WO2019085699A1 - 数据共享方法、客户端、服务器、计算设备及存储介质 - Google Patents

数据共享方法、客户端、服务器、计算设备及存储介质 Download PDF

Info

Publication number
WO2019085699A1
WO2019085699A1 PCT/CN2018/107962 CN2018107962W WO2019085699A1 WO 2019085699 A1 WO2019085699 A1 WO 2019085699A1 CN 2018107962 W CN2018107962 W CN 2018107962W WO 2019085699 A1 WO2019085699 A1 WO 2019085699A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
authorization code
client
encrypted data
data
Prior art date
Application number
PCT/CN2018/107962
Other languages
English (en)
French (fr)
Inventor
张建俊
邹文伟
李茂材
唐子超
藏军
尚庆正
王宗友
秦青
Original Assignee
腾讯科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 腾讯科技（深圳）有限公司 filed Critical 腾讯科技（深圳）有限公司
Priority to JP2020524318A priority Critical patent/JP6961818B2/ja
Priority to EP18872127.8A priority patent/EP3618394B1/en
Priority to KR1020197034696A priority patent/KR102219008B1/ko
Publication of WO2019085699A1 publication Critical patent/WO2019085699A1/zh
Priority to US16/683,597 priority patent/US11223477B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6209—Protecting access to data via a platform, e.g. using keys or access control rules to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/0618—Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0838—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/085—Secret sharing or secret splitting, e.g. threshold schemes
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3239—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/50—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using hash chains, e.g. blockchains or hash trees
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload

Definitions

  • the present application relates to the field of computer technologies, and in particular, to a data sharing method, a client, a server, a computing device, and a storage medium.
  • the information sharing system needs to adopt the following technical means to ensure the security of the data, for example, when a user requests access to a file, the information provided by the user is verified.
  • the embodiment of the present application provides a data sharing method, which is performed by a first client, and includes: encrypting a piece of plaintext data according to a key to obtain an encrypted data; and uploading the encrypted data to a region of the information sharing system.
  • the information sharing system is a blockchain system; uploading a first part of the key to an authorized access server corresponding to the information sharing system; and receiving an authorization code corresponding to the encrypted data from the authorized access server Transmitting the authorization code and the second portion of the key to the second client of the user when authorizing a user to access the encrypted data, the second portion of the key including the key And a remaining portion other than the first portion, such that when the second client sends an access request for the encrypted data to the authorized access server, the authorization code is carried in the access request and The second portion of the key, such that the authorized access server determines the first portion and the second portion of the key when determining that the authorization code is available Generating the key, decrypting the encrypted data acquired from the block of the information sharing system according to
  • the embodiment of the present application further provides a data sharing method, including: receiving, from a first client, a first part of a first key, where the first key corresponds to a part uploaded to a block of the information sharing system.
  • Encrypting data the encrypted data is obtained by performing encryption processing on a plaintext data according to the first key, the information sharing system is a blockchain system; and generating a first authorization code corresponding to the encrypted data; Transmitting the first authorization code to the first client, so that the first client, when authorizing the second client to access the encrypted data, the first authorization code and the first key
  • the second part is sent to the second client, so that the second client carries the first authorization code and the second part of the first key during access when accessing the encrypted data
  • the second portion of the first key includes a remaining portion of the first key other than the first portion; when receiving an access request for the encrypted data from any client,
  • the method further includes: Obtaining a second authorization code and an incomplete key in the access request; when the second authorization code is the same as
  • the embodiment of the present application provides a first client, including: an encryption module, which encrypts a plaintext data according to a key to obtain an encrypted data; and an uploading module that uploads the encrypted data to a region of the information sharing system.
  • the information sharing system is a blockchain system, and the first part of the key is uploaded to an authorized access server corresponding to the information sharing system; and the authorization module receives the encrypted data corresponding to the authorized access server.
  • Authorization code when authorizing a user to access the encrypted data, transmitting the authorization code and the second part of the key to the second client, the second part of the key including the key And a remaining portion other than the first portion, such that when the second client sends an access request for the encrypted data to the authorized access server, carrying the authorization code and the location in the access request Said second part of the key, such that said authorized access server determines said first part and said second part of said key when said authorization code is available
  • Generating the key decrypting the encrypted data obtained from the block of the information sharing system according to the generated key to obtain the plaintext data and returning to the second client .
  • An embodiment of the present application provides an authorization access server, including: an authorization module, which receives a first part of a first key from a first client, where the first key corresponds to a block uploaded to the information sharing system. Encrypted data obtained by encrypting a plaintext data according to the first key, the information sharing system is a blockchain system; generating a first authorization corresponding to the encrypted data Transmitting the first authorization code to the first client, so that the first client, when authorizing the second client to access the encrypted data, the first authorization code and the first Sending a second portion of the key to the second client, such that the second client carries the first authorization code and the second portion of the first key when accessing the encrypted data In the access request, the second portion of the first key includes a remaining portion of the first key other than the first portion; and the verification module receives the encrypted data from any client Access request Obtaining a second authorization code and an incomplete key from the access request; when the second authorization code is the same as the first authorization code and the second authorization code is available, triggering
  • Embodiments of the present application also provide a computing device comprising: one or more processors; a memory; and one or more programs stored in the memory and configured to be executed by the one or more processors,
  • the one or more programs include instructions for performing the above method.
  • Embodiments of the present application also propose a storage medium storing one or more programs, the one or more programs including instructions that, when executed by a computing device, cause the computing device to perform the above method.
  • FIG. 1 is a structural diagram of a system involved in an example of the present application.
  • FIG. 3 is a flow chart of a method of an example of the present application.
  • FIG. 5 is a user interface diagram of an example of the present application.
  • FIG. 6 is a user interface diagram of an example of the present application.
  • FIG. 7 is a schematic structural diagram of a client in an example of the present application.
  • FIG. 8 is a schematic structural diagram of a server in an example of the present application.
  • FIG. 9 is a schematic structural diagram of a computing device in an example of the present application.
  • the embodiment of the present application proposes a data sharing method, which can be applied to the system architecture shown in FIG.
  • the system architecture includes a first client 101, a second client 102, an authorized access server 103, and an information sharing system 104, which can communicate over the Internet 105.
  • the information sharing system 104 is configured to store various data uploaded by the user, and the user can also access the data in the information sharing system 104.
  • the authorized access server 103 can connect directly or via the Internet 105 to the information sharing system 104 for providing access to the information sharing system 104 (specifically referred to as an authorized referral service).
  • the second client 102 obtains the data that it wants to access from the information sharing system 104 through the authorized access server 103.
  • the second client 102 sends an access request for a certain data to the authorized access server 103 (specifically, it can be referred to as a lookup request).
  • the encrypted data obtained from the information sharing system 104 is decrypted according to the key information carried in the access request, and if the plaintext data after decryption can be successfully obtained, the plaintext data is returned to the second client 102.
  • the first client 101 and the second client 102 may be various APP clients or browsers that can access shared data, and the first client 101 and the second client 102 may run on various terminal devices, including : PC, mobile phone, tablet, PDA, ultrabook, wearable device, etc.
  • the information sharing system 104 can be a variety of centralized or distributed data storage systems including, but not limited to, a blockchain system (or blockchain network), a database system, a network disk/cloud disk system, and the like.
  • the data stored in the information sharing system 104 may relate to data generated in various business scenarios, including: digital assets, forensic services, shared books, sharing economy, and the like.
  • digital assets refer to non-monetary assets that are owned or controlled by enterprises and exist in the form of electronic data, which are held in daily activities for sale or in the production process.
  • Digital assets are generated by office automation, and digital assets are developed based on electronic payment systems for sharing points, coupons, digital currencies, and equity registrations.
  • the attestation service is used for business scenarios such as copyright/ownership protection, judicial document preservation, charitable donations, personal and corporate certification.
  • the shared ledger is used for business scenarios such as inter-agency clearing, bank factoring, inter-agency joint lending, supply chain finance, and cross-border remittances.
  • a blockchain is a chained data structure that combines data blocks in a chronological order in a sequential manner, and cryptographically guaranteed non-tamperable and unforgeable distributed ledgers.
  • the blockchain system is a brand new distributed infrastructure that uses blockchain data structures to validate and store data, uses distributed node consensus algorithms to generate and update data, and uses cryptography to ensure data transmission and access. Secure, using smart contracts consisting of automated script code to program and manipulate data.
  • data uploaded to the information sharing system 104 needs to be encrypted, and data access is authorized, that is, some data is conditionally shared, and the data may be referred to as user privacy data, for example, an individual. Or the organization's real-name authentication information, financial account information, photo albums, original works, information that needs to be shared for authentication, etc. For these data, the user wants to share and does not want to make the content public, but can be shared among specific people. Therefore, the data is encrypted and stored in the information sharing system 104 and then authorized for viewing by a specific user.
  • the application example provides a data sharing method applicable to the first client 101 in the terminal device. Only one first client 101 is shown in FIG. 1. In an actual application scenario, the first client 101 may have multiple, even massive, and each first client 101 may implement the method. As shown in FIG. 2, the method process 200 includes the following steps:
  • Step 201 The first client 101 encrypts a plaintext data according to the key to obtain an encrypted data.
  • Step 202 The first client 101 uploads the encrypted data into a block of the information sharing system 104, and the information sharing system is a blockchain system.
  • the first client 101 used by the user encrypts the data (ie, the plaintext data) using a preset key, and then uploads the encrypted data to the information sharing system 104. .
  • Step 203 The first client 101 uploads the first part of the key to the authorized access server 103 corresponding to the information sharing system 104.
  • the authorized access server 103 corresponding to the information sharing system 104 refers to the authorized access server 103 to which it is connected.
  • the key is a string, which can be divided into two strings as the first part and the second part of the key.
  • the first part of the key is uploaded to Authorize access to the server 103.
  • the first half of the key may be the first part and the second half of the key may be the second part.
  • the second half of the key can be used as the first part and the first half of the key can be used as the second part.
  • the lengths of the first part and the second part may be the same or different.
  • the string of the corresponding length may be segmented as the first part of the key according to a preset string length value (ie, the number of characters included in the set string), and then the remaining characters are The string acts as the second part of the key.
  • a preset string length value ie, the number of characters included in the set string
  • Step 204 The first client 101 receives an authorization code corresponding to the encrypted data from the authorized access server 103.
  • the authorized access server 103 when receiving the first part of the key for a certain encrypted data uploaded by the first client 101, the authorized access server 103 generates an authorization code for the encrypted data, and returns the authorization code to the first A client 101. Specifically, the authorized access server 103 may generate an authorization code according to a rule corresponding to the uploading user of the data.
  • Step 205 When authorizing a user to access the encrypted data, the first client 101 sends the authorization code and the second part of the key to the client of the user (ie, the corresponding second client 102)
  • the second portion of the key includes a remainder of the key other than the first portion to cause the second client 102 to send an access request for the encrypted data to the authorized access server 103 And carrying the authorization code and the second part of the key in the access request.
  • the authorized access server 103 generates the key according to the first part and the second part of the key when determining that the authorization code is available, according to the generated key pair from the information sharing system 104.
  • the encrypted data obtained in the block is decrypted, and the decrypted plaintext data is provided to the second client 102.
  • the second client 103 used by the user requests the authorization code from the first client 101, and the first client 101 determines that the user is authorized to view the data.
  • the authorization code and the second portion of the above key are sent to the second client 102.
  • the authorized access server 103 can stitch together the first portion and the second portion of the key to form the complete key. If the second part of the key obtained by the authorized access server 103 from the second client 102 does not belong to the same key as the first part of the key obtained from the first client 101, it cannot be spliced into a correct key. In turn, the decryption will fail, and the second client 102 will not be able to obtain the plaintext data. The authorized access server 103 can return a failure response to the second client 102 or return encrypted data. In this way, the second client 102 cannot successfully access the content of the data, thereby effectively securing the data uploaded by the first client 101.
  • the first client 101 holds the key and the authorization code
  • the authorization access server 103 holds the authorization code and the first part of the key
  • the second client 102 can hold the key when authorized.
  • the second part and the authorization code such that when the second client 102 requests access to the corresponding data through the authorized access server 103, the authorized access server 103 can first verify whether the authorization code is available, and if the authorization code is available, reuse the The incomplete key (the first part and the second part of the key) obtained by the first client 101 and the second client 102 respectively obtain the complete key, and if the incomplete key provided by the second client 102 has a problem, If the correct full key cannot be obtained, the encrypted data cannot be successfully decrypted, thus ensuring the security of the data.
  • the second client 102 and the authorized access server 103 respectively hold a part of the key, neither of which has the right to access the encrypted data, and only the key information held by the two can be obtained together.
  • the key which effectively protects data security and user privacy.
  • the first client 101 can authorize certain second clients 102 to access the plaintext of the encrypted data, thereby sharing information and privacy. The balance is reached, providing a better information sharing mechanism.
  • the above examples can be applied to the data sharing scenario of the blockchain.
  • the authorized access server 103 provides a service for private data authorization and access, and is an optional service for data privacy protection provided for the blockchain in the shared information system, and can be applied to the information sharing blockchain and the digital asset block.
  • the blockchain is based on the principle of sharing, all users can freely access the above data. At this time, the user can freely check whether it is authorized or not, but only the data that the authorized access server 103 passes through is the decrypted plaintext data. If a user directly consults on the blockchain, the resulting data is encrypted and the plaintext data cannot be obtained.
  • the first client 101 may further generate an access token (also referred to as a data lookup token) of the encrypted data after receiving the authorization code, the access token including the authorization And a second portion of the code and the key.
  • the step of sending the authorization code and the second part of the key to the second client 102 may include: sending the access token to the second client 102. So that the second client 102 carries the access token in the access request.
  • the first client 101 sends the authorization code and the second portion of the key to the second client 102.
  • both the authorization code and the key may be a string of numbers and/or characters
  • the access token consisting of the authorization code and the second part of the key may be a string of numbers and/or characters.
  • the first client 101 can authorize the corresponding user to access the encrypted data uploaded by issuing the token to the second client 102, and there is no complete key in the issued token, and the authorization is required.
  • the server 103 is further authenticated to obtain a complete key for decryption processing, thereby effectively securing data.
  • step 202 when the encrypted data is uploaded to the information sharing system 104, the first client 101 further uploads the file identifier of the encrypted data and the user identifier of the holder (usually currently used) a user identifier of the first client 101) to cause the information sharing system 104 to associate the encrypted data with the file identifier and the user ID of the holder to authorize the access server 103 to identify and
  • the user identification of the holder acquires the encrypted data from the information sharing system 104.
  • uploading an encrypted data its file identifier and the user ID of the holder are simultaneously transmitted to the information sharing system 104, and the information sharing system 104 will identify the encrypted data with the file identifier and holder when saving the encrypted data.
  • the user ID is associated.
  • the authorized access server 103 queries a certain encrypted data from the information sharing system 104, the file identifier and the user identifier of the holder are carried in the query request, so that the information sharing server 104 can determine the file identifier and the holder's The user identifies the associated encrypted data and returns it to the authorized access server 103.
  • step 203 when the first portion of the key is uploaded to the authorized access server 104, the first client 101 further uploads the file identifier and the user identifier of the holder to Causing the authorized access server 103 to generate the authorization code according to a rule corresponding to the user identifier of the holder, and the authorization code and the first part of the key, the file identifier, and the holder The user ID is associated.
  • the authorized access server 103 may obtain the associated authorization code and the first part of the key according to the file identifier carried therein and the user identifier of the holder (may be The first part of the encrypted data corresponding to the authorization code and the key that is authorized to be accessed by the server 103, so as to determine whether the authorization code carried by the access request is available according to the obtained authorization code, according to the obtained location.
  • the first portion of the key and the second portion carried by the access request generate the key.
  • the authorization access server 103 is pre-configured with rules for generating an authorization code for each user, which may specify a data address, an expiration time, and the like that the generated authorization code allows access.
  • the above data address may be, for example, a block height in a blockchain, a uniform resource locator (URL) address, or the like.
  • the authorized access server 104 can determine the rules for generating the authorization code based on the user identification of the concurrently uploaded encrypted data holder.
  • the authorized access server 103 can locally query the authorization code corresponding to the encrypted data currently requested to be accessed (ie, the file identifier and the authorization code associated with the user identifier of the holder), if the access request carries The authorization code is consistent with the authorization code obtained from the local query, indicating that the authorization code carried in the access request is legal, and further verifying whether the authorization code expires (such as whether the expiration time is reached or whether it is still in the effective use date).
  • the access request sent by the second client 102 may carry the file identifier of the data to be consulted, and the authorized access server 103 may determine the block height of the data according to the file identifier, thereby verifying the location.
  • the access request sent by the second client 102 can directly carry the block height of the data, and the authorized access server 103 can verify whether the block height carried by the access request is the block height allowed for access corresponding to the authorization code.
  • the acquired first portion of the key associated with the file identification and the user identification of the holder and the second portion of the key carried by the access request may be combined into a complete key. This combination can be as simple as splicing the two parts together.
  • the first client 101 may further generate an access token including the authorization code and the encrypted data of the second part of the key, Associating the access token with the file identification.
  • the sending the authorization code and the second part of the key to the second client 102 may include: sending the access token associated with the file identifier to a second client.
  • the terminal 102 is configured to enable the second client 102 to carry the access token in the access request.
  • one or more access tokens are maintained in the first client 101, and each data uploaded by the first client 101 corresponds to one access token, that is, each file identifier is associated with an access token.
  • the second client 102 requests the data access authorization from the first client 101, if the first client 101 agrees to authorize, the first client 101 can determine the corresponding access token and issue the access token to The second client 102.
  • the second client 102 may request access authorization for a certain data or for a data set that meets certain conditions or for all data, the first client 101 may send the corresponding one or more access tokens to the second client. End 102.
  • the method further includes: the first client 101 transmitting a cancellation request for the authorization code to the authorized access server 103 to cause the authorized access server 103 to invalidate the authorization code.
  • the first client 101 also invalidates the local authorization code.
  • the cancellation request for an authorization code may carry the corresponding file identifier, and the authorization access server 103 may determine the authorization code corresponding to the file identifier according to the file identifier, and may invalidate the authorization code, for example, setting the status to be invalid or Clear this authorization code and more.
  • the authorized access server 103 can return a response to the first client 101 after the authorization code is invalidated, and the first client 101 invalidates the local authorization code when receiving the response, thereby completing the entire process of canceling the authorization code.
  • the first client 101 can not only enable the authorized access server 103 to generate an authorization code for the uploaded data, but also request the authorized access server 103 to cancel the authorization code.
  • the authorization code is cancelled, if the second client 102 requests access, When the data uses this authorization code or an access token containing the authorization code, the authorization code will be verified as unavailable, so that the access request will be rejected, the second client 102 cannot access the data, or can only obtain the encryption. The data cannot be decrypted and the plaintext data is not available. This forms a dynamic authorization mode for data access. Users sharing a certain data can cancel the corresponding authorization code as needed, so that users who have obtained the authorization code to access the data can no longer access the data.
  • the first client 101 may further send a generation authorization code request for the encrypted data to the authorized access server 103 to enable the authorized access server 103 to generate the encryption.
  • the new authorization code corresponding to the data after which the first client 101 receives the new authorization code corresponding to the encrypted data from the authorized access server 103.
  • the user can not only cancel the authorization code at any time, so that the previously authorized user cannot access the plaintext of the encrypted data, and can also request to generate a new authorization code to re-authorize the user to access the plaintext of the encrypted data, thereby realizing flexible data access authorization.
  • the first client 101 may also request the authorized access server 103 to update the authorization code after obtaining the authorization code.
  • the authorization code obtained by the first client 101 has not been deleted or has not been used yet.
  • the first client 101 sends an update authorization code request for a certain encrypted data to the authorized access server 103, so that the authorized access server 103 generates a new authorization code corresponding to the encrypted data, and replaces the previous authorization code with the new authorization code.
  • the authorization code thereafter, the first client 101 receives the new authorization code from the authorized access server 103 and replaces the previous authorization code with the new authorization code. In this way, the first client 101 can cancel the previous authorization code through an authorization code update process, so that the previously authorized user cannot access the plaintext of the encrypted data, and a new authorization code can be obtained, and some users can be authorized subsequently.
  • the cancellation request, the generation authorization code request, and the update authorization code request of the foregoing authorization code may coexist, and the user may select a cancellation authorization code, generate a new authorization code, or update an authorization code according to the need, thereby implementing a more perfect Dynamic authorization scheme.
  • the present application example provides a data sharing method that can be applied to the authorized access server 103.
  • the method process 300 includes the following steps:
  • Step 301 Receive a first part of the first key from the first client 101, the first key corresponding to a piece of encrypted data uploaded into a block of the information sharing system 104, the encrypted data is according to the The first key is obtained by encrypting a plaintext data, and the information sharing system is a blockchain system.
  • Step 302 Generate a first authorization code corresponding to the encrypted data.
  • Step 303 Send the first authorization code to the first client 101, so that the first client 101, when authorizing the second client 102 to access the encrypted data, the first authorization code and the first
  • the second portion of the key is sent to the second client 102 such that the second client 102 carries the first authorization code and the second portion of the first key on access when accessing the encrypted data
  • the second portion of the first key includes a remaining portion of the first key other than the first portion.
  • Step 304 When receiving an access request for the encrypted data from any client (possibly the above-mentioned authorized second client 102 may also be another unauthorized client), perform the following steps:
  • Step 305 Obtain a second authorization code and an incomplete key from the access request.
  • Step 306 When the second authorization code is the same as the first authorization code and the second authorization code is available, according to the incomplete key and the first key corresponding to the encrypted data. A portion generates a second key, wherein the generated second key is the same as the first key when the incomplete key is the same as the second portion of the first key.
  • Step 307 Acquire the encrypted data from the block of the information sharing system 104. Decrypting the encrypted data according to the second key, wherein when the second key is the same as the first key, the plaintext data is decrypted and sent to send the access The requested client.
  • the authorized access server 103 may first Verifying that the authorization code is available, and if the authorization code is available, using the incomplete key (the first part and the second part of the key) obtained from the first client 101 and the client respectively, obtain the complete key, if If there is a problem with the incomplete key provided by this client, the correct full key cannot be obtained, and the encrypted data cannot be successfully decrypted, thus ensuring the security of the data.
  • the authorized second client 102 and the authorized access server 103 respectively hold a part of the key, neither of which has the right to access the encrypted data, only when the key information held by the two is merged together
  • the first client 101 can authorize certain second clients 102 to access the plaintext of the encrypted data, thereby sharing information and privacy. The balance is reached, providing a better information sharing mechanism.
  • the step of obtaining the second authorization code and the one incomplete key from the access request may include: acquiring an access token of the encrypted data from the access request; And obtaining the second authorization code and the incomplete key from the access token.
  • step 301 when the first portion of the key is received from the first client, the authorized access server 103 further receives the file identification and the user identification of the holder of the encrypted data.
  • step 302 the step of generating the first authorization code corresponding to the encrypted data may include: generating the authorization code according to a rule corresponding to the user identifier of the holder, and the authorization code and the The first part of the key, the file identifier, and the user identifier of the holder are associated; when the access request is received, the file identifier and the user identifier of the holder are obtained according to the access request The associated authorization code and the first portion of the key.
  • the block corresponds to a block height.
  • the generated first authorization code corresponds to a block height and/or an expiration time that is allowed to be accessed.
  • the block height and/or the expiration time of the access allowed corresponding to the second authorization code is obtained. And when the block height of the encrypted data for the access request matches the block height of the access allowed corresponding to the second authorization code and/or the second authorization code does not reach the expiration time Determining that the second authorization code is available.
  • the method further includes: invalidating the authorization code in response to a cancellation request for the authorization code from the first client 101.
  • the authorized access server 103 can return a response to the first client 101 after the authorization code is invalidated, and the first client 101 invalidates the local authorization code when receiving the response, thereby completing the entire process of canceling the authorization code.
  • the user can cancel the authorization code for some data as needed to cancel the sharing for some users or data, such as: the second client 102 that obtained the authorization code of one piece of data before, if the authorization code fails, then When the second client 102 requests access to this data using this authorization code, the authorization code will be verified as unavailable and cannot be accessed.
  • the method further includes: generating a new authorization code corresponding to the encrypted data in response to a request for generating an authorization code for the encrypted data from the first client 101; transmitting the encryption to the first client 101 The new authorization code corresponding to the data.
  • the user can also request a new authorization code to re-authorize some users to access the data, thereby realizing flexible data access authorization.
  • the method further includes: generating a new authorization code corresponding to the encrypted data in response to the update authorization code request for the encrypted data from the first client 101, and replacing the previous location with the new authorization code The first authorization code is described. Sending the new authorization code corresponding to the encrypted data to the first client 101 to replace the previous first authorization code with the new authorization code.
  • FIG. 4 shows a message interaction process in an embodiment of the present application. As shown in FIG. 4, the process involves at least four entities: a first client 101, a second client 102, an authorized access server 103, and an information sharing system 104, which may include the following processing steps:
  • Step 401 The first client 101 holds an encryption key, and encrypts data to be uploaded to the information sharing system 104 to obtain a piece of encrypted data.
  • the first client 101 uploads the encrypted data to the information sharing system 104, and also transmits the encrypted user's user identification and file identification associated with the encrypted data to the information sharing system 104 when uploading the encrypted data.
  • the first client 101 can send a data upload request to the information sharing system 104, which carries the user ID, file identifier and encrypted data of the holder.
  • the user identifier of the holder is an identifier of the currently logged-in user of the first client 101, for example, a QQ number, a cloud disk account, an account of a blockchain system, and the like; and the file identifier is used to identify the encrypted data.
  • the information sharing system 104 can save the encrypted data uploaded by the first client 101 and associate it with the user identifier and the file identifier of the holder, so as to store the encrypted data in a directory corresponding to the holder's user identifier.
  • the file identifier is used to identify the encrypted data.
  • the first client 101 is a network disk client
  • the information sharing system 104 is a cloud disk server (or simply a cloud disk server).
  • Users can upload photos, videos and other files using this web client. For example, clicking the control 501 can upload a photo, and clicking the control 502 can upload a video.
  • the network disk client can be configured to encrypt the uploaded data, so that the network disk client performs the encryption process of the above step 401.
  • Step 402 The first client 101 uploads the first half of the key used for the encryption of step 401 (which may be referred to as the first half of the key) to the authorized access server 103, and also sends the user identifier of the holder associated with the encrypted data. Give authorization to access the server.
  • the first client 101 may send a key upload request to the authorized access server 103, where the request carries the user identifier of the holder of the encrypted data and the first half of the key.
  • the authorization access server 103 generates an authorization code according to the rule corresponding to the user identifier of the holder, and associates the authorization code with the first half of the key and the user identifier of the holder, and then returns the authorization code to the first Client 101.
  • Step 403 The first client 101 combines the second half of the key used for the step 401 encryption (which may be referred to as the second half of the key) and the received authorization code into a data review token, and the data reference token is Associated with the file identification of the aforementioned encrypted data.
  • the data review token may be provided to the second client 102.
  • the second client 102 requests the first client 101 for the authorization of the data, and sends an authorization request for carrying the target file information to the first client 101, and the first client 101 can determine the first file according to the target file information.
  • the object file information may include a file identifier, an identifier of a folder or a directory address, and the like, and the first client 101 may determine a corresponding file identifier set, and then determine an associated data review token through the file identifier set.
  • a file identifier set (one or more file identifiers) may be associated with a data lookup token, and the first client 101 may batch-authorize a file set to the second client 102; a file identifier set may also be associated with multiple Data reference tokens, wherein different file identifiers associate different data lookup tokens, and the first client 101 provides a data lookup token to the second client 102 for each file.
  • Step 404 After holding the data review token, the second client 102 sends a referral request to the authorized access server 103, the request carrying the user identifier, the file identifier and the data reference token of the holder of the encrypted data.
  • the second client 102 is a browser that accesses the blockchain page
  • the information sharing system 104 is a blockchain system.
  • Users can view various information by accessing the blockchain page, and some information is private. Users can view plaintext data when they have a data access token. For example, if the user can click on the control 601, step 404 can be performed to issue a lookup request. If the data lookup token carried by the lookup request contains the correct available authorization code and the correct second half of the key, the browser may present a second page containing the plaintext data corresponding to the "details" item.
  • Step 405 The authorized access server 103 extracts the data reference token, the user identifier and the file identifier of the holder from the received review request, extracts the authorization code from the data reference token, and determines whether the authorization code is available.
  • the authorization access server 103 determines whether the authorization code is available, including two aspects: 1. Whether the authorization code extracted from the data review token is the same as the authorization code associated with the locally stored user identifier of the holder, if the data is read from the order If the authorization code extracted from the card is consistent with the authorization code obtained from the local query, the authorization code carried in the data reference token is legal. 2.
  • the two authorization codes are the same, further verify whether the authorization code expires ( For example, whether the expiration time is reached or whether it is still within the effective use date, and/or whether the address of the encrypted data currently requested to be checked belongs to the data address permitted to be accessed corresponding to the authorization code.
  • the authorized access server 103 acquires the first half of the key associated with the authorization code, extracts the second half of the key from the data reference token, and combines the first half of the key and the second half of the key into one complete Key.
  • the authorization access server 103 also sends a query request to the information sharing system 104, the request carrying the user identifier and the file identifier of the holder, so that the information sharing server 104 queries the associated encrypted data according to the user identifier and the file identifier of the holder. It is returned to the authorized access server 103.
  • Step 406 Decrypt the encrypted data using the complete key obtained in step 405. If the second half of the key extracted in the data lookup token is accurate, then an accurate complete key can be obtained in step 405, then the decrypted data (ie, plaintext data) can be successfully decrypted in this step, and the decrypted data is returned. To the second client 102. If the second half of the key extracted in the data lookup token is erroneous, the key obtained in step 405 is erroneous and cannot be successfully decrypted in this step. In this case, the second client 102 may report an error, or directly return an encrypted data to the second client 102. In short, the second client 102 cannot successfully access the plaintext data, thereby ensuring the first client. 101 The security of the uploaded data.
  • the embodiment of the present application further provides a client (which may be the first client 101) that can implement the foregoing method.
  • a client which may be the first client 101
  • the first client 700 includes the following modules:
  • the encryption module 701 encrypts a plaintext data according to the key to obtain an encrypted data.
  • the uploading module 702 uploads the encrypted data to a block of the information sharing system 104.
  • the information sharing system is a blockchain system, and the first part of the key is uploaded to the information sharing system 104. Authorize access to the server 103.
  • the authorization module 703 receives an authorization code corresponding to the encrypted data from the authorized access server 103; when authorizing a user to access the encrypted data, sending the authorization code and the second part of the key to the second Client 102, the second portion of the key includes a remainder of the key other than the first portion, such that the second client 102 sends an access request for the encrypted data to the
  • the authorization code and the second part of the key are carried in the access request, so that the authorized access server 103 is determined according to the key when determining that the authorization code is available.
  • the first part and the second part generate the key, and decrypt the encrypted data acquired from the block of the information sharing system 104 according to the generated key to obtain the The plaintext data is returned to the second client 102.
  • the authorization module 703 further generates an access token of the encrypted data, the access token including the authorization code and the second portion of the key; wherein the authorization module 703 The access token is sent to the second client 102 to cause the second client 102 to carry the access token in the access request.
  • the uploading module 702 when the encrypted data is uploaded to the information sharing system 104, the uploading module 702 further uploads the file identifier of the encrypted data and the user identifier of the holder thereof to enable the information sharing.
  • the system 104 associates the encrypted data with the file identification and the user identification of the holder such that the authorized access server 103 shares from the information based on the file identification and the user identification of the holder.
  • System 104 obtains the encrypted data.
  • the uploading module 702 when the first portion of the key is uploaded to the authorized access server 103, the uploading module 702 further uploads the file identifier and the user identification of the holder to The authorization access server 103 generates the authorization code according to a rule corresponding to the holder's user identifier, and the authorization code and the first part of the key, the file identifier, and the holder Corresponding to the user identifier, when the access request is received, obtaining the associated authorization code and the first part of the key according to the file identifier carried in the holder and the user identifier of the holder. And determining, according to the obtained authorization code, whether the authorization code carried by the access request is available, and generating the secret according to the obtained first part of the key and the second part carried by the access request. key.
  • the authorization module 703 further generates an access token including the authorization code and the encrypted data of the second portion of the key, the access token being associated with the file identification And the authorization module 703 sends the access token associated with the file identifier to the second client 102, so that the second client 102 carries the access request in the access request The access token.
  • the authorization module 703 further sends a cancellation request for the authorization code to the authorized access server 103 to cause the authorized access server 103 to invalidate the authorization code; the authorization module 703 further The local authorization code is invalid.
  • the authorization module 703 sends a request for generating an authorization code for the encrypted data to the authorized access server 103 to cause the authorized access server 103 to generate a new authorization code corresponding to the encrypted data;
  • the authorization module 703 also receives the new authorization code corresponding to the encrypted data from the authorized access service 103.
  • the authorization module 703 further sends an update authorization code request for the encrypted data to the authorized access server 103, so that the authorized access server 103 generates a new authorization code corresponding to the encrypted data, and uses The new authorization code replaces the previous authorization code; the authorization module 703 also receives the new authorization code from the authorized access server 103, and replaces the previous authorization code with the new authorization code.
  • the embodiment of the present application further provides an authorized access server (such as the foregoing authorized access server 103) that can implement the foregoing method.
  • the server 800 can include the following modules:
  • the authorization module 801 receives a first portion of the first key from the first client 101, the first key corresponding to a piece of encrypted data uploaded into a block of the information sharing system 104, the encrypted data being based on Obtaining, by the first key, a plaintext data, the information sharing system is a blockchain system; generating a first authorization code corresponding to the encrypted data; and sending the first authorization code to The first client 101, to enable the first client 101 to send the first authorization code and the second part of the first key to the second client 102 when the second client 102 is authorized to access the encrypted data
  • the second client 102 so that the second client 102 carries the first authorization code and the second part of the first key in an access request when accessing the encrypted data,
  • the second portion of the first key includes the remainder of the first key except the first portion.
  • the verification module 802 when receiving an access request for the encrypted data from any client (such as the second client 102), obtain a second authorization code and an incomplete key from the access request; When the second authorization code is the same as the first authorization code and the second authorization code is available, the key module 803 is triggered.
  • the key module 803 generates a second key according to the incomplete key and the first part of the first key corresponding to the encrypted data, where the incomplete key and the first key are When the second part is the same, the generated second key is the same as the first key.
  • Decryption module 804 obtaining the encrypted data from the block of the information sharing system 104; decrypting the encrypted data according to the second key, wherein when the second key is When the first key is the same, the plaintext data is decrypted and sent to the client that sends the access request.
  • the verification module 802 obtains an access token of the encrypted data from the access request, and obtains the second authorization code and the incomplete key from the access token.
  • the authorization module 801 when receiving the first portion of the key from the first client 101, further receives a file identification and a user identification of a holder of the encrypted data; The authorization module 801 generates the first authorization code according to a rule corresponding to the user identifier of the holder, and the first authorization code and the first part of the key, the file identifier and The user identifier of the holder is associated; wherein, when the access request is received, the verification module 802 obtains an associated location according to the file identifier carried by the access request and the user identifier of the holder. Describe the first authorization code and the first portion of the key.
  • the block corresponds to a block height
  • the first authorization code generated by the authorization module 801 corresponds to a block height and/or an expiration time that is allowed to be accessed
  • the verification module 802 is Obtaining a block height and/or an expiration time of the access allowed corresponding to the second authorization code when the second authorization code is the same as the first authorization code
  • the block of the encrypted data for the access request When the height of the block that is allowed to access corresponding to the second authorization code is matched and/or the second authorization code does not reach the expiration time, it is determined that the second authorization code is available.
  • the authorization module 801 further invalidates the first authorization code in response to a cancellation request for the authorization code from the first client 101; returns to the first client 101 Responding to cause the first client 101 to invalidate the local first authorization code.
  • the authorization module 801 further generates a new authorization code corresponding to the encrypted data in response to a request for generating an authorization code for the encrypted data from the first client 101; to the first The client 101 sends the new authorization code corresponding to the encrypted data.
  • the authorization module 801 further generates a new authorization code corresponding to the encrypted data in response to an update authorization code request for the encrypted data from the first client 101, and uses the new authorization The code replaces the previous first authorization code; the new authorization code corresponding to the encrypted data is sent to the first client 101 to replace the previous first authorization code with the new authorization code .
  • client 700 and server 800 described above can be run in various computing devices and loaded into the memory of the computing device.
  • Embodiments of the present application propose a computing device comprising: one or more processors; a memory; and one or more programs stored in the memory and configured to be executed by the one or more processors, The one or more programs include instructions for performing an instance of a method of the aforementioned person.
  • FIG. 9 shows a compositional diagram of a computing device in which the client 700 or server 800 is located.
  • the computing device includes one or more processors (CPUs) 902, communication modules 904, memory 906, user interface 910, and a communication bus 908 for interconnecting these components.
  • processors CPUs
  • communication modules 904
  • memory 906 user interface 910
  • communication bus 908 for interconnecting these components.
  • the processor 902 can receive and transmit data through the communication module 904 to enable network communication and/or local communication.
  • User interface 910 includes one or more output devices 912 that include one or more speakers and/or one or more visual displays.
  • User interface 910 also includes one or more input devices 914 including, for example, a keyboard, a mouse, a voice command input unit or loudspeaker, a touch screen display, a touch sensitive tablet, a gesture capture camera or other input button or control, and the like.
  • the memory 906 can be a high speed random access memory such as DRAM, SRAM, DDR RAM, or other random access solid state storage device; or a non-volatile memory such as one or more magnetic disk storage devices, optical disk storage devices, flash memory devices, Or other non-volatile solid-state storage devices.
  • a high speed random access memory such as DRAM, SRAM, DDR RAM, or other random access solid state storage device
  • non-volatile memory such as one or more magnetic disk storage devices, optical disk storage devices, flash memory devices, Or other non-volatile solid-state storage devices.
  • the memory 906 stores a set of instructions executable by the processor 902, including:
  • Operating system 916 including programs for processing various basic system services and for performing hardware related tasks
  • the application 918 includes various applications that can implement the processing flow in the above examples, and may include, for example, the client 700 shown in FIG. 7 and/or the server 800 shown in FIG.
  • client 700 may include some or all of modules 701-703 shown in FIG. 7, and modules 701-703 may store machine-executable instructions.
  • the processor 902 can implement the functions of the above-described modules 701 to 703 by executing the machine executable instructions in the modules 701 to 703 in the memory 906.
  • server 800 can include some or all of modules 801-804 shown in FIG. 8, and modules 801-804 can store machine-executable instructions.
  • the processor 902 can implement the functions of the above-described modules 801 to 804 by executing the machine executable instructions in the modules 801 to 804 in the memory 906.
  • the first client 101 holds a key and an authorization code
  • the authorized access server 103 holds the authorization code and the first part of the key
  • the second client 102 is authorized
  • the second portion of the key and the authorization code can be held such that when the second client 102 requests access to the corresponding data through the authorized access server 103, the authorized access server 103 can first verify whether the authorization code is available, and the authorization code is available.
  • the incomplete key (the first part and the second part of the key) obtained from the first client 101 and the second client 102, respectively, is used to obtain the complete key, if the second client 102 does not provide the full key.
  • the second client 102 and the authorized access server 103 respectively hold a part of the key, neither of which has the right to access the encrypted data, and only the key information held by the two can be obtained together.
  • the key which effectively protects data security and user privacy.
  • the hardware modules in the embodiments may be implemented in a hardware manner or a hardware platform plus software.
  • the above software includes machine readable instructions stored in a non-volatile storage medium.
  • embodiments can also be embodied as software products.
  • the hardware may be implemented by specialized hardware or hardware that executes machine readable instructions.
  • the hardware can be a specially designed permanent circuit or logic device (such as a dedicated processor such as an FPGA or ASIC) for performing a particular operation.
  • the hardware may also include programmable logic devices or circuits (such as including general purpose processors or other programmable processors) that are temporarily configured by software for performing particular operations.
  • each instance of the present application can be implemented by a data processing program executed by a data processing device such as a computer.
  • the data processing program constitutes the present application.
  • a data processing program usually stored in a storage medium is executed by directly reading a program out of a storage medium or by installing or copying the program to a storage device (such as a hard disk and or a memory) of the data processing device. Therefore, such a storage medium also constitutes the present application.
  • the embodiment of the present application further provides a non-volatile storage medium in which a data processing program is stored, which can be used to execute the method in the above method example of the present application. Any kind of instance.
  • the machine readable instructions corresponding to the modules of Figures 7 and 8 may cause an operating system or the like operating on a computer to perform some or all of the operations described herein.
  • the non-transitory computer readable storage medium may be inserted into a memory provided in an expansion board within the computer or written to a memory provided in an expansion unit connected to the computer.
  • the CPU or the like installed on the expansion board or the expansion unit can perform part and all of the actual operations according to the instructions.
  • the non-transitory computer readable storage medium includes a floppy disk, a hard disk, a magneto-optical disk, an optical disk (such as a CD-ROM, a CD-R, a CD-RW, a DVD-ROM, a DVD-RAM, a DVD-RW, a DVD+RW), and a magnetic tape. , non-volatile memory card and ROM.
  • the program code can be downloaded from the server computer by the communication network.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Health & Medical Sciences (AREA)
  • Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • General Physics & Mathematics (AREA)
  • General Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • Storage Device Security (AREA)
  • Information Transfer Between Computers (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)

Abstract

本申请提出了一种数据共享方法，包括：根据密钥对一份明文数据进行加密得到一份加密数据；将所述加密数据上传至信息共享系统的一个区块中，所述信息共享系统为区块链系统；将所述密钥的第一部分上传至所述信息共享系统对应的授权访问服务器；从所述授权访问服务器接收所述加密数据对应的授权码；当授权一个用户访问所述加密数据时，将所述授权码和所述密钥的第二部分发送给所述用户的第二客户端，所述密钥的第二部分包括所述密钥中除所述第一部分之外的剩余部分。本申请还提出了相应的客户端、服务器、计算设备及存储介质。

Description

数据共享方法、客户端、服务器、计算设备及存储介质
本申请要求于2017年11月02日提交中国专利局、申请号为201711065783.1、名称为“数据共享方法、客户端、服务器、计算设备及存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及计算机技术领域，特别涉及数据共享方法、客户端、服务器、计算设备及存储介质。
背景
随着互联网技术的发展，出现了一些信息共享系统，用户可以将自身持有的一些数据(比如：图片、文档、视频等文件)上传到信息共享系统，并可授权其它用户通过信息共享系统来访问这些数据。
那么，信息共享系统需要采用以下技术手段来保障这些数据的安全，比如在某个用户请求访问某个文件时，对此用户提供的信息进行验证。
技术内容
本申请实施例提出了一种数据共享方法，由第一客户端执行，包括：根据密钥对一份明文数据进行加密得到一份加密数据；将所述加密数据上传至信息共享系统的一个区块中，所述信息共享系统为区块链系统；将所述密钥的第一部分上传至所述信息共享系统对应的授权访问服务器；从所述授权访问服务器接收所述加密数据对应的授权码； 当授权一个用户访问所述加密数据时，将所述授权码和所述密钥的第二部分发送给所述用户的第二客户端，所述密钥的第二部分包括所述密钥中除所述第一部分之外的剩余部分，以使所述第二客户端当发送针对所述加密数据的访问请求至所述授权访问服务器时，在所述访问请求中携带所述授权码和所述密钥的所述第二部分，以便所述授权访问服务器在确定所述授权码可用时根据所述密钥的所述第一部分和所述第二部分生成所述密钥，根据所生成的所述密钥对从所述信息共享系统的所述区块中获取的所述加密数据进行解密而得到所述明文数据并返回给所述第二客户端。
本申请实施例还提出了一种数据共享方法，包括：从第一客户端接收第一密钥的第一部分，所述第一密钥对应于一份上传到信息共享系统的一个区块中的加密数据，所述加密数据为根据所述第一密钥对一份明文数据进行加密处理而获得的，所述信息共享系统为区块链系统；生成所述加密数据对应的第一授权码；将所述第一授权码发送给所述第一客户端，以使所述第一客户端在授权第二客户端访问所述加密数据时将所述第一授权码和所述第一密钥的第二部分发送给所述第二客户端，以便所述第二客户端在访问所述加密数据时将所述第一授权码和所述第一密钥的所述第二部分携带在访问请求中，所述第一密钥的第二部分包括所述第一密钥中除所述第一部分之外的剩余部分；当接收到来自任一客户端的对于所述加密数据的访问请求时，所述方法还包括：从所述访问请求中获取第二授权码和一个不完整密钥；当所述第二授权码与所述第一授权码相同并且所述第二授权码可用时，根据所述不完整密钥和所述加密数据对应的所述第一密钥的第一部分生成第二密钥，其中，当所述不完整密钥与所述第一密钥的第二部分相同时，所生成的所述第二密钥与所述第一密钥相同；从所述信 息共享系统的所述区块中获取所述加密数据；根据所述第二密钥对所述加密数据进行解密处理，其中，当所述第二密钥与所述第一密钥相同时，解密得到所述明文数据并将其发送给发送所述访问请求的所述客户端。
本申请实施例提出了一种第一客户端，包括：加密模块，根据密钥对一份明文数据进行加密得到一份加密数据；上传模块，将所述加密数据上传至信息共享系统的一个区块中，所述信息共享系统为区块链系统，将所述密钥的第一部分上传至所述信息共享系统对应的授权访问服务器；授权模块，从所述授权访问服务器接收所述加密数据对应的授权码；当授权一个用户访问所述加密数据时，将所述授权码和所述密钥的第二部分发送给第二客户端，所述密钥的第二部分包括所述密钥中除所述第一部分之外的剩余部分，以使所述第二客户端当发送针对所述加密数据的访问请求至所述授权访问服务器时，在所述访问请求中携带所述授权码和所述密钥的所述第二部分，以便所述授权访问服务器在确定所述授权码可用时根据所述密钥的所述第一部分和所述第二部分生成所述密钥，根据所生成的所述密钥对从所述信息共享系统的所述区块中获取的所述加密数据进行解密而得到所述明文数据并返回给所述第二客户端。
本申请实施例提出了一种授权访问服务器，包括：授权模块，从第一客户端接收第一密钥的第一部分，所述第一密钥对应于一份上传到信息共享系统的一个区块中的加密数据，所述加密数据为根据所述第一密钥对一份明文数据进行加密处理而获得的，所述信息共享系统为区块链系统；生成所述加密数据对应的第一授权码；将所述第一授权码发送给所述第一客户端，以使所述第一客户端在授权第二客户端 访问所述加密数据时将所述第一授权码和所述第一密钥的第二部分发送给所述第二客户端，以便所述第二客户端在访问所述加密数据时将所述第一授权码和所述第一密钥的所述第二部分携带在访问请求中，所述第一密钥的第二部分包括所述第一密钥中除所述第一部分之外的剩余部分；验证模块，当接收到来自任一客户端的对于所述加密数据的访问请求时，从所述访问请求中获取第二授权码和一个不完整密钥；当所述第二授权码与所述第一授权码相同并且所述第二授权码可用时，触发密钥模块；所述密钥模块，根据所述不完整密钥和所述加密数据对应的所述第一密钥的第一部分生成第二密钥，其中，当所述不完整密钥与所述第一密钥的第二部分相同时，所生成的所述第二密钥与所述第一密钥相同；解密模块，从所述信息共享系统的所述区块中获取所述加密数据；根据所述第二密钥对所述加密数据进行解密处理，其中，当所述第二密钥与所述第一密钥相同时，解密得到所述明文数据并将其发送给发送所述访问请求的所述客户端。
本申请实施例还提出了一种计算设备，包括：一个或多个处理器；存储器；以及一个或多个程序，存储在该存储器中并被配置为由所述一个或多个处理器执行，所述一个或多个程序包括用于执行上述方法的指令。
本申请实施例还提出了一种存储介质，存储有一个或多个程序，所述一个或多个程序包括指令，所述指令当由计算设备执行时，使得所述计算设备执行上述方法。
附图说明
为了更清楚的说明本申请实施例中的技术方案，下面将对实施例 描述中所需要使用的附图作简单的介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实例，对于本领域普通技术人员来说，在不付出创造性劳动的前提下，还可以根据这些附图获得其它的附图。其中，
图1为本申请实例涉及的系统构架图；
图2为本申请实例的方法流程图；
图3为本申请实例的方法流程图；
图4为本申请实例的消息交互图；
图5为本申请实例的用户界面图；
图6为本申请实例的用户界面图；
图7为本申请实例中客户端的结构示意图；
图8为本申请实例中服务器的结构示意图；及
图9为本申请实例中计算设备的组成结构示意图。
实施方式
下面为了描述上的简洁和直观，下文通过描述若干代表性的实施例来对本发明的方案进行阐述。但本文并未示出所有实施方式。实施例中大量的细节仅用于帮助理解本发明的方案，本发明的技术方案实现时可以不局限于这些细节。为了避免不必要地模糊了本发明的方案，一些实施方式没有进行细致地描述，而是仅给出了框架。下文中，“包括”是指“包括但不限于”，“根据……”是指“至少根据……，但不限于仅根据……”。说明书和权利要求书中的“包括”是指某种程度上至少包括，应当解释为除了包括之后提到的特征外，其它特征也可以存在。
本申请实施例提出了一种数据共享方法，该方法可应用于图1所 示的系统构架中。如图1所示，该系统构架包括：第一客户端101、第二客户端102、授权访问服务器103和信息共享系统104，这些实体可以通过互联网105进行通信。其中，信息共享系统104用于保存用户上传的各种数据，用户也可访问信息共享系统104中的数据。在实际的网络中，会有大量的客户端101/102，对于被上传到信息共享系统104中的一份数据而言，其对应一个第一客户端101，是这份数据的持有者和上传者所使用的客户端，也叫共享者客户端，而这份数据还对应一个或多个第二客户端102，是请求访问这份数据的用户使用的客户端，也叫访问者客户端或者查阅者客户端。授权访问服务器103可直接连接或者通过互联网105连接信息共享系统104，用于提供对于信息共享系统104的访问服务(具体可称为授权查阅服务)。第二客户端102通过授权访问服务器103从信息共享系统104获取其想访问的数据，具体的，第二客户端102向授权访问服务器103发送针对某份数据的访问请求(具体可称为查阅请求)，授权访问服务器103对此访问请求进行鉴权，以验证第二客户端102对应的用户是否有权访问此份数据(比如验证访问请求中的授权码)，在鉴权通过的情况下，根据访问请求中携带的密钥信息对从信息共享系统104获得的加密数据进行解密处理，如果能成功获得解密之后的明文数据，则将此明文数据返回给第二客户端102。
这里，第一客户端101和第二客户端102可以为各种可访问共享数据的APP客户端或者浏览器，第一客户端101和第二客户端102可运行在各种终端设备上，包括：PC机、手机、平板电脑、掌上电脑、超极本、可穿戴设备等。信息共享系统104可以是各种集中或分布式的数据存储系统，包括但不仅限于：区块链系统(或称区块链网络)、数据库系统、网盘/云盘系统等。信息共享系统104中存储 的数据可涉及多种业务场景中产生的数据，包括：数字资产、鉴证服务、共享账本、共享经济等场景。
其中，数字资产(Digital assets)是指企业拥有或控制的，以电子数据的形式存在的，在日常活动中持有以备出售或处在生产过程中的非货币性资产。数字资产的产生得益于办公自动化，数字资产依托电子支付系统而发展，用于共享积分、优惠券、数字货币、股权登记等场景。鉴证服务是用于版权/所有权保护、司法文件保全、公益捐赠、个人及企业证明等业务场景。共享账本是用于机构间清算、银行保理、机构间联合贷款、供应链金融、跨境汇款等业务场景。区块链是一种按照时间顺序将数据区块以顺序相连的方式组合成的一种链式数据结构,并以密码学方式保证的不可篡改和不可伪造的分布式账本。区块链系统是一种全新的分布式基础架构，其利用块链式数据结构来验证与存储数据，利用分布式节点共识算法来生成和更新数据，利用密码学的方式保证数据传输和访问的安全，利用由自动化脚本代码组成的智能合约来编程和操作数据的。
在一些业务场景中，上传到信息共享系统104中的数据需要加密，并且要对数据访问加以授权，也就是说有些数据是有条件共享的，这些数据可被称为用户隐私数据，例如：个人或机构的实名认证信息、金融账户信息、相册、原创作品、需要共享鉴证的信息等等，对于这些数据，用户既想共享又不想将内容公之于众，但又能做到在特定人之间共享，因此，会将数据加密保存在信息共享系统中104，然后授权给特定用户进行查阅。
本申请实例提供了一种数据共享方法，其可应用于终端设备中的第一客户端101。图1中仅示出了一个第一客户端101，在实际的应用场景中，第一客户端101可以有多个，甚至是海量，每一第一客户 端101都可实现此方法。如图2所示，此方法流程200包括如下步骤：
步骤201：第一客户端101根据密钥对一份明文数据进行加密得到一份加密数据。
步骤202：第一客户端101将所述加密数据上传至信息共享系统104的一个区块中，所述信息共享系统为区块链系统。
这里，用户想要上传一份数据时，其所使用的第一客户端101会使用预先设置的密钥对这份数据(即明文数据)进行加密，再将加密数据上传到信息共享系统104中。
步骤203：第一客户端101将所述密钥的第一部分上传至信息共享系统104对应的授权访问服务器103。
这里，信息共享系统104对应的授权访问服务器103就是指其连接的授权访问服务器103。
这里，密钥是一个字符串，可以将作为密钥的这个字符串分割成两个字符串，分别作为密钥的第一部分和第二部分，在本步骤中，将密钥的第一部分上传到授权访问服务器103。在一些实例中，可以将密钥的前半部作为第一部分，而将密钥的后半部作为第二部分。在另一些实例中，可以将密钥的后半部作为第一部分，而将密钥的前半部作为第二部分。其中，第一部分和第二部分的长度可以相同，也可以不同。在一些实例中，分割密钥时，可以按预先设定的字符串长度值(即设定字符串包含的字符数目)分割出相应长度的字符串作为密钥的第一部分，然后将剩余的字符串作为密钥的第二部分。
步骤204：第一客户端101从授权访问服务器103接收所述加密数据对应的授权码。
在一些实例中，授权访问服务器103在收到第一客户端101上传的针对某份加密数据的密钥的第一部分时，会为此份加密数据生成授 权码，再将此授权码返回给第一客户端101。具体的，授权访问服务器103可以按此份数据的上传用户对应的规则来生成授权码。
步骤205：当授权一个用户访问所述加密数据时，第一客户端101将所述授权码和所述密钥的第二部分发送给所述用户的客户端(即对应的第二客户端102)，所述密钥的第二部分包括所述密钥中除所述第一部分之外的剩余部分，以使第二客户端102当发送针对所述加密数据的访问请求至授权访问服务器103时，在所述访问请求中携带所述授权码和所述密钥的所述第二部分。
这样，授权访问服务器103在确定所述授权码可用时根据所述密钥的所述第一部分和所述第二部分生成所述密钥，根据所生成的所述密钥对从信息共享系统104的所述区块中获取的所述加密数据进行解密处理，并将解密得到的所述明文数据提供给第二客户端102。
在一些实例中，当某个用户向查阅此加密数据时，会通过其使用的第二客户端103向第一客户端101请求授权码，第一客户端101确定授权此用户查阅数据时，会将此授权码和上述密钥的第二部分发送给第二客户端102。
在一些实例中，授权访问服务器103可将密钥的第一部分和第二部分拼接起来即可组合成完整的所述密钥。如果授权访问服务器103从第二客户端102获得的密钥的第二部分与从第一客户端101获得的密钥的第一部分不属于同一个密钥，则无法拼接成一个正确的密钥，进而解密就会失败，第二客户端102则无法获得明文数据。授权访问服务器103可以向第二客户端102返回失败响应，或者返回加密数据。这样，第二客户端102就不能成功查阅到数据的内容，从而有效保障了第一客户端101上传的数据的安全。
采用上述实例提供的方法，第一客户端101持有密钥和授权码， 授权访问服务器103持有授权码和密钥的第一部分，第二客户端102在获得授权时可持有密钥的第二部分和授权码，这样，当第二客户端102通过授权访问服务器103请求访问相应的数据时，授权访问服务器103可首先验证授权码是否可用，在授权码可用的情况下，再利用从第一客户端101和第二客户端102分别获得的不完整密钥(密钥的第一部分和第二部分)获得完整密钥，如果第二客户端102的提供的不完整密钥有问题，则无法获得正确的完整密钥，就无法对加密数据成功解密，从而保障了数据的安全。在此方案中，第二客户端102和授权访问服务器103分别持有密钥的一部分，二者都不具有访问加密数据的权限，只有二者持有的密钥信息合并在一起时才能获得完整密钥，从而有效保障了数据安全和用户隐私。这样对于信息共享系统104中保存的用户不想公开的加密数据，通过授权访问服务器103，第一客户端101可以授权某些第二客户端102来访问加密数据的明文，从而在信息共享和隐私保护中达到了平衡，提供了一种更优的信息共享机制。
上述实例可以应用于区块链的数据共享场景中。授权访问服务器103提供了一种隐私数据授权查阅的服务，属于为共享信息系统中的区块链提供的一个针对数据隐私保护的可选服务，可以应用于信息共享区块链、数字资产区块链等场景中，在保护用户不想公开的数据的同时，还可通过独立授权的方式给某部分人查阅。因为区块链是以共享为原则，所有用户都可以自由查阅上面的数据，此时无论是否被授权，用户都能自由查阅，但只有授权访问服务器103通过查阅出来的数据是解密的明文数据，如果某个用户直接在区块链上查阅，所得的是加密数据，无法得到明文数据。
在一些实例中，步骤204中，第一客户端101在收到授权码之后 可进一步生成所述加密数据的访问令牌(也可称为数据查阅令牌)，该访问令牌包含所述授权码和所述密钥的所述第二部分。步骤205中，所述将所述授权码和所述密钥的第二部分发送给所述第二客户端102的步骤具体可包括：将所述访问令牌发送给所述第二客户端102，以使所述第二客户端102在所述访问请求中携带所述访问令牌。这样，第一客户端101就将授权码和密钥的第二部分发送给第二客户端102了。这里，授权码和密钥都可以是一个数字和/或字符组成的字符串，由授权码和密钥的第二部分组成的访问令牌可以是一个数字和/或字符组成的字符串。在此实例中，第一客户端101可以通过向第二客户端102发放令牌来授权相应的用户来访问其上传的加密数据，并且所发放的令牌中并没有完整密钥，需要到授权访问服务器103中做进一步验证才能获得完整密钥而进行解密处理，从而能有效保障数据安全。
在一些实例中，步骤202中，当将所述加密数据上传至信息共享系统104时，第一客户端101进一步上传所述加密数据的文件标识及其持有者的用户标识(通常是当前使用第一客户端101的用户标识)，以使信息共享系统104将所述加密数据与所述文件标识和所述持有者的用户标识相关联，以便授权访问服务器103根据所述文件标识和所述持有者的用户标识从信息共享系统104获取所述加密数据。这里，在上传一份加密数据时，其文件标识和持有者的用户标识会同时传到信息共享系统104，信息共享系统104在保存此份加密数据时会将其与文件标识和持有者的用户标识相关联。授权访问服务器103在从信息共享系统104中查询某份加密数据时，会在查询请求中携带文件标识及持有者的用户标识，这样，信息共享服务器104可确定与文件标识及持有者的用户标识相关联的加密数据并返回给授权访问服务器103。
在一些实例中，步骤203中，当将所述密钥的所述第一部分上传至授权访问服务器104时，第一客户端101进一步上传所述文件标识和所述持有者的用户标识，以使授权访问服务器103根据所述持有者的用户标识对应的规则生成所述授权码，并将所述授权码与所述密钥的所述第一部分、所述文件标识和所述持有者的用户标识相关联。授权访问服务器103在收到所述访问请求时可根据其中携带的所述文件标识和所述持有者的用户标识获取相关联的所述授权码和所述密钥的所述第一部分(可以是授权访问服务器103在本地维护的所述加密数据对应授权码和密钥的第一部分)，以便根据获取的所述授权码确定所述访问请求携带的所述授权码是否可用，根据获取的所述密钥的所述第一部分和所述访问请求携带的所述第二部分生成所述密钥。
在一些实例中，授权访问服务器103中预先配置有针对各个用户的用于生成授权码的规则，此规则可以指定所生成的授权码允许访问的数据地址、失效时间等等。上述的数据地址可以是如区块链中的区块高度、统一资源定位符(URL)地址等。在一些实例中，步骤203中，当第一客户端101上传密钥的第一部分时，授权访问服务器104可以根据同时上传的加密数据持有者的用户标识确定生成授权码所用的规则。之后，授权访问服务器103在收到访问请求时，可从本地查询到当前请求访问的加密数据对应的授权码(即文件标识和持有者的用户标识关联的授权码)，如果访问请求中携带的授权码与从本地查询到的授权码一致，则说明访问请求中携带的授权码是合法的，进一步的还可验证授权码是否过期(比如是否到达失效时间或者是否还在有效使用日期内)、和/或验证当前请求访问的加密数据的地址是否属于授权码对应的允许访问的数据地址(比如：在区块链场景下，验证当前请求查阅的数据的区块高度是否为授权码对应的允许访问的 区块高度。又比如：在共享照片场景下，验证当前请求查阅的相册文件夹是否为授权码允许访问的文件夹。)。在验证通过时，确定授权码可用。在一些区块链场景下的实例中，第二客户端102发出的访问请求可携带要查阅的数据的文件标识，授权访问服务器103可根据文件标识确定数据所在的区块高度，进而可验证所确定的此数据的区块高度是否为授权码对应的允许访问的区块高度。在另一些实例中，第二客户端102发出的访问请求可直接携带数据的区块高度，授权访问服务器103可验证访问请求携带的区块高度是否为授权码对应的允许访问的区块高度。
在确定授权码可用时，可采用获取的与文件标识和持有者的用户标识相关联的密钥的第一部分与访问请求携带的密钥的第二部分来组合成完整的密钥。这种组合方式可以是简单的将两个部分拼接起来。
在一些实例中，步骤204中，第一客户端101在收到授权码时，可进一步生成包含所述授权码和所述密钥的所述第二部分的所述加密数据的访问令牌，将所述访问令牌与所述文件标识相关联。步骤205中，所述将所述授权码和所述密钥的第二部分发送给第二客户端102可具体包括：将与所述文件标识相关联的所述访问令牌发送给第二客户端102，以使第二客户端102在所述访问请求中携带所述访问令牌。
这里，第一客户端101中维护着一个或多个访问令牌，第一客户端101上传的每一份数据都会对应一个访问令牌，即每一个文件标识会关联一个访问令牌。这样，当第二客户端102向第一客户端101请求数据访问授权时，如果第一客户端101同意授权，第一客户端101可以确定对应的访问令牌，并将此访问令牌发放给第二客户端102。其中，第二客户端102可能请求对于某份数据或者对于符合一定条件的数据集合或者对于所有数据的访问授权，第一客户端101可以将对 应的一个或多个访问令牌发送给第二客户端102。
在一些实例中，在步骤204之后，可进一步包括：第一客户端101向授权访问服务器103发送针对所述授权码的取消请求，以使授权访问服务器103令所述授权码失效。同时，第一客户端101也令本地的所述授权码失效。其中，针对某个授权码的取消请求可携带其对应的文件标识，授权访问服务器103根据文件标识可以确定其所对应的授权码，进而可以使此授权码失效，比如：设置其状态为失效或者清除此授权码等等。授权访问服务器103在令所述授权码失效后可给第一客户端101返回响应，第一客户端101在收到响应时令本地的授权码失效，从而完成取消此授权码的整个过程。
这样，第一客户端101不仅能令授权访问服务器103为上传的数据生成授权码，还能请求授权访问服务器103取消此授权码，当授权码被取消后，如有第二客户端102请求访问数据时使用此授权码或者包含此授权码的访问令牌，则该授权码会被验证为不可用，从而访问请求会被拒绝，第二客户端102无法访问到此数据，或者只能获取加密数据而无法得到解密后的明文数据。这就形成了一种数据访问的动态授权方式，共享某份数据的用户根据需要可以取消对应的授权码，进而使得原来得到授权码能够访问此份数据的用户不能再访问此份数据。
在一些实例中，在取消了某份加密数据的授权码之后，第一客户端101可进一步向授权访问服务器103发送针对此份加密数据的生成授权码请求，以使授权访问服务器103生成此加密数据对应的新授权码，之后，第一客户端101从授权访问服务器103接收此加密数据对应的新授权码。这样，用户不仅能随时取消授权码，使得之前授权的用户无法访问到加密数据的明文，还能请求生成新的授权码，以重新 授权用户访问加密数据的明文，实现了灵活的数据访问授权。
在一些实例中，第一客户端101在获得授权码之后，还能请求授权访问服务器103更新授权码。此时，第一客户端101获得的授权码还未被删除，或者还未被使用过。其中，第一客户端101向授权访问服务器103发送针对某份加密数据的更新授权码请求，以使授权访问服务器103生成此份加密数据对应的新的授权码，并用此新的授权码替代之前的授权码；之后，第一客户端101从授权访问服务器103接收此新的授权码，并用此新的授权码替代之前的授权码。这样，通过一个授权码更新过程，第一客户端101可以取消之前的授权码，使之前获得授权的用户无法访问加密数据的明文，同时可获得新的授权码，可以在后续对一些用户进行授权。
在一些实例中，上述授权码的取消请求、生成授权码请求和更新授权码请求可以并存，用户可以根据需要选择取消授权码、生成新的授权码或者更新授权码，从而实现了一种更完善的动态授权方案。
本申请实例提供了一种数据共享方法，其可应用于授权访问服务器103。如图3所示，此方法流程300包括如下步骤：
步骤301：从第一客户101接收第一密钥的第一部分，所述第一密钥对应于一份上传到信息共享系统104的一个区块中的加密数据，所述加密数据为根据所述第一密钥对一份明文数据进行加密处理而获得的，所述信息共享系统为区块链系统。
步骤302：生成所述加密数据对应的第一授权码。
步骤303：将所述第一授权码发送给第一客户端101，以使第一客户端101在授权第二客户端102访问所述加密数据时将所述第一授权码和所述第一密钥的第二部分发送给第二客户端102，以便第二客户端102在访问所述加密数据时将所述第一授权码和所述第一密钥的 所述第二部分携带在访问请求中，所述第一密钥的第二部分包括所述第一密钥中除所述第一部分之外的剩余部分。
步骤304：当接收到来自任一客户端(可能是上述获得授权的第二客户端102也可能是其它未获得授权的客户端)的对于所述加密数据的访问请求时，执行以下步骤：
步骤305：从所述访问请求中获取第二授权码和一个不完整密钥。
步骤306：当所述第二授权码与所述第一授权码相同并且所述第二授权码可用时，根据所述不完整密钥和所述加密数据对应的所述第一密钥的第一部分生成第二密钥，其中，当所述不完整密钥与所述第一密钥的第二部分相同时，所生成的所述第二密钥与所述第一密钥相同。
步骤307：从信息共享系统104的所述区块中获取所述加密数据。根据所述第二密钥对所述加密数据进行解密处理，其中，当所述第二密钥与所述第一密钥相同时，解密得到所述明文数据并将其发送给发送所述访问请求的所述客户端。
采用上述实例提供的方法，第一客户端101持有密钥和授权码，授权访问服务器103持有授权码和密钥的第一部分，第二客户端102在获得授权时可持有密钥的第二部分和授权码，这样，当某个客户端(可能是获得授权的第二客户端102也可能是其它客户端)通过授权访问服务器103请求访问相应的数据时，授权访问服务器103可首先验证授权码是否可用，在授权码可用的情况下，再利用从第一客户端101和此客户端分别获得的不完整密钥(密钥的第一部分和第二部分)获得完整密钥，如果此客户端的提供的不完整密钥有问题，则无法获得正确的完整密钥，就无法对加密数据成功解密，从而保障了数据的安全。在此方案中，获得授权的第二客户端102和授权访问服务器103 分别持有密钥的一部分，二者都不具有访问加密数据的权限，只有二者持有的密钥信息合并在一起时才能获得完整密钥，从而有效保障了数据安全和用户隐私。这样对于信息共享系统104中保存的用户不想公开的加密数据，通过授权访问服务器103，第一客户端101可以授权某些第二客户端102来访问加密数据的明文，从而在信息共享和隐私保护中达到了平衡，提供了一种更优的信息共享机制。
在一些实例中，步骤305中，所述从所述访问请求中获取第二授权码和一个不完整密钥的步骤具体可包括：从所述访问请求中获取所述加密数据的访问令牌；及从所述访问令牌中获得所述第二授权码和所述不完整密钥。
在一些实例中，步骤301中，当从所述第一客户端接收所述密钥的所述第一部分时，授权访问服务器103进一步接收文件标识和所述加密数据的持有者的用户标识。步骤302中，所述生成所述加密数据对应的第一授权码的步骤具体可包括：根据所述持有者的用户标识对应的规则生成所述授权码，并将所述授权码与所述密钥的所述第一部分、所述文件标识和所述持有者的用户标识相关联；当收到所述访问请求时，根据所述访问请求携带的文件标识和持有者的用户标识获取相关联的所述授权码和所述密钥的所述第一部分。
在一些实例中，所述区块对应一个区块高度。步骤302中，所生成的所述第一授权码对应允许访问的区块高度和/或过期时间。步骤306中，当所述第二授权码与所述第一授权码相同时，获取所述第二授权码对应的允许访问的区块高度和/或过期时间。当所述访问请求针对的所述加密数据的区块高度与所述第二授权码对应的所述允许访问的区块高度相匹配和/或所述第二授权码未达到所述过期时间时，确定所述第二授权码可用。
在一些实例中，可进一步包括：响应于来自第一客户端101的针对所述授权码的取消请求，令所述授权码失效。授权访问服务器103在令所述授权码失效后可给第一客户端101返回响应，第一客户端101在收到响应时令本地的授权码失效，从而完成取消此授权码的整个过程。这样，用户可根据需要取消针对某些数据的授权码，以取消针对某些用户或数据的分享，比如：之前获得一份数据的授权码的第二客户端102，如果此授权码失效，则第二客户端102再使用此授权码请求访问此数据时，此授权码会被验证为不可用，而无法访问到此数据。
在一些实例中，可进一步包括：响应于来自第一客户端101的针对所述加密数据的生成授权码请求，生成所述加密数据对应的新授权码；向第一客户端101发送所述加密数据对应的所述新授权码。这样，用户在取消了某份数据的授权码之后，还能请求新的授权码，以重新授权一些用户访问此数据，实现了灵活的数据访问授权。
在一些实例中，可进一步包括：响应于来自第一客户端101的针对所述加密数据的更新授权码请求，生成所述加密数据对应的新授权码，并用所述新授权码替代之前的所述第一授权码。向第一客户端101发送所述加密数据对应的所述新授权码，以使其用所述新授权码替代之前的所述第一授权码。
图4示出了本申请一实施例中的消息交互流程。如图4所示，该流程至少涉及第一客户端101、第二客户端102、授权访问服务器103和信息共享系统104这四种实体，可包括如下处理步骤：
步骤401：第一客户端101持有加密密钥，对欲上传信息共享系统104的数据进行加密处理，得到一份加密数据。
第一客户端101将该加密数据上传到信息共享系统104，在上传 加密数据时还将与该加密数据关联的其持有者的用户标识、文件标识发送到信息共享系统104。比如：第一客户端101可向信息共享系统104发送一个数据上传请求，该请求中携带持有者的用户标识、文件标识和加密数据。其中，所述持有者的用户标识为第一客户端101当前登录用户的标识，例如：QQ号、云盘账号、区块链系统的账号等；文件标识用于标识加密数据。
信息共享系统104可以保存第一客户端101上传的加密数据，并将其与持有者的用户标识和文件标识相关联，以便将此加密数据保存在持有者的用户标识对应的目录下，并用文件标识来标识该加密数据。
在图5的场景下，第一客户端101是一种网盘客户端，信息共享系统为104为云端的网盘服务器(或简称云盘服务器)。用户使用此网盘客户端可上传照片、视频等文件。比如：点击控件501可上传照片，点击控件502可上传视频。如果用户想保证上传照片和视频的私密性，可设置网盘客户端对上传的数据进行加密，这样，网盘客户端就会执行上述步骤401的加密处理，
步骤402：第一客户端101将步骤401加密所用的密钥的前半部(可称为密钥前半部)上传给授权访问服务器103，还将与该加密数据关联的持有者的用户标识发送给授权访问服务器。比如：第一客户端101可向授权访问服务器103发送密钥上传请求，该请求中携带加密数据的持有者的用户标识和密钥前半部。
授权访问服务器103根据所述持有者的用户标识对应的规则，生成授权码，并将授权码与密钥前半部和所述持有者的用户标识相关联，之后将授权码返回给第一客户端101。
步骤403：第一客户端101将步骤401加密所用的密钥的后半部(可称为密钥后半部)和接收到的授权码组合成数据查阅令牌，并将 此数据查阅令牌与前述加密数据的文件标识相关联。
