File sharing methods, media, products, and electronic devices

Abstract

This application applies to the field of computer technology, providing a file sharing method, medium, and electronic device. The method includes: when the electronic device detects that a user intends to share a file with another target user account, it identifies the currently logged-in user account and / or the security level corresponding to the target user account. Based on the security levels of the current user account and the target user account, and according to a preset auditing policy, the electronic device audits the file to be shared to confirm whether the file can be shared with the target user account. Furthermore, different auditing policies can be formulated for file sharing between different security spaces, thereby meeting the file sharing needs of users using different accounts on the electronic device in different scenarios.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a file sharing method, medium, product, and electronic device. Background Technology

[0002] Users can register user accounts on electronic devices, which can allocate independent storage space for different user accounts. Each user account is typically equipped with different access permissions, allowing users to control the sharing and access permissions of their own account's data to ensure the data security and privacy of each user.

[0003] For example, data between different user accounts can be shared by setting up shared folders. Users can set the access permissions of a folder to be shared, or specify accounts that can access the shared folder. Then, users can store the files they want to share in the shared folder path, and other users can then access the shared files from the shared folder when logging into other accounts on their electronic devices.

[0004] However, as users have more diverse requirements for file access permissions, simply setting up shared folders cannot meet their file sharing needs in different scenarios. For example, users can register not only personal accounts but also corporate accounts. In an office setting, when a corporate account is logged into the electronic device's system, users have higher security requirements for file sharing. If a user directly shares files from their corporate account to their personal account, there may be a risk of data leakage. Conversely, if a user directly shares files from their personal account to their corporate account, and those files contain viruses, the security of the files in the corporate account could also be compromised. Summary of the Invention

[0005] In view of this, this application provides a file sharing method, medium, product, and electronic device.

[0006] In a first aspect, a file sharing method is provided, applied to a first device. The method includes: receiving a first request, the first request being used to request sharing a first file under a first account with a second account; determining attribute information of the first account and the second account; determining whether to share the first file under the first account with the second account based on the relationship between the attribute information of the first account and the second account; if it is determined that the first file should be shared, determining the login status of the second account; if it is detected that the second account is not logged in, sharing the first file with a system account; if it is detected that the second account has switched to a logged-in status, sharing the first file from the system account to the second account.

[0007] In the above scheme, sharing the first file under the first account with the second account can be initiated by the user based on the first account, or the user can request to retrieve the first file under the first account based on the second account. The first and second accounts can be user accounts logged into the electronic device. These user accounts can include different types such as personal accounts, enterprise accounts, system accounts, and guest accounts. Different types of user accounts have different access permissions to files and different methods of file sharing. The electronic device can determine the corresponding file sharing method based on the relationship between the attribute information of the user accounts. For example, an enterprise account can share non-confidential files with a personal / guest account, and a personal / guest account can share secure files with a personal account. Similarly, a personal account can share non-confidential files with a guest account, and a guest account can share secure files with a personal account. Furthermore, different review strategies can be formulated for file sharing between different accounts, thereby meeting the file sharing needs of users using different accounts on electronic devices in different scenarios.

[0008] Furthermore, if the electronic device determines that the second account is not logged in, it can first share the first file to be shared with the system account. After the second account logs in, the system account then sends the first file to the second account. For example, the system account can be a user account with a high security level, thus ensuring file security and enabling the sharing operation to be completed even if the receiving user account is not logged in.

[0009] In conjunction with the first aspect, in some implementations, the method includes: determining whether to share the first file under the first account with the second account based on the relationship between the attribute information of the first account and the second account, and whether the first file is a non-confidential file or a secure file.

[0010] In the above scheme, different file review strategies can be adopted for the relationship between the different attribute information of the first account and the second account. For example, if the relationship between the attribute information of the first account and the second account is that the first account has a higher security level than the second account, then an outbound review strategy can be used to determine whether the file is a non-confidential file. If the first file is a non-confidential file, then it is determined that the first file under the first account can be shared with the second account.

[0011] For example, if the attribute information of the first account and the second account indicates that the first account has a lower security level than the second account, a security scanning strategy can be used to determine whether a file is safe. If the first file is safe, then it can be determined that the first file under the first account can be shared with the second account.

[0012] Furthermore, different review strategies can be formulated for file sharing between different accounts to meet users' needs for file sharing when using electronic devices with different accounts in different scenarios.

[0013] In conjunction with the first aspect, in some implementations, the attribute information includes security level information; the method further includes: determining whether to share the first file under the first account with the second account based on the relationship between the attribute information of the first account and the second account, including: if the security level of the first account is higher than the security level of the second account, and the first file is a non-confidential file, determining to share the first file under the first account with the second account; or, if the security level of the first account is lower than the security level of the second account, and the first file is a secure file, determining to share the first file under the first account with the second account.

[0014] In the above scheme, user account attribute information includes security level information. For example, the security levels of user accounts, from highest to lowest, can be system account, enterprise account, personal account, and guest account. Electronic devices can determine file sharing policies based on the security level of user accounts. For example, a user account with a higher security level can share non-confidential files with a user account with a lower security level, and a user account with a lower security level can share secure files with a user account with a higher security level. Different review policies can be formulated for file sharing between different accounts to meet the file sharing needs of users using different accounts on electronic devices in different scenarios.

[0015] In conjunction with the first aspect, in some implementation methods, the security level of the system account is higher than that of the first account and the second account.

[0016] In the above scheme, the system account has the highest security level, and it can log in in the background even when any user account is logged in. If the second account is not logged in, the first file is shared to the system account first. After the second account logs in, the system account then sends the first file to the shared account. For example, the system account can be a user account with a high security level, thus ensuring file security and enabling the sharing operation to be completed even if the receiving user account is not logged in.

[0017] In conjunction with the first aspect, in some implementations, the first file is a non-confidential file when it meets one or more of the following conditions: the file type of the first file is a preset type; the first file is a user-confirmed non-confidential file.

[0018] In the above scheme, if the first file is not a plaintext data type such as .doc, and / or the file to be shared has been approved by preset personnel, then the first file can be considered a non-confidential file. This ensures that the first account will not share confidential files with the second account, preventing the leakage of file content.

[0019] In conjunction with the first aspect, in some implementations, a first file is considered a safe file when it meets one or more of the following conditions: the first file is not detected as a virus; the first file is a non-abnormal file, wherein being an abnormal file includes one or more of the following: the first file includes a program for initiating a communication connection between the first device and other devices, an action of creating a file initiated by the first file, an action of deleting a file initiated by the first file, or an action of modifying a file initiated by the first file.

[0020] In the above solution, if the first file does not detect any virus, or if there is any suspicious behavior when the first file is shared or enabled—for example, by monitoring the network connection of electronic devices to identify whether there is communication with malicious servers or abnormal data transmission patterns, or by tracking file creation, modification, deletion, and other behaviors to detect activities inconsistent with normal behavior patterns, such as electronic devices automatically deleting or modifying a large number of files—it can be ensured that the file to be shared will not carry a virus that affects other files in the second account.

[0021] In conjunction with the first aspect, in some implementations, the method further includes: if the second account is not in the preset account list, then determining to share the first file under the first account with the second account; and if the device logging into the second account is not in the preset device list, then determining to share the first file under the first account with the second account.

[0022] In the above solution, in addition to detecting whether the first file is a secure or non-confidential file, it can also detect whether the peer electronic device is a blacklisted device and whether the second account is a blacklisted account. Files will not be shared with blacklisted devices and accounts. Therefore, it avoids sharing files with suspicious accounts and devices, preventing file leaks and ensuring file security.

[0023] In conjunction with the first aspect, in some implementations, the method further includes: granting the second account access to the first file; and writing the first file into storage space accessible to the second account.

[0024] In the above scheme, sharing the first file with the second account can be achieved by modifying the access permissions of the first file. That is, the storage location of the first file can be left unchanged, or the first file can be written to the storage space corresponding to the second account without being written to it. The electronic device can set access permissions for each stored file. If the electronic device determines that the first file can be shared with the second account, it can also modify the access permissions of the first file to be accessible to the second account. When the electronic device is logged into the second account, it can obtain the access permissions of the files on the electronic device, determine the files that the second account can access, and then the user can access the allowed files when logged into the second account.

[0025] In conjunction with the first aspect, in some implementations, the file storage space of the first account is the first space, the file storage space of the second account is the second space, and the file storage space of the system account is the system space; the method further includes: if it is detected that the second account is not logged in, writing the first file to the system space; if it is detected that the second account has switched to a logged-in state, sharing the first file from the system account to the second account, including: if it is detected that the second account is logged in, writing the first file from the system space to the second space.

[0026] In the above scheme, the electronic device allocates different storage spaces for different user accounts, and these storage spaces are isolated from each other. If the electronic device determines that the first file can be shared with the second account, it can write the second file to the storage space corresponding to the second account. Then, the user can access the file to be shared when logged into the second account.

[0027] In conjunction with the first aspect, in some implementations, the method further includes: generating a first key for encrypting a first file, and generating a second key for encrypting the first key based on the private key of a first account and the public key of a second account; encrypting the first file using the first key, and encrypting the first key based on the second key to obtain ciphertext of the first key; and writing the encrypted first file and the ciphertext of the first key into the system space.

[0028] In the above scheme, the file needs to be encrypted before it can be written to the system space. This prevents users from obtaining the first file through their system accounts. Furthermore, the encryption of the first file uses the keys of the first and second accounts, which means that only the first and second accounts can decrypt the first file, thus ensuring the security of the file.

[0029] In conjunction with the first aspect, in some implementations, the method further includes: generating a third key based on the private key of the second account and the public key of the first account; decrypting the ciphertext of the first key based on the third key to obtain the first key; decrypting the encrypted first file based on the first key to obtain the decrypted first file; and copying the decrypted first file from the system space to the second space.

[0030] In the above scheme, the second account can decrypt the encrypted first file and store the decrypted first file in the storage space corresponding to the second account. This ensures that only the first and second accounts can access the first file, thus guaranteeing file security.

[0031] In conjunction with the first aspect, in some implementations, the file storage space of the first account is the first space, and the file storage space of the second account is the second space; the method also includes: if the security level of the first account is higher than the security level of the second account, determining whether to share the first file under the first account with the second account through the application in the first space; or, if the security level of the first account is lower than the security level of the second account, determining whether to share the first file under the first account with the second account through the application in the second space.

[0032] In the above scheme, file review is performed by an account with a higher security level; that is, the relevant file review program is installed in the storage space of an account with a higher security level. For example, file review could be performed by a corporate account.

[0033] In conjunction with the first aspect, in some implementations, the second space belongs to the first device, or the second space belongs to a second device that is communicatively connected to the first device.

[0034] In the above solution, different user accounts can log in on different electronic devices. These accounts can share files, and the shared files are reviewed according to a preset approval policy based on the user account attributes, such as security level. Multiple devices used for file sharing can be connected via a local area network (LAN). For example, multiple electronic devices within a company's LAN can share files and be reviewed based on a preset approval policy. Alternatively, the multiple devices can be connected via a wide area network (WAN). This enables cross-device file sharing and allows different approval policies to be applied based on the attributes of different user accounts, meeting users' file sharing needs when using different accounts on different electronic devices in different scenarios.

[0035] In conjunction with the first aspect, in some implementations, the first device includes a file-sharing application, and the method further includes: displaying a first interface of the file-sharing application, the first interface including a sharing operation area, the sharing operation area including account information of a second account; receiving a first operation of dragging a first file to the sharing operation area, and determining that a first request has been received.

[0036] In the above solution, the file-sharing application can also be called a file transfer application. Electronic devices also include file transfer applications for sharing files between different secure spaces. Users can select files to be shared through the interface of the file transfer application. For example, a user can drag the icon of the first file to the file-sharing area of ​​the file transfer application, and then initiate a request to share the first file with a second account. This operation is relatively convenient and quick, simplifying user operations.

[0037] In conjunction with the first aspect, in some implementations, the method further includes: receiving a second operation from the user to launch a file-sharing application, determining the security level of the currently logged-in account of the first device; if the security level of the first account is higher than the security level of the second account, displaying the window of the file-sharing application with a first animation effect; if the security level of the first account is lower than the security level of the second account, displaying the window of the file-sharing application with a second animation effect.

[0038] In conjunction with the first aspect, in some implementations, the first animation effect includes a flipping animation effect with the flipping direction in the first direction, and the second animation effect includes a flipping animation effect with the flipping direction in the opposite direction of the first direction; or, the first animation effect includes a sliding animation effect with the sliding direction in the second direction, and the second animation effect includes a sliding animation effect with the sliding direction in the opposite direction of the second direction; or, the first animation effect includes a sliding animation effect with the popping direction in the third direction, and the second animation effect includes a popping animation effect with the popping direction in the opposite direction of the third direction.

[0039] In the above solution, different display effects can be used to show the file transfer application window for different user accounts currently logged in on the electronic device. For example, corresponding to a user account with a higher security level, the file transfer application window can slide out of the desktop display area from the right side of the screen display area using a 3D stereoscopic flip, decreasing in size. Conversely, corresponding to a user account with a lower security level, the file transfer application window can slide out of the desktop display area from the left side of the screen display area using a 3D stereoscopic flip, decreasing in size. This makes the file transfer application more interactive.

[0040] In a second aspect, this application provides an electronic device including a processor and a memory, wherein the memory is used to store instructions and the processor is used to execute the instructions, and when the processor executes the instructions, it performs the method described in the first aspect.

[0041] Thirdly, this application provides a computer-readable storage medium storing instructions that, when executed on an electronic device, perform the method described in the first aspect.

[0042] Fourthly, this application provides a computer program product including computer instructions, which, when executed by a computing device, cause the computing device to perform the method described in the first aspect. Attached Figure Description

[0043] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below.

[0044] Figure 1 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application;

[0045] Figure 2A This is a schematic diagram of a user account login interface provided in an embodiment of this application;

[0046] Figure 2B This is a schematic diagram of the main interface of user A provided in an embodiment of this application;

[0047] Figure 2C This is a schematic diagram of an interface for file sharing via a menu bar, provided in an embodiment of this application.

[0048] Figure 3A This is a schematic diagram of another user account login interface provided in an embodiment of this application;

[0049] Figure 3B This is a schematic diagram of the main interface of employee B provided in an embodiment of this application;

[0050] Figure 4A This is a schematic diagram of another interface for file sharing via a menu bar provided in this application embodiment;

[0051] Figure 4B This is a schematic diagram showing a received shared file displayed on the interface of user A, as provided in an embodiment of this application;

[0052] Figure 5 This is a schematic diagram of a shared file review process provided in an embodiment of this application;

[0053] Figure 6 This is a schematic diagram of the interface of a file transfer application provided in an embodiment of this application;

[0054] Figure 7 This is an animated illustration of the file sharing process in a file transfer application provided in an embodiment of this application;

[0055] Figure 8 This is a schematic diagram of another interface for file sharing via a menu bar provided in this application embodiment;

[0056] Figure 9 This is a flowchart illustrating a file sharing method provided in an embodiment of this application;

[0057] Figure 10A This is a schematic diagram of the structure of a file sharing system provided in an embodiment of this application;

[0058] Figure 10B This is a schematic diagram of the software structure of an electronic device provided in an embodiment of this application;

[0059] Figure 10C This is a schematic diagram illustrating the interaction between a spatial communication SA and a security control SA provided in an embodiment of this application;

[0060] Figure 10D This is a schematic diagram illustrating a file encryption and decryption method provided in an embodiment of this application;

[0061] Figure 11A This is a schematic diagram illustrating a process of sharing files from a personal space to an enterprise space, provided in an embodiment of this application, where the enterprise space is already logged in;

[0062] Figure 11B This is a schematic diagram of a process for sharing files from a personal space to an enterprise space without logging into the enterprise space, provided in an embodiment of this application.

[0063] Figure 12A This is a schematic diagram of a process for sharing files from an enterprise space to a personal space, provided in an embodiment of this application, where the personal space is already logged in;

[0064] Figure 12B This is a schematic diagram of a process for sharing files from an enterprise space to a personal space without the personal space being logged in, provided in an embodiment of this application.

[0065] Figure 13 This is a flowchart illustrating another file sharing method provided in an embodiment of this application. Detailed Implementation

[0066] The illustrative embodiments of this application include, but are not limited to, file sharing methods, media, products, and electronic devices.

[0067] It is understood that the electronic devices in the embodiments of this application can be terminals, user equipment (UE), mobile stations (MS), mobile terminals (MT), etc. Terminal devices can be mobile phones, smart TVs, wearable devices, tablets, computers with wireless transceiver capabilities, virtual reality (VR) terminal devices, augmented reality (AR) terminal devices, wireless terminals in industrial control, wireless terminals in self-driving, wireless terminals in remote medical surgery, wireless terminals in smart grids, wireless terminals in transportation safety, wireless terminals in smart cities, wireless terminals in smart homes, and so on.

[0068] The following is a schematic diagram of the structure of the electronic device involved in the embodiments of this application, using electronic device 100 as an example. See also: Figure 1 , Figure 1 A schematic diagram of the structure of an exemplary electronic device 100 provided in an embodiment of this application is shown.

[0069] Electronic device 100 may include processor 110, external memory interface 120, internal memory 121, universal serial bus (USB) interface 130, charging management module 140, power management module 141, battery 142, antenna 1, antenna 2, mobile communication module 150, wireless communication module 160, audio module 170, sensor module 180, button 190, motor 191, indicator 192, camera 193, display screen 194, and subscriber identification module (SIM) card interface 195, etc.

[0070] Processor 110 may include one or more processing units, such as: application processor (AP), modem processor, graphics processing unit (GPU), image signal processor (ISP), controller, memory, video codec, digital signal processor (DSP), baseband processor, and / or neural network processing unit (NPU), etc. Different processing units may be independent devices or integrated into one or more processors.

[0071] The controller can be the nerve center and command center of the electronic device 100. The controller can generate operation control signals according to the instruction opcode and timing signals to complete the control of fetching and executing instructions.

[0072] The processor 110 may also include a memory for storing instructions and data. In some embodiments, the memory in the processor 110 is a cache memory. This memory can store instructions or data that the processor 110 has just used or that are used repeatedly. If the processor 110 needs to use the instruction or data again, it can retrieve it directly from the memory. This avoids repeated accesses, reduces the waiting time of the processor 110, and thus improves the efficiency of the system.

[0073] In some embodiments, the processor 110 may include one or more interfaces. Interfaces may include an inter-integrated circuit (I2C) interface, an inter-integrated circuit sound (I2S) interface, a pulse code modulation (PCM) interface, a universal asynchronous receiver / transmitter (UART) interface, a mobile industry processor interface (MIPI), a general-purpose input / output (GPIO) interface, a subscriber identity module (SIM) interface, and / or a universal serial bus (USB) interface, etc.

[0074] It is understood that the interface connection relationships between the modules illustrated in the embodiments of this application are merely illustrative and do not constitute a structural limitation on the electronic device 100. In other embodiments of this application, the electronic device 100 may also employ different interface connection methods or combinations of multiple interface connection methods as described in the above embodiments.

[0075] The charging management module 140 receives charging input from a charger, which can be either a wireless or wired charger. The power management module 141 connects to the battery 142, the charging management module 140, and the processor 110. The power management module 141 receives input from the battery 142 and / or the charging management module 140, providing power to the processor 110, internal memory 121, external memory, display 194, camera 193, and wireless communication module 160, etc.

[0076] The wireless communication function of electronic device 100 can be realized through antenna 1, antenna 2, mobile communication module 150, wireless communication module 160, modem processor and baseband processor, etc.

[0077] Antennas 1 and 2 are used to transmit and receive electromagnetic wave signals. Each antenna in electronic device 100 can cover one or more communication frequency bands. Mobile communication module 150 can provide solutions for wireless communication applications including 2G / 3G / 4G / 5G on electronic device 100. The modem processor can include a modulator and a demodulator. The modulator is used to modulate the low-frequency baseband signal to be transmitted into a mid-to-high frequency signal. The demodulator is used to demodulate the received electromagnetic wave signal into a low-frequency baseband signal. The demodulator then transmits the demodulated low-frequency baseband signal to the baseband processor for processing. After processing by the baseband processor, the low-frequency baseband signal is transmitted to the application processor. The application processor outputs sound signals through an audio device or displays images or videos through display screen 194.

[0078] The wireless communication module 160 can provide solutions for wireless communication applications on the electronic device 100, including wireless local area networks (WLAN) (such as wireless fidelity (WiFi) networks), Bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), infrared (IR) technology, etc.

[0079] Electronic device 100 implements display functions through a GPU, a display screen 194, and an application processor. The GPU is a microprocessor for image processing, connected to the display screen 194 and the application processor. The GPU is used to perform mathematical and geometric calculations and for graphics rendering. Processor 110 may include one or more GPUs, which execute program instructions to generate or modify display information.

[0080] Display screen 194 is used to display images, videos, etc. Display screen 194 includes a display panel. The display panel may be a liquid crystal display (LCD), an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode (AMOLED), a flexible light-emitting diode (FLED), a mini-LED, a micro-OLED, a quantum dot light-emitting diode (QLED), etc. In some embodiments, electronic device 100 may include one or N displays 194, where N is a positive integer greater than 1.

[0081] In some embodiments of this application, the display screen 194 can be used to display a user account login interface, as well as the main interface corresponding to a logged-in user account, etc. Further details can be found below. Figures 2A to 4B ,as well as Figures 6 to 8 .

[0082] Electronic device 100 can perform shooting functions through ISP, camera 193, video codec, GPU, display 194 and application processor.

[0083] The external memory interface 120 can be used to connect to an external memory to expand the storage capacity of the electronic device 100.

[0084] Internal memory 121 can be used to store computer executable program code, which includes instructions. Processor 110 executes various functional applications and data processing of electronic device 100 by running the instructions stored in internal memory 121.

[0085] In some embodiments of this application, the external memory and internal memory 121 can be used to store data for different user accounts. The electronic device system can allocate different storage spaces in the electronic device for multiple user accounts, with each storage space isolated from the others. Different user accounts can only access the data in their corresponding storage spaces. Alternatively, the electronic device can mark the access permissions of the data stored in the external memory and / or internal memory 121, so that only user accounts marked as allowed to access the corresponding files can access those files.

[0086] Electronic device 100 can implement audio functions through audio modules and application processors, such as music playback and recording.

[0087] Button 190 includes the power button, volume buttons, etc. Button 190 can be a mechanical button or a touch button.

[0088] Motor 191 can generate vibration alerts. Motor 191 can be used for incoming call vibration alerts or for touch vibration feedback.

[0089] Indicator 192 can be an indicator light, used to indicate charging status, power changes, or to indicate messages, missed calls, notifications, etc.

[0090] The SIM card interface 195 is used to connect a SIM card. The SIM card can be inserted into or removed from the SIM card interface 195 to make contact with or separate from the electronic device 100.

[0091] It is understood that the structures illustrated in the embodiments of this application do not constitute a specific limitation on the electronic device 100. In other embodiments of this application, the electronic device 100 may include more or fewer components than illustrated, or combine some components, or split some components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0092] As mentioned earlier, electronic devices can set data access permissions for each user account. After logging into a user's account on an electronic device, a user can access the data associated with that user account. Furthermore, based on a logged-in user account, a user can also share files from that user account with other user accounts.

[0093] For example, let's take a personal computer (PC) as an example. Figure 2AThe user account login interface 11 shown allows users to change their login account after PC 10 is powered on, using control 12. For example, to log in to the account "User A," the user can enter the password for "User A" through input box 13, thus logging in to "User A's" account on PC 10. PC 10 can then display the interface corresponding to "User A," which may include icons for applications downloaded by User A, icons for files that User A is allowed to access, etc.

[0094] For example, Figure 2B Interface 14 corresponding to User A is shown. Interface 14 displays application icons downloaded by User A (such as music, calculator, etc.) and file F1, etc. File F1 can be a file created and / or edited by the user while using the "User A" account, or it can be a file downloaded by the user from the internet, etc., while using the "User A" account. Furthermore, the current user can access data corresponding to the "User A" account, for example, using the application icons displayed on interface 14 and accessing file F1, etc.

[0095] Interface 14 also includes a main system control 15. Users can select the main system control 15 to bring up the main system interface, and switch the currently logged-in user account using the user account switching control in the main system interface.

[0096] Users can also set files under user A's account to be shared, for example, Figure 2C As shown in interface 21, PC 10 can share file F1 with other users of PC 10 based on the user's selection of file F1 and selection of the "Share" control 22. Users can also view and / or edit file F1 when logged into other user accounts. Optionally, users can also set sharing access permissions for file F1, such as read-only, read-write, etc. Alternatively, users can specify user accounts that can access file F1; only user accounts specified as allowed to access file F1 can view and / or edit file F1.

[0097] It should be understood that when a user logs into another user account, the PC10 will display the interface corresponding to that other user account, including the icons and files of the applications downloaded by that other user account, as well as files that other users are allowed to access and have set to be shared.

[0098] However, to address different application scenarios, such as office environments, the operating system currently offers various user account types, including personal accounts and enterprise accounts. For example, the same user or different users can register personal accounts, as well as enterprise accounts. A user's enterprise account can share files with other enterprise accounts within the same company. Furthermore, the same user can also receive data from other enterprise accounts or their own enterprise account, or share data from their own enterprise account with other users' personal accounts.

[0099] However, users have different security requirements for files on enterprise accounts and personal accounts. If files are shared from one personal account to another (as mentioned above)... Figure 2C In this system, users can directly modify the file sharing permissions (F1 key) to enable file sharing between personal and corporate accounts. If a file in a personal account contains a virus, and that infected file is directly shared to a corporate account, the files in the corporate account will also be at risk of infection. Alternatively, highly confidential files in a corporate account may be directly shared to a personal account, leading to file leaks.

[0100] For example, Figure 3A The interface 31 for user login to the enterprise account is shown. The user can select the "Employee B" account on PC 10 and enter the corresponding password through input box 32. PC 10 will then log in to the "Employee B" account and display the corresponding interface. For example... Figure 3B As shown in interface 33, the application interface corresponding to the "Employee B" account displayed on PC10 may include application icons such as email and company system, as well as file F2 generated by the user when using the "Employee B" account.

[0101] For personal accounts (e.g., "User A") and enterprise accounts (e.g., "Employee B"), users can also share files with another account by directly modifying file sharing permissions. For example, ... Figure 4A As shown, when a user logs into the "Employee B" account, they can select the sharing control 42 based on file F2, thereby sharing file F2 with "User A". Then, after logging into the "User A" account on PC 10, for example, the user can switch the logged-in user account to "User A" through the main system control 43, and then access file F2 in the interface corresponding to the "User A" account, for example... Figure 4B As shown, the interface 44 of "User A" displayed on PC10 may include an icon for file F2.

[0102] In other words, when electronic devices need to share files from a high-security space (such as the storage space accessible when an electronic device logs into a user's corporate account) to a low-security space (such as the storage space accessible when an electronic device logs into a user's personal account), or share files from a low-security space to a high-security space, if the files can be shared simply by the user modifying the sharing permissions, it cannot meet the user's needs for file sharing in different application scenarios.

[0103] To address the varying security needs when sharing files between different accounts on electronic devices, this application provides a file-sharing method. When an electronic device detects an operation by a user intending to share a file with another target user account, it identifies the attribute information corresponding to the currently logged-in user account and / or the target user account. Based on the relationship between the attribute information of the current user account and the target user account, and according to a preset review policy, the electronic device can review the file to be shared to confirm whether the file can be shared with the target user account.

[0104] For example, user accounts logged into electronic devices can include different types such as personal accounts, enterprise accounts, system accounts, and guest accounts. Different types of user accounts have different file access permissions and file sharing methods. Electronic devices can determine the corresponding file sharing method based on the relationship between the attribute information of user accounts. For instance, an enterprise account can share non-confidential files with a personal / guest account, and a personal / guest account can share secure files with another personal account. Similarly, a personal account can share non-confidential files with a guest account, and a guest account can share secure files with a personal account.

[0105] In some embodiments, the attribute information of a user account includes security level information. For example, the security levels of a user account, from highest to lowest, can be system account, enterprise account, personal account, and guest account. Electronic devices can determine file sharing policies based on the security level of the user account. For example, a user account with a higher security level can share non-confidential files with a user account with a lower security level, and a user account with a lower security level can share secure files with a user account with a higher security level.

[0106] Specifically, when an electronic device detects that a user needs to share a file from a higher-security user account to a lower-security user account (e.g., the current user account is a corporate account, and the target user account is a personal account), the electronic device will determine whether the file to be shared complies with a preset outbound review policy. For example, the outbound review policy may include whether the file to be shared is a highly confidential file (i.e., whether the file to be shared can be accessed in the lower-security space), whether the file to be shared can be accessed in the lower-security space after manual review, whether the target user account is a blacklisted account, and whether the device recently logged into the target user account is a blacklisted device. If the file to be shared is determined to comply with the outbound review policy, it will then determine whether the file to be shared is a non-confidential file. For example, the file type is not a preset file type (e.g., plaintext like .doc), the file to be shared has been reviewed by preset personnel, the target user account is an account other than a blacklisted account, and / or the device recently logged into the target user account is a device other than a blacklisted device. In such cases, the file to be shared can be shared in the lower-security space, where the user can access the file.

[0107] For example, when an electronic device detects that a user needs to share a file from a user account with a lower security level to a user account with a higher security level (e.g., the current user account is a personal account and the target user account is a corporate account), the electronic device will determine whether the file to be shared complies with a preset security scanning policy, and thus determine whether the file is safe, such as whether it carries viruses or other harmful substances. If the electronic device determines that the file to be shared complies with the security scanning policy—for example, if the file does not contain viruses, or if it can also determine that the target user account is not on a blacklist, and / or that the device recently logged into the target user account is not on a blacklist—then the file can be shared to a high-security space, where the user can access the file.

[0108] In some embodiments, if the current user account and the target user account have the same security level, the shared file may be reviewed according to the outbound audit policy or the security scanning policy. This application does not impose specific restrictions on this.

[0109] Optionally, the electronic device can also set access permissions for the target user account to the shared file. For example, the target user account can access the shared file in read-only or read-write mode. The electronic device can determine the access permissions for the target user account to the shared file based on the review results. For example, if the electronic device determines that the shared file meets more than N review policies (where N is a positive integer), then the shared file can be accessed in read-write mode. If the electronic device determines that the shared file meets only N or fewer review policies, then the shared file can only be accessed in read-only mode. Alternatively, the electronic device can also obtain the current user account's access permission settings for the target user account to access the shared file, and specify the access permission settings for the target user account to access the shared file according to the user settings.

[0110] Furthermore, different review strategies can be formulated for file sharing between different accounts, thereby meeting users' needs for file sharing when using electronic devices with different accounts in different scenarios.

[0111] Optionally, the electronic device allocates different storage spaces for different user accounts, and these storage spaces are isolated from each other. If the electronic device determines that the file to be shared can be shared with the target user account, it can write the file to be shared to the storage space corresponding to the target user account. Then, the user can access the shared file after logging into the target user account.

[0112] Alternatively, electronic devices can set access permissions for each stored file. If the electronic device determines that a file to be shared can be shared with the target user account, it can also modify the access permissions of the file to be shared so that the target user account can access it. When the electronic device is logged into the target user account, it can obtain the access permissions of the files on the electronic device, determine the files that the target user account can access, and then the user, when logged into the target user account, can access the allowed files to be shared.

[0113] In other words, when a file is shared with a target user account, the electronic device can either write the file to the storage space corresponding to the target user account, or it can simply modify the access permissions of the file. It should be understood that this application does not impose specific restrictions on the method of sharing files between different accounts.

[0114] For ease of explanation, the following example illustrates how a file to be shared can be written to the storage space corresponding to the target user account by an electronic device.

[0115] In some embodiments, the review process for files to be shared, whether transferred from a low-security space to a high-security space or vice versa, can be conducted within the high-security space. For example, the high-security space may contain modules such as a virus detection module, an endpoint detection and response (EDR) module, an enterprise asset management (EAM) module, and an outbound approval module. The virus detection module scans and identifies malicious software, including viruses, worms, and Trojans, in files to be shared. The EDR and EAM modules detect suspicious behavior on the electronic device when sharing files or opening / launching files. For example, by monitoring the network connection of the electronic device, they can identify communication with malicious servers or abnormal data transmission patterns. Alternatively, the EDR and EAM modules can also detect activities inconsistent with normal behavior patterns by tracking file creation, modification, and deletion, such as the electronic device automatically deleting or modifying a large number of files.

[0116] For example, such as Figure 5 As shown, when file F1 in the low-security space needs to be sent to the high-security space, it must undergo virus detection by the virus detection module in the high-security space. Only after file F1 passes the virus detection, is determined to be a safe file, and the EDR module detects no suspicious behavior on the electronic device, can file F1 be shared with the high-security space. This ensures that the file to be shared will not carry a virus that could affect other files in the enterprise system.

[0117] When file F2 in the high-security space needs to be sent to the low-security space, the outbound approval module in the high-security space needs to review the request. This module can include customizable review policies, such as prohibiting the outbound transmission of executable files or requiring approval from a specific account before outbound transmission. For example, the designated account could be an administrator account within the company. Only after the file to be shared has passed the outbound approval module's review, and both the EDR and EAM modules have detected no suspicious activity on the electronic device, can the electronic device write file F2 to a user-accessible folder in the low-security space. This ensures that files in the high-security space can be sent to the low-security space, guaranteeing the confidentiality of files within the high-security space.

[0118] In other embodiments, the electronic device can also allocate a space transfer folder for files to be shared within the high-security space. Personal accounts and / or enterprise accounts cannot directly access files in this space transfer folder. Files to be shared transferred from the low-security space to the high-security space, and vice versa, can first be written to the space transfer folder. After the detection module in the high-security space (such as the aforementioned virus detection module, EDR module, EAM module, and outbound approval module) completes the review of the files to be shared, the files are then written to a folder accessible to the user in the target secure space.

[0119] It should be understood that in other embodiments, the various detection modules (such as virus detection module, EDR module, EAM module, and outbound approval module, etc.) and the space transfer folder may also be set in a low-security space, and this application does not limit this.

[0120] In some embodiments, multiple user accounts can be logged into an electronic device simultaneously, with each user account sharing the operating system kernel and system resources. When a user account configured with the aforementioned detection modules is logged in, each detection module (e.g., virus detection module, EDR module, EAM module, and outbound approval module) can run to review files to be shared. Furthermore, both the sending and receiving security spaces (i.e., the target security space) are running, enabling data transmission and reception. After the electronic device has reviewed the files to be shared through the various detection modules, it can directly write the files to be shared into a user-accessible folder within the target security space. When the user switches to the target user account, they can access the files to be shared from the target security space.

[0121] For example, consider an electronic device logged into both a personal account and a business account. The personal account corresponds to a low-security space, and the business account corresponds to a high-security space, with all detection modules installed in the high-security space. When the electronic device detects a user transferring a file to be shared from the low-security space to the high-security space using their personal account, the detection modules in the high-security space can review the file since the business account is logged in. After reviewing the file, the high-security detection modules can directly write the file to a user-accessible folder within the high-security space. When the user switches to their business account, they can access the file from the high-security space.

[0122] In other embodiments, if the electronic device determines that the target user account is not logged in, the application in the target secure space corresponding to the target user account cannot run, and the file to be shared cannot be directly transferred to the target secure space. Therefore, the electronic device can first write the file to be shared to the system space, where the system space corresponds to a system account (e.g., the root account). In the event of any user account logging in, the system account can run and log in in the background. Optionally, the system space may have a cache folder, and the file to be shared may be first written to the cache folder. After the electronic device detects that the target user account is logged in, the electronic device can retrieve the file to be shared from the cache folder and transfer it to the target secure space.

[0123] In other embodiments, different user accounts can log in on different electronic devices. These user accounts can share files, and the files to be shared are reviewed according to a preset review policy based on the attribute information of the user accounts on different electronic devices, such as security level. For example, consider user A logged in on device 1 and employee B logged in on device 2, where user A's security level is lower than employee B's. When a user shares a file from user A on device 1 to employee B on device 2, either device 1 or device 2 can review the file using a security scanning policy. Conversely, when a user shares a file from employee B on device 2 to user A on device 1, either device 1 or device 2 can review the file using an outbound review policy. Furthermore, the receiving device can only receive the file if it passes the review.

[0124] Optionally, the multiple devices used for sharing files can be connected via a local area network (LAN). For example, multiple electronic devices within a company's LAN can share files and review them based on a preset approval policy. Alternatively, the multiple devices used for sharing files can also be connected via a wide area network (WAN), etc. This application does not impose specific limitations on this.

[0125] In other embodiments, the electronic device also includes a file sharing application for sharing files between different security spaces, whereby users can select files to be shared through the interface of the file sharing application.

[0126] For example, such as Figure 6As shown, taking the currently logged-in personal account on PC10 as an example, PC10 displays interface 61 corresponding to the personal account, which includes an icon 62 for the file sharing application. Based on PC10's detection of the user selecting the file sharing application icon 62, a window for the file sharing application can be displayed, such as window 63. Window 63 displays information about other user accounts currently logged in or previously logged in on PC10 (e.g., employee B) and the corresponding desktop thumbnail of that other user account. The user can drag and drop the file to be shared (e.g., file F1) to a designated area in window 63 (also known as the transfer hotspot). For example, the user can drag the file F1 icon to the designated area in window 63 with the mouse and release the mouse.

[0127] The file transfer application can share file F1 to employee B's enterprise space based on the user's action of dragging the file F1 icon to the display area of ​​window 63. For example, the application can trigger the file sharing process when it detects that a user has dragged the file to be shared into the transfer hotspot of the file transfer card, such as obtaining file information and target user account information. When the application detects that the user has released the mouse, it can start the file transfer process, such as reviewing the file to be shared, and if the file is approved, sending it to the target secure space corresponding to the target user account or writing it to the cache folder.

[0128] Optionally, during the process of transferring a file to be shared to the target secure space, the file transfer application can also display a transfer list, which includes information about the file to be shared. Once the file to be shared has been transferred to the target secure space, the file transfer application can also display a sent list, which includes information about the file to be shared. Alternatively, if the file transfer application of the current user account receives a file sent by another user account, the application can also display the received file information in the received list.

[0129] Optionally, the file transfer application may only display the received file information in the received list after the received file has passed the review process. Alternatively, the application may also display information such as "received file has passed review" upon receiving a file that has passed the review process. Furthermore, after a file sent by the application has passed the review process of the target security space, it may also display information indicating that the sent file has passed the review process.

[0130] In some embodiments, the file transfer application in an electronic device can also determine the display effect of the application window based on the attribute information of the currently logged-in user account, such as the security level of the user account. For example, corresponding to a higher security level for the currently logged-in user account, the application window can slide from the right side of the screen display area, growing larger as it rotates, into the desktop display area. Corresponding to a lower security level for the currently logged-in user account, the application window can slide from the left side of the screen display area, growing larger as it rotates, into the desktop display area. This allows the display of the application window to reflect the directionality of the file during spatial transfer.

[0131] In other embodiments, if the electronic device detects an operation to close the file transfer application or a operation to close the file transfer application window, it can also close the file transfer application window with a corresponding animation effect. For example, if the security level of the currently logged-in user account is high, the file transfer application window can slide out of the desktop display area from the right side of the screen display area using a 3D stereoscopic flip, decreasing in size. If the security level of the currently logged-in user account is low, the file transfer application window can slide out of the desktop display area from the left side of the screen display area using a 3D stereoscopic flip, decreasing in size.

[0132] It should be understood that the file transfer application window can also be displayed using display effects opposite to those described above, or other display effects (such as pop-up, fade-in, sliding display, etc.). Furthermore, for different user account attribute information, the file transfer application window can be displayed in different locations, or with animation effects using different display directions; this application does not impose specific restrictions on this.

[0133] For example, such as Figure 7 As shown, taking a personal account (e.g., "User A") currently logged into PC10 as an example, based on PC10 detecting a selection operation based on the mutual transfer application icon 72, as follows... Figure 7 As shown in (A), the inter-application window 73 can slide into the display area of ​​interface 71 from the left side, and the window size increases as it slides in. The final display interface can be referenced as follows. Figure 7 As shown in (B) of the interface 74, the transfer application window 73 is displayed on the left side of the interface 74, and the transfer application window 73 includes information of another user account ("Employee B").

[0134] Taking the currently logged-in account on PC10 as an enterprise account (e.g., "Employee B") as an example, based on PC10 detecting the selection operation based on the mutual transfer application icon 76, such as... Figure 7 As shown in (C), the inter-application window 77 can slide into the display area of ​​interface 75 from the right side of interface 75, and the window grows from small to large. The final display interface can be referenced as follows. Figure 7As shown in (D) of the interface 78, the transfer application window 79 is displayed on the right side of the interface 78, and the transfer application window 79 includes information of another user account (“User A”).

[0135] In other embodiments, the file transfer application can also provide quick access methods. The electronic device can display access options for the file transfer application in a menu bar based on the file to be shared; for example, the electronic device can display a menu bar based on the file to be shared based on the detected user right-click selection of the file. For example, as... Figure 8 On the interface 81 shown, PC10 detects the right-click selection of file F1 and displays menu bar 82. Menu bar 82 includes multiple operations that can be performed on file F1, such as "Open", "Open with", "Copy", "Rename", and "Space Transfer". Based on PC10's detection of the selection operation based on the "Space Transfer" control 83, PC10 can send file F1 to the target secure space via the transfer application.

[0136] Furthermore, in the file transfer method provided by this application, file sharing can be carried out through the mutual transfer application, which provides a unified file sharing interface. Users can share all files based on the mutual transfer application, simplifying user operations. Users do not need to remember or operate different applications and protocols to achieve file sharing.

[0137] The following is combined with Figure 9 This application provides a detailed description of the file-sharing method. The file-sharing method provided in this application can be applied to electronic devices. For ease of description, the following description... Figure 9 The execution entity for each step in the illustrated process will not be described again. For example... Figure 9 As shown, this method includes, but is not limited to, the following schemes:

[0138] S910: A request to share a file to be shared from the current user account to the target user account has been detected.

[0139] When an electronic device is logged into the current user account (as an instance of the first account) and the current user account is running in the foreground on the electronic device, the electronic device can determine that it has received a request to share the file to be shared from the current user account to the target user account (as an instance of the second account) based on the detection that the user has dragged the file to be shared to a designated area in the file sharing application interface, where the file sharing application interface corresponds to the target user account (hereinafter referred to as the sharing request). For example, refer to the aforementioned Figure 6 The description states that the electronic device detects the user dragging and dropping a file (F1) into area 63 of the file transfer application window, thus confirming a sharing request has been received. Alternatively, the user can use other methods for file sharing, such as those mentioned above. Figure 8As shown, based on the electronic device detecting the selection operation of control 83, it can also be determined that the electronic device has received a sharing request.

[0140] The target user account can be a user account that is not logged in, a user account that is logged in in the background on an electronic device, or a user account logged in on another electronic device. This application does not impose specific restrictions in this regard.

[0141] S920: Review the files to be shared based on the relationship between the attribute information of the current user account and the target user account.

[0142] Electronic devices will acquire attribute information of the current user account and the target user account. For example, the user account attribute information can indicate the user account type, such as personal accounts, enterprise accounts, system accounts, and guest accounts. Different types of user accounts have different file access permissions and file sharing methods. Electronic devices can determine the corresponding file sharing method based on the relationship between the user account attribute information. For instance, an enterprise account can share non-confidential files with a personal / guest account, and a personal / guest account can share secure files with a personal account. Similarly, a personal account can share non-confidential files with a guest account, and a guest account can share secure files with a personal account.

[0143] In some embodiments, the attribute information of a user account includes security level information. The electronic device will determine the review strategy for files to be shared based on the security level of the current user account and the security level of the target user account. The security level of each user account can be preset based on the user account type. For example, the user accounts logged into by the electronic device can include personal accounts, enterprise accounts, system accounts, guest accounts, etc., and the security levels of user accounts, from highest to lowest, can be system accounts, enterprise accounts, personal accounts, and guest accounts.

[0144] For example, if the current user account has a higher security level than the target user account, the first strategy will be applied to review the shared file. For instance, if the current user account is a corporate account and the target user account is a personal account, the electronic device will determine whether the file to be shared complies with the preset first strategy, such as an outbound review strategy. This includes whether the file is highly confidential, whether it has passed manual review, and whether the target user account is on a blacklist and / or whether the device used to log in to the target user account is on a blacklist. For example, plaintext files in .doc format or core corporate data cannot be shared with user accounts that have a lower security level. See the preceding section for details. Figure 5 The relevant descriptions will not be repeated here.

[0145] The blacklisted accounts and devices can be user-defined or can be accounts that have previously engaged in violations or posed security risks, such as accounts and devices involved in cyberattacks. In other words, the blacklist of accounts and devices can be based on user-preset files, pre-loaded at runtime, or entered through other ports.

[0146] For example, if the security level of the current user account is lower than that of the target user account, a second strategy is adopted to review the files to be shared. For instance, if the current user account is a personal account and the target user account is a corporate account, the electronic device will determine whether the file to be shared complies with the preset second strategy, such as a security scanning strategy, including identifying whether the file carries viruses or if there is any abnormal behavior during the file writing process. Alternatively, it may also determine whether the target user account is a blacklisted account and / or whether the device logging into the target user account is a blacklisted device. See the aforementioned explanation for details. Figure 5 The relevant descriptions will not be repeated here.

[0147] S930: Determine whether the file to be shared has passed the review. If yes, proceed to step S940; otherwise, proceed to step S950.

[0148] After the file to be shared has passed the review under either the first or second strategy, if the file is determined to be approved, step S940 is executed; otherwise, step S950 is executed. For example, if the first strategy determines that the file to be shared is not a highly confidential file and does not require manual review or has already passed manual review, and / or the target user account is not a blacklisted account, then the file to be shared can be determined to have passed the review. As another example, if the second strategy determines that the file to be shared does not carry a virus, then the file to be shared can be determined to have passed the review.

[0149] S940: Share the file to be shared to the target user account.

[0150] Once the electronic device confirms that the file to be shared has passed the review, it can then determine that the file can be shared with the target user account. This can be achieved by either modifying the access permissions of the file to be shared to the target user account or by writing the file to the storage space corresponding to the target user account.

[0151] In some embodiments, if the target user account is not logged in, the electronic device may first write the file to be shared to the storage space corresponding to the system account, such as the cache folder. Once the electronic device detects that the target user account is logged in, it will then write the file to be shared to the storage space corresponding to the target user account.

[0152] Specifically, electronic devices can determine the currently logged-in user account by detecting foreground and / or background switching events of the user account. For example, an electronic device can determine the currently foreground logged-in user account by detecting screen unlock events and obtaining the user account selected for login based on screen unlock. See the aforementioned documentation for details. Figure 2A The relevant description is provided. Alternatively, the electronic device can record user account login events, or it can send user account login information (such as the logged-in user account ID, login time, etc.) to a cloud device or server. When a user triggers a request to share a file to be shared with the target user account, the login status of the target user account can be obtained from the local device, cloud device, and / or server. It should be understood that this application does not impose specific limitations on the method by which the electronic device determines the user account login status.

[0153] In other embodiments, the review of the file to be shared can be performed by a user account with a higher security level. Furthermore, if the current user account's security level is lower than the target user account's security level, and the target user account is not logged in, the electronic device can first write the file to be shared to the storage space corresponding to the system account, such as a cache folder. Once the electronic device detects that the target user account is logged in, the various detection modules corresponding to the target user account will then review the file to be shared. Only after the electronic device determines that the file to be shared has passed the review can it determine that the file can be shared with the target user account; for example, only then can the electronic device write the file to be shared to a folder accessible to the target user account.

[0154] In other embodiments, the electronic device may also display a notification on the interface indicating that the file to be shared has passed the review, once it has been determined that the file has passed the review.

[0155] S950: It has been determined that the file to be shared has failed to be shared.

[0156] If the electronic device determines that the file to be shared has passed the review, it will not modify the access permissions of the file to be shared, and / or will not write the file to be shared to the storage space corresponding to the target user account.

[0157] In some embodiments, if the electronic device determines that the file to be shared has failed the review, it can also display a message on the interface indicating that the file to be shared has failed the review.

[0158] Furthermore, the file sharing method provided in this application allows for the formulation of different co-audit strategies for file sharing between different security spaces, thereby meeting the file sharing needs of users when using different accounts on electronic devices in different scenarios.

[0159] The following is combined with Figure 10A This application describes the software system architecture of the file-sharing system provided. For example... Figure 10A As shown, the layered architecture divides the software into several layers, each with a clear role and function. Layers communicate with each other through software interfaces. Figure 10A The diagram illustrates the application layer and framework layer of a file transfer system. In some embodiments, the file transfer system may also include system libraries, a hardware abstraction layer (HAL), and a kernel layer, etc. Figure 10A (Not illustrated in the text).

[0160] The application layer can include a series of application packages. Since different user accounts have independent storage space, users can download and install applications based on their respective user accounts. For example, Figure 10A Taking low-security space, high-security space, and system space as examples, low-security space and high-security space have file management application and file transfer application installed. Users can view files in the corresponding space using the file management application, and can share files with another user account using the file transfer application.

[0161] Optionally, the application package may also include Figure 10A Applications not shown include camera, gallery, calendar, call, game, shopping, travel, and instant messaging (such as SMS). Additionally, the application package may include system applications such as the home screen (desktop), the negative one screen, control center, and notification center.

[0162] The framework layer provides application programming interfaces (APIs) and programming frameworks for applications in the application layer. The framework layer includes some predefined functions.

[0163] like Figure 10A As shown, the framework layer corresponding to the system space can include security management service capabilities (SA). The security management SA can be composed of the aforementioned detection modules, such as the virus detection module, EDR module, EAM module, and outbound approval module.

[0164] The Space Inter-Transfer (SA) in the system space is used to realize the spatial transfer between files to be shared, including receiving files to be shared sent by the inter-transfer application in the secure space as the sender, and sending the files to be shared to the target secure space.

[0165] In some embodiments, users can also customize audit policies, integrating capabilities such as virus scanning and data security checks (i.e., the capabilities of the aforementioned detection module) into the security management system (SA) in the form of secure extended shared objects (SOs). The file sharing audit policy implemented by capabilities such as virus scanning and data security checks can also be referred to as a credit default swaps (CDS) policy.

[0166] In this way, users or enterprises can customize their auditing policies according to their own needs, ensuring that file sharing meets their specific requirements. Furthermore, electronic devices can complete file sharing audits through user-defined security extensions (SOs), eliminating the need for professional security personnel to audit file sharing, thus reducing wasted human resources and lowering the complexity and cost of security operations.

[0167] Furthermore, the Security Extension SO enables pluggable detection capabilities. That is, if an electronic device does not include detection modules in its default factory settings, users can install these modules into the device's system via the Security Extension SO. This gives the electronic device the capability of Security Management (SA) without requiring modifications to the device's system itself. Optionally, the electronic device's system can also adapt to Security Extension SOs with different data formats, ensuring compatibility between Security Extension SOs with different security detection interface standards and the electronic device's system.

[0168] The system space may also include a screen lock management (SA) module, which is used to identify user account logins. In situations such as when the user powers on the device, transitions from lock screen to unlocked state, or detects a user switching accounts, the electronic device will display an icon like... Figure 2A The user account login interface shown is displayed. At this time, the lock screen management (SA) will also obtain the user account that the user is logged in based on the user account login interface to determine the user account that is currently logged in in the foreground.

[0169] The system space may also include a key management system (SA) for encrypting files to be shared in the cache folder to ensure the security of the files to be shared in the cache folder.

[0170] The system space also includes the interface display (SA), which is used to realize the interface display and refresh processes of electronic devices.

[0171] Optionally, the framework layer may also include an input manager, a window manager, a content provider, a view system, a phone manager, a resource manager, a notification manager, a display manager, an activity manager, etc., not shown in the figure. The view system includes visual controls, such as controls for displaying text and controls for displaying images. The view system can be used to construct the application's display interface, as described above. Figures 6 to 8 The interface shown can consist of one or more views. The display manager is used to transmit display content to the kernel layer.

[0172] Furthermore, the file sharing system provided in this application enables the review of file sharing in different scenarios, ensuring data security and preventing security threats caused by file sharing.

[0173] In other embodiments, the software architecture of the electronic device may also refer to, for example, Figure 10B As shown, the software architecture of an electronic device can be divided into several layers. In some embodiments, from bottom to top, these layers are: kernel layer, system service layer, framework layer, and application layer. The layers communicate with each other through software interfaces. System functions can be tailored, added, or combined at the subsystem granularity in different device deployment scenarios, and each subsystem can also be tailored, added, or combined at the functional granularity.

[0174] The kernel abstract layer (KAL) provides basic kernel capabilities to upper layers by shielding the differences between multiple kernels, including but not limited to process / thread management, memory management, file system, network management, and peripheral device management.

[0175] Kernel Subsystem: Supports the selection of a suitable OS kernel for different resource-constrained devices, including but not limited to Linux kernel, HarmonyOS kernel, LiteOS, etc.

[0176] Driver Subsystem: The driver framework is the foundation for the open system hardware ecosystem, providing unified peripheral access capabilities and a framework for driver development and management. The driver framework includes: display drivers, camera drivers, audio drivers, Bluetooth drivers, sensor drivers, etc.

[0177] The system service layer comprises the core capabilities of the system, providing services to applications through the framework layer. This layer includes, but is not limited to, the following subsystems:

[0178] The system's basic capability subsystem set provides fundamental capabilities for the operation, scheduling, and migration of distributed applications across multiple devices; for example, it may include distributed soft bus, distributed data management, distributed task scheduling, and Ark multi-language runtime; it also includes multi-modal input subsystem, graphics subsystem, etc.

[0179] Basic Software Service Subsystem Set: Provides common and general software services; for example, including Security Management (SA), Spatial Transfer (SA), Lock Screen Management (SA), Key Management (SA), and Interface Display (SA). See the preceding section for details. Figure 10A The relevant descriptions will not be repeated here.

[0180] Enhanced software service subsystem suite: Provides differentiated capability-enhancing software services for different devices; for example, it may include IoT proprietary business subsystems, smart screen proprietary business subsystems, wearable proprietary business subsystems, etc. (not shown in the figure).

[0181] Hardware service subsystem set: provides hardware services; for example, it may include wearable proprietary hardware service subsystem, as well as location service subsystem, unified identity and access management (IAM) subsystem, biometric identification, IoT proprietary hardware service and other subsystems (not shown in the figure).

[0182] Distributed task scheduling enables distributed service management (discovery, synchronization, registration, and invocation), supporting remote startup, remote invocation, remote connection, and migration of applications across devices.

[0183] Distributed data management enables data synchronization, data storage, data sharing, and data access across all scenarios and devices.

[0184] The distributed soft bus provides communication-related capabilities for seamless interconnection between multiple devices, including: WLAN service capabilities, Bluetooth service capabilities, soft bus, inter-process communication (remote procedure call, RPC) and other communication capabilities.

[0185] Ark Multilingual Runtime is a unified compilation runtime platform designed to support the joint compilation and execution of multiple programming languages ​​and multiple chip platforms.

[0186] The framework layer provides application programming interfaces (APIs) and programming frameworks for applications in the application layer. Examples include the ArkUI framework (which provides a complete infrastructure for UI development of system applications, including UI functionalities such as components, layouts, animations, and interactive events, as well as a real-time interface preview tool), the user application framework, and the Ability framework (an Ability is a lightweight application; the Ability framework schedules and manages the operation and lifecycle of Abilities). Different devices may run different operating systems, and therefore support different APIs.

[0187] The HarmonyOS API is a series of open capabilities provided to support HarmonyOS application development. The HarmonyOS API can be set at the framework layer or independently of the framework layer. Examples include: Audio API (audio service), Push API (push service), and Account API (account service).

[0188] Applications can include system applications and extended / third-party applications. For example, they can include file management and file transfer applications in a low-security space, as well as file management and file transfer applications in a high-security space.

[0189] The following describes the interaction process between the spatial communication SA and the security control SA mentioned above. For details, please refer to [reference needed]. Figure 10C As shown.

[0190] When the Space Transfer SA detects a file to be shared with another user account, it can notify the Security Management SA to review the file. Optionally, a relay SA connects the Space Transfer SA and the Security Management SA, facilitating communication between them. While the Space Transfer SA initiates the Security Management SA's review task for the file to be shared via the relay SA, it can also register a callback interface. This allows the Security Management SA to notify the user of the review result after completing the review, by calling the relay SA's callback interface. In other words, initiating the Security Management SA's review task and registering the callback interface can be asynchronous processes.

[0191] When the Security Administration (SA) receives a task to audit files to be shared, it can synchronously invoke the CDS (Card Stability Management) policy and then audit the files according to the preset CDS policy. This includes tasks such as CDS auditing, virus scanning, data security checks, and audit process review. These audits can be performed in parallel, i.e., asynchronous operations.

[0192] In some embodiments, the electronic device can encrypt files to be shared in the cache folder based on spatial transfer (SA) and key management (SA). For details, please refer to [example...]. Figure 10D As shown.

[0193] First, the Spatial Interchange SA obtains the public and private keys stored in the sending and receiving spaces, respectively. Based on these keys, it generates elliptic curve cryptography (ECC) symmetric key pairs. This process can also be called negotiated elliptic curve Diffie-Hellman key exchange (AgreeECDH), and the negotiated symmetric key is used as the key encryption key (KEK). For example, the Spatial Interchange SA generates the sending space's KEK from the sending space's private key and the receiving space's public key. Similarly, the Spatial Interchange SA generates the receiving space's KEK from the receiving space's private key and the sending space's public key. It should be understood that the sending space's KEK and the receiving space's KEK are a matching set. The Spatial Interchange SA can also store the corresponding space's KEK in a specified path, such as in an exception level (EL2) accessible only to system accounts or accounts with higher privileges.

[0194] Furthermore, the Space Transfer SA also obtains the data encryption key from the sending end space. The DEK can be a data file encryption key stored in the database, and its length can be 256 bytes. The Space Transfer SA then sends the KEK and DEK to the Key Management SA, which encrypts the DEK using the KEK based on Advanced Encryption Standard / Galois / Counter Mode (AES / GCM) to obtain the ciphertext DEK. The ciphertext DEK is then sent to the Space Transfer SA, which stores it and uses it to encrypt the files to be shared and store them in the cache folder. Because the Space Transfer SA stores the ciphertext DEK instead of the plaintext DEK, file security is improved.

[0195] When the Lock Screen Management (SA) detects that the target user account is logged in to the receiving space, the Space Transfer SA can obtain the KEK in the receiving space, use the KEK to decode the DEK ciphertext, and obtain the DEK plaintext. Furthermore, the Space Transfer SA can use the DEK plaintext to decode the file to be shared.

[0196] It should be understood that Figure 10D The receiving end space can also generate its own DEK ciphertext based on its symmetric key and DEK. When the receiving end space needs to send a file to be shared to the sending end space, and the sending end space is not logged in, the file to be shared can be encrypted using the receiving end space's DEK and stored in a cache folder, along with the DEK ciphertext.

[0197] Let's take a closer look at the specific details below. Figures 11A to 12B The process of file sharing in different scenarios (such as sharing files from a low-security space to a high-security space, and sharing files from a high-security space to a low-security space) is illustrated with examples.

[0198] exist Figures 11A to 12B In this example, the security space corresponding to the personal account "User A" is called the personal space, the security space corresponding to the enterprise account "Employee B" is called the enterprise space, and the system account "User 0" corresponds to the system space.

[0199] In this case, personal accounts and enterprise accounts can be logged in on the same electronic device, in which case the system account is also the account logged in on that electronic device. Alternatively, personal accounts and enterprise accounts can be logged in on different electronic devices, in which case the system account can refer to the account logged in on the same electronic device as the personal account or enterprise account. Or, the system account can refer to the system account on the sending device, that is, the account used by the sending device to complete the following... Figures 11A to 12B Inter-system space-related data transfer operations.

[0200] First, we will introduce the process of sharing files from personal space to enterprise space. Figure 11A This example demonstrates how both personal and corporate accounts can be logged in. Figure 11B This example uses a personal account that is logged in while a corporate account is not.

[0201] If the enterprise account is logged in, such as Figure 11A As shown, users can view and query files in their personal space through the file management system. For example, a personal space contains a personal folder and a file named F1 stored under the path of that folder. When a user needs to share file F1 with the enterprise space, they can locate file F1 through the system's file management application and then send file F1 to the file transfer application (step 1.1). The specific steps for sending file F1 to the file transfer application and instructing it to be shared with the enterprise space can be found in the previous section. Figures 7 to 9And its related description. The file transfer application will send file F1 to the space transfer SA (step 1.2). After receiving file F1 and confirming that the enterprise account is logged in, the space transfer SA will first write file F1 to the space transfer folder in the enterprise space (step 1.3).

[0202] The Security Assistant (SA) in the system space can review file F1 in the space transfer folder (step 1.4). Specifically, the file transfer application in the enterprise space may detect that file F1 has been written to the space transfer folder, and notify the Security Assistant to review file F1. Since the security level of personal space is lower than that of enterprise space, the Security Assistant can perform a security scan on file F1 to determine whether file F1 carries a virus. For details, please refer to the relevant descriptions of the virus security management SA and EDR modules mentioned above, which will not be repeated here. After the Security Assistant detects that file F1 has passed the review, file F1 can be sent to a folder accessible to the enterprise account (e.g., the enterprise folder) (step 1.5). Furthermore, the file transfer application can also display file F1 in the received list or display information such as the completion of the review of file F1 (step 1.6).

[0203] If the enterprise account is not logged in, such as Figure 11B As shown, the user can find file F1 through the system's file management application and then initiate a file sharing request for F1 through the file transfer application (step 2.1). The file transfer application can send file F1 to the Space Transfer SA (step 2.2). After receiving file F1 and confirming that the enterprise account is not logged in, the Space Transfer SA will first write file F1 to the cache folder (step 2.3). Optionally, when writing file F1 to the cache folder, the Space Transfer SA will also work with the Key Management SA to encrypt file F1. For details on obtaining the encrypted file F1, please refer to the aforementioned... Figure 10D The relevant descriptions will not be repeated here.

[0204] The Lock Screen Management (SA) can detect the login status of an account. After detecting that an enterprise account is logged in, the Lock Screen Management SA can notify the Space Transfer SA to decrypt the shared folder (not shown in the figure) and send the file F1 in the cache folder to the Space Transfer folder in the enterprise space (step 2.4). Alternatively, after the enterprise account logs in, the Transfer application can retrieve the file F1 from the cache folder and send it to the Space Transfer folder. Then, the Security Management (SA) can review the file F1 in the Space Transfer folder (step 2.5), such as performing a security scan on the file F1 to determine whether the file F1 carries a virus. After the Security Management (SA) detects that the file F1 has passed the review, it can send the file F1 to a folder accessible to the enterprise account (e.g., the enterprise folder) (step 2.6). Furthermore, the Transfer application can also display the file F1 in the received list or display information such as the completion of the file F1 review (step 2.7).

[0205] The following describes the process of sharing files from enterprise space to personal space. Figure 12A This example uses the scenario where both a personal account and a business account are logged in. Figure 12B This example uses a personal account that is logged in while a corporate account is not.

[0206] If a personal account is logged in, such as Figure 12A As shown, users can view and query files in their personal space through the file management system. When a user needs to share file F2 to their personal space, they can find file F2 through the system's file management application and then send file F2 to the file transfer application (step 3.1). The file transfer application will then send file F2 to the file transfer folder via the file transfer application SA (steps 3.2 and 3.3).

[0207] The Security Assistant (SA) in the system space can review file F2 in the space transfer folder (step 3.4), such as performing outbound review to determine whether file F2 has been accessed in a lower security space. For details, please refer to the relevant descriptions of the EDR module, EAM module, and outbound approval module mentioned above; they will not be repeated here. After the Security Assistant detects that file F2 has passed review, file F2 can be sent to the personal space via the space transfer SA (steps 3.5 and 3.6). The transfer application can also display file F2 in the received list, or display information such as the completion of the review for file F1. Furthermore, file F1 can be sent to a folder accessible to the personal account (e.g., the personal folder) (step 3.7).

[0208] If a personal account is not logged in, such as Figure 12BAs shown, the user can locate file F2 through the system's file management application and then send file F2 to the file transfer application (step 4.1). The file transfer application will then send file F2 to the file transfer folder via the file transfer application SA (steps 4.2 and 4.3).

[0209] The Security Assistant (SA) in the system space can audit file F2 in the space transfer folder (step 4.4), such as by auditing its outbound transmission to determine if file F2 has been accessed in a lower-security space. After the Security Assistant detects that file F2 has passed the audit, it can send file F2 to the Space Transfer Assistant (step 4.5). If the Space Transfer Assistant determines that the user account is not logged in, it will first write file F2 to the cache folder (step 4.6). It should be understood that when writing file F2 to the cache folder, the Space Transfer Assistant will also work with the Key Management Assistant (SA) to encrypt file F2, obtaining an encrypted file F2, and then store the encrypted file F2 in the cache folder.

[0210] Lock Screen Management (SA) can be used to detect the login status of an account. After Lock Screen Management (SA) detects that a personal account is logged in, Space Transfer (SA) can also decrypt the shared folder to be shared, and send the file F2 from the cache folder to the personal folder in the personal space, or write the file F2 to the personal folder through the transfer application (steps 4.7 and 4.8). In addition, the transfer application in the personal space can also display the file F2 in the received list, or display information such as the approval of the file F2.

[0211] It should be understood that in practice, electronic devices can be logged into with more than two user accounts. When any two of these user accounts need to share files, the above-mentioned method can be used for verification and sharing. For example, Figure 13 As shown, taking the example of an electronic device that can also log in to the enterprise account "Employee C", the electronic device can also include the enterprise space corresponding to the enterprise account "Employee C". Furthermore, the enterprise space of Employee C can also include file management applications, file transfer applications, file transfer SA, security management SA, etc., which will not be elaborated here.

[0212] Next, let's combine... Figure 13 Another file-sharing method provided in this application. For example... Figure 13 As shown, the method includes:

[0213] S1301: The file transfer application detected that the current user account has dragged and dropped files into the file transfer application.

[0214] For example, refer to the above Figure 6The description states that the file sharing application detected that the current user account had dragged and dropped a file (F1) into area 63 of the application window, confirming that a sharing request had been received. The user account interface displayed in the application window represents the target user account to which the current user account wishes to share the file.

[0215] S1302: The file copying application triggers the file copying to the space for file transfer (SA).

[0216] The file sharing application can send files that users drag and drop to a specified area in the display interface to Space Share SA, which will then complete the subsequent file sharing process.

[0217] S1303: Copy the SA file to the Space Transfer folder.

[0218] The Space Transfer SA copies files to the Space Transfer folder of the target user account. During this process, if the target user account is logged in, the files will be successfully copied to the target user account's folder, and subsequent steps S1304 to S1314 will be executed. If the target user account is not logged in, the file copy will fail, and subsequent steps S1315 to S1337 will be executed.

[0219] S1304: Spatial Interoperability (SA) updates the database.

[0220] After a file is successfully copied, Space Transfer SA can update the file information in the database, such as updating the file's status to "copied to the target user account." It should be understood that at this point, the file is only copied to the target user account's Space Transfer folder; however, if the file has not passed review, the target user account cannot access the file.

[0221] S1305: Spatial Transfer SA notifies the transfer application of the copy result.

[0222] S1306: The Inter-Transfer application displays the SA notification status card on the interface.

[0223] S1307: The interface displays that SA sends a status card notification to the current user account.

[0224] After a file copy is successfully performed in the space transfer, the information that the file copy was successful can be displayed in the form of a status card.

[0225] S1308: The interface of the file transfer application is displayed.

[0226] After a file is successfully copied using the SA file transfer service, the application can be notified to display a success message. The application will then display the SA file through its interface. For example, the application window may display the message "File copied successfully," and / or show information about the copied file, such as the filename, file icon, and / or copy time.

[0227] It should be understood that if the current user account and the target user account are logged in on the same device, the file transfer application is launched under the currently logged-in user account, and a successful file copy interface is displayed. If the current user account and the target user account are logged in on different devices, and both are logged in in the foreground, the successful file copy interface can be displayed on both the devices corresponding to the current user account and the target user account through the file transfer application.

[0228] S1309: Spatial Communication SA initiates document review to Security Management SA.

[0229] The Space Transfer SA also needs to initiate file review with the Security Management SA. Only after the file passes the review can it be accessed by the target user account. The Security Management SA can determine the file review policy based on the security level of the current user account and the target user account, and then review the file according to the determined file review policy. For details, please refer to the relevant description of S920 mentioned above, which will not be repeated here.

[0230] S1310: Security Management (SA) transmits audit results to Space Interoperability (SA).

[0231] Furthermore, if the review is approved, the Security Assistant (SA) can also write files from the shared folder to a folder accessible to the target user account. If the review fails, the SA can also delete files from the shared folder.

[0232] S1311: Spatial Transfer SA notifies the transfer application of the audit results.

[0233] S1312: The Inter-Transfer application displays the SA notification card on the interface.

[0234] S1313: The interface displays a status card notification from SA to the current user account.

[0235] S1314: The interface of the file transfer application is displayed.

[0236] In the aforementioned S1303, if the target user account is not logged in, the file copy will fail, and then the following S1315 to S1337 will be executed.

[0237] S1315: Spatial transfer SA generates DEK.

[0238] Space Transfer SA needs to encrypt the file and then cache it in the system space's cache folder. Then, Space Transfer SA will obtain the DEK used to encrypt the file.

[0239] S1316: Spatial transfer (SA) generates KEK.

[0240] Space Transfer (SA) also generates a KEK based on the current user account's private key and the target user account's public key, which is used to encrypt the DEK. See the previous section for details. Figure 10D The relevant descriptions will not be repeated here.

[0241] It should be understood that S1315 and S1316 can also be executed simultaneously, and this application does not impose specific restrictions on the execution order of S1315 and S1316.

[0242] S1317: The Space Interchange SA sends the DEK and KEK to the Key Management SA.

[0243] S1318: Key Management (SA) returns DEK ciphertext to Space Interchange (SA).

[0244] The key management (SA) encrypts the DEK based on the KEK to obtain the DEK ciphertext, and then transmits the returned DEK ciphertext to the space exchange.

[0245] S1319: Spatial transfer SA updates the database, saving the DEK ciphertext with the file.

[0246] Space Transfer (SA) will use DEK to encrypt and store the file records in the database, and save the DEK ciphertext in the cache folder.

[0247] S1320: Spatial Transfer SA notifies the transfer application of the copy result.

[0248] S1321: The Inter-Transfer application displays the SA notification status card on the interface.

[0249] S1322: The interface displays a status card notification from SA to the current user account.

[0250] S1323: The interface of the file transfer application is displayed.

[0251] S1324: The Lock Screen Management (SA) sends a message to the Space Communication (SA) indicating that an unlock event has been detected.

[0252] The Lock Screen Management (SA) is used to identify user account logins. In situations such as when a user powers on the device, transitions from lock screen to unlocked state, or detects a user switching accounts, the Lock Screen Management (SA) retrieves the user account logged in through the user account login interface to determine the currently logged-in user account. The Lock Screen Management (SA) then sends a notification to the Space Transfer (SA) indicating that an unlock event has been detected.

[0253] S1325: Spatial Transfer SA queries the front-end user from the target user account.

[0254] Space Transfer (SA) will query the information of the user account currently in the foreground, taking the currently logged-in user account as the target user account as an example.

[0255] S1326: Target user account: Returns the current foreground user ID.

[0256] S1327: Spatial Inter-transfer (SA) query transmission task.

[0257] Space Transfer (SA) will query the database based on the current front-end user ID to see if there are any files that have not been sent to the target user account.

[0258] S1328: Spatial intercommunication (SA) negotiates to obtain the target KEK.

[0259] Based on the aforementioned steps S1319, the Space Transfer SA determines that there are files in the cache that have not yet been sent to the target user account. It will first decrypt the files before sending them to the Space Transfer folder. First, the Space Transfer SA needs to negotiate and obtain a KEK that can decrypt the DEK ciphertext. For example, it can negotiate and obtain the target KEK based on the public key of the previously logged-in user account and the private key of the currently logged-in target user account.

[0260] S1329: The Space Interchange SA sends the DEK ciphertext and the target KEK to the Key Management SA.

[0261] The key management (SA) will decrypt the DEK ciphertext based on the target KEK to obtain the DEK plaintext.

[0262] S1330: Key Management (SA) returns DEK plaintext to Space Interchange (SA).

[0263] S1331: Transfer the SA decrypted file between spaces and copy it to the space transfer folder.

[0264] Space Transfer SA decrypts files in plaintext using DEK and copies the decrypted files to the Space Transfer folder.

[0265] S1332: Spatial Interchange SA initiates document review to Security Management SA.

[0266] S1333: Security control SA transmits audit results to space SA.

[0267] S1334: Spatial Transfer SA notifies the transfer application of the audit results.

[0268] S1335: The Inter-Transfer application displays an SA notification card on the interface.

[0269] S1336: The interface displays a status card notification from SA to the current user account.

[0270] S1337: The interface of the file transfer application is displayed.

[0271] In some embodiments, if the file transfer and security management (SA) belong to the space corresponding to the sending user account, the space transfer SA can first write the file to the space transfer folder, then execute S1332 and S1333 to review the file. After the file review is passed, execute S1315 to S1319 to store the DEK ciphertext and the file in the cache folder. Then, based on the lock screen management (SA) detecting an unlock event, execute S1324 to S1330, and after decrypting the file based on the DEK plaintext, send the file to the space of the receiving user account (i.e., the target user account). For details, please refer to the foregoing. Figure 12B The relevant descriptions will not be repeated here.

[0272] Furthermore, the file sharing system provided in this application enables the review of file sharing in different scenarios, ensuring data security and preventing security threats caused by file sharing.

[0273] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive), etc.

[0274] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. This program can be stored in a computer-readable storage medium, and when executed, it can include the processes described in the above method embodiments. The aforementioned storage medium includes various media capable of storing program code, such as read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

Claims

1. A file sharing method, characterized in that, Applied to a first device, the method includes: Upon receiving a first request, the first request is used to request that the first file under the first account be shared with the second account; Determine the attribute information of the first account and the second account; Based on the relationship between the attribute information of the first account and the second account, determine whether to share the first file under the first account with the second account; If it is determined that the first file is shared, then determine the login status of the second account; If the second account is detected to be not logged in, the first file will be shared with the system account; Upon detecting that the second account has switched to a logged-in state, the first file is shared from the system account to the second account.

2. The method according to claim 1, characterized in that, The step of determining whether to share the first file under the first account with the second account based on the relationship between the attribute information of the first account and the second account includes: Based on the relationship between the attribute information of the first account and the second account, and whether the first file is a non-confidential file or a secure file, determine whether to share the first file under the first account with the second account.

3. The method according to claim 1, characterized in that, The attribute information includes security level information; The step of determining whether to share the first file under the first account with the second account based on the relationship between the attribute information of the first account and the second account includes: If the security level of the first account is higher than that of the second account, and the first file is a non-confidential file, then the first file under the first account will be shared with the second account; or... If the security level of the first account is lower than that of the second account, and the first file is a secure file, then the first file under the first account will be shared with the second account.

4. The method according to claim 3, characterized in that, The security level of the system account is higher than that of the first account and the second account.

5. The method according to any one of claims 2 to 4, characterized in that, The first file is a non-confidential file when it meets one or more of the following conditions: The file type of the first file is a preset type; The first document is a non-confidential document confirmed by the user.

6. The method according to any one of claims 2 to 4, characterized in that, The first file is a safe file when it meets one or more of the following conditions: The first file was not detected to contain a virus; The first file is a non-abnormal file. The first file being an abnormal file includes one or more of the following: the first file includes a program for initiating a communication connection between the first device and other devices, the first file initiating the act of creating a file, the first file initiating the act of deleting a file, or the first file initiating the act of modifying a file.

7. The method according to any one of claims 1 to 6, characterized in that, The step of determining whether to share the first file under the first account with the second account based on the relationship between the attribute information of the first account and the second account includes: If the second account is not in the preset account list, then the first file under the first account will be shared with the second account; and if the device logged into the second account is not in the preset device list, then the first file under the first account will be shared with the second account.

8. The method according to claim 1, characterized in that, The sharing of the first file with the second account includes: Grant the second account access rights to the first file; Write the first file to the storage space accessible to the second account.

9. The method according to claim 1, characterized in that, The file storage space of the first account is the first space, the file storage space of the second account is the second space, and the file storage space of the system account is the system space; If the second account is detected to be not logged in, sharing the first file with the system account includes: If the second account is detected to be not logged in, the first file will be written to the system space; The step of detecting that the second account has switched to a logged-in state and sharing the first file from the system account to the second account includes: If the second account is detected to be logged in, the first file is written from the system space to the second space.

10. The method according to claim 9, characterized in that, If the second account is detected to be in an unlogged-in state, writing the first file to the system space includes: Generate a first key to encrypt the first file, and generate a second key to encrypt the first key based on the private key of the first account and the public key of the second account; The first file is encrypted using the first key, and the first key is encrypted using the second key to obtain the first key ciphertext; The encrypted first file and the first key ciphertext are written into the system space.

11. The method according to claim 10, characterized in that, If the second account is detected to be logged in, writing the first file from the system space to the second space includes: A third key is generated based on the private key of the second account and the public key of the first account; The first key is obtained by decrypting the ciphertext of the first key using the third key; The encrypted first file is decrypted based on the first key to obtain the decrypted first file; The decrypted first file is copied from the system space to the second space.

12. The method according to claim 3, characterized in that, The file storage space for the first account is the first space, and the file storage space for the second account is the second space; The step of determining whether to share the first file under the first account with the second account based on the relationship between the attribute information of the first account and the second account includes: If the security level of the first account is higher than that of the second account, the application in the first space determines whether to share the first file under the first account with the second account; or... If the security level of the first account is lower than that of the second account, the application in the second space determines whether to share the first file under the first account with the second account.

13. The method according to any one of claims 9 to 12, characterized in that, The second space belongs to the first device, or the second space belongs to a second device that is communicatively connected to the first device.

14. The method according to claim 1, characterized in that, The first device includes a file-sharing application; The receipt of the first request includes: The first interface of the file sharing application is displayed. The first interface includes a sharing operation area, which includes the account information of the second account. Upon receiving a first operation to drag the first file to the shared operation area, it is determined that the first request has been received.

15. The method according to claim 14, characterized in that, The method further includes: Upon receiving a second operation from the user to launch the file-sharing application, determine the security level of the currently logged-in account on the first device; If the security level of the first account is higher than that of the second account, the window of the file-sharing application is displayed with a first animation effect; if the security level of the first account is lower than that of the second account, the window of the file-sharing application is displayed with a second animation effect.

16. The method according to claim 15, characterized in that, The first animation effect includes a flip animation effect with the flip direction being the first direction, and the second animation effect includes a flip animation effect with the flip direction being the opposite of the first direction; or, The first animation effect includes a sliding animation effect with the sliding direction being the second direction, and the second animation effect includes a sliding animation effect with the sliding direction being the opposite of the second direction; or, The first animation effect includes a sliding animation effect with the pop-in direction being third-party, and the second animation effect includes a pop-in animation effect with the pop-in direction being the opposite of third-party.

17. An electronic device, characterized in that, It includes a processor and a memory, the memory being used to store instructions, the processor being used to execute the instructions, and when the processor executes the instructions, performing the method as described in any one of claims 1 to 16.

18. A computer-readable storage medium, characterized in that, Includes instructions that, when executed on an electronic device, cause the electronic device to perform the method as described in any one of claims 1 to 16.

19. A computer program product, characterized in that, The computer program product includes computer instructions that, when executed by an electronic device, enable the electronic device to perform the method as described in any one of claims 1 to 16.

Images