embodiments, the method further comprises:

[0060] The second client writes a notification of revoking permissions into the first pipe, so that the first client deletes the transmission key and / or the first key information stored in the local memory based on the notification of revoking permissions.

[0061] In some embodiments, the method further comprises:

[0062] The second client applies for and obtains a token from the server;

[0063] The second client writes the token into the first pipeline so that the first client obtains the token; wherein the token is used for identity authentication when the first client or the second client sends a request to the server.

[0064] In some embodiments, the method further comprises:

[0065] The second client sends a first heartbeat packet to the first pipeline in the first data format at a first preset time interval, and polls the second pipeline at the first preset time interval to read a second heartbeat packet sent by the first client.

[0066] In some embodiments, the second client polls and reads the second pipe to obtain a notification of the first client's logout and a logout status of the first client.

[0067] In some embodiments, when the first client is offline, the pipeline connection is disconnected, and the second client re-establishes a new pipeline connection by scanning a new first graphic code generated by the first client; and / or,

[0068] When the second client is in an offline state and the first client is in an online state, when the second client switches to an online state, the second client maintains a pipeline connection with the first client through the universal unique identification code of the first pipeline and the first data format pre-stored locally.

[0069] In some embodiments, the method further comprises:

[0070] The second client creates a new shared folder and second key information of the new shared folder on the server according to the instruction to create a new shared folder.

[0071] In some embodiments, the second client obtains a request to create a new shared folder by scanning a second graphic code;

[0072] In response to the request to create a new shared folder, the second client writes the second key information corresponding to the new shared folder into the first pipe, so that the first client creates a new shared file based on the second key information.

[0073] On the other hand, the embodiments of the present application provide a terminal, wherein the terminal includes:

[0074] A memory and a processor, wherein the memory stores a computer program executed by the processor, and when the computer program is executed by the processor, the processor executes the data protection method as described above.

[0075] Another aspect of the present application embodiment provides a data protection system, the system comprising a first client, a second client and a server; wherein:

[0076] The first client is used to establish a pipeline connection with the second client through the server, and send a shared data access request to the second client through the pipeline connection, and receive the first key information corresponding to the shared data sent by the second client through the pipeline connection, and use the first key information to decrypt and access the shared data; wherein the shared data is encrypted data;

[0077] The second client is used to establish the pipeline connection with the first client through the server, and receive the shared data access request sent by the first client through the pipeline connection; send the first key information corresponding to the shared data through the pipeline connection, so that the first client decrypts and accesses the shared data using the first key information;

[0078] The server is configured to send a universal unique identifier of a first pipeline and a universal unique identifier of a second pipeline to the first client and the second client respectively according to applications for creating a pipeline from the first client and the second client, so that the first client and the second client establish a pipeline connection;

[0079] The server is further configured to receive a data access request from the first client and / or the second client, and authenticate the first client and / or the second client according to a token carried in the data access request.

[0080] On another aspect, an embodiment of the present application provides a storage medium, on which a computer program is stored. When the computer program is executed by a processor, the processor executes the data protection method as described above.

[0081] Another aspect of the embodiments of the present application provides a computer program product, which implements the data protection method as described above when the computer program is executed by a processor.

[0082] In the process of controlling the permission of the first client to use shared data through the second client in the embodiment of the present application, the message is transmitted through the pipeline connection and will not be recorded by the cache of each terminal (the client is installed on the terminal), thereby ensuring that the message cannot be monitored and tampered with, and ensuring the security of communication between the first client and the second client. BRIEF DESCRIPTION OF THE DRAWINGS

[0083] Figure 1 A schematic flow chart showing a data protection method according to an embodiment of the present application;

[0084] Figure 2 A schematic flow chart of step S101 according to an embodiment of the present application is shown;

[0085] Figure 3 A schematic flow chart showing step S101 according to another embodiment of the present application is shown;

[0086] Figure 4 A schematic flowchart of step S102 according to an embodiment of the present application is shown;

[0087] Figure 5 A schematic flowchart of step S103 according to an embodiment of the present application is shown;

[0088] Figure 6 A schematic flow chart showing how to cancel the permission for a first client to access shared data according to an embodiment of the present application;

[0089] Figure 7 A schematic flow chart showing a first pipeline acquiring a token according to an embodiment of the present application is shown;

[0090] Figure 8 A schematic flow chart showing a first client and a second client sending a heartbeat packet at a first preset time interval according to an embodiment of the present application;

[0091] Fig. 9 A schematic flowchart showing a first client logging out according to an embodiment of the present application is shown;

[0092] Fig.10 A schematic flow chart showing how to create a new shared folder for a first client according to an embodiment of the present application is shown;

[0093] Fig.11 A schematic flow chart showing the second client authorizing the first client to create a new shared folder according to an embodiment of the present application;

[0094] Fig.12 A schematic diagram showing a first client and a second client interacting through a pipe connection of a server according to an embodiment of the present application;

[0095] Fig.13 A schematic block diagram of a data protection system according to an embodiment of the present application is shown;

[0096] Fig.14 A schematic block diagram of a terminal according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0097] In order to enable those skilled in the art to better understand the technical solutions of the embodiments of the present application, the present application is described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0098] Based on at least one of the aforementioned technical problems, an embodiment of the present application provides a data protection method, which is applied to a first client, and the method includes: the first client and the second client establish a pipeline connection through a server; the first client sends a shared data access request to the second client through the pipeline connection; wherein the shared data is encrypted data; the first client receives the first key information corresponding to the shared data sent by the second client through the pipeline connection, and uses the first key information to decrypt and access the shared data.

[0099] An embodiment of the present application also provides a data protection method, which is applied to a second client, and the method includes: the second client establishes a pipeline connection with the first client through a server; the second client receives a shared data access request sent by the first client through the pipeline connection; wherein the shared data is encrypted data; the second client sends first key information corresponding to the shared data through the pipeline connection, so that the first client uses the first key information to decrypt and access the shared data.

[0100] In the embodiment of the present application, the permission of the first client to use the shared data is controlled by the second client, and in this process, the message is transmitted through the pipeline connection and will not be recorded by the cache of each terminal (the client is installed on the terminal), which ensures that the message cannot be monitored and tampered with, ensures the communication security between the first client and the second client, and thus improves the security of the shared data when it is accessed by the first client.

[0101] Figure 1 A schematic flow chart showing a data protection method according to an embodiment of the present application; Fig.12 A schematic diagram showing a first client and a second client interacting through a pipe connection of a server according to an embodiment of the present application. Figure 1 and Fig.12 As shown, the data protection method 100 according to the embodiment of the present application may include the following steps S101, S102 and S103:

[0102] In step S101, the first client and the second client establish a pipeline connection through a server.

[0103] The pipeline connection includes a connection between the second client and the first pipeline, and a connection between the first client and the second pipeline; the first pipeline is used by the second client to send messages to the first client, and is used by the first client to read messages; the second pipeline is used by the first client to send messages to the second client, and is used by the second client to read messages.

[0104] For example, the first client is installed on terminals such as computers (Personal Computer, PC), laptops, smart phones, tablet computers, smart watches, etc., and the second client is installed on mobile terminals such as smart phones, tablet computers, smart watches, computers (Personal Computer, PC), laptops, etc. For example, the first client is the computer version application MiKey (a platform software product that provides users with functions such as data security sharing), and the second client is the mobile version application MiKey.

[0105] The embodiment of the present application takes the example that the first client is installed on a computer (Personal Computer, PC) and the second client is installed on a smart phone to introduce the technical solution of the present application.

[0106] The server of the embodiment of the present application is configured with pipeline logic. After the first client and the second client establish a pipeline connection through the server, the two clients can use the pipeline logic of the server to send messages to each other for communication, thereby performing implicit information interaction, thereby ensuring the security of the interaction between the first client and the second client.

[0107] In one embodiment of the present application, Figure 2 As shown, the first client and the second client in step S101 establish a pipeline connection through the server, including step S201:

[0108] In step S201, the first client generates a first graphic code, so that the second client authorizes the establishment of the pipeline connection by scanning the first graphic code.

[0109] For example, the first graphic code may include a one-dimensional barcode, a two-dimensional barcode (also called a QR code), a three-dimensional code, or other graphic codes.

[0110] In one example, if Figure 3 As shown, the first client and the second client in step S101 establish a pipeline connection through the server, including steps S301, S302, S303, S304 and S305:

[0111] Step S301, the first client applies for a first channel from a server, and receives a universal unique identification code of the first channel returned by the server;

[0112] Step S302, the first client generates a first graphic code, so that the second client is authorized to use the universal unique identifier to log in to the first pipe through the first graphic code, and writes a confirmation message to the first pipe in a first data format; wherein the first graphic code includes the universal unique identifier and the first data format;

[0113] Step S303: the first client polls and reads the confirmation message at a first preset time interval, and removes the confirmation message from the first pipeline within a second preset time interval; wherein the confirmation message represents the connection status between the second client and the first pipeline;

[0114] Step S304: the first client polls and reads the connection message at a first preset time interval to obtain authorization to use the second pipe, and removes the connection message from the first pipe at a second preset time interval; wherein the second pipe is applied for by the second client to the server; the connection message includes a second data format, and the second data format is used by the first client to write a message to the second pipe;

[0115] Step S305: the first client writes notifications of the removal of the confirmation message and the connection message into the second pipe in the second data format, so that the second client obtains the connection status between the first client and the second pipe through the notifications.

[0116] Wherein, if the confirmation message or the connection message is not removed from the first pipeline by the first client within the second preset time interval, the confirmation message or the connection message will be re-delivered to the first pipeline by the server.

[0117] At the same time, the first client installed on the computer (Personal Computer, PC) and the second client installed on the smart phone can complete display interaction after logging in. That is, any access and / or read and write operation performed by the first client on the shared data will be displayed on the display interface of the second client.

[0118] In one example, the process of establishing a pipe connection between a first client and a second client is as follows:

[0119] In the first step, the first client applies for the first pipeline from the server, and the server returns the universally unique identifier (UUID) of the first pipeline.

[0120] In the second step, the first client generates a QR code for the second client to scan the first graphic code to obtain the first data format, wherein the first data format can be defined by the first client according to actual needs.

[0121] For example, the first data format is as follows:

[0122] platform from type, client version, pipeline uuid, random (8 bytes base64) eg: "2,1,6ab01a5a-4412-4ae8-b67e-59a9ed1c9e01,MTIzNDU2Nzg=".

[0123] The code obtained after compiling the information in the QR code is as follows:

[0124]

[0125]

[0126] Among them, platform type can represent the system type of the computer or mobile phone. For example, the system type can be any of the following: Microsoft Windows system, Android system, Apple IOS system, macOS system or Linux system. If both parties agree that 0 represents an unknown system, 1 represents an Android system, 2 represents an IOS system, 3 represents a macOS system, 4 represents a Windows system, and 5 represents a Linux system, then the number 2 in the above message indicates that the system type of the first client is an IOS system.

[0127] The client version may be the version information of the first client. For example, the version information in the above message is 1, and if the version information represented by 1 is 0x102, then the version information of the above first client is 0x102.

[0128] The pipeline uuid may represent a universally unique identifier (UUID) of the first pipeline. For example, the universally unique identifier (UUID) obtained after the above message is compiled is 389a9361-8160-4391-82f5-d59fa9ef307a.

[0129] Random can represent a random number. For example, the random number of the above message is MTIzNDU2Nzg.

[0130] In the third step, the second client scans the QR code, obtains the first data format, and then writes a confirmation message to the first pipeline of the first client using the first data format. For example, the confirmation message is:

[0131] {protocol:1

[0132] type:1

[0133] status:0 / / 0, scan code successful, waiting for confirmation, 1 login denied}

[0134] Among them, protocol indicates the version number of the protocol, and status indicates the login status. For status, a value of 0 indicates that the code is scanned successfully and waiting for confirmation; a value of 1 indicates that the login is rejected. In the above message, status 0 indicates that the second client scans the code successfully and waits for confirmation from the first client.

[0135] In step 4, the first client polls the first pipeline to obtain a confirmation message and a login status. The first client removes the confirmation message from the first pipeline within 30 seconds.

[0136] In one example, if the message in the pipeline has not been read for a long time, the client may fail to read the message. To prevent this and ensure the reliability of communication between the two parties, the server can re-put the message into the pipeline.

[0137] The client can write messages to the pipeline continuously. Since the first pipeline and the second pipeline are both stored in the server's memory, the storage space of the server's memory is limited. If too many messages are stored, the server's operating space will be under pressure, which may cause message congestion in severe cases. Therefore, in order to reduce the operating space pressure on the server, the client can remove the message within a certain period of time after the message is written to the pipeline. After removing the message, the notification of the message removal is written to the other party's pipeline so that the other party knows that the message has been read based on the notification of the message removal. The above-mentioned time interval for reading messages can be set according to actual needs. For example, it is set to 30 seconds.

[0138] Obviously, since the time interval for reading messages is also the time interval for each polling, this time interval should be less than the time interval for removing messages. For example, the polling time interval is 5 seconds, and the time interval for removing messages is 30 seconds. This ensures that the client reads the message and can remove the message in time, reducing the storage pressure on the server.

[0139] For example, the first client may confirm by removing the message from the first pipe and writing a notification of the removal into the second pipe. After the second client reads the notification of the removal from the second pipe, it indicates that the first client has confirmed and the pipes of both parties are connected successfully.

[0140] In addition, the above-mentioned first pipeline and second pipeline can be stored in the memory of the server, so that the first client and the second client exchange information through the pipeline of the server, thereby ensuring the security of the interactive information.

[0141] Accordingly, when the second client establishes a pipeline connection with the first client through the server, the connection process may include:

[0142] In the first step, the second client applies for a second pipeline from the server, and receives a universally unique identifier (UUID) of the second pipeline returned by the server.

[0143] In the second step, the second client assembles data in a second format, and the second data format is used by the first client to write a message to the second pipe. The second data format includes information about a universally unique identifier (UUID) of the second pipe.

[0144] In the third step, the second client uses the transmission key to encrypt the plaintext of the first key of the shared data to obtain the ciphertext of the plaintext. For example, the transmission key uses random to generate the ciphertext through the pbkdf2 algorithm.

[0145] In the fourth step, the second client writes a confirmation message to the first pipeline. The confirmation message may include a second data format so that the first client can write a message to the second pipeline using the second data format. This means that the first client is authorized to use the second pipeline.

[0146] In step S102, the first client sends a shared data access request to the second client through the pipe connection.

[0147] Wherein, the shared data is encrypted data.

[0148] For example, shared data may include shared folders and shared files.

[0149] In one embodiment of the present application, Figure 4 As shown, the first client in step S102 sends the shared data access request to the second client through the pipeline connection, including step S401:

[0150] In step S401, the first client writes the shared data access request to the second pipe in a second data format, so that the second client obtains the shared data access request when polling the second pipe.

[0151] In step S103, the first client receives the first key information corresponding to the shared data sent by the second client through the pipeline connection, and uses the first key information to decrypt and access the shared data.

[0152] In the above message, secrets indicates the keys of different file directories. The first client can decrypt and view the files corresponding to the keys given by the second client.

[0153] In the embodiment of the present application, the second client has access rights to all shared data within the current user's permission range, and can obtain access rights to all shared data, so the second client can control the access rights of the first client. This method refines the management function of the second client's access rights to the shared data of the first client, and at the same time, when the first client and the second client interact, since the messages are all exchanged within the server, the security of the message interaction is also guaranteed.

[0154] In one embodiment of the present application, Figure 5 As shown, in step S103, the first client receives the first key information corresponding to the shared data sent by the second client through the pipeline connection, and uses the first key information to decrypt and access the shared data, including steps S501, S502 and S503:

[0155] In step S501, the first client polls the first pipeline at a first preset time interval to receive response data sent by the second client;

[0156] In step S502, the first client obtains permission to access the shared data based on the response data, and accesses the shared data based on the permission;

[0157] In step S503, the first client removes the response data in the first pipeline within a second preset time interval.

[0158] The response data includes any one of the following: plain text of the first key used to decrypt the shared data, ciphertext obtained by encrypting the plain text with the transmission key, key information used to generate the first key, or ciphertext obtained by encrypting the key information with the transmission key;

[0159] That is, the response data may include multiple implementations of the first key information. The implementation of the first key information includes at least one of the following:

[0160] (1) The plain text of the first key used to decrypt the shared data. At this time, the shared data is the data encrypted by the first key.

[0161] (2) The ciphertext obtained by encrypting the plaintext of the first key with the transmission key.

[0162] (3) Some key information used to generate the first key. The first client can calculate the first key based on the key information and then decrypt the shared data.

[0163] (4) The ciphertext obtained by encrypting the key information with the transmission key.

[0164] In one embodiment of the present application, Figure 6 , which is a schematic flow chart of canceling the first client's permission to access shared data. The method further includes steps S601, S602, and S603:

[0165] In step S601, the first client stores the response data in a local memory after polling the first pipeline at a first preset time interval;

[0166] In step S602, the first client polls and reads the permission cancellation notification in the first pipeline;

[0167] In step S603, the first client deletes the transmission key and / or the first key information stored in the local memory based on the notification of revoking the authority.

[0168] In an embodiment of the present application, when the first client cancels the permission to access a certain folder, the second client writes a notification of permission cancellation into the first pipeline, and the first client deletes the transmission key and / or the first key information stored in the local memory based on the notification of permission cancellation. For example, when the second client writes ciphertext encrypted by the transmission key into the first pipeline of the first client, the first client deletes the ciphertext pre-stored in the local memory. This method does not require multiple information exchanges and is relatively simple to implement.

[0169] In one embodiment of the present application, Figure 7 The method further comprises step S701:

[0170] In step S701, the first client obtains a token sent by the second client through the first pipeline; wherein the token is applied for by the second client to the server and is used for identity authentication when the first client or the second client sends a request to the server.

[0171] In the embodiment of the present application, the token is applied for by the second client to the server, and the token can be used to verify the identity information of the client (including the first client and the second client) when the client (including the first client and the second client) sends a request to the server. When the client (including the first client and the second client) sends a request to the server, the token can be placed in the header information of the request.

[0172] After the second client applies for a token from the server, it can send the token to the first client through a pipeline connection. In one example, the token can be carried in the above connection message and sent to the first client, or a special message can be written into the first pipeline so that the first client obtains the token.

[0173] In an embodiment of the present application, the first client and the second client share a token, so when the second client logs out, the token of the first client will also become invalid, and the first client will also log out. This ensures that the second client has absolute control over the server access rights of the first client, that is, when the second client logs out, the token becomes invalid, and the token of the first client also becomes invalid. Since the first client loses the token, it no longer has the right to access the shared data of the server, and therefore cannot access the shared data of the server. Only when the second client logs in and the token is valid can the first client access the shared data of the server, thus achieving the absolute control of the second client over the server access rights of the first client.

[0174] In one embodiment of the present application, Figure 8 As shown, a schematic flow chart of the first client and the second client sending heartbeat packets at a first preset time interval. The method further includes step S801:

[0175] In step S801, the first client sends a first heartbeat packet to the second pipe in the second data format at a first preset time interval, and polls the first pipe at the first preset time interval to read a second heartbeat packet sent by the second client.

[0176] In an embodiment of the present application, the first client and the second client need to ensure the heartbeat packet to ensure that the communication between the first client and the second client is not interrupted. In one example, the first client and the second client can use a timer to poll the messages in the pipeline of each end. For example, every 5 seconds, the first client and the second client poll the messages in their own pipelines. The interaction between the first client and the second client has good real-time performance through the above-mentioned heartbeat packet and timed polling.

[0177] In one embodiment of the present application, Fig. 9 The method further comprises step S901:

[0178] In step S901, the first client writes a notification of logging out of the second pipeline into the second pipeline, so that the second client can learn the exit status of the first client by polling the second pipeline.

[0179] In one embodiment of the present application, when the first client is offline, the pipeline connection is disconnected, and the first client generates a new first graphic code so that the second client rescans the new first graphic code to re-establish a new pipeline connection.

[0180] In another embodiment of the present application, when the first client is in an online state and the second client is in an offline state, the universal unique identifier of the first pipe and the first data format are stored locally in the second client, so that the second client can maintain a pipe connection with the first client when switching to an online state.

[0181] For example, when the first client polls the first pipeline, it reads the transmission key written by the second client and stores the transmission key in the local memory. When the first client is offline and changes from offline to online, it will reapply for the first pipeline and generate a first graphic code containing the first pipeline UUID and the first data format. The second client rescans the first graphic code to obtain authorization to log in to the new first pipeline. This ensures the second client's permission to access the shared folder of the first client, and also ensures the security of the interaction between the second client and the first client.

[0182] In one embodiment of the present application, Fig.10 The method further comprises steps S1001, S1002 and S1003:

[0183] In step S1001, the first client generates a second graphic code, wherein the second graphic code includes a creation request, and the creation request is used to request to create a new shared folder;

[0184] In step S1002, the first client polls the first pipe to obtain second key information corresponding to the new shared folder; the second key information is written into the first pipe by the second client in response to the creation request, and the creation request is obtained by the second client by scanning the second graphic code;

[0185] In step S1003, the first client creates a new shared file based on the second key information.

[0186] In the embodiment of the present application, the first client and the second client have different permissions to create new shared files. When the first client needs to create a new shared folder, it needs to obtain authorization from the second client. However, when the second client needs to create a new shared folder, it can directly create a new shared folder on the server without obtaining authorization from other clients.

[0187] In one embodiment of the present application, Fig.11 As shown, a schematic flow chart of the second client authorizing the first client to create a new shared folder. The method further includes step S1101 and step S1102:

[0188] In step S1101, the second client obtains a request to create a new shared folder by scanning a second graphic code;

[0189] In step S1102, in response to the request to create a new shared folder, the second client writes the second key information corresponding to the new shared folder into the first pipe, so that the first client creates a new shared file based on the second key information.

[0190] In addition, in one example, the first client may generate a third data format, so that the second client may write a response to the request to create a new shared folder to the first pipe in the third data format, so as to distinguish different types of messages written in the first data format.

[0191] For example, when the first client creates a new shared folder, it needs to assemble its own information first, which may include information such as the name of the new shared folder. The first client then generates a second graphic code (for example, a one-dimensional barcode, a two-dimensional barcode, or a three-dimensional code), where the second graphic code includes a request to create a new shared folder and may also include a third data format. The second client obtains the first client's request to create a new shared folder by scanning the second graphic code. After the second client generates the second key information for the new shared folder, it transmits the second key information to the first pipeline of the first client. The first client polls the pipeline, and after obtaining the second key information, it can perform the operation of creating a new shared folder.

[0192] The second key information may include at least one of the following:

[0193] (1) The plain text of the second key used to decrypt the new shared folder. At this time, the shared data is the shared folder encrypted by the second key.

[0194] (2) The ciphertext obtained by encrypting the plaintext of the second key with the transmission key.

[0195] (3) Some key information used to generate the second key. The first client can calculate the second key based on the key information and then decrypt the shared data folder.

[0196] (4) The ciphertext obtained by encrypting the key information with the transmission key.

[0197] When the second client needs to create a new shared folder, it can directly create a new shared folder on the server side without obtaining authorization from other clients. For example, the second client creates a new shared folder and the second key information of the new shared folder on the server side according to the instruction to create a new shared folder. When the first client sends a request to access the new shared folder through the pipeline connection, the second client can send the second key information corresponding to the new shared folder to the first pipeline through the pipeline connection, so that the first client can access the new shared folder according to the second key information.

[0198] In the process of controlling the permission of the first client to use shared data through the second client in the embodiment of the present application, the message is transmitted through the pipeline connection and will not be recorded by the cache of each terminal (the client is installed on the terminal), thereby ensuring that the message cannot be monitored and tampered with, and ensuring the security of communication between the first client and the second client.

[0199] The present application also provides a data protection system. Fig.13As shown, the data protection system 1300 includes a first client 1301, a second client 1302 and a server 1303.

[0200] The first client 1301 is used to establish a pipeline connection with the second client through the server, and send a shared data access request to the second client through the pipeline connection, and receive the first key information corresponding to the shared data sent by the second client through the pipeline connection, and use the first key information to decrypt and access the shared data; wherein the shared data is encrypted data;

[0201] The second client 1302 is used to establish the pipeline connection with the first client through the server, and receive the shared data access request sent by the first client through the pipeline connection; send the first key information corresponding to the shared data through the pipeline connection, so that the first client decrypts and accesses the shared data using the first key information;

[0202] The server 1303 is used to send the first pipeline universal unique identifier and the second pipeline universal unique identifier to the first client and the second client respectively according to the pipeline creation application of the first client and the second client, so that the first client and the second client establish a pipeline connection;

[0203] The server 1303 is further configured to receive a data access request from the first client and / or the second client, and authenticate the first client and / or the second client according to a token carried in the data access request.

[0204] The various pipelines in the embodiment of the present application are independent of each other, and disconnection or delay of any pipeline will not affect other pipelines, thereby ensuring the stability of the entire system.

[0205] Combine the following Fig.14 The terminal of the present application is described, wherein: Fig.14 A schematic block diagram of a terminal according to an embodiment of the present application is shown.

[0206] like Fig.14 As shown, the terminal 1400 includes: one or more memories 1401 and one or more processors 1402, and the memory 1401 stores a computer program executed by the processor 1402. When the computer program is executed by the processor 1402, the processor 1402 executes the design method of the power device layout described above.

[0207] The terminal 1400 may be part or all of a computer device that can implement the method for designing a power device layout through software, hardware, or a combination of software and hardware.

[0208] like Fig.14 As shown, the terminal 1400 includes one or more memories 1401, one or more processors 1402, a display (not shown), and a communication interface, etc. These components are interconnected through a bus system and / or other forms of connection mechanisms (not shown). It should be noted that Fig.14 The components and structure of the terminal 1400 shown are merely exemplary and non-limiting. The terminal 1400 may also have other components and structures as required.

[0209] The memory 1401 is used to store various data and executable program instructions generated during the operation of the relevant train, such as for storing various application programs or algorithms for implementing various specific functions. It may include one or more computer program products, and the computer program product may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, a random access memory (RAM) and / or a cache memory (cache), etc. The non-volatile memory may include, for example, a read-only memory (ROM), a hard disk, a flash memory, etc.

[0210] Processor 1402 may be a central processing unit (CPU), a graphics processing unit (GPU), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other forms of processing units having data processing capabilities and / or instruction execution capabilities, and may be other components in terminal 1400 to perform desired functions.

[0211] In one example, the terminal 1400 also includes an output device that can output various information (such as images or sounds) to the outside (such as a user), and can include one or more of a display device, a speaker, etc.

[0212] The communication interface can be an interface of any currently known communication protocol, such as a wired interface or a wireless interface, wherein the communication interface may include one or more serial ports, USB interfaces, Ethernet ports, WiFi, wired networks, DVI interfaces, device integrated interconnect modules or other suitable ports, interfaces, or connections.

[0213] In addition, according to an embodiment of the present application, a storage medium is also provided, on which program instructions are stored, and when the program instructions are run by a computer or a processor, the corresponding steps of the design method of the power device layout of the embodiment of the present application are executed. The storage medium may include, for example, a memory card of a smart phone, a storage component of a tablet computer, a hard disk of a personal computer, a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a portable compact disk read-only memory (CD-ROM), a USB memory, or any combination of the above storage media.

[0214] An embodiment of the present application also provides a computer program product, which implements the data protection method as described above when the computer program is executed by a processor.

[0215] The data protection system, terminal, storage medium and computer program product of the embodiments of the present application have the same advantages as the aforementioned data protection method because they can implement the aforementioned data protection method.

[0216] Although example embodiments have been described herein with reference to the accompanying drawings, it should be understood that the above example embodiments are merely exemplary and are not intended to limit the scope of the present application to this. Those of ordinary skill in the art may make various changes and modifications therein without departing from the scope and spirit of the present application. All these changes and modifications are intended to be included within the scope of the present application as required by the appended claims.

[0217] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0218] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of the units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed.

[0219] In the description provided herein, a large number of specific details are described. However, it is understood that the embodiments of the present application can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0220] Similarly, it should be understood that in order to streamline the present application and help understand one or more of the various inventive aspects, in the description of the exemplary embodiments of the present application, the various features of the present application are sometimes grouped together into a single embodiment, figure, or description thereof. However, the method of the present application should not be interpreted as reflecting the following intention: the claimed application requires more features than the features clearly stated in each claim. More specifically, as reflected in the corresponding claims, the inventive point is that the corresponding technical problem can be solved with features less than all the features of a single disclosed embodiment. Therefore, the claims following the specific embodiment are hereby explicitly incorporated into the specific embodiment, wherein each claim itself serves as a separate embodiment of the present application.

[0221] It will be understood by those skilled in the art that, except for mutually exclusive features, all features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed in this specification may be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature that provides the same, equivalent or similar purpose.

[0222] In addition, those skilled in the art will appreciate that, although some embodiments described herein include certain features included in other embodiments but not other features, the combination of features of different embodiments is meant to be within the scope of the present application and form different embodiments. For example, in the claims, any one of the claimed embodiments can be used in any combination.

[0223] The various component embodiments of the present application can be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that a microprocessor or digital signal processor (DSP) can be used in practice to implement some or all functions of some modules according to the embodiments of the present application. The application can also be implemented as a device program (e.g., computer program and computer program product) for executing a part or all of the methods described herein. Such a program implementing the present application can be stored on a computer-readable medium, or can have the form of one or more signals. Such a signal can be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0224] It should be noted that the above embodiments illustrate the present application rather than limit the present application, and that those skilled in the art may design alternative embodiments without departing from the scope of the appended claims. In the claims, any reference symbol between brackets should not be constructed as a limitation to the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "one" or "an" preceding an element does not exclude the presence of multiple such elements. The present application may be implemented by means of hardware including several different elements and by means of a suitably programmed computer. In a unit claim that lists several devices, several of these devices may be embodied by the same hardware item. The use of the words first, second, and third, etc. does not indicate any order. These words may be interpreted as names.

[0225] The above is only a specific implementation or description of a specific implementation of the present application, and the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. The protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A data protection method, characterized in that: Applied to a first client, the method includes: The first client and the second client establish a pipeline connection through the server; The first client sends a shared data access request to the second client through the pipeline connection; wherein the shared data is encrypted data; The first client receives the first key information corresponding to the shared data sent by the second client through the pipeline connection, and uses the first key information to decrypt and access the shared data.

2. The method according to claim 1, characterized in that: The pipeline connection includes a connection between the second client and the first pipeline, and a connection between the first client and the second pipeline; the first pipeline is used by the second client to send messages to the first client, and is used by the first client to read messages; the second pipeline is used by the first client to send messages to the second client, and is used by the second client to read messages.

3. The method according to any one of claims 1 to 2, characterized in that: The first client and the second client establish a pipeline connection through the server, including: The first client generates a first graphic code so that the second client authorizes the establishment of the pipeline connection by scanning the first graphic code.

4. The method according to any one of claims 1 to 3, characterized in that: The first client and the second client establish a pipeline connection through the server, including: The first client applies for a first pipeline from the server, and receives a universal unique identification code of the first pipeline returned by the server; The first client generates a first graphic code so that the second client is authorized to use the universal unique identification code to log in to the first pipeline through the first graphic code, and writes a confirmation message to the first pipeline in a first data format; wherein the first graphic code includes the universal unique identification code and the first data format; The first client polls and reads the confirmation message at a first preset time interval, and removes the confirmation message from the first pipeline within a second preset time interval; wherein the confirmation message represents the connection status between the second client and the first pipeline; The first client polls and reads the connection message at a first preset time interval to obtain authorization to use the second pipe, and removes the connection message from the first pipe at a second preset time interval; wherein the second pipe is applied for by the second client to the server; the connection message includes a second data format, and the second data format is used by the first client to write a message to the second pipe; The first client writes notifications of removal of the confirmation message and the connection message into the second pipe in the second data format, so that the second client obtains the connection status of the first client and the second pipe through the notifications.

5. The method according to claim 4, characterized in that in, If the confirmation message or the connection message is not removed from the first pipeline by the first client within the second preset time interval, the confirmation message or the connection message will be re-delivered to the first pipeline by the server.

6. The method according to any one of claims 2 to 5, characterized in that: The first client sends a shared data access request to the second client through the pipe connection, including: The first client writes the shared data access request to the second pipe in a second data format, so that the second client obtains the shared data access request when polling the second pipe.

7. The method according to any one of claims 2 to 5, characterized in that: The first client receives the first key information corresponding to the shared data sent by the second client through the pipeline connection, and uses the first key information to decrypt and access the shared data, including: The first client polls the first pipeline at a first preset time interval to receive response data sent by the second client; The first client obtains the permission to access the shared data based on the response data, and accesses the shared data based on the permission; wherein the response data includes any one of the following: plain text of the first key used to decrypt the shared data, ciphertext obtained by encrypting the plain text with the transmission key, key information used to generate the first key, or ciphertext obtained by encrypting the key information with the transmission key; The first client removes the response data in the first pipeline within a second preset time interval.

8. The method according to claim 7, characterized in that The method further comprises: After the first client polls the first pipeline at a first preset time interval, the first client stores the response data in a local memory; The first client polls and reads the permission cancellation notification in the first pipeline; The first client deletes the transmission key and / or the first key information stored in the local memory based on the notification of revoking the authority.

9. The method according to any one of claims 2 to 8, characterized in that: The method further comprises: The first client obtains a token sent by the second client through the first pipeline; wherein the token is applied for by the second client and is used for identity authentication when the first client or the second client sends a request to the server.

10. The method according to claim 4, characterized in that The method further comprises: The first client sends a first heartbeat packet to the second pipeline in the second data format at a first preset time interval, and polls the first pipeline at the first preset time interval to read a second heartbeat packet sent by the second client.

11. The method according to claim 3, characterized in that The method further comprises: The first client writes a notification of logging out of the second pipeline into the second pipeline, so that the second client can learn the exit status of the first client by polling the second pipeline.

12. The method according to claim 3, It is characterized in that Wherein, when the first client is offline, the pipeline connection is disconnected, and the first client generates a new first graphic code, so that the second client re-scans the new first graphic code to re-establish a new pipeline connection; and / or, Wherein, when the first client is in an online state and the second client is in an offline state, the universal unique identifier of the first pipe and the first data format are stored locally in the second client, so that the second client can maintain a pipe connection with the first client when switching to an online state.

13. The method according to claims 1 to 3, characterized in that The method further comprises: The first client generates a second graphic code, wherein the second graphic code includes a creation request, and the creation request is used to request to create a new shared folder; The first client polls the first pipe to obtain the second key information corresponding to the new shared folder; the second key information is written into the first pipe by the second client in response to the creation request, and the creation request is obtained by the second client by scanning the second graphic code; The first client creates a new shared file based on the second key information.

14. A data protection method, characterized in that: Applied to the second client, the method includes: The second client establishes a pipeline connection with the first client via the server; The second client receives the shared data access request sent by the first client through the pipeline connection; wherein the shared data is encrypted data; The second client sends the first key information corresponding to the shared data through the pipeline connection, so that the first client decrypts and accesses the shared data using the first key information.

15. The method according to claim 14, characterized in that The pipeline connection includes a connection between the second client and the first pipeline, and a connection between the first client and the second pipeline; the first pipeline is used by the second client to send messages to the first client, and is used by the first client to read messages; the second pipeline is used by the first client to send messages to the second client, and is used by the second client to read messages.

16. The method according to claim 15, characterized in that The second client establishes a pipeline connection with the first client through the server, including: The second client is authorized to establish the pipeline connection by scanning a first graphic code; wherein the first graphic code is generated by the first client.

17. The method according to any one of claims 14 to 16, characterized in that: The second client establishes a pipeline connection with the first client through the server, including: The second client is authorized to use the unique identification code to log in to the first pipeline by scanning the first graphic code, and writes a confirmation message to the first pipeline in a first data format, so that the first client knows the connection status between the second client and the first pipeline; wherein the first pipeline is applied for by the first client to the server, the universal unique identification code is used to log in to the first pipeline, and the first graphic code includes the universal unique identification code and the first data format; wherein the confirmation message will be removed from the first pipeline by the first client at a second preset time interval; The second client applies for a second channel from the server, and receives a universal unique identifier corresponding to the second channel returned by the server; The second client writes a connection message to the first pipe in the first data format, the connection message including a second data format; wherein the second data format is adopted by the first client to write a message to the second pipe, and the connection message will be removed from the first pipe by the first client at a second preset time interval; The second client polls the second pipe to obtain a notification that the confirmation message and the connection message have been removed, and obtains a connection status between the first client and the second pipe through the notification.

18. The method according to claim 17, characterized in that in, If the confirmation message or the connection message is not removed from the first pipeline by the first client within the second preset time interval, the confirmation message or the connection message will be re-delivered to the first pipeline by the server.

19. The method according to any one of claims 14 to 18, characterized in that The second client receives the shared data access request sent by the first client through the pipeline connection, including: The second client polls the second pipe at a first preset time interval to receive a shared data access request written by the first client in the second data format.

20. The method according to any one of claims 14 to 18, characterized in that The second client sends the first key information corresponding to the shared data through the pipeline connection, so that the first client decrypts and accesses the shared data using the first key information, including: The second client generates response data based on the shared data access request; wherein the response data includes any one of the following: plain text of the first key used to decrypt the shared data, ciphertext obtained by encrypting the plain text with the transmission key, key information used to generate the first key, or ciphertext obtained by encrypting the key information with the transmission key; The second client writes the response data into the first pipe in a second data format so that the first client obtains permission to access the shared data based on the response data; wherein the response data in the first pipe will be removed by the first client within a second preset time interval.

21. The method according to claim 20, characterized in that The method further comprises: The second client writes a notification of revoking permissions into the first pipe, so that the first client deletes the transmission key and / or the first key information stored in the local memory based on the notification of revoking permissions.

22. The method according to any one of claims 14 to 21, characterized in that The method further comprises: The second client applies for and obtains a token from the server; The second client writes the token into the first pipeline so that the first client obtains the token; wherein the token is used for identity authentication when the first client or the second client sends a request to the server.

23. The method according to claim 17, characterized in that The method further comprises: The second client sends a first heartbeat packet to the first pipeline in the first data format at a first preset time interval, and polls the second pipeline at the first preset time interval to read a second heartbeat packet sent by the first client.

24. The method according to claim 16, characterized in that The second client polls and reads the second pipe to obtain a notification of the first client logging out and a logout status of the first client.

25. The method according to claim 16, It is characterized in that Wherein, when the first client is offline, the pipeline connection is disconnected, and the second client re-establishes a new pipeline connection by scanning a new first graphic code generated by the first client; and / or, When the second client is in an offline state and the first client is in an online state, when the second client switches to an online state, the second client maintains a pipeline connection with the first client through the universal unique identification code of the first pipeline and the first data format pre-stored locally.

26. The method according to any one of claims 14 to 16, characterized in that The method further comprises: The second client creates a new shared folder and second key information of the new shared folder on the server according to the instruction to create a new shared folder.

27. The method according to any one of claims 14 to 16, characterized in that The second client obtains a request to create a new shared folder by scanning the second graphic code; In response to the request to create a new shared folder, the second client writes the second key information corresponding to the new shared folder into the first pipe, so that the first client creates a new shared file based on the second key information.

28. A terminal, characterized in that: The terminal comprises: A memory and a processor, wherein the memory stores a computer program executed by the processor, and when the computer program is executed by the processor, the processor executes the data protection method as described in any one of claims 1 to 13 or the data protection method as described in any one of claims 14 to 27.

29. A data protection system, characterized in that: The system includes a first client, a second client and a server; wherein, The first client is used to establish a pipeline connection with the second client through the server, and send a shared data access request to the second client through the pipeline connection, and receive the first key information corresponding to the shared data sent by the second client through the pipeline connection, and use the first key information to decrypt and access the shared data; wherein the shared data is encrypted data; The second client is used to establish the pipeline connection with the first client through the server, and receive the shared data access request sent by the first client through the pipeline connection; send the first key information corresponding to the shared data through the pipeline connection, so that the first client decrypts and accesses the shared data using the first key information; The server is configured to send a universal unique identifier of a first pipeline and a universal unique identifier of a second pipeline to the first client and the second client respectively according to applications for creating a pipeline from the first client and the second client, so that the first client and the second client establish a pipeline connection; The server is further configured to receive a data access request from the first client and / or the second client, and authenticate the first client and / or the second client according to a token carried in the data access request.

30. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, which, when executed by a processor, enables the processor to execute the data protection method according to any one of claims 1 to 13 or the data protection method according to any one of claims 14 to 27.

31. A computer program product, characterized in that When the computer program is executed by a processor, the computer program implements the data protection method according to any one of claims 1 to 13 or the data protection method according to any one of claims 14 to 27.

Images