当第一客户端101授权第二客户端102可查阅上述加密数据的明文数据时，可将上述数据查阅令牌提供给第二客户端102。比如：第二客户端102向第一客户端101请求对于某份数据的查阅授权，会向第一客户端101发送携带目标文件信息的授权请求，第一客户端101根据目标文件信息可以确定第二客户端102想查阅的数据集合对应的文件标识集合。该目标文件信息可以包括文件标识，也可以是一个文件夹的标识或者目录地址等等，第一客户端101可以确定相应的文件标识集合，进而可通过文件标识集合确定关联的数据查阅令牌。这里，一个文件标识集合(一个或多个文件标识)可以关联一个数据查阅令牌，代表第一客户端101将一个文件集合批量授权给第二客户端102查；一个文件标识集合也可以关联多个数据查阅令牌，其中不同的文件标识关联不同的数据查阅令牌，代表第一客户端101针对每个文件分别给第二客户端102提供数据查阅令牌。
步骤404：第二客户端102持有上述数据查阅令牌之后，向授权访问服务器103发出查阅请求，该请求携带上述加密数据的持有者的用户标识、文件标识和此数据查阅令牌。
在图6的场景下，第二客户端102是一种访问区块链页面的浏览器，信息共享系统为104为区块链系统。用户通过访问区块链页面可查看各种信息，而有些信息是具有私密性的，用户在具有数据查阅令牌时才能查阅到明文数据。比如：用户可点击控件601，则可执行步骤404以发出查阅请求。如果查阅请求携带的数据查阅令牌包含正确可用的授权码和正确的密钥后半部，则浏览器可展示包含“详情”项对应的明文数据的第二页面。
步骤405：授权访问服务器103从接收到的查阅请求中提取数据 查阅令牌、上述持有者的用户标识和文件标识，从数据查阅令牌中提取授权码，确定该授权码是否可用。这里，授权访问服务器103确定授权码是否可用包括两方面：一、从数据查阅令牌中提取的授权码是否与本地保存的该持有者的用户标识关联的授权码相同，如果从数据查阅令牌中提取的授权码与从本地查询到的授权码一致，则说明数据查阅令牌中携带的授权码是合法的；二、如果确定这两个授权码相同，则进一步验证授权码是否过期(比如是否到达失效时间或者是否还在有效使用日期内)、和/或验证当前请求查阅的加密数据的地址是否属于授权码对应的允许访问的数据地址。
如果确定该授权码可用，授权访问服务器103获取与授权码关联的密钥前半部，从数据查阅令牌中提取密钥后半部，将密钥前半部和密钥后半部组合成一个完整密钥。
授权访问服务器103还向信息共享系统104发送查询请求，该请求携带上述持有者的用户标识和文件标识，使得信息共享服务器104根据此持有者的用户标识和文件标识查询到关联的加密数据再返回给授权访问服务器103。
步骤406：使用步骤405获得的完整密钥对加密数据进行解密处理。如果数据查阅令牌中提取的密钥后半部是准确的，则在步骤405可以获得准确的完整密钥，则本步骤中可以成功解密得到解密数据(即明文数据)，并将解密数据返回给第二客户端102。如果数据查阅令牌中提取的密钥后半部是错误的，则步骤405获得的密钥是错误的，本步骤中就无法成功解密。此种情况下，可以向第二客户端102报错，也可以直接返回一份加密数据给第二客户端102，总之，第二客户端102无法成功查阅到明文数据，进而保证了第一客户端101上传的数据的安全。
上述各个步骤中的任一步骤在处理失败时，都可直接结束本流程。
基于上述方法实例，本申请实施例还提出了一种可实现前述方法的客户端(可以为第一客户端101)。如图7所示，第一客户端700包括以下模块：
加密模块701，根据密钥对一份明文数据进行加密得到一份加密数据。
上传模块702，将所述加密数据上传至信息共享系统104的一个区块中，所述信息共享系统为区块链系统，将所述密钥的第一部分上传至所述信息共享系统104对应的授权访问服务器103。
授权模块703，从所述授权访问服务器103接收所述加密数据对应的授权码；当授权一个用户访问所述加密数据时，将所述授权码和所述密钥的第二部分发送给第二客户端102，所述密钥的第二部分包括所述密钥中除所述第一部分之外的剩余部分，以使所述第二客户端102当发送针对所述加密数据的访问请求至所述授权访问服务器时，在所述访问请求中携带所述授权码和所述密钥的所述第二部分，以便所述授权访问服务器103在确定所述授权码可用时根据所述密钥的所述第一部分和所述第二部分生成所述密钥，根据所生成的所述密钥对从所述信息共享系统104的所述区块中获取的所述加密数据进行解密而得到所述明文数据并返回给所述第二客户端102。
在一些实例中，授权模块703，进一步生成所述加密数据的访问令牌，所述访问令牌包含所述授权码和所述密钥的所述第二部分；其中，所述授权模块703将所述访问令牌发送给所述第二客户端102，以使所述第二客户端102在所述访问请求中携带所述访问令牌。
在一些实例中，当将所述加密数据上传至所述信息共享系统104时，所述上传模块702进一步上传所述加密数据的文件标识及其持有 者的用户标识，以使所述信息共享系统104将所述加密数据与所述文件标识和所述持有者的用户标识相关联，以便所述授权访问服务器103根据所述文件标识和所述持有者的用户标识从所述信息共享系统104获取所述加密数据。
在一些实例中，当将所述密钥的所述第一部分上传至所述授权访问服务器103时，所述上传模块702进一步上传所述文件标识和所述持有者的用户标识，以使所述授权访问服务器103根据所述持有者的用户标识对应的规则生成所述授权码，并将所述授权码与所述密钥的所述第一部分、所述文件标识和所述持有者的用户标识相关联，在收到所述访问请求时根据其中携带的所述文件标识和所述持有者的用户标识获取相关联的所述授权码和所述密钥的所述第一部分，以便根据获取的所述授权码确定所述访问请求携带的所述授权码是否可用，根据获取的所述密钥的所述第一部分和所述访问请求携带的所述第二部分生成所述密钥。
在一些实例中，所述授权模块703进一步生成包含所述授权码和所述密钥的所述第二部分的所述加密数据的访问令牌，将所述访问令牌与所述文件标识相关联；其中，所述授权模块703将与所述文件标识相关联的所述访问令牌发送给所述第二客户端102，以使所述第二客户端102在所述访问请求中携带所述访问令牌。
在一些实例中，所述授权模块703进一步向所述授权访问服务器103发送针对所述授权码的取消请求，以使所述授权访问服务器103令所述授权码失效；所述授权模块703还令本地的所述授权码失效。
在一些实例中，所述授权模块703向所述授权访问服务器103发送针对所述加密数据的生成授权码请求，以使所述授权访问服务器103生成所述加密数据对应的新授权码；所述授权模块703还从所述 授权访问服务103器接收所述加密数据对应的所述新授权码。
在一些实例中，所述授权模块703进一步向所述授权访问服务器103发送针对所述加密数据的更新授权码请求，以使所述授权访问服务器103生成所述加密数据对应的新授权码，并用所述新授权码替代之前的所述授权码；所述授权模块703还从所述授权访问服务器103接收所述新授权码，并用所述新授权码替代之前的所述授权码。
基于上述方法实例，本申请实施例还提出了一种可实现前述方法的授权访问服务器(如前述的授权访问服务器103)。如图8所示，该服务器800可包括以下模块：
授权模块801，从第一客户端101接收第一密钥的第一部分，所述第一密钥对应于一份上传到信息共享系统104的一个区块中的加密数据，所述加密数据为根据所述第一密钥对一份明文数据进行加密处理而获得的，所述信息共享系统为区块链系统；生成所述加密数据对应的第一授权码；将所述第一授权码发送给所述第一客户端101，以使所述第一客户端101在授权第二客户端102访问所述加密数据时将所述第一授权码和所述第一密钥的第二部分发送给所述第二客户端102，以便所述第二客户端102在访问所述加密数据时将所述第一授权码和所述第一密钥的所述第二部分携带在访问请求中，所述第一密钥的第二部分包括所述第一密钥中除所述第一部分之外的剩余部分。
验证模块802，当接收到来自任一客户端(比如第二客户端102)的对于所述加密数据的访问请求时，从所述访问请求中获取第二授权码和一个不完整密钥；当所述第二授权码与所述第一授权码相同并且所述第二授权码可用时，触发密钥模块803。
密钥模块803，根据所述不完整密钥和所述加密数据对应的所述第一密钥的第一部分生成第二密钥，其中，当所述不完整密钥与所述 第一密钥的第二部分相同时，所生成的所述第二密钥与所述第一密钥相同。
解密模块804，从所述信息共享系统104的所述区块中获取所述加密数据；根据所述第二密钥对所述加密数据进行解密处理，其中，当所述第二密钥与所述第一密钥相同时，解密得到所述明文数据并将其发送给发送所述访问请求的所述客户端。
在一些实例中，所述验证模块802从所述访问请求中获取所述加密数据的访问令牌，从所述访问令牌中获得所述第二授权码和所述不完整密钥。
在一些实例中，所述授权模块801，当从所述第一客户端101接收所述密钥的所述第一部分时，进一步接收文件标识和所述加密数据的持有者的用户标识；其中，所述授权模块801根据所述持有者的用户标识对应的规则生成所述第一授权码，并将所述第一授权码与所述密钥的所述第一部分、所述文件标识和所述持有者的用户标识相关联；其中，所述验证模块802当收到所述访问请求时，根据所述访问请求携带的文件标识和所述持有者的用户标识获取相关联的所述第一授权码和所述密钥的所述第一部分。
在一些实例中，所述区块对应一个区块高度；所述授权模块801所生成的所述第一授权码对应允许访问的区块高度和/或过期时间；所述验证模块802，当所述第二授权码与所述第一授权码相同时，获取所述第二授权码对应的允许访问的区块高度和/或过期时间；当所述访问请求针对的所述加密数据的区块高度与所述第二授权码对应的所述允许访问的区块高度相匹配和/或所述第二授权码未达到所述过期时间时，确定所述第二授权码可用。
在一些实例中，所述授权模块801，进一步响应于来自所述第一 客户端101的针对所述授权码的取消请求，令所述第一授权码失效；向所述第一客户端101返回响应，以使所述第一客户端101令本地的所述第一授权码失效。
在一些实例中，所述授权模块801，进一步响应于来自所述第一客户端101的针对所述加密数据的生成授权码请求，生成所述加密数据对应的新授权码；向所述第一客户端101发送所述加密数据对应的所述新授权码。
在一些实例中，所述授权模块801，进一步响应于来自所述第一客户端101的针对所述加密数据的更新授权码请求，生成所述加密数据对应的新授权码，并用所述新授权码替代之前的所述第一授权码；向所述第一客户端101发送所述加密数据对应的所述新授权码，以使其用所述新授权码替代之前的所述第一授权码。
上述各模块功能的实现原理前文已有详述，这里不再赘述。
在一些实例中，上述客户端700和服务器800可运行在各种计算设备中，并加载在该计算设备的存储器中。本申请实施例提出了一种计算设备，包括：一个或多个处理器；存储器；以及一个或多个程序，存储在该存储器中并被配置为由所述一个或多个处理器执行，所述一个或多个程序包括用于执行前述人一种方法实例的指令。
图9示出了客户端700或服务器800所在的计算设备的组成结构图。如图9所示，该计算设备包括一个或者多个处理器(CPU)902、通信模块904、存储器906、用户接口910，以及用于互联这些组件的通信总线908。
处理器902可通过通信模块904接收和发送数据以实现网络通信和/或本地通信。
用户接口910包括一个或多个输出设备912，其包括一个或多个 扬声器和/或一个或多个可视化显示器。用户接口910也包括一个或多个输入设备914，其包括诸如，键盘，鼠标，声音命令输入单元或扩音器，触屏显示器，触敏输入板，姿势捕获摄像机或其他输入按钮或控件等。
存储器906可以是高速随机存取存储器，诸如DRAM、SRAM、DDR RAM、或其他随机存取固态存储设备；或者非易失性存储器，诸如一个或多个磁盘存储设备、光盘存储设备、闪存设备，或其他非易失性固态存储设备。
存储器906存储处理器902可执行的指令集，包括：
操作系统916，包括用于处理各种基本系统服务和用于执行硬件相关任务的程序；
应用918，包括各种应用程序，其能够实现上述各实例中的处理流程，比如可以包括图7所示的客户端700和/或图8所示的服务器800。在一些实例中，客户端700可包括图7所示的各模块701～703中的部分或全部模块，各模块701～703可以存储有机器可执行指令。处理器902通过执行存储器906中各模块701～703中的机器可执行指令，进而能够实现上述各模块701～703的功能。在一些实例中，服务器800可包括图8所示的各模块801～804中的部分或全部模块，各模块801～804可以存储有机器可执行指令。处理器902通过执行存储器906中各模块801～804中的机器可执行指令，进而能够实现上述各模块801～804的功能。
采用上述实例提供的客户端、服务器和计算设备，第一客户端101持有密钥和授权码，授权访问服务器103持有授权码和密钥的第一部分，第二客户端102在获得授权时可持有密钥的第二部分和授权码，这样，当第二客户端102通过授权访问服务器103请求访问相应 的数据时，授权访问服务器103可首先验证授权码是否可用，在授权码可用的情况下，再利用从第一客户端101和第二客户端102分别获得的不完整密钥(密钥的第一部分和第二部分)获得完整密钥，如果第二客户端102的提供的不完整密钥有问题，则无法获得正确的完整密钥，就无法对加密数据成功解密，从而保障了数据的安全。在此方案中，第二客户端102和授权访问服务器103分别持有密钥的一部分，二者都不具有访问加密数据的权限，只有二者持有的密钥信息合并在一起时才能获得完整密钥，从而有效保障了数据安全和用户隐私。
需要说明的是，上述各流程和各结构图中不是所有的步骤和模块都是必须的，可以根据实际的需要忽略某些步骤或模块。各步骤的执行顺序不是固定的，可以根据需要进行调整。各模块的划分仅仅是为了便于描述采用的功能上的划分，实际实现时，一个模块可以分由多个模块实现，多个模块的功能也可以由同一个模块实现，这些模块可以位于同一个设备中，也可以位于不同的设备中。
各实施例中的硬件模块可以以硬件方式或硬件平台加软件的方式实现。上述软件包括机器可读指令，存储在非易失性存储介质中。因此，各实施例也可以体现为软件产品。
各例中，硬件可以由专门的硬件或执行机器可读指令的硬件实现。例如，硬件可以为专门设计的永久性电路或逻辑器件(如专用处理器，如FPGA或ASIC)用于完成特定的操作。硬件也可以包括由软件临时配置的可编程逻辑器件或电路(如包括通用处理器或其它可编程处理器)用于执行特定操作。
另外，本申请的每个实例可以通过由数据处理设备如计算机执行的数据处理程序来实现。显然，数据处理程序构成了本申请。此外，通常存储在一个存储介质中的数据处理程序通过直接将程序读取出 存储介质或者通过将程序安装或复制到数据处理设备的存储设备(如硬盘和或内存)中执行。因此，这样的存储介质也构成了本申请，本申请实施例还提供了一种非易失性存储介质，其中存储有数据处理程序，这种数据处理程序可用于执行本申请上述方法实例中的任何一种实例。
图7和8中的模块对应的机器可读指令可以使计算机上操作的操作系统等来完成这里描述的部分或者全部操作。非易失性计算机可读存储介质可以是插入计算机内的扩展板中所设置的存储器中或者写到与计算机相连接的扩展单元中设置的存储器。安装在扩展板或者扩展单元上的CPU等可以根据指令执行部分和全部实际操作。
非易失性计算机可读存储介质包括软盘、硬盘、磁光盘、光盘(如CD-ROM、CD-R、CD-RW、DVD-ROM、DVD-RAM、DVD-RW、DVD+RW)、磁带、非易失性存储卡和ROM。可选择地，可以由通信网络从服务器计算机上下载程序代码。
综上所述，权利要求的范围不应局限于以上描述的实例中的实施方式，而应当将说明书作为一个整体并给予最宽泛的解释。

Claims (15)

  1. 一种数据共享方法，由第一客户端执行，所述方法包括：
    根据密钥对一份明文数据进行加密得到一份加密数据；
    将所述加密数据上传至信息共享系统的一个区块中，所述信息共享系统为区块链系统；
    将所述密钥的第一部分上传至所述信息共享系统对应的授权访问服务器；
    从所述授权访问服务器接收所述加密数据对应的授权码；
    当授权一个用户访问所述加密数据时，将所述授权码和所述密钥的第二部分发送给所述用户的第二客户端，所述密钥的第二部分包括所述密钥中除所述第一部分之外的剩余部分，以使所述第二客户端当发送针对所述加密数据的访问请求至所述授权访问服务器时，在所述访问请求中携带所述授权码和所述密钥的所述第二部分，以便所述授权访问服务器在确定所述授权码可用时根据所述密钥的所述第一部分和所述第二部分生成所述密钥，根据所生成的所述密钥对从所述信息共享系统的所述区块中获取的所述加密数据进行解密而得到所述明文数据并返回给所述第二客户端。
  2. 根据权利要求1所述的方法，其中，当将所述加密数据上传至所述信息共享系统的所述区块中时，进一步上传所述加密数据的文件标识及其持有者的用户标识，以使所述信息共享系统将所述加密数据与所述文件标识和所述持有者的用户标识相关联，以便所述授权访问服务器根据所述文件标识和所述持有者的用户标识从所述信息共享系统的所述区块中获取所述加密数据。
  3. 根据权利要求2所述的方法，其中，当将所述密钥的所述第 一部分上传至所述授权访问服务器时，进一步上传所述文件标识和所述持有者的用户标识，以使所述授权访问服务器根据所述持有者的用户标识对应的规则生成所述授权码，并将所述授权码与所述密钥的所述第一部分、所述文件标识和所述持有者的用户标识相关联，在收到所述访问请求时根据其中携带的所述文件标识和所述持有者的用户标识获取相关联的所述授权码和所述密钥的所述第一部分，以便根据获取的所述授权码确定所述访问请求携带的所述授权码是否可用，根据获取的所述密钥的所述第一部分和所述访问请求携带的所述第二部分生成所述密钥。
  4. 根据权利要求1所述的方法，进一步包括：
    向所述授权访问服务器发送针对所述授权码的取消请求，以使所述授权访问服务器令所述授权码失效；
    令本地的所述授权码失效。
  5. 根据权利要求1所述的方法，进一步包括：
    向所述授权访问服务器发送针对所述加密数据的更新授权码请求，以使所述授权访问服务器生成所述加密数据对应的新授权码，并用所述新授权码替代之前的所述授权码；
    从所述授权访问服务器接收所述新授权码，并用所述新授权码替代之前的所述授权码。
  6. 一种数据共享方法，由授权访问服务器执行，所述方法包括：
    从第一客户端接收第一密钥的第一部分，所述第一密钥对应于一份上传到信息共享系统的一个区块中的加密数据，所述加密数据为根据所述第一密钥对一份明文数据进行加密处理而获得的，所述信息共享系统为区块链系统；
    生成所述加密数据对应的第一授权码；
    将所述第一授权码发送给所述第一客户端，以使所述第一客户端在授权第二客户端访问所述加密数据时将所述第一授权码和所述第一密钥的第二部分发送给所述第二客户端，以便所述第二客户端在访问所述加密数据时将所述第一授权码和所述第一密钥的所述第二部分携带在访问请求中，所述第一密钥的第二部分包括所述第一密钥中除所述第一部分之外的剩余部分；
    当接收到来自任一客户端的对于所述加密数据的访问请求时，所述方法还包括：
    从所述访问请求中获取第二授权码和一个不完整密钥；
    当所述第二授权码与所述第一授权码相同并且所述第二授权码可用时，根据所述不完整密钥和所述加密数据对应的所述第一密钥的第一部分生成第二密钥，其中，当所述不完整密钥与所述第一密钥的第二部分相同时，所生成的所述第二密钥与所述第一密钥相同；
    从所述信息共享系统的所述区块中获取所述加密数据；
    根据所述第二密钥对所述加密数据进行解密处理，其中，当所述第二密钥与所述第一密钥相同时，解密得到所述明文数据并将其发送给发送所述访问请求的所述客户端。
  7. 根据权利要求6所述的方法，其中，当从所述第一客户端接收所述密钥的所述第一部分时，进一步接收文件标识和所述加密数据的持有者的用户标识；
    所述生成所述加密数据对应的第一授权码包括：
    根据所述持有者的用户标识对应的规则生成所述第一授权码，并将所述第一授权码与所述密钥的所述第一部分、所述文件标识和所述持有者的用户标识相关联；
    当收到所述访问请求时，根据所述访问请求携带的文件标识和所 述持有者的用户标识获取相关联的所述第一授权码和所述密钥的所述第一部分。
  8. 根据权利要求6所述的方法，其中，所述区块对应一个区块高度；
    所生成的所述第一授权码对应允许访问的区块高度和/或过期时间；
    当所述第二授权码与所述第一授权码相同时，获取所述第二授权码对应的允许访问的区块高度和/或过期时间；
    当所述访问请求针对的所述加密数据的区块高度与所述第二授权码对应的所述允许访问的区块高度相匹配和/或所述第二授权码未达到所述过期时间时，确定所述第二授权码可用。
  9. 根据权利要求6所述的方法，进一步包括：
    响应于来自所述第一客户端的针对所述授权码的取消请求，令所述第一授权码失效；
    向所述第一客户端返回响应，以使所述第一客户端令本地的所述第一授权码失效。
  10. 根据权利要求6所述的方法，进一步包括：
    响应于来自所述第一客户端的针对所述加密数据的生成授权码请求，生成所述加密数据对应的新授权码；
    向所述第一客户端发送所述加密数据对应的所述新授权码。
  11. 根据权利要求6所述的方法，进一步包括：
    响应于来自所述第一客户端的针对所述加密数据的更新授权码请求，生成所述加密数据对应的新授权码，并用所述新授权码替代之前的所述第一授权码；
    向所述第一客户端发送所述加密数据对应的所述新授权码，以使 其用所述新授权码替代之前的所述第一授权码。
  12. 一种第一客户端，包括：
    加密模块，根据密钥对一份明文数据进行加密得到一份加密数据；
    上传模块，将所述加密数据上传至信息共享系统的一个区块中，所述信息共享系统为区块链系统，将所述密钥的第一部分上传至所述信息共享系统对应的授权访问服务器；
    授权模块，从所述授权访问服务器接收所述加密数据对应的授权码；当授权一个用户访问所述加密数据时，将所述授权码和所述密钥的第二部分发送给第二客户端，所述密钥的第二部分包括所述密钥中除所述第一部分之外的剩余部分，以使所述第二客户端当发送针对所述加密数据的访问请求至所述授权访问服务器时，在所述访问请求中携带所述授权码和所述密钥的所述第二部分，以便所述授权访问服务器在确定所述授权码可用时根据所述密钥的所述第一部分和所述第二部分生成所述密钥，根据所生成的所述密钥对从所述信息共享系统的所述区块中获取的所述加密数据进行解密而得到所述明文数据并返回给所述第二客户端。
  13. 一种授权访问服务器，包括：
    授权模块，从第一客户端接收第一密钥的第一部分，所述第一密钥对应于一份上传到信息共享系统的一个区块中的加密数据，所述加密数据为根据所述第一密钥对一份明文数据进行加密处理而获得的，所述信息共享系统为区块链系统；生成所述加密数据对应的第一授权码；将所述第一授权码发送给所述第一客户端，以使所述第一客户端在授权第二客户端访问所述加密数据时将所述第一授权码和所述第一密钥的第二部分发送给所述第二客户端，以便所述第二客户端在访问所述加密数据时将所述第一授权码和所述第一密钥的所述第二部 分携带在访问请求中，所述第一密钥的第二部分包括所述第一密钥中除所述第一部分之外的剩余部分；
    验证模块，当接收到来自任一客户端的对于所述加密数据的访问请求时，从所述访问请求中获取第二授权码和一个不完整密钥；当所述第二授权码与所述第一授权码相同并且所述第二授权码可用时，触发密钥模块；
    所述密钥模块，根据所述不完整密钥和所述加密数据对应的所述第一密钥的第一部分生成第二密钥，其中，当所述不完整密钥与所述第一密钥的第二部分相同时，所生成的所述第二密钥与所述第一密钥相同；
    解密模块，从所述信息共享系统的所述区块中获取所述加密数据；根据所述第二密钥对所述加密数据进行解密处理，其中，当所述第二密钥与所述第一密钥相同时，解密得到所述明文数据并将其发送给发送所述访问请求的所述客户端。
  14. 一种计算设备，包括：
    一个或多个处理器；
    存储器；以及
    一个或多个程序，存储在该存储器中并被配置为由所述一个或多个处理器执行，所述一个或多个程序包括用于执行权利要求1-11中任一项所述方法的指令。
  15. 一种存储介质，存储有一个或多个程序，所述一个或多个程序包括指令，所述指令当由计算设备执行时，使得所述计算设备执行如权利要求1-11中任一项所述的方法。
PCT/CN2018/107962 2017-11-02 2018-09-27 数据共享方法、客户端、服务器、计算设备及存储介质 WO2019085699A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
JP2020524318A JP6961818B2 (ja) 2017-11-02 2018-09-27 データ共有方法、クライアント、サーバ、コンピューティングデバイス、及び記憶媒体
EP18872127.8A EP3618394B1 (en) 2017-11-02 2018-09-27 Data sharing method, client, server, computing device, and storage medium
KR1020197034696A KR102219008B1 (ko) 2017-11-02 2018-09-27 데이터 공유 방법, 클라이언트, 서버, 컴퓨팅 장치 및 저장 매체
US16/683,597 US11223477B2 (en) 2017-11-02 2019-11-14 Data sharing method, client, server, computing device, and storage medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201711065783.1 2017-11-02
CN201711065783.1A CN107979590B (zh) 2017-11-02 2017-11-02 数据共享方法、客户端、服务器、计算设备及存储介质

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/683,597 Continuation US11223477B2 (en) 2017-11-02 2019-11-14 Data sharing method, client, server, computing device, and storage medium

Publications (1)

Publication Number Publication Date
WO2019085699A1 true WO2019085699A1 (zh) 2019-05-09

Family

ID=62012925

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/107962 WO2019085699A1 (zh) 2017-11-02 2018-09-27 数据共享方法、客户端、服务器、计算设备及存储介质

Country Status (6)

Country Link
US (1) US11223477B2 (zh)
EP (1) EP3618394B1 (zh)
JP (1) JP6961818B2 (zh)
KR (1) KR102219008B1 (zh)
CN (1) CN107979590B (zh)
WO (1) WO2019085699A1 (zh)

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112333199A (zh) * 2020-11-17 2021-02-05 珠海大横琴科技发展有限公司 一种数据处理的方法和装置
US11088833B1 (en) 2020-01-26 2021-08-10 International Business Machines Corporation Decentralized secure data sharing
JP2021136694A (ja) * 2020-02-26 2021-09-13 バイドゥ オンライン ネットワーク テクノロジー （ベイジン） カンパニー リミテッド ブロックチェーンネットワークに基づくデータ共有方法、装置、機器及び媒体
US11194918B2 (en) * 2019-07-10 2021-12-07 International Business Machines Corporation Data transmission based on verification codes
US11271742B2 (en) 2020-01-26 2022-03-08 International Business Machines Corporation Decentralized secure data sharing
US11356260B2 (en) 2020-01-26 2022-06-07 International Business Machines Corporation Decentralized secure data sharing

Families Citing this family (45)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108632284B (zh) * 2018-05-10 2021-02-23 网易（杭州）网络有限公司 基于区块链的用户数据授权方法、介质、装置和计算设备
CN108768972B (zh) * 2018-05-16 2020-11-27 智车优行科技（北京）有限公司 车辆数据的存储和访问方法及装置、系统、电子设备
CN108462724B (zh) * 2018-05-17 2020-07-31 京东数字科技控股有限公司 数据共享方法、装置、系统、成员节点和可读存储介质
CN108768633B (zh) * 2018-05-30 2022-03-25 腾讯科技（深圳）有限公司 实现区块链中信息共享的方法及装置
US11108762B2 (en) 2018-06-05 2021-08-31 The Toronto-Dominion Bank Methods and systems for controlling access to a protected resource
CN112567441A (zh) * 2018-06-29 2021-03-26 索尼公司 信息处理系统、信息处理方法和信息处理装置
CN109032694A (zh) * 2018-07-03 2018-12-18 郑州云海信息技术有限公司 一种数据加载方法及终端
CN108985863A (zh) * 2018-08-27 2018-12-11 中国联合网络通信集团有限公司 一种募捐捐赠方法及系统
CN110958211B (zh) * 2018-09-27 2022-05-27 安徽华峪文化科技有限公司 一种基于区块链的数据处理系统及方法
CN109559117B (zh) * 2018-11-14 2022-05-20 北京科技大学 基于属性基加密的区块链合约隐私保护方法与系统
CN109474597A (zh) * 2018-11-19 2019-03-15 中链科技有限公司 一种基于区块链的分布式消息发送与接收方法以及装置
WO2020102974A1 (zh) * 2018-11-20 2020-05-28 深圳市欢太科技有限公司 一种数据访问方法、数据访问装置及移动终端
CN109583905A (zh) * 2018-12-21 2019-04-05 众安信息技术服务有限公司 基于区块链网络的利用通证来实现数据共享的方法和设备
CN111385266B (zh) * 2018-12-29 2022-06-17 湖南亚信软件有限公司 数据共享方法、装置、计算机设备和存储介质
US11368441B2 (en) * 2019-01-29 2022-06-21 Mastercard International Incorporated Method and system for general data protection compliance via blockchain
CN110147410B (zh) * 2019-04-18 2020-08-04 阿里巴巴集团控股有限公司 一种块链式账本中的数据验证方法、系统、装置及设备
CN110263556A (zh) * 2019-05-22 2019-09-20 广东安创信息科技开发有限公司 一种oa系统数据的加解密方法及系统
CN110177092A (zh) * 2019-05-22 2019-08-27 南京邮电大学 一种基于区块链的电子数据可信下载方法
EP3764613A1 (en) * 2019-07-09 2021-01-13 Gemalto Sa Method, first device, first server, second server and system for accessing a private key
CN111010386B (zh) * 2019-12-10 2021-12-21 上海信联信息发展股份有限公司 一种基于共享账本的隐私保护与数据监管控制方法
CN111061982B (zh) * 2019-12-11 2023-04-18 电子科技大学 一种基于区块链的新闻资讯发布及管理系统
CN111179067B (zh) * 2019-12-31 2023-06-27 杭州趣链科技有限公司 一种基于区块链的银行间客户信息交换系统
CN111448565B (zh) * 2020-02-14 2024-04-05 支付宝(杭州)信息技术有限公司 基于去中心化标识的数据授权
US11658816B2 (en) * 2020-04-15 2023-05-23 Philips North America Llc Document control system for blockchain
CN111639350B (zh) * 2020-05-16 2023-01-31 中信银行股份有限公司 密码服务系统及加密方法
CN111740986B (zh) * 2020-06-19 2022-07-19 公安部第三研究所 基于标识密码技术的实现数据共享控制的系统及其方法
CN111914293B (zh) * 2020-07-31 2024-05-24 平安科技（深圳）有限公司 一种数据访问权限验证方法、装置、计算机设备及存储介质
US11621837B2 (en) * 2020-09-03 2023-04-04 Theon Technology Llc Secure encryption of data using partial-key cryptography
US11310042B2 (en) 2020-09-11 2022-04-19 Crown Sterling Limited, LLC Methods of storing and distributing large keys
CN112184426A (zh) * 2020-10-12 2021-01-05 深圳壹账通智能科技有限公司 数据共享方法、系统、服务器及计算机可读存储介质
CN112637177B (zh) * 2020-12-17 2022-09-27 赛尔网络有限公司 数据加密传输方法、装置、设备及介质
CN112615936A (zh) * 2020-12-28 2021-04-06 南京披云信息科技有限公司 提升物联网安全的方法及装置
EP4289107A4 (en) * 2021-02-05 2024-03-20 Visa International Service Association SECRET PROTECTION SYSTEM AND METHOD FOR MOBILE DEVICE
CN113515728B (zh) * 2021-05-18 2023-08-04 北京飞利信电子技术有限公司 一种基于多级部署的物联网平台软件授权控制系统和方法
US11615375B2 (en) * 2021-07-02 2023-03-28 dexFreight, Inc. Electronic management of supply chain factoring with shared state storage in a distributed ledger
US11755772B2 (en) 2021-09-20 2023-09-12 Crown Sterling Limited, LLC Securing data in a blockchain with a one-time pad
CN113868605B (zh) * 2021-09-30 2024-03-22 新华三大数据技术有限公司 授权管理方法、装置及系统
CN113722695B (zh) * 2021-11-02 2022-02-08 佳瑛科技有限公司 基于云端服务器的财务数据安全共享方法、装置及系统
US11943336B2 (en) 2021-11-22 2024-03-26 Theon Technology Llc Use of gradient decent function in cryptography
US11791988B2 (en) 2021-11-22 2023-10-17 Theon Technology Llc Use of random entropy in cryptography
US11902420B2 (en) 2021-11-23 2024-02-13 Theon Technology Llc Partial cryptographic key transport using one-time pad encryption
CN114124572B (zh) * 2021-12-07 2023-06-27 建信金融科技有限责任公司 基于单向网络的数据传输方法、装置、设备和介质
KR102602189B1 (ko) * 2022-02-18 2023-11-14 주식회사 한글과컴퓨터 클라우드 기반의 문서 공유 서비스를 운영하기 위한 문서 공유 서비스 서버 및 그 동작 방법
US11727145B1 (en) 2022-06-10 2023-08-15 Playback Health Inc. Multi-party controlled transient user credentialing for interaction with patient health data
CN116155619B (zh) * 2023-04-04 2023-07-07 江西农业大学 数据处理方法、数据请求端、数据拥有端及数据处理装置

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106612275A (zh) * 2015-10-27 2017-05-03 连株式会社 用于传送和接收消息的用户终端和方法
US20170177898A1 (en) * 2015-12-16 2017-06-22 International Business Machines Corporation Personal ledger blockchain
CN107196900A (zh) * 2017-03-24 2017-09-22 阿里巴巴集团控股有限公司 一种共识校验的方法及装置

Family Cites Families (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8464353B2 (en) * 2003-10-03 2013-06-11 Hewlett-Packard Development Company, L. P. Method and system for content downloads via an insecure communications channel to devices
JP2007089098A (ja) * 2005-09-20 2007-04-05 Chaosware Inc クライアント・サーバ型暗号化システム
JP2008103936A (ja) * 2006-10-18 2008-05-01 Toshiba Corp 秘密情報管理装置および秘密情報管理システム
KR20100042457A (ko) * 2008-10-16 2010-04-26 삼성전자주식회사 데이터 암호화 방법 및 장치와 데이터 복호화 방법 및 장치
US9171298B2 (en) * 2011-02-24 2015-10-27 Dvdcase, Inