WO2014146609A1 - 信息处理方法、信任服务器及云服务器 - Google Patents

信息处理方法、信任服务器及云服务器 Download PDF

Info

Publication number
WO2014146609A1
WO2014146609A1 PCT/CN2014/073886 CN2014073886W WO2014146609A1 WO 2014146609 A1 WO2014146609 A1 WO 2014146609A1 CN 2014073886 W CN2014073886 W CN 2014073886W WO 2014146609 A1 WO2014146609 A1 WO 2014146609A1
Authority
WO
WIPO (PCT)
Prior art keywords
information
uid
user
user data
private information
Prior art date
Application number
PCT/CN2014/073886
Other languages
English (en)
French (fr)
Inventor
汪婵
吴黄伟
Original Assignee
华为终端有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为终端有限公司 filed Critical 华为终端有限公司
Priority to EP14771033.9A priority Critical patent/EP2942899B1/en
Publication of WO2014146609A1 publication Critical patent/WO2014146609A1/zh
Priority to US14/820,673 priority patent/US10063655B2/en

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/60—Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/1097—Protocols in which an application is distributed across nodes in the network for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/061—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key exchange, e.g. in peer-to-peer networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]

Definitions

  • the present application claims priority to Chinese Patent Application No. 201310092589.8, the entire disclosure of which is hereby incorporated by reference.
  • TECHNICAL FIELD [01] The present invention relates to the field of network communication technologies, and in particular, to an information processing method, a trust server, and a cloud server. Background technique
  • Cloud Computing is a technology that provides dynamic and scalable virtualized resources through the Internet. It can easily access the network through cloud computing, and can store massive amounts of data by configuring a large number of storage devices. management. Cloud computing requires a large number of users to participate. Usually, to protect the security of user data, users encrypt the user data uploaded to the cloud server.
  • the summary information of the user data is also uploaded at the same time.
  • the summary information is a simple summary of the user data, and the key information is extracted from the user data in a compact form.
  • the user data describes the information, and the summary information may include the user's name, telephone number, email address, information of interest, and the like. Due to the openness of the summary information, the third party can obtain the summary information of the user who is interested from the cloud server, thereby causing the leakage of the user's personal information and reducing the security performance of the cloud computing system.
  • an information processing method is provided, where the method includes: [07] acquiring user data of a user terminal;
  • the method further includes: saving the private information and the UID Correspondence between the two.
  • the acquiring user data of the user terminal is specifically:
  • the notification message is used to notify the user terminal that the encrypted user data has been uploaded to the cloud server, and the encrypted user data is the encryption key pair issued by the user terminal according to the The user data is encrypted data;
  • the method before the receiving the notification message sent by the user terminal, the method further includes:
  • the acquiring user data of the user terminal is specifically: receiving the user terminal User data of the uploaded user terminal; [21] the method further includes:
  • the method further includes: [25] receiving the push information and the UID sent by the third-party terminal,
  • the UID is a non-privacy that the cloud server obtains and sends to the third-party terminal to match the demand information after receiving the demand information sent by the third-party terminal.
  • another information processing method includes: [29] receiving non-private information and a UID of a user transmitted by a trusted server, where the non-private information is obtained by the trust server The information contained in the summary information extracted in the user data, the summary information further includes the user's private information, and the UID is a UID generated by the trust server for the private information;
  • the method further includes: [32] receiving demand information sent by a third-party terminal;
  • a trust server includes:
  • an obtaining unit configured to acquire user data of the user terminal
  • an extracting unit configured to extract digest information of user data acquired by the acquiring unit, where the digest information includes private information and non-private information of the user
  • a generating unit configured to The private information in the summary information extracted by the extracting unit generates a unique identifier UID
  • a transmission unit configured to transmit the non-private information in the summary information extracted by the extracting unit and the UID generated by the generating unit to the cloud server, so that the cloud server saves the non-private information and the Correspondence between UIDs.
  • the trust server further includes: [41] a saving unit, configured to save the foregoing in the summary information extracted by the extracting unit Privacy information and the generated unit Correspondence between the UIDs.
  • the acquiring unit includes:
  • a notification message receiving subunit configured to receive a notification message sent by the user terminal, where the notification message is used to notify the user terminal that the encrypted user data has been uploaded to the cloud server, and the encrypted user data is the user terminal Encrypting the user data according to the issued encryption key;
  • a data request sending subunit configured to send, to the cloud server, a data request message for requesting the encrypted user data according to the notification message received by the notification message receiving subunit;
  • an encrypted data receiving subunit configured to receive the encrypted user data returned by the cloud server according to the data request message sent by the request message sending subunit;
  • An encrypted data decryption subunit configured to decrypt the encrypted user data received by the encrypted data receiving subunit by using the encryption key to obtain decrypted user data.
  • the trusted server further includes: [48] a first receiving unit, configured to receive the a key request message sent by the user terminal;
  • a sending unit configured to send the encryption key to the user terminal according to the key request message received by the first receiving unit, so that the user terminal performs the pair according to the encryption key After the user data is encrypted, the encrypted user data is transmitted to the cloud server.
  • the acquiring unit includes:
  • a user data receiving subunit configured to receive user data of the user terminal uploaded by the user terminal;
  • the trust server further includes:
  • the trust server further includes:
  • a second receiving unit configured to receive the push information and the UID sent by the third-party terminal, where the UID is obtained by the cloud server after receiving the demand information sent by the third-party terminal, and sent to the third party a UID corresponding to the non-private information of the terminal that matches the demand information;
  • an obtaining unit configured to obtain private information corresponding to the UID received by the second receiving unit;
  • a sending unit configured to send the push information according to user address information included in the private information acquired by the obtaining unit.
  • a trust server includes: a bus through which a processor and a network interface are connected, wherein [60] the processor is configured to pass the network interface Obtaining user data of the user terminal, extracting summary information of the user data, the summary information includes private information and non-private information of the user, generating a unique identifier UID for the private information, and using the non-private information And transmitting, by the UID, to the cloud server by using the network interface, so that the cloud server saves a correspondence between the non-private information and the UID.
  • the trusted server further includes: a memory connected to the bus;
  • the memory is configured to save a correspondence between the private information and the UID.
  • the processor is further configured to receive, by using the network interface The push information and the UID sent by the third party terminal, where the UID is the non-private information that is obtained by the cloud server and is sent to the third party terminal and matched with the demand information, after the cloud server receives the demand information sent by the third party terminal.
  • the processor is further configured to receive, by using the network interface The push information and the UID sent by the third party terminal, where the UID is the non-private information that is obtained by the cloud server and is sent to the third party terminal and matched with the demand information, after the cloud server receives the demand information sent by the third party terminal.
  • Corresponding UID obtaining private information corresponding to the UID, and sending the push information to the user by using the network interface according to the user address information included in the private information.
  • a cloud server includes:
  • a first receiving unit configured to receive non-private information and a UID of a user that is transmitted by the trusted server, where the non-private information is information included in the digest information extracted by the trusted server from the acquired user data, where The summary information further includes the user's private information, and the UID is a UID generated by the trust server for the private information;
  • the cloud server further includes: [68] a second receiving unit, configured to receive demand information sent by the third-party terminal;
  • a matching unit configured to match the non-private information saved by the saving unit with the requirement information received by the second receiving unit, and obtain a non-private information corresponding to the demand information.
  • a sending unit configured to send, by the matching unit, a UID corresponding to the non-private information to the third-party terminal, so that the third-party terminal sends the UID and the push information to the trust
  • the trust server sends the push information according to the user address information included in the privacy information corresponding to the UID.
  • a cloud server includes: a bus, and a processor, a network interface, and a memory connected through the bus, where [72] the processor is configured to pass The network interface receives the non-private information and the UID of the user transmitted by the trusted server, where the non-private information is information included in the summary information extracted by the trusted server from the acquired user data, and the summary information further includes The UID of the user is a UID generated by the trust server for the privacy information, and the correspondence between the non-private information and the UID is saved to the memory.
  • the processor is further configured to receive, by using the network interface, demand information sent by a third-party terminal, and save the memory
  • the non-private information is matched with the demand information, and the UID corresponding to the non-private information matching the demand information is obtained, and the obtained UID corresponding to the non-private information is sent to the third party through the network interface.
  • the trusted server sends the push information according to the user address information included in the private information corresponding to the UID.
  • the trust server acquires user data of the user terminal, and extracts summary information of the user data, where the summary information includes the user's private information and non-private information, generates a UID for the private information, and uses the non-private information.
  • the UID is transmitted to the cloud server, and the cloud server stores the correspondence between the non-private information and the UID. Since the trust server is introduced in the embodiment provided by the present invention, after the summary information of the user is processed by the trust server, the cloud server does not save the complete summary information composed of the private information and the non-private information, but only saves the summary information.
  • the UID of the non-private information and the private information so that the third party cannot obtain the user's private information from the cloud server, thereby improving the security performance of the cloud computing system.
  • 1 is a flow chart of an embodiment of an information processing method
  • FIG. 2 is a flow chart of another embodiment of an information processing method
  • FIG. 3 is a flow chart of another embodiment of an information processing method
  • FIG. 5 is a block diagram of an embodiment of a trust server of the present invention.
  • FIG. 6 is a block diagram of another embodiment of a trust server of the present invention.
  • FIG. 7 is a block diagram of another embodiment of a trust server of the present invention.
  • FIG. 8 is a block diagram of another embodiment of a trust server of the present invention.
  • FIG. 9 is a block diagram of another embodiment of a trust server of the present invention.
  • FIG. 10 is a block diagram of an embodiment of a cloud server according to the present invention.
  • FIG. 1 is a block diagram of another embodiment of a cloud server according to the present invention.
  • FIG. 12 is a block diagram of another embodiment of a cloud server according to the present invention.
  • the following embodiments of the present invention provide an information processing method, a trust server, and a cloud server.
  • FIG. 1 is a flowchart of an embodiment of an information processing method according to the present invention
  • the embodiment describes an information processing process in a cloud computing from a trusted server side:
  • Step 101 The trust server acquires user data of the user terminal.
  • the trust server may be specifically a server of a trust center, and the trust center is deployed.
  • the cloud server, the user terminal, and the third-party terminal that exchange information through the trust server can issue certificates in advance to implement identity authentication between them, that is, the trust center can have a certificate authority (Certificate Authority) , CA) center; and, the trust center can also issue a key for the user terminal, that is, the trust center can have a Key Distribution Center (KDC).
  • the trust server may receive the user data directly uploaded by the user terminal; or the trust server may send the data requesting the encrypted user data to the cloud server according to the notification message after receiving the notification message sent by the user terminal.
  • the notification message is used to notify the trust server that the user terminal has uploaded the encrypted user data to the cloud server, and the encrypted user data is data encrypted by the user terminal according to the encryption key issued by the trust server, and the trusted server is trusted.
  • the receiving cloud server decrypts the encrypted user data according to the encrypted user data returned by the data request message, and obtains the decrypted user data.
  • Step 102 The trust server extracts summary information of the user data, and the summary information includes the user's private information and non-private information.
  • the summary information refers to information that simply summarizes the user data, extracts key information from the user data, and describes the user data in a compact form.
  • the summary information can be divided into two parts: private information and non-private information.
  • the private information refers to some personal sensitive information with confidentiality characteristics, and the non-private information may include information of the user's interest, for example, for the user's medical data.
  • the privacy information may include a user name, a phone number, a home address, an E-Mai l, an account information, etc.; the non-private information may include hospital information, drug information, family medical history information, and the like.
  • the summary information may be extracted from the user data by using the crawler technology or the automatic summarization technology in the prior art, and details are not described herein again.
  • Step 103 The trust server generates a UID for the private information.
  • each user may have a user identifier indicating an identity, and each user may have multiple user data.
  • the trust server is for each The private information generates a unique identifier (Uniform Identifier, UID), which may be a serial number generated by the trust server in sequence, or may be generated by the trust server using a preset function to generate a serial number, that is, each private information. Corresponds to a unique serial number.
  • UID Uniform Identifier
  • Step 104 The trust server transmits the non-private information and the UID to the cloud server, so that the cloud server saves the correspondence between the non-private information and the UID.
  • the trust server transmits the non-private information in the summary information and the UID generated for the private information to the cloud server. Since the cloud server only saves the user's non-private information, the third party cannot obtain the cloud server from the cloud server. User's private information.
  • the cloud server no longer stores the complete summary information composed of the private information and the non-private information, but only the non-private information in the summary information. And the UID of the private information, so that the third party can not obtain the user's private information from the cloud server, thereby improving the security performance of the cloud computing system.
  • FIG. 2 it is a flowchart of another embodiment of an information processing method according to the present invention.
  • the embodiment describes an information processing process in a cloud computing from a cloud server side:
  • Step 201 The cloud server receives the non-private information and the UID of the user transmitted by the trusted server, where the non-private information is information included in the summary information extracted by the trusted server from the obtained user data, and the summary information further includes The user's private information, the UID is the UID generated by the trust server for the private information.
  • the cloud server may be specifically a server set in the cloud computing system, and the server has a function of storing massive user data, and the user terminal may access the cloud server through the network.
  • the trust server extracts summary information of the user data, where the summary information includes the user's private information and non-private information, and the trust server generates a UID for the private information.
  • the non-private information and the UID are transmitted to the cloud server, so the cloud server only obtains the non-private information of the user, so that the third party cannot obtain the user's private information from the cloud server.
  • Step 202 The cloud server saves the correspondence between the non-private information and the UID.
  • FIG. 3 it is a flowchart of another embodiment of an information processing method according to the present invention.
  • the embodiment describes a detailed process of information processing through interaction between a user terminal, a trust server, a cloud server, and a third-party terminal:
  • Step 301 The user terminal sends a key request message to the trust server.
  • the trust server may be specifically a server of a trust center, and the trust center is deployed between the cloud server and the terminal, and may be pre-filtered to the cloud server and the user terminal through the trust server.
  • the third-party terminal issues a certificate to implement identity authentication between them, that is, the trust center can have a CA; and the trust center can also issue a key for the user terminal, that is, the trust center can have a KDC.
  • the user terminal may upload the user data to the cloud server before The trust server sends a key request message containing the user ID for requesting the trust server to allocate the encryption key.
  • Step 302 The trust server returns an encryption key to the user terminal according to the key request message, and saves a correspondence between the user identifier and the encryption key.
  • Step 303 The user terminal encrypts the user data to be uploaded to the cloud server by using an encryption key to obtain encrypted user data.
  • the cloud server is used to implement mass storage of user data.
  • the user terminal may encrypt the user data and save the encrypted user data.
  • Step 304 The user terminal uploads the encrypted user data to the cloud server.
  • the user terminal When the user terminal uploads the encrypted user data to the cloud server, the user terminal carries the user identifier at the same time.
  • Step 305 The cloud server saves the correspondence between the user identifier and the encrypted user data.
  • Step 306 The user terminal sends a notification message that the encrypted user data has been uploaded to the cloud server to the trust server.
  • Step 307 The trust server sends a data request message requesting the encrypted user data to the cloud server.
  • the trust server carries the user identifier in the sent data request message.
  • Step 308 The cloud server searches for the corresponding relationship between the saved user identifier and the encrypted user data according to the user identifier, obtains the encrypted user data corresponding to the user identifier, and sends the obtained encrypted user data to the trusted server.
  • Step 309 The trust server obtains an encryption key corresponding to the user identifier according to the user identifier, and decrypts the received encrypted user data by using the encryption key to obtain user data.
  • Step 310 The trust server performs summary information processing on the user data, extracts summary information in the user data, removes the private information in the summary information, and generates a UID for the private information.
  • Step 31 1 The trust server saves the correspondence between the private information and the UID.
  • Step 312 The trust server uploads the non-private information and the UID generated for the private information to the cloud server.
  • Step 313 The cloud server further saves the correspondence between the user identifier and the non-private information and the UID based on the correspondence between the user identifier and the encrypted user data saved in the foregoing step 305.
  • Step 314 The third party terminal sends the demand information to the cloud server.
  • the demand information is information set when a third-party terminal wants to obtain information of a user who satisfies a certain condition from a cloud server. For example, if a travel company wants to obtain information from a cloud server to users who have visited more than three times a year and pushes travel information to these users, then "tours more than 3 times" is a kind of demand information.
  • Step 315 The cloud server matches the demand information with the saved non-private information, and obtains a UID corresponding to the non-private information that matches the demand information.
  • the cloud server stores the correspondence between the non-private information and the UID, and the cloud server can match the demand information with the saved non-private information one by one to obtain non-private information that matches the demand information, and then, according to the correspondence, Obtain a UID corresponding to the matched non-private information.
  • Step 316 The cloud server sends the obtained UID to the third party terminal.
  • Step 317 The third party terminal sends the push information and the UID to the trusted server.
  • Step 318 The trust server acquires the privacy information corresponding to the UID sent by the third party terminal, and obtains the address information of the user from the privacy information.
  • the trust server Since the trust server stores the correspondence between the private information and the UID, the trust server can obtain the private information corresponding to the UID through the correspondence after receiving the UID sent by the third party terminal, and the privacy information can usually be Contains the user's address information.
  • Step 319 The trust server sends the push information to the user terminal according to the obtained address information.
  • the user terminal may also upload the encrypted user data to the trust server, so that the trust server does not need to obtain the encrypted user data from the cloud server, and the embodiment of the present invention does not Make restrictions.
  • FIG. 4 is a flowchart of another embodiment of an information processing method according to the present invention. The embodiment describes a detailed process of information processing through interaction between a user terminal, a trust server, a cloud server, and a third-party terminal:
  • Step 401 The user terminal performs key agreement with the trust server to obtain an encryption key.
  • the difference between this embodiment and the embodiment shown in FIG. 3 is that, in this embodiment, the user terminal does not directly accept the encryption key issued by the trust server, but uses the key agreement with the trust server to obtain the encryption key. key.
  • Step 402 The user terminal sends the user data to the trust server.
  • Step 403 The trust server encrypts the user data by using the negotiated encryption key to obtain encrypted user data.
  • Step 404 The trust server performs summary information processing on the user data, extracts summary information in the user data, removes the private information in the summary information, and generates a UID for the private information.
  • step 404 may also be performed before step 403, and the embodiment is not limited.
  • Step 405 The trust server saves the correspondence between the private information and the UID.
  • Step 406 The trust server uploads the user identification, encrypted user data, non-private information, and UID generated for the private information to the cloud server.
  • the trust server can simultaneously upload user IDs, encrypt user data, non-private information, and
  • the UID is sent to the cloud server.
  • the non-private information and the UID are first uploaded to the cloud server, and then the user identifier and the encrypted user data are uploaded to the cloud server.
  • the cloud server is used to implement the mass storage of user data.
  • the user terminal can directly send the user data to the trust server, and the trust server After encrypting the user data, the encrypted user data is uploaded to the cloud server for storage.
  • the user data may be encrypted and sent to the trusted server, and the trusted server uploads the encrypted user data to the cloud server for storage. Since the third party terminal has difficulty obtaining the encryption key, the third party terminal cannot access the user data from the cloud server.
  • Step 407 The cloud server saves the user identity, encrypts the user data, and the correspondence between the non-private information and the UID.
  • Step 408 The third party terminal sends the demand information to the cloud server.
  • Step 409 The cloud server matches the demand information with the saved non-private information, and obtains a UID corresponding to the non-private information that matches the demand information.
  • Step 410 The cloud server sends the obtained UID to the third-party terminal.
  • Step 41 1 The third party terminal sends the push information and the UID to the trust server.
  • Step 412 The trust server acquires the private information corresponding to the UID sent by the third-party terminal, and obtains the address information of the user from the private information.
  • Step 413 The trust server sends the push information to the user terminal according to the obtained address information.
  • the third-party terminal may be various terminals that push advertisement information to the user terminal, such as a terminal of a medical institution, and the third-party terminal may access the cloud server, but the non-private information is saved on the cloud server.
  • the UID of the private information so the third-party terminal cannot obtain the private information of the user terminal from the cloud server, and can only send the UID and the push information to the trust server according to the UID of the private information returned by the cloud server, and the trusted server obtains the The private information corresponding to the UID, and then the address information of the user, so that the trust server pushes the push information to the user terminal.
  • the user terminal may also send the encrypted user data encrypted by the encryption key to the trust server in step 402, and the trust server may encrypt the user by using the encryption key pair.
  • the obtained user data is subjected to digest processing, and then the non-private information obtained by the digest processing, the UID of the private information, and the encrypted user data sent by the user terminal are uploaded to the cloud server, thereby eliminating the need to trust the server to the user data.
  • Encryption is performed to forward encrypted user data to the cloud server through the trust server; or, the user terminal can directly transmit the encrypted user data to the cloud server without forwarding through the trust server, and the user terminal can use the user data or the encrypted user.
  • the data is sent to the trust server, and the user data is digested by the trust server, and then the UID of the non-private information and the private information obtained after the digest processing is uploaded to the cloud server.
  • the embodiment of the present invention is not limited thereto.
  • the cloud server no longer stores the complete summary information composed of the private information and the non-private information, but only the non-private information in the summary information. And the UID of the private information, so that the third party can not obtain the user's private information from the cloud server, thereby improving the security performance of the cloud computing system.
  • the present invention also provides an embodiment of a trust server and a cloud server.
  • a trust server of the present invention:
  • the trust server includes: an obtaining unit 510, an extracting unit 520, a generating unit 530, and a transmitting unit 540.
  • the obtaining unit 510 is configured to acquire user data of the user terminal.
  • the extracting unit 520 is configured to extract summary information of the user data acquired by the acquiring unit 510, where the summary information includes private information and non-private information of the user; [163] a generating unit 530, configured to generate a unique identifier UID for the private information in the digest information extracted by the extracting unit 520;
  • the transmitting unit 540 is configured to transmit the non-private information in the summary information extracted by the extracting unit 520 and the UID generated by the generating unit 530 to the cloud server, so that the cloud server saves the non-private information. Correspondence with the UID.
  • the trust server may be specifically a server of a trust center, and the trust center is deployed between the cloud server and the terminal, and may be pre-filtered to the cloud server and the user terminal through the trust server.
  • the third-party terminal issues a certificate to implement identity authentication between them, that is, the trust center can have a certificate authority; and the trust center can also issue a key for the user terminal, that is, the trust center can have a key distribution center.
  • FIG. 6 is a block diagram of another embodiment of the trust server of the present invention:
  • the trust server includes: a first receiving unit 610, a sending unit 620, an obtaining unit 630, an extracting unit 640, a generating unit 650, a saving unit 660, and a transmitting unit 670.
  • the first receiving unit 610 is configured to receive a key request message sent by the user terminal, and [169] a sending unit 620, configured to receive, according to the key request message received by the first receiving unit 610, Sending an encryption key to the user terminal, so that the user terminal encrypts the user data according to the encryption key, and transmits the encrypted user data to the cloud server;
  • the obtaining unit 630 is configured to acquire user data of the user terminal. Specifically, the obtaining unit 630 may include
  • a notification message receiving subunit configured to receive a notification message sent by the user terminal, where the notification message is used to notify the trust server that the user terminal has uploaded the encrypted user data to the cloud server,
  • the encrypted user data is data obtained by the user terminal according to the encryption key sent by the trust server, and the data request sending subunit is configured to receive the notification received by the subunit according to the notification message.
  • the encrypted data receiving subunit configured to receive the encrypted user data returned by the cloud server according to the data request message sent by the request message sending subunit;
  • An encrypted data decryption subunit configured to decrypt the encrypted user data received by the encrypted data receiving subunit by using the encryption key, to obtain decrypted user data;
  • the extracting unit 640 is configured to extract summary information of the user data acquired by the acquiring unit 630, where the summary information includes the user's private information and non-private information;
  • a generating unit 650 configured to generate a unique identifier for the private information in the summary information extracted by the extracting unit 640 Identification UID;
  • the saving unit 660 is configured to save a correspondence between the private information in the summary information extracted by the extracting unit 640 and the UID generated by the generating unit 650.
  • the transmitting unit 670 is configured to transmit the non-private information in the summary information extracted by the extracting unit 640 and the UID generated by the generating unit 650 to the cloud server, so that the cloud server saves the non-private information. Correspondence with the UID.
  • FIG. 7 is a block diagram of another embodiment of the trust server of the present invention:
  • the trust server includes: an obtaining unit 710, an encrypting unit 720, a transmitting unit 730, an extracting unit 740, a generating unit 750, and a saving unit 760.
  • the obtaining unit 710 is configured to acquire user data of the user terminal.
  • the acquiring unit 710 may include (not shown in FIG. 7): a user data receiving subunit, configured to receive the uploaded by the user terminal. User data of the user terminal;
  • the encryption unit 720 is configured to encrypt the user data acquired by the acquiring unit 710 by using an encryption key negotiated with the user terminal; [179] a transmission unit 730, configured to output the encryption unit 720 Transmitting encrypted user data to the cloud server;
  • the extracting unit 740 is configured to extract summary information of the user data acquired by the acquiring unit 710, where the summary information includes the user's private information and non-private information;
  • a generating unit 750 configured to generate a unique identifier UID for the private information in the summary information extracted by the extracting unit 740;
  • the transmitting unit 730 is further configured to use the summary information extracted by the extracting unit 740
  • the non-private information is transmitted to the cloud server by the UID generated by the generating unit 750, so that the cloud server saves the correspondence between the non-private information and the UID;
  • the saving unit 760 is configured to save a correspondence between the private information in the summary information extracted by the extracting unit 740 and the UID generated by the generating unit 750.
  • FIG. 8 a block diagram of another embodiment of the trust server of the present invention is shown:
  • the trust server includes: an obtaining unit 810, an extracting unit 820, a generating unit 830, a saving unit 840, a transmitting unit 850, a second receiving unit 860, an obtaining unit 870, and a transmitting unit 880.
  • the obtaining unit 810 is configured to acquire user data of the user terminal.
  • the extracting unit 820 is configured to extract summary information of the user data acquired by the acquiring unit 810, where the summary information includes the user's private information and non-private information;
  • the generating unit 830 is configured to generate a unique identifier UID for the private information in the summary information extracted by the extracting unit 820;
  • a saving unit 840 configured to save a correspondence between the private information in the summary information extracted by the extracting unit 820 and the UID generated by the generating unit 830;
  • the transmitting unit 850 is configured to transmit the non-private information in the digest information extracted by the extracting unit 820 and the UID generated by the generating unit 830 to the cloud server, so that the cloud server saves the non-private information. Correspondence relationship with the UID;
  • the second receiving unit 860 is configured to receive the push information and the UID sent by the third-party terminal, where the UID is obtained by the cloud server after receiving the demand information sent by the third-party terminal, and sent to the a UID corresponding to the non-private information of the three-party terminal that matches the demand information;
  • the obtaining unit 870 is configured to obtain, from the correspondence between the private information and the UID saved by the saving unit 840, the private information corresponding to the UID received by the second receiving unit 860;
  • the sending unit 880 is configured to send the push information according to the user address information included in the private information acquired by the obtaining unit 870.
  • the trust server includes: a bus 910, a processor 920, a network interface 930, and a memory 940.
  • the processor 920 is configured to acquire user data of the user terminal by using the network interface 930, and extract summary information of the user data, where the summary information includes privacy information and non-privacy of the user. Information, generating a unique identifier UID for the private information, transmitting the non-private information and the UID to the cloud server through the network interface 930, so that the cloud server saves the non-private information and the UID Correspondence between them.
  • the memory 940 is configured to save a correspondence between the private information and the UID.
  • the processor 920 is further configured to receive, by using the network interface 930, push information and a UID sent by a third-party terminal, where the UID is sent by the cloud server to the third-party terminal.
  • the processor 920 After the demand information, Obtaining a UID corresponding to the non-private information that matches the requirement information, obtaining the privacy information corresponding to the UID, and transmitting, by using the network interface 930, the user to the user according to the user address information included in the private information.
  • Push information is further configured to receive, by using the network interface 930, push information and a UID sent by a third-party terminal, where the UID is sent by the cloud server to the third-party terminal.
  • the cloud server includes: a first receiving unit 1010 and a saving unit 1020.
  • the first receiving unit 1010 is configured to receive non-private information and a UID of a user that is transmitted by the trusted server, where the non-private information is included in the digest information extracted by the trusted server from the acquired user data.
  • Information, the summary information further includes the user's private information, the UID is a UID generated by the trust server for the private information;
  • a saving unit 1020 configured to save the receiving unit 1010 to receive Correspondence between the non-private information and the UID.
  • FIG. 1 a block diagram of another embodiment of a cloud server according to the present invention:
  • the cloud server includes: a first receiving unit 1 1 10, a saving unit 1 120, a second receiving unit 1 130, a matching unit 1 140, and a transmitting unit 1 150.
  • the first receiving unit 1 1 10 is configured to receive non-private information and a UID of a user that is transmitted by the trusted server, where the non-private information is used in the digest information extracted by the trusted server from the acquired user data.
  • the included information, the summary information further includes the user's private information, and the UID is a UID generated by the trust server for the private information;
  • the saving unit 1120 is configured to save a correspondence between the non-private information and the UID received by the receiving unit 1 1 10;
  • the second receiving unit 1130 is configured to receive demand information sent by the third-party terminal.
  • the matching unit 1 140 is configured to match the non-private information saved by the saving unit 1 120 with the demand information received by the second receiving unit 1 130, and obtain non-private information that matches the demand information.
  • Corresponding UID
  • the sending unit 1150 is configured to send the UID corresponding to the non-private information obtained by the matching unit 1 140 to the third-party terminal, so that the third-party terminal sends the UID and the push information. After the trust server is sent, the trust server sends the push information according to the user address information included in the private information corresponding to the UID.
  • FIG. 12 it is a block diagram of another embodiment of a cloud server according to the present invention:
  • the cloud server includes: a bus 1210, and a processor 1220, a network interface 1230, and a memory 1240 connected by the bus 1210.
  • the processor 1220 is configured to receive, by using the network interface 1230, non-private information and a UID of a user that is transmitted by a trusted server, where the non-private information is extracted by the trusted server from the acquired user data.
  • the information included in the summary information, the summary information further includes the privacy information of the user, the UID is a wind generated by the trust server for the private information, and the non-private information and the UID are The correspondence is saved to the memory 1240.
  • the processor 1220 is further configured to: receive, by using the network interface 1230, the requirement information sent by the third-party terminal, and match the non-private information saved by the memory 1240 with the requirement information, Obtaining, by the wind corresponding to the non-private information that matches the requirement information, the UID corresponding to the non-private information obtained by the wind is sent to the third-party terminal by the network interface 1230, so that the third-party terminal sends the UID After the push information is sent to the trust server, the trust server sends the push information according to the user address information included in the privacy information corresponding to the UID.
  • the trust server acquires user data of the user terminal, and extracts summary information of the user data, where the summary information includes the user's private information and non-private information, generates a UID for the private information, and uses the non-private information and the UID.
  • the cloud server transfers the correspondence between the non-private information and the UID.
  • the cloud server does not save the complete summary information composed of the private information and the non-private information, but only saves the non-privacy in the summary information.
  • the UID of the information and privacy information so that the third party can not obtain the user's private information from the cloud server, and improve the security performance of the cloud computing system.
  • the techniques in the embodiments of the present invention can be implemented by means of software plus the necessary general hardware platform. Based on such understanding, the technical solution in the embodiments of the present invention may be embodied in the form of a software product in essence or in the form of a software product, and the computer software product may be stored in a storage medium, such as a ROM/RAM. , a diskette, an optical disk, etc., comprising instructions for causing a computer device (which may be a personal computer, server, or network device, etc.) to perform the methods described in various embodiments of the present invention or in certain portions of the embodiments.
  • a computer device which may be a personal computer, server, or network device, etc.

Abstract

本发明实施例公开了信息处理方法、信任服务器及云服务器，该方法包括：获取用户终端的用户数据；提取所述用户数据的摘要信息，所述摘要信息中包含所述用户的隐私信息和非隐私信息；为所述隐私信息生成唯一标识符UID；将所述非隐私信息与所述UID传输至云服务器，以使所述云服务器保存所述非隐私信息与所述UID之间的对应关系。由于本发明实施例中引入信任服务器，通过信任服务器对用户的摘要信息进行处理后，云服务器不再保存由隐私信息和非隐私信息组成的完整摘要信息，而是仅保存摘要信息中的非隐私信息和隐私信息的UID，从而使得第三方无法从云服务器获取到用户的隐私信息，提高了云计算系统的安全性能。

Description

信息处理方法、 信任服务器及云服务器
本申请要求于 2013年 3月 21日提交中国专利局、 申请号为 201310092589.8中 国专利申请的优先权， 其全部内容通过引用结合在本申请中。 技术领域 [01] 本发明涉及网络通信技术领域， 特别涉及信息处理方法、 信任服务器及云服务器。 背景技术
[02] 云计算 （Cloud Comput ing ) 是一种通过互联网提供动态易扩展的虚拟化资源的技 术， 通过云计算可以便捷地访问网络， 并且通过配置大量的存储设备， 可以实现海量数 据的存储和管理。 云计算要求大量用户参与， 通常为了保护用户数据的安全性， 用户会 对上传到云服务器的用户数据进行加密。
[03] 但是由于用户在上传加密后的用户数据到云服务器时， 还会同时上传用户数据的摘 要信息， 摘要信息是对用户数据简单概括， 从用户数据中提取关键信息， 以简洁的形式 对用户数据进行描述的信息， 摘要信息可以包括用户的姓名、 电话、 电子邮箱地址、 感 兴趣信息等。 由于摘要信息的开放性， 第三方可以从云服务器获得其感兴趣的用户的摘 要信息， 从而导致用户的个人隐私信息泄露， 降低了云计算系统的安全性能。
发明内容
[04] 本发明实施例中提供了信息处理方法、 信任服务器和云服务器， 以解决云服务器容 易泄露用户的隐私信息， 导致安全性能不高的问题。 [05] 为了解决上述技术问题， 本发明实施例公开了如下技术方案： [06] 第一方面， 提供一种信息处理方法， 所述方法包括： [07] 获取用户终端的用户数据；
[08] 提取所述用户数据的摘要信息， 所述摘要信息中包含所述用户的隐私信息和非隐私 信息； [09] 为所述隐私信息生成唯一标识符 UID ;
[10] 将所述非隐私信息与所述 UID传输至云服务器， 以使所述云服务器保存所述非隐私 信息与所述 UID之间的对应关系。
[11] 结合第一方面， 在第一方面的第一种可能的实现方式中， 所述提取所述用户数据的摘 要信息后， 所述方法还包括： 保存所述隐私信息与所述 UID之间的对应关系。
[12] 结合第一方面， 或第一方面的第一种可能的实现方式， 在第一方面的第二种可能的 实现方式中， 所述获取用户终端的用户数据， 具体为：
[13] 接收用户终端发送的通知消息，所述通知消息用于通知所述用户终端已将加密用户数据 上传到云服务器， 所述加密用户数据为所述用户终端根据下发的加密密钥对所述用户数据进 行加密后的数据；
[14] 根据所述通知消息向所述云服务器发送用于请求所述加密用户数据的数据请求消息； [15] 接收所述云服务器根据所述数据请求消息返回的所述加密用户数据；
[16] 利用所述加密密钥对所述加密用户数据进行解密， 得到解密后的用户数据。
[17] 结合第一方面的第二种可能的实现方式， 在第一方面的第三种可能的实现方式中， 所述接收用户终端发送的通知消息之前， 所述方法还包括：
[18] 接收所述用户终端发送的密钥请求消息； [19] 根据所述密钥请求消息向所述用户终端下发所述加密密钥， 以使所述用户终端根据所述 加密密钥对所述用户数据加密后， 将所述加密用户数据传输至所述云服务器。
[20] 结合第一方面， 或第一方面的第一种可能的实现方式， 在第一方面的第四种可能的 实现方式中， 所述获取用户终端的用户数据， 具体为： 接收用户终端上传的所述用户终端的 用户数据； [21] 所述方法还包括：
[22] 利用与所述用户终端协商的加密密钥对所述用户数据进行加密； [23] 将加密用户数据传输至所述云服务器。
[24] 结合第一方面的第一种可能的实现方式， 在第一方面的第五种可能的实现方式中， 所述方法还包括： [25] 接收第三方终端发送的推送信息和 UID， 所述 UID为所述云服务器接收到所述第三 方终端发送的需求信息后， 获得并发送给所述第三方终端的与所述需求信息匹配的非隐私 信息对应的 UID;
[26] 获得与所述 UID对应的隐私信息；
[27] 按照所述隐私信息中包含的用户地址信息发送所述推送信息。
[28] 第二方面， 提供另一种信息处理方法， 所述方法包括： [29] 接收信任服务器传输的用户的非隐私信息与 UID， 所述非隐私信息为所述信任服务器从 获取到的用户数据中提取的摘要信息中包含的信息， 所述摘要信息中还包含所述用户的隐私 信息， 所述 UID为所述信任服务器为所述隐私信息生成的 UID;
[30] 保存所述非隐私信息与所述 UID之间的对应关系。
[31] 结合第二方面， 在第二方面的第一种可能的实现方式中， 所述方法还包括： [32] 接收第三方终端发送的需求信息；
[33] 将保存的所述非隐私信息与所述需求信息进行匹配， 获得与所述需求信息匹配的非隐私 信息对应的 UID;
[34] 将获得的所述非隐私信息对应的 UID发送至所述第三方终端， 以使所述第三方终端将所 述 UID和推送信息发送给所述信任服务器后， 由所述信任服务器根据所述 UID对应的隐私信 息中包含的用户地址信息发送所述推送信息。
[35] 第三方面， 提供一种信任服务器， 所述信任服务器包括：
[36] 获取单元， 用于获取用户终端的用户数据；
[37] 提取单元， 用于提取所述获取单元获取到的用户数据的摘要信息， 所述摘要信息中 包含所述用户的隐私信息和非隐私信息； [38] 生成单元，用于为所述提取单元提取的摘要信息中的隐私信息生成唯一标识符 UID;
[39] 传输单元， 用于将所述提取单元提取的摘要信息中的非隐私信息与所述生成单元生 成的 UID传输至云服务器， 以使所述云服务器保存所述非隐私信息与所述 UID之间的对 应关系。
[40] 结合第三方面， 在第三方面的第一种可能的实现方式中， 所述信任服务器还包括： [41] 保存单元，用于保存所述提取单元提取的摘要信息中的所述隐私信息与所述生成单元生 成的所述 UID之间的对应关系。
[42] 结合第三方面， 或第三方面的第一种可能的实现方式， 在第三方面的第二种可能的 实现方式中， 所述获取单元包括：
[43] 通知消息接收子单元， 用于接收用户终端发送的通知消息， 所述通知消息用于通知所述 用户终端已将加密用户数据上传到云服务器， 所述加密用户数据为所述用户终端根据下发的 加密密钥对所述用户数据进行加密后的数据；
[44] 数据请求发送子单元，用于根据所述通知消息接收子单元接收到的通知消息向所述云服 务器发送用于请求所述加密用户数据的数据请求消息；
[45] 加密数据接收子单元，用于接收所述云服务器根据所述请求消息发送子单元发送的数据 请求消息返回的所述加密用户数据；
[46] 加密数据解密子单元，用于利用所述加密密钥对所述加密数据接收子单元接收到的加密 用户数据进行解密， 得到解密后的用户数据。
[47] 结合第三方面的第二种可能的实现方式， 在第三方面的第三种可能的实现方式中， 所述信任服务器还包括： [48] 第一接收单元， 用于接收所述用户终端发送的密钥请求消息；
[49] 下发单元，用于根据所述第一接收单元接收到的密钥请求消息向所述用户终端下发所述 加密密钥， 以使所述用户终端根据所述加密密钥对所述用户数据加密后， 将所述加密用户数 据传输至所述云服务器。
[50] 结合第三方面， 或第三方面的第一种可能的实现方式， 在第三方面的第四种可能的 实现方式中， 所述获取单元包括：
[51] 用户数据接收子单元， 用于接收用户终端上传的所述用户终端的用户数据；
[52] 所述信任服务器还包括：
[53] 加密单元，用于利用与所述用户终端协商的加密密钥对所述用户数据接收子单元接收到 的用户数据进行加密； [54] 所述传输单元， 还用于将所述加密单元输出的加密用户数据传输至所述云服务器。 [55] 结合第三方面的第一种可能的实现方式， 在第三方面的第五种可能的实现方式中， 所述信任服务器还包括:
[56] 第二接收单元， 用于接收第三方终端发送的推送信息和 UID， 所述 UID为所述云服 务器接收到所述第三方终端发送的需求信息后， 获得并发送给所述第三方终端的与所述需 求信息匹配的非隐私信息对应的 UID ; [57] 获得单元， 用于获得与所述第二接收单元接收到的 UID对应的隐私信息；
[58] 发送单元， 用于按照所述获得单元获取的隐私信息中包含的用户地址信息发送所述 推送信息。
[59] 第四方面， 提供另一种信任服务器， 所述信任服务器包括： 总线， 通过所述总线连 处理器和网络接口， 其中， [60] 所述处理器， 用于通过所述网络接口获取用户终端的用户数据， 提取所述用户数据的摘 要信息， 所述摘要信息中包含所述用户的隐私信息和非隐私信息， 为所述隐私信息生成唯一 标识符 UID， 将所述非隐私信息与所述 UID通过所述网络接口传输至云服务器， 以使所述云 服务器保存所述非隐私信息与所述 UID之间的对应关系。
[61] 结合第四方面， 在第四方面的第一种可能的实现方式中， 所述信任服务器还包括： 与所述总线相连的存储器；
[62] 所述存储器， 用于保存所述隐私信息与所述 UID之间的对应关系。
[63] 结合第四方面， 或第四方面的第一种可能的实现方式， 在第四方面的第二种可能的 实现方式中， 所述处理器， 还用于通过所述网络接口接收第三方终端发送的推送信息和 UID , 所述 UID为所述云服务器接收到所述第三方终端发送的需求信息后， 获得并发送给 所述第三方终端的与所述需求信息匹配的非隐私信息对应的 UID， 获得与所述 UID对应的 隐私信息， 并按照所述隐私信息中包含的用户地址信息通过所述网络接口向所述用户发 送所述推送信息。
[64] 第五方面， 提供一种云服务器， 所述云服务器包括：
[65] 第一接收单元， 用于接收信任服务器传输的用户的非隐私信息与 UID， 所述非隐私信息 为所述信任服务器从获取到的用户数据中提取的摘要信息中包含的信息， 所述摘要信息中还 包含所述用户的隐私信息， 所述 UID为所述信任服务器为所述隐私信息生成的 UID;
[66] 保存单元， 用于保存所述接收单元接收到的所述非隐私信息与所述 UID之间的对应 关系。 [67] 结合第五方面， 在五方面的第一种可能的实现方式中， 所述云服务器还包括： [68] 第二接收单元， 用于接收第三方终端发送的需求信息；
[69] 匹配单元，用于将所述保存单元保存的所述非隐私信息与所述第二接收单元接收到的所 述需求信息进行匹配， 获得与所述需求信息匹配的非隐私信息对应的 UID;
[70] 发送单元，用于将所述匹配单元获得的所述非隐私信息对应的 UID发送至所述第三方终 端， 以使所述第三方终端将所述 UID和推送信息发送给所述信任服务器后， 由所述信任服务 器根据所述 UID对应的隐私信息中包含的用户地址信息发送所述推送信息。
[71] 第六方面， 提供另一种云服务器， 所述云服务器包括： 总线， 以及通过所述总线相 连的处理器、 网络接口和存储器， 其中， [72] 所述处理器， 用于通过所述网络接口接收信任服务器传输的用户的非隐私信息与 UID， 所述非隐私信息为所述信任服务器从获取到的用户数据中提取的摘要信息中包含的信息， 所 述摘要信息中还包含所述用户的隐私信息， 所述 UID为所述信任服务器为所述隐私信息生成 的 UID， 并将所述非隐私信息与所述 UID之间的对应关系保存到所述存储器。
[73] 结合第六方面， 在第六方面的第一种可能的实现方式中， 所述处理器， 还用于通过所 述网络接口接收第三方终端发送的需求信息， 将所述存储器保存的所述非隐私信息与所述需 求信息进行匹配， 获得与所述需求信息匹配的非隐私信息对应的 UID， 将获得的所述非隐私 信息对应的 UID通过所述网络接口发送至所述第三方终端， 以使所述第三方终端将所述 UID 和推送信息发送给所述信任服务器后， 由所述信任服务器根据所述 UID对应的隐私信息中包 含的用户地址信息发送所述推送信息。 [74] 本发明提供的实施例中， 信任服务器获取用户终端的用户数据， 提取用户数据的摘 要信息， 摘要信息中包含用户的隐私信息和非隐私信息， 为隐私信息生成 UID， 将非隐 私信息与 UID传输至云服务器， 云服务器保存非隐私信息与 UID之间的对应关系。 由于 本发明提供的实施例中引入信任服务器，通过信任服务器对用户的摘要信息进行处理后， 云服务器不再保存由隐私信息和非隐私信息组成的完整摘要信息， 而是仅保存摘要信息 中的非隐私信息和隐私信息的 UID， 从而使得第三方无法从云服务器获取到用户的隐私 信息， 提高了云计算系统的安全性能。
附图说明
[75] 为了更清楚地说明本发明实施例或现有技术中的技术方案， 下面将对实施例或现有 技术描述中所需要使用的附图作简单地介绍， 显而易见地， 对于本领域普通技术人员而 言， 在不付出创造性劳动的前提下， 还可以根据这些附图获得其他的附图。
[76] 图 1为信息处理方法的一个实施例流程图；
[77] 图 2为信息处理方法的另一个实施例流程图；
[78] 图 3为信息处理方法的另一个实施例流程图；
[79] 图 4为信息处理方法的另一个实施例流程图；
[80] 图 5为本发明信任服务器的一个实施例框图；
[81] 图 6为本发明信任服务器的另一个实施例框图；
[82] 图 7为本发明信任服务器的另一个实施例框图；
[83] 图 8为本发明信任服务器的另一个实施例框图；
[84] 图 9为本发明信任服务器的另一个实施例框图；
[85] 图 10为本发明云服务器的一个实施例框图；
[86] 图 1 1为本发明云服务器的另一个实施例框图；
[87] 图 12为本发明云服务器的另一个实施例框图。
具体实施方式
[88] 本发明如下实施例提供了信息处理方法、 信任服务器和云服务器。
[89] 为了使本技术领域的人员更好地理解本发明实施例中的技术方案， 并使本发明实施 例的上述目的、 特征和优点能够更加明显易懂， 下面结合附图对本发明实施例中技术方 案作进一步详细的说明。
[90] 参见图 1， 为本发明信息处理方法的一个实施例流程图， 该实施例从信任服务器侧 描述了云计算中的信息处理过程：
[91] 步骤 101 : 信任服务器获取用户终端的用户数据。
[92] 本发明实施例中， 信任服务器可以具体为某个信任中心的服务器， 该信任中心部署 在云服务器和终端之间， 可以预先向通过该信任服务器进行信息交互的云服务器、 用户 终端和第三方终端颁发证书， 实现它们之间的身份认证， 即信任中心可以具有一个证书 授权（Certificate Authority, CA) 中心； 并且， 信任中心还可以为用户终端下发密钥， 即信任中心可以具有一个密钥分发中心 （Key Distribution Center, KDC)。 [93] 本实施例中， 信任服务器可以接收用户终端直接上传的用户数据； 或者， 信任服务 器也可以在接收到用户终端发送的通知消息后， 根据通知消息向云服务器发送请求加密 用户数据的数据请求消息， 该通知消息用于通知信任服务器用户终端已将加密用户数据 上传到云服务器， 该加密用户数据为用户终端根据信任服务器下发的加密密钥对用户数 据进行加密后的数据，信任服务器接收云服务器根据数据请求消息返回的加密用户数据， 通过加密密钥对加密用户数据进行解密， 得到解密后的用户数据。
[94] 步骤 102: 信任服务器提取用户数据的摘要信息， 该摘要信息中包含用户的隐私信 息和非隐私信息。
[95] 本发明实施例中， 摘要信息指对用户数据简单概括， 从用户数据中提取关键信息， 以简洁的形式对用户数据进行描述的信息。 摘要信息可以分为隐私信息和非隐私信息两 部分， 其中， 隐私信息指某些具有保密特性的个人敏感信息， 非隐私信息可以包括用户 的感兴趣信息等， 例如， 对于用户的医疗数据， 则其隐私信息可以包括用户姓名、 电话、 家庭住址、 E-Mai l、 账号信息等； 其非隐私信息可以包括用户就诊的医院信息， 药品信 息、 家庭病史信息等。
[96] 本发明实施例中， 可以使用现有技术中的爬虫技术或自动文摘技术从用户数据中提 取摘要信息， 在此不再赘述。
[97] 步骤 103: 信任服务器为隐私信息生成 UID。
[98] 本实施例中， 每个用户可以具有一个表示身份的用户标识， 每个用户可以有多份用 户数据， 为了区别每个用户数据的摘要信息中的隐私信息， 则信任服务器为每个隐私信 息生成一个唯一标识符 （Unique Identifier, UID)， 该 UID可以为信任服务器顺序生成 的序列号， 或者也可以由信任服务器利用预设函数对数据进行作用生成的序列号， 即每 一个隐私信息对应一个唯一的序列号。
[99] 步骤 104: 信任服务器将非隐私信息与 UID传输至云服务器， 以使云服务器保存非 隐私信息与 UID之间的对应关系。
[100]本实施例中， 信任服务器将摘要信息中的非隐私信息和为隐私信息生成的 UID传输 到云服务器， 由于云服务器仅保存用户的非隐私信息， 因此第三方无法从云服务器获得 用户的隐私信息。
[101]由上述实施例可见， 通过信任服务器对用户的摘要信息进行处理后， 云服务器不再 保存由隐私信息和非隐私信息组成的完整摘要信息， 而是仅保存摘要信息中的非隐私信 息和隐私信息的 UID， 从而使得第三方无法从云服务器获取到用户的隐私信息， 提高了 云计算系统的安全性能。
[102]参见图 2， 为本发明信息处理方法的另一个实施例流程图， 该实施例从云服务器侧 描述了云计算中的信息处理过程：
[103]步骤 201 : 云服务器接收信任服务器传输的用户的非隐私信息与 UID， 该非隐私信 息为信任服务器从获取到的用户数据中提取的摘要信息中包含的信息， 该摘要信息中还 包含用户的隐私信息， 该 UID为信任服务器为隐私信息生成的 UID。
[104]本发明实施例中， 云服务器可以具体为云计算系统中设置的服务器， 该服务器具有 存储海量用户数据的功能， 用户终端可以通过网络访问该云服务器。 由图 1描述的信任 服务器侧实施例可见， 信任服务器获取用户终端的用户数据后， 提取用户数据的摘要信 息， 该摘要信息中包含用户的隐私信息和非隐私信息， 信任服务器为隐私信息生成 UID 后， 将非隐私信息与 UID传输给云服务器， 因此云服务器仅会得到用户的非隐私信息， 从而使第三方无法从云服务器获得用户的隐私信息。
[105]步骤 202: 云服务器保存非隐私信息与 UID之间的对应关系。
[106]由上述实施例可见， 通过信任服务器对用户的摘要信息进行处理后， 云服务器仅保 存摘要信息中的非隐私信息， 从而使得第三方无法从云服务器获取到用户的隐私信息， 提高了云计算系统的安全性能。
[107]参见图 3， 为本发明信息处理方法的另一个实施例流程图， 该实施例通过用户终端、 信任服务器、 云服务器和第三方终端之间的交互描述了信息处理的详细过程：
[108]步骤 301 : 用户终端向信任服务器发送密钥请求消息。
[109]本发明实施例中， 信任服务器可以具体为某个信任中心的服务器， 该信任中心部署 在云服务器和终端之间， 可以预先向通过该信任服务器进行信息交互的云服务器、 用户 终端和第三方终端颁发证书， 实现它们之间的身份认证， 即信任中心可以具有一个 CA; 并且， 信任中心还可以为用户终端下发密钥， 即信任中心可以具有一个 KDC。
[110]用户终端为了保护用户数据的私密性， 可以在将用户数据上传到云服务器之前， 向 信任服务器发送包含用户标识的密钥请求消息， 用于请求信任服务器分配加密密钥。
[111]步骤 302 : 信任服务器根据该密钥请求消息向用户终端返回加密密钥， 并保存用户 标识与加密密钥的对应关系。
[112]步骤 303 : 用户终端通过加密密钥对待上传到云服务器的用户数据进行加密得到加 密用户数据。
[113]云服务器是用于实现海量存储用户数据的设备， 为了保证保存在云服务器上的用户 数据的安全， 本实施例中， 用户终端可以对用户数据进行加密， 并将加密用户数据保存 在云服务器上， 由于第三方终端难以获得加密密钥， 从而使得第三方终端无法随意访问 到用户数据。 [114]步骤 304 : 用户终端将加密用户数据上传到云服务器。
[115]用户终端在将加密用户数据上传到云服务器时， 同时携带用户标识。
[116]步骤 305 : 云服务器保存用户标识与加密用户数据的对应关系。
[117]步骤 306 :用户终端向信任服务器发送已上传加密用户数据至云服务器的通知消息。
[118]步骤 307 : 信任服务器向云服务器发送请求该加密用户数据的数据请求消息。 [119]信任服务器在发送的数据请求消息中携带用户标识。
[120]步骤 308 : 云服务器根据用户标识查找保存的用户标识与加密用户数据的对应关系， 获取与该用户标识对应的加密用户数据， 并将获取的加密用户数据发送给信任服务器。
[121]步骤 309 : 信任服务器根据用户标识获得与该用户标识对应的加密密钥， 并通过该 加密密钥对接收到的加密用户数据进行解密得到用户数据。 [122]步骤 310 : 信任服务器对用户数据进行摘要信息处理， 提取用户数据中的摘要信息， 去除摘要信息中的隐私信息， 并为该隐私信息生成 UID。
[123]步骤 31 1 : 信任服务器保存隐私信息与 UID之间的对应关系。
[124]步骤 312 : 信任服务器将非隐私信息与为隐私信息生成的 UID上传到云服务器。
[125]步骤 313 : 云服务器在前述步骤 305保存的用户标识与加密用户数据的对应关系的 基础上进一步保存该用户标识与非隐私信息和 UID之间的对应关系。 [126]步骤 314 : 第三方终端向云服务器发送需求信息。
[127]该需求信息为第三方终端想从云服务器获取到的满足一定条件的用户的信息时所 设置的信息。 例如， 某旅游公司想从云服务器获取到每年旅游次数超过 3次的用户的信 息， 并向这些用户推送旅游信息， 则 "旅游次数超过 3次" 即为一种需求信息。 [128]步骤 315 : 云服务器将需求信息与保存的非隐私信息进行匹配， 获得与该需求信息 匹配的非隐私信息对应的 UID。
[129]云服务器上保存了非隐私信息与 UID的对应关系， 则云服务器可以将需求信息与保 存的非隐私信息逐一匹配， 获得与该需求信息匹配的非隐私信息， 然后根据该对应关系， 获得与匹配的非隐私信息对应的 UID。
[130]步骤 316 : 云服务器将获得的 UID发送给第三方终端。
[131]步骤 317 : 第三方终端将推送信息和 UID发送给信任服务器。
[132]步骤 318 : 信任服务器获取与第三方终端发送的 UID对应的隐私信息， 并从该隐私 信息中获得用户的地址信息。
[133]由于信任服务器中保存了隐私信息与 UID的对应关系， 因此信任服务器接收到第三 方终端方发送的 UID后， 可以通过该对应关系获得与 UID对应的隐私信息， 该隐私信息 中通常可以包含用户的地址信息。
[134]步骤 319 : 信任服务器将推送信息按照获得的地址信息发送到用户终端。
[135]可选的， 上述图 3示出的实施例中， 用户终端也可以将加密用户数据上传到信任服 务器， 从而使得信任服务器无需从云服务器获得加密用户数据， 对此本发明实施例不进 行限制。
[136]由上述实施例可见， 通过信任服务器对用户的摘要信息进行处理后， 云服务器不再 保存由隐私信息和非隐私信息组成的完整摘要信息， 而是仅保存摘要信息中的非隐私信 息和隐私信息的 UID， 从而使得第三方无法从云服务器获取到用户的隐私信息， 提高了 云计算系统的安全性能。 [137]参见图 4， 为本发明信息处理方法的另一个实施例流程图， 该实施例通过用户终端、 信任服务器、 云服务器和第三方终端之间的交互描述了信息处理的详细过程：
[138]步骤 401 : 用户终端与信任服务器进行密钥协商得到加密密钥。 [139]本实施例与图 3实施例示出的其中一个不同点在于， 本实施例中用户终端不是直接 接受信任服务器下发的加密密钥， 而是利用与信任服务器进行密钥协商获得加密密钥。
[140]步骤 402 : 用户终端将用户数据发送给信任服务器。
[141]步骤 403 :信任服务器通过协商的加密密钥对用户数据进行加密得到加密用户数据。 [142]步骤 404 : 信任服务器对用户数据进行摘要信息处理， 提取用户数据中的摘要信息， 去除摘要信息中的隐私信息， 并为该隐私信息生成 UID。
[143]需要说明的是， 上述步骤 404也可以在步骤 403之前执行， 对此本实施例不进行限 制。
[144]步骤 405 : 信任服务器保存隐私信息与 UID之间的对应关系。 [145]步骤 406 : 信任服务器将用户标识， 加密用户数据， 非隐私信息和为隐私信息生成 的 UID上传到云服务器。
[146]需要说明的是， 信任服务器可以同时上传用户标识、 加密用户数据、 非隐私信息和
UID 到云服务器； 也可以先上传非隐私信息和 UID 到云服务器， 然后再上传用户标识和 加密用户数据到云服务器， 对此本发明实施例不进行限制。 [147]云服务器是用于实现海量存储用户数据的设备， 为了保证保存在云服务器上的用户 数据的安全， 本实施例中， 用户终端可以直接将用户数据发给信任服务器， 并由信任服 务器对用户数据进行加密后将加密用户数据上传到云服务器上进行保存； 也可以对用户 数据进行加密后发给信任服务器， 并由信任服务器将加密用户数据上传到云服务器上进 行保存。 由于第三方终端难以获得加密密钥， 从而使得第三方终端无法从云服务器上随 意访问到用户数据。
[148]步骤 407 : 云服务器保存用户标识， 加密用户数据， 非隐私信息和 UID之间的对应 关系。
[149]步骤 408 : 第三方终端向云服务器发送需求信息。
[150]步骤 409 : 云服务器将需求信息与保存的非隐私信息进行匹配， 获得与该需求信息 匹配的非隐私信息对应的 UID。
[151]步骤 410 : 云服务器将获得的 UID发送给第三方终端。
[152]步骤 41 1 : 第三方终端将推送信息和 UID发送给信任服务器。 [153]步骤 412 : 信任服务器获取与第三方终端发送的 UID对应的隐私信息， 并从该隐私 信息中获得用户的地址信息。
[154]步骤 413 : 信任服务器将推送信息按照获得的地址信息发送到用户终端。
[155]在应用本实施例时， 第三方终端可以是各种向用户终端推送广告信息的终端， 例如 医疗机构的终端， 第三方终端可以访问云服务器， 但是由于云服务器上保存了非隐私信 息和隐私信息的 UID， 因此第三方终端无法从云服务器上获取用户终端的隐私信息， 只 能根据云服务器返回的隐私信息的 UID， 从而将 UID和推送信息发送给信任服务器， 由 信任服务器获得与 UID对应的隐私信息， 进而得到用户的地址信息， 从而由信任服务器 将推送信息推送给用户终端。 [156]可选的， 上述图 4示出的实施例中， 用户终端也可以在步骤 402向信任服务器发送 通过加密密钥加密后的加密用户数据， 则信任服务器可以通过加密密钥对加密用户数据 进行解密后， 再对得到的用户数据进行摘要处理， 然后将摘要处理后得到的非隐私信息、 隐私信息的 UID和用户终端发送的加密用户数据上传到云服务器， 从而无需信任服务器 对用户数据进行加密， 从而通过信任服务器将加密用户数据转发到云服务器； 或者， 用 户终端也可以直接将加密用户数据传输到云服务器， 而无需通过信任服务器转发， 用户 终端可以将用户数据或加密后的用户数据发给信任服务器， 由信任服务器对用户数据进 行摘要处理， 然后将摘要处理后得到的非隐私信息、 隐私信息的 UID上传到云服务器。 对此本发明实施例不进行限制。
[157]由上述实施例可见， 通过信任服务器对用户的摘要信息进行处理后， 云服务器不再 保存由隐私信息和非隐私信息组成的完整摘要信息， 而是仅保存摘要信息中的非隐私信 息和隐私信息的 UID， 从而使得第三方无法从云服务器获取到用户的隐私信息， 提高了 云计算系统的安全性能。
[158]与本发明信息处理方法的实施例相对应， 本发明还提供了信任服务器和云服务器的 实施例。 [159]参见图 5， 为本发明信任服务器的一个实施例框图：
[160]该信任服务器包括： 获取单元 510、 提取单元 520、 生成单元 530和传输单元 540。
[161]其中， 获取单元 510， 用于获取用户终端的用户数据；
[162]提取单元 520， 用于提取所述获取单元 510获取到的用户数据的摘要信息， 所述摘 要信息中包含所述用户的隐私信息和非隐私信息； [163]生成单元 530， 用于为所述提取单元 520提取的摘要信息中的隐私信息生成唯一标 识符 UID ;
[164]传输单元 540， 用于将所述提取单元 520提取的摘要信息中的非隐私信息与所述生 成单元 530生成的 UID传输至云服务器， 以使所述云服务器保存所述非隐私信息与所述 UID之间的对应关系。
[165]本发明实施例中， 信任服务器可以具体为某个信任中心的服务器， 该信任中心部署 在云服务器和终端之间， 可以预先向通过该信任服务器进行信息交互的云服务器、 用户 终端和第三方终端颁发证书， 实现它们之间的身份认证， 即信任中心可以具有一个证书 授权中心； 并且， 信任中心还可以为用户终端下发密钥， 即信任中心可以具有一个密钥 分发中心。
[166]参见图 6， 为本发明信任服务器的另一个实施例框图：
[167]该信任服务器包括： 第一接收单元 610、 下发单元 620、 获取单元 630、 提取单元 640、 生成单元 650、 保存单元 660和传输单元 670。
[168]其中， 第一接收单元 610， 用于接收所述用户终端发送的密钥请求消息； [169]下发单元 620， 用于根据所述第一接收单元 610接收到的密钥请求消息向所述用户 终端下发加密密钥， 以使所述用户终端根据所述加密密钥对所述用户数据加密后， 将加 密用户数据传输至所述云服务器；
[170]获取单元 630， 用于获取用户终端的用户数据； 具体的， 获取单元 630可以包括（图
6中未示出）： 通知消息接收子单元， 用于接收用户终端发送的通知消息， 所述通知消息 用于通知所述信任服务器所述用户终端已将加密用户数据上传到云服务器， 所述加密用 户数据为所述用户终端根据所述信任服务器下发的加密密钥对所述用户数据进行加密后 的数据； 数据请求发送子单元， 用于根据所述通知消息接收子单元接收到的通知消息向 所述云服务器发送请求所述加密用户数据的数据请求消息； 加密数据接收子单元， 用于 接收所述云服务器根据所述请求消息发送子单元发送的数据请求消息返回的加密用户数 据； 加密数据解密子单元， 用于利用所述加密密钥对所述加密数据接收子单元接收到的 加密用户数据进行解密， 得到解密后的用户数据；
[171]提取单元 640， 用于提取所述获取单元 630获取到的用户数据的摘要信息， 所述摘 要信息中包含所述用户的隐私信息和非隐私信息；
[172]生成单元 650， 用于为所述提取单元 640提取的摘要信息中的隐私信息生成唯一标 识符 UID ;
[173]保存单元 660， 用于保存所述提取单元 640提取的摘要信息中的隐私信息与所述生 成单元 650生成的 UID之间的对应关系。
[174]传输单元 670， 用于将所述提取单元 640提取的摘要信息中的非隐私信息与所述生 成单元 650生成的 UID传输至云服务器， 以使所述云服务器保存所述非隐私信息与所述 UID之间的对应关系。
[175]参见图 7， 为本发明信任服务器的另一个实施例框图：
[176]该信任服务器包括： 获取单元 710、 加密单元 720、 传输单元 730、 提取单元 740、 生成单元 750和保存单元 760。 [177]其中， 获取单元 710， 用于获取用户终端的用户数据； 具体的， 该获取单元 710可 以包括 （图 7中未示出）： 用户数据接收子单元， 用于接收用户终端上传的所述用户终端 的用户数据；
[178]加密单元 720， 用于利用与所述用户终端协商的加密密钥对所述获取单元 710获取 的用户数据进行加密； [179]传输单元 730，用于将所述加密单元 720输出的加密用户数据传输至所述云服务器；
[180]提取单元 740， 用于提取所述获取单元 710获取到的用户数据的摘要信息， 所述摘 要信息中包含所述用户的隐私信息和非隐私信息；
[181]生成单元 750， 用于为所述提取单元 740提取的摘要信息中的隐私信息生成唯一标 识符 UID ; [182]传输单元 730， 还用于将所述提取单元 740提取的摘要信息中的非隐私信息与所述 生成单元 750生成的 UID传输至云服务器， 以使所述云服务器保存所述非隐私信息与所 述 UID之间的对应关系；
[183]保存单元 760， 用于保存所述提取单元 740提取的摘要信息中的隐私信息与所述生 成单元 750生成的 UID之间的对应关系。 [184]参见图 8， 为本发明信任服务器的另一个实施例框图：
[185]该信任服务器包括： 获取单元 810、 提取单元 820、 生成单元 830、 保存单元 840、 传输单元 850、 第二接收单元 860、 获得单元 870和发送单元 880。 [186]其中， 获取单元 810， 用于获取用户终端的用户数据;
[187]提取单元 820， 用于提取所述获取单元 810获取到的用户数据的摘要信息， 所述摘 要信息中包含所述用户的隐私信息和非隐私信息；
[188]生成单元 830， 用于为所述提取单元 820提取的摘要信息中的隐私信息生成唯一标 识符 UID ;
[189]保存单元 840， 用于保存所述提取单元 820提取的摘要信息中的隐私信息与所述生 成单元 830生成的 UID之间的对应关系；
[190]传输单元 850， 用于将所述提取单元 820提取的摘要信息中的非隐私信息与所述生 成单元 830生成的 UID传输至云服务器， 以使所述云服务器保存所述非隐私信息与所述 UID之间的对应关系；
[191]第二接收单元 860， 用于接收第三方终端发送的推送信息和 UID， 所述 UID为所述 云服务器接收到所述第三方终端发送的需求信息后， 获得并发送给所述第三方终端的与所 述需求信息匹配的非隐私信息对应的 UID ;
[192]获得单元 870， 用于从所述保存单元 840保存的隐私信息与 UID之间的对应关系中 获得与所述第二接收单元 860接收到的 UID对应的隐私信息；
[193]发送单元 880， 用于按照所述获得单元 870获取的隐私信息中包含的用户地址信息 发送所述推送信息。
[194]参见图 9， 为本发明信任服务器的另一个实施例框图：
[195]该信任服务器包括： 总线 910、 处理器 920、 网络接口 930和存储器 940。 [196]其中， 所述处理器 920， 用于通过所述网络接口 930获取用户终端的用户数据， 提 取所述用户数据的摘要信息， 所述摘要信息中包含所述用户的隐私信息和非隐私信息， 为所述隐私信息生成唯一标识符 UID， 将所述非隐私信息与所述 UID通过所述网络接口 930传输至云服务器， 以使所述云服务器保存所述非隐私信息与所述 UID之间的对应关 系。 [197]所述存储器 940， 用于保存所述隐私信息与所述 UID之间的对应关系。
[198]可选的， 所述处理器 920， 还可以用于通过所述网络接口 930接收第三方终端发送 的推送信息和 UID， 所述 UID为所述云服务器接收到所述第三方终端发送的需求信息后， 获得的与所述需求信息匹配的非隐私信息对应的 UID， 获得与所述 UID对应的隐私信息， 并按照所述隐私信息中包含的用户地址信息通过所述网络接口 930 向所述用户发送所述 推送信息。
[199]参见图 10， 为本发明云服务器的一个实施例框图： [200]该云服务器包括： 第一接收单元 1010和保存单元 1020。
[201]其中， 第一接收单元 1010， 用于接收信任服务器传输的用户的非隐私信息与 UID， 所述非隐私信息为所述信任服务器从获取到的用户数据中提取的摘要信息中包含的信 息， 所述摘要信息中还包含所述用户的隐私信息， 所述 UID为所述信任服务器为所述隐 私信息生成的 UID ; [202]保存单元 1020， 用于保存所述接收单元 1010接收到的所述非隐私信息与 UID之间 的对应关系。
[203]参见图 1 1， 为本发明云服务器的另一个实施例框图：
[204]该云服务器包括： 第一接收单元 1 1 10、 保存单元 1 120、 第二接收单元 1 130、 匹配 单元 1 140和发送单元 1 150。 [205]其中， 第一接收单元 1 1 10， 用于接收信任服务器传输的用户的非隐私信息与 UID， 所述非隐私信息为所述信任服务器从获取到的用户数据中提取的摘要信息中包含的信 息， 所述摘要信息中还包含所述用户的隐私信息， 所述 UID为所述信任服务器为所述隐 私信息生成的 UID ;
[206]保存单元 1 120， 用于保存所述接收单元 1 1 10接收到的所述非隐私信息与 UID之间 的对应关系；
[207]第二接收单元 1 130， 用于接收第三方终端发送的需求信息；
[208]匹配单元 1 140， 用于将所述保存单元 1 120保存的非隐私信息与所述第二接收单元 1 130接收到的需求信息进行匹配， 获得与所述需求信息匹配的非隐私信息对应的 UID ;
[209]发送单元 1 150， 用于将所述匹配单元 1 140获得的所述非隐私信息对应的 UID发送 至所述第三方终端， 以使所述第三方终端将所述 UID和推送信息发送给所述信任服务器 后， 由所述信任服务器根据所述 UID对应的隐私信息中包含的用户地址信息发送所述推 送信息。 [210]参见图 12， 为本发明云服务器的另一个实施例框图:
[211]该云服务器包括： 总线 1210， 以及通过所述总线 1210相连的处理器 1220、 网络接 口 1230和存储器 1240。
[212]其中， 所述处理器 1220， 用于通过所述网络接口 1230接收信任服务器传输的用户 的非隐私信息与 UID， 所述非隐私信息为所述信任服务器从获取到的用户数据中提取的 摘要信息中包含的信息， 所述摘要信息中还包含所述用户的隐私信息， 所述 UID为所述 信任服务器为所述隐私信息生成的 風 并将所述非隐私信息与 UID之间的对应关系保 存到所述存储器 1240。
[213]可选的， 所述处理器 1220， 还可以用于通过所述网络接口 1230接收第三方终端发 送的需求信息， 将所述存储器 1240保存的非隐私信息与所述需求信息进行匹配， 获得与 所述需求信息匹配的非隐私信息对应的 風 将获得的所述非隐私信息对应的 UID通过 所述网络接口 1230发送至所述第三方终端， 以使所述第三方终端将所述 UID和推送信息 发送给所述信任服务器后， 由所述信任服务器根据所述 UID对应的隐私信息中包含的用 户地址信息发送所述推送信息。 [214]由上述实施例可见， 信任服务器获取用户终端的用户数据， 提取用户数据的摘要信 息， 摘要信息中包含用户的隐私信息和非隐私信息， 为隐私信息生成 UID， 将非隐私信 息与 UID传输至云服务器， 云服务器保存非隐私信息与 UID之间的对应关系。 由于本发 明实施例中引入信任服务器， 通过信任服务器对用户的摘要信息进行处理后， 云服务器 不再保存由隐私信息和非隐私信息组成的完整摘要信息， 而是仅保存摘要信息中的非隐 私信息和隐私信息的 UID， 从而使得第三方无法从云服务器获取到用户的隐私信息， 提 高了云计算系统的安全性能。
[215]本领域的技术人员可以清楚地了解到本发明实施例中的技术可借助软件加必需的 通用硬件平台的方式来实现。 基于这样的理解， 本发明实施例中的技术方案本质上或者 说对现有技术做出贡献的部分可以以软件产品的形式体现出来， 该计算机软件产品可以 存储在存储介质中， 如 R0M/RAM、 磁碟、 光盘等， 包括若干指令用以使得一台计算机设 备 （可以是个人计算机， 服务器， 或者网络设备等） 执行本发明各个实施例或者实施例 的某些部分所述的方法。
[216]本说明书中的各个实施例均采用递进的方式描述， 各个实施例之间相同相似的部分 互相参见即可， 每个实施例重点说明的都是与其他实施例的不同之处。 尤其， 对于系统 实施例而言， 由于其基本相似于方法实施例， 所以描述的比较简单， 相关之处参见方法 实施例的部分说明即可。 [217]以上所述的本发明实施方式， 并不构成对本发明保护范围的限定。 任何在本发明的 精神和原则之内所作的修改、 等同替换和改进等， 均应包含在本发明的保护范围之内。

Claims

权利要求
1、 一种信息处理方法， 其特征在于， 所述方法包括：
获取用户终端的用户数据；
提取所述用户数据的摘要信息， 所述摘要信息中包含所述用户的隐私信息和非隐私 信息；
为所述隐私信息生成唯一标识符 UID;
将所述非隐私信息与所述 UID传输至云服务器， 以使所述云服务器保存所述非隐私 信息与所述 UID之间的对应关系。
2、 根据权利要求 1所述的方法， 其特征在于， 所述提取所述用户数据的摘要信息 后， 所述方法还包括： 保存所述隐私信息与所述 UID之间的对应关系。
3、 根据权利要求 1或 2所述的方法， 其特征在于， 所述获取用户终端的用户数据， 具体为：
接收用户终端发送的通知消息， 所述通知消息用于通知所述用户终端已将加密用户 数据上传到云服务器，所述加密用户数据为所述用户终端根据下发的加密密钥对所述用 户数据进行加密后的数据；
根据所述通知消息向所述云服务器发送用于请求所述加密用户数据的数据请求消 息；
接收所述云服务器根据所述数据请求消息返回的所述加密用户数据；
利用所述加密密钥对所述加密用户数据进行解密， 得到解密后的用户数据。
4、 根据权利要求 3所述的方法， 其特征在于， 所述接收用户终端发送的通知消息 之前， 所述方法还包括：
接收所述用户终端发送的密钥请求消息；
根据所述密钥请求消息向所述用户终端下发所述加密密钥， 以使所述用户终端根据 所述加密密钥对所述用户数据加密后， 将所述加密用户数据传输至所述云服务器。
5、 根据权利要求 1或 2所述的方法， 其特征在于， 所述获取用户终端的用户数据， 具体为： 接收用户终端上传的所述用户终端的用户数据；
所述方法还包括：
利用与所述用户终端协商的加密密钥对所述用户数据进行加密；
将加密用户数据传输至所述云服务器。
6、 根据权利要求 2所述的方法， 其特征在于， 所述方法还包括： 接收第三方终端发送的推送信息和 UID， 所述 UID为所述云服务器接收到所述第三 方终端发送的需求信息后， 获得并发送给所述第三方终端的与所述需求信息匹配的非隐 私信息对应的 UID;
获得与所述 UID对应的隐私信息；
按照所述隐私信息中包含的用户地址信息发送所述推送信息。
7、 一种信息处理方法， 其特征在于， 所述方法包括：
接收信任服务器传输的用户的非隐私信息与 UID， 所述非隐私信息为所述信任服务 器从获取到的用户数据中提取的摘要信息中包含的信息，所述摘要信息中还包含所述用 户的隐私信息， 所述 UID为所述信任服务器为所述隐私信息生成的 UID;
保存所述非隐私信息与所述 UID之间的对应关系。
8、 根据权利要求 7所述的方法， 其特征在于， 所述方法还包括：
接收第三方终端发送的需求信息；
将保存的所述非隐私信息与所述需求信息进行匹配， 获得与所述需求信息匹配的非 隐私信息对应的 UID;
将获得的所述非隐私信息对应的 UID发送至所述第三方终端， 以使所述第三方终端 将所述 UID和推送信息发送给所述信任服务器后， 由所述信任服务器根据所述 UID对应 的隐私信息中包含的用户地址信息发送所述推送信息。
9、 一种信任服务器， 其特征在于， 所述信任服务器包括：
获取单元， 用于获取用户终端的用户数据；
提取单元， 用于提取所述获取单元获取到的用户数据的摘要信息， 所述摘要信息中 包含所述用户的隐私信息和非隐私信息；
生成单元，用于为所述提取单元提取的摘要信息中的隐私信息生成唯一标识符 UID; 传输单元， 用于将所述提取单元提取的摘要信息中的非隐私信息与所述生成单元生 成的 UID传输至云服务器， 以使所述云服务器保存所述非隐私信息与所述 UID之间的对 应关系。
10、 根据权利要求 9所述的信任服务器， 其特征在于， 所述信任服务器还包括： 保存单元， 用于保存所述提取单元提取的摘要信息中的所述隐私信息与所述生成单 元生成的所述 UID之间的对应关系。
11、 根据权利要求 9或 10所述的信任服务器， 其特征在于， 所述获取单元包括： 通知消息接收子单元， 用于接收用户终端发送的通知消息， 所述通知消息用于通知 所述用户终端已将加密用户数据上传到云服务器，所述加密用户数据为所述用户终端根 据下发的加密密钥对所述用户数据进行加密后的数据；
数据请求发送子单元， 用于根据所述通知消息接收子单元接收到的通知消息向所述 云服务器发送用于请求所述加密用户数据的数据请求消息；
加密数据接收子单元， 用于接收所述云服务器根据所述请求消息发送子单元发送的 数据请求消息返回的所述加密用户数据；
加密数据解密子单元， 用于利用所述加密密钥对所述加密数据接收子单元接收到的 加密用户数据进行解密， 得到解密后的用户数据。
12、 根据权利要求 11所述的信任服务器， 其特征在于， 所述信任服务器还包括： 第一接收单元， 用于接收所述用户终端发送的密钥请求消息；
下发单元， 用于根据所述第一接收单元接收到的密钥请求消息向所述用户终端下发 所述加密密钥， 以使所述用户终端根据所述加密密钥对所述用户数据加密后， 将所述加 密用户数据传输至所述云服务器。
13、 根据权利要求 9或 10所述的信任服务器， 其特征在于， 所述获取单元包括： 用户数据接收子单元， 用于接收用户终端上传的所述用户终端的用户数据； 所述信任服务器还包括：
加密单元， 用于利用与所述用户终端协商的加密密钥对所述用户数据接收子单元接 收到的用户数据进行加密；
所述传输单元， 还用于将所述加密单元输出的加密用户数据传输至所述云服务器。
14、 根据权利要求 10所述的信任服务器， 其特征在于， 所述信任服务器还包括： 第二接收单元， 用于接收第三方终端发送的推送信息和 UID， 所述 UID为所述云服 务器接收到所述第三方终端发送的需求信息后， 获得并发送给所述第三方终端的与所述 需求信息匹配的非隐私信息对应的 UID;
获得单元， 用于获得与所述第二接收单元接收到的 UID对应的隐私信息； 发送单元， 用于按照所述获得单元获取的隐私信息中包含的用户地址信息发送所述 推送信息。
15、 一种云服务器， 其特征在于， 所述云服务器包括： 第一接收单元， 用于接收信任服务器传输的用户的非隐私信息与 UID， 所述非隐私 信息为所述信任服务器从获取到的用户数据中提取的摘要信息中包含的信息，所述摘要 信息中还包含所述用户的隐私信息，所述 UID为所述信任服务器为所述隐私信息生成的 UID;
保存单元， 用于保存所述接收单元接收到的所述非隐私信息与所述 UID之间的对应 关系。
16、 根据权利要求 15所述的云服务器， 其特征在于， 所述云服务器还包括： 第二接收单元， 用于接收第三方终端发送的需求信息；
匹配单元， 用于将所述保存单元保存的所述非隐私信息与所述第二接收单元接收到 的所述需求信息进行匹配， 获得与所述需求信息匹配的非隐私信息对应的 UID;
发送单元， 用于将所述匹配单元获得的所述非隐私信息对应的 UID发送至所述第三 方终端， 以使所述第三方终端将所述 UID和推送信息发送给所述信任服务器后， 由所述 信任服务器根据所述 UID对应的隐私信息中包含的用户地址信息发送所述推送信息。
PCT/CN2014/073886 2013-03-21 2014-03-21 信息处理方法、信任服务器及云服务器 WO2014146609A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP14771033.9A EP2942899B1 (en) 2013-03-21 2014-03-21 Information processing method, trust server and cloud server
US14/820,673 US10063655B2 (en) 2013-03-21 2015-08-07 Information processing method, trusted server, and cloud server

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201310092589.8 2013-03-21
CN201310092589.8A CN104065623B (zh) 2013-03-21 2013-03-21 信息处理方法、信任服务器及云服务器

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US14/820,673 Continuation US10063655B2 (en) 2013-03-21 2015-08-07 Information processing method, trusted server, and cloud server

Publications (1)

Publication Number Publication Date
WO2014146609A1 true WO2014146609A1 (zh) 2014-09-25

Family

ID=51553156

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/073886 WO2014146609A1 (zh) 2013-03-21 2014-03-21 信息处理方法、信任服务器及云服务器

Country Status (4)

Country Link
US (1) US10063655B2 (zh)
EP (1) EP2942899B1 (zh)
CN (1) CN104065623B (zh)
WO (1) WO2014146609A1 (zh)

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105991563B (zh) 2015-02-05 2020-07-03 阿里巴巴集团控股有限公司 一种保护敏感数据安全的方法、装置及三方服务系统
CN107026826B (zh) * 2016-02-02 2020-08-14 阿里巴巴集团控股有限公司 数据处理方法、装置、服务器及云端管理系统
CN107528810A (zh) * 2016-06-21 2017-12-29 中兴通讯股份有限公司 一种登录云服务器的方法及装置
CN112383388B (zh) * 2020-11-06 2023-04-25 华南师范大学 一种基于云计算大数据的双秘钥加密系统及方法
CN114189511B (zh) * 2021-12-06 2024-01-09 成都傲梅科技有限公司 一种基于第三方云的多云组合方法
CN116566642B (zh) * 2023-03-23 2024-03-01 北京神州安付科技股份有限公司 基于云服务器密码机的隐私保护系统和方法

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080263645A1 (en) * 2007-04-23 2008-10-23 Telus Communications Company Privacy identifier remediation
CN102655508A (zh) * 2012-04-19 2012-09-05 华中科技大学 云环境下的用户隐私数据保护方法
US20120297184A1 (en) * 2011-05-20 2012-11-22 Lockheed Martin Corporation Cloud computing method and system

Family Cites Families (21)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7146505B1 (en) * 1999-06-01 2006-12-05 America Online, Inc. Secure data exchange between date processing systems
US7630986B1 (en) * 1999-10-27 2009-12-08 Pinpoint, Incorporated Secure data interchange
US20020035605A1 (en) * 2000-01-26 2002-03-21 Mcdowell Mark Use of presence and location information concerning wireless subscribers for instant messaging and mobile commerce
CA2298194A1 (en) * 2000-02-07 2001-08-07 Profilium Inc. Method and system for delivering and targeting advertisements over wireless networks
CA2349914C (en) * 2000-06-09 2013-07-30 Invidi Technologies Corp. Advertising delivery method
AU2001281294A1 (en) * 2000-07-06 2002-01-21 Protigen, Inc. System and method for anonymous transaction in a data network and classificationof individuals without knowing their real identity
US20060075228A1 (en) * 2004-06-22 2006-04-06 Black Alistair D Method and apparatus for recognition and real time protection from view of sensitive terms in documents
WO2006072052A2 (en) * 2004-12-31 2006-07-06 Anonymizer, Inc. System for protecting identity in a network environment
US8301887B2 (en) * 2005-09-30 2012-10-30 Blue Coat Systems, Inc. Method and system for automated authentication of a device to a management node of a computer network
US8607044B2 (en) * 2006-04-25 2013-12-10 Verisign, Inc. Privacy enhanced identity scheme using an un-linkable identifier
US8639920B2 (en) * 2009-05-11 2014-01-28 Experian Marketing Solutions, Inc. Systems and methods for providing anonymized user profile data
US20110078775A1 (en) * 2009-09-30 2011-03-31 Nokia Corporation Method and apparatus for providing credibility information over an ad-hoc network
CN101834861A (zh) * 2010-04-16 2010-09-15 华中师范大学 位置服务中基于邻居节点转发查询的轨迹隐私保护方法
US8769269B2 (en) * 2010-08-12 2014-07-01 International Business Machines Corporation Cloud data management
GB2485783A (en) * 2010-11-23 2012-05-30 Kube Partners Ltd Method for anonymising personal information
WO2012087646A2 (en) * 2010-12-22 2012-06-28 Intel Corporation A system and method to protect user privacy in multimedia uploaded to internet sites
US20130080767A1 (en) * 2011-09-27 2013-03-28 Max Planck Gesellschaft Zur Foerderung Der Wissenschaften Profiling users in a private online system
US20130124628A1 (en) * 2011-11-15 2013-05-16 Srilal Weerasinghe Method and apparatus for providing social network based advertising with user control and privacy
CN102611711A (zh) 2012-04-09 2012-07-25 中山爱科数字科技股份有限公司 一种云数据安全存储方法
CN102857338A (zh) * 2012-08-31 2013-01-02 浪潮电子信息产业股份有限公司 一种云存储系统中数据安全传输的方法
CN102916948B (zh) * 2012-09-29 2015-05-06 深圳市易联盛世科技有限公司 数据安全处理方法、装置及终端

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080263645A1 (en) * 2007-04-23 2008-10-23 Telus Communications Company Privacy identifier remediation
US20120297184A1 (en) * 2011-05-20 2012-11-22 Lockheed Martin Corporation Cloud computing method and system
CN102655508A (zh) * 2012-04-19 2012-09-05 华中科技大学 云环境下的用户隐私数据保护方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP2942899A4 *

Also Published As

Publication number Publication date
US10063655B2 (en) 2018-08-28
US20150350375A1 (en) 2015-12-03
CN104065623A (zh) 2014-09-24
EP2942899B1 (en) 2021-01-20
EP2942899A4 (en) 2016-03-02
CN104065623B (zh) 2018-01-23
EP2942899A1 (en) 2015-11-11

Similar Documents

Publication Publication Date Title
US9923877B2 (en) External indexing and search for a secure cloud collaboration system
WO2018077086A1 (zh) 数据传输方法、装置及系统
CN110049016B (zh) 区块链的数据查询方法、装置、系统、设备及存储介质
EP2940959B1 (en) Apparatuses and system for the privacy and security of user files stored at a cloud server
WO2016180264A1 (zh) 获取电子文件的方法及装置
CN106487765B (zh) 授权访问方法以及使用该方法的设备
US20150082024A1 (en) Technologies for synchronizing and restoring reference templates
CN114024710B (zh) 一种数据传输方法、装置、系统及设备
WO2018177045A1 (zh) 数字证书管理方法及设备
WO2016201732A1 (zh) 一种虚拟sim卡参数管理方法、移动终端及服务器
CN105656624A (zh) 一种客户端、服务器、数据传输方法与系统
US10063655B2 (en) Information processing method, trusted server, and cloud server
CN101605137A (zh) 安全分布式文件系统
CN103516516A (zh) 文件安全共享方法、系统和终端
US11582020B2 (en) Homomorphic encryption offload for lightweight devices
WO2019047927A1 (zh) 数字证书管理方法及设备
CN104243439A (zh) 文件传输处理方法、系统及终端
KR101541165B1 (ko) 모바일 메시지 암호화 방법, 이 방법을 수행하는 프로그램을 기록한 컴퓨터 판독가능 기록매체 및 이 방법을 저장한 다운로드 서버
WO2014194818A1 (zh) 一种用于发现设备的用户的方法和用户设备
CN111460475B (zh) 基于云服务实现数据对象主体去标识化处理的方法
CN111698203A (zh) 一种云数据加密方法
WO2013163861A1 (zh) 一种代理转换的方法、装置和系统
WO2012075761A1 (zh) 一种加密mms的方法及系统
CN115766119A (zh) 通信方法、装置、通信系统及存储介质
TW201426597A (zh) 基於群組的用戶管理方法及用戶管理系統

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14771033

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2014771033

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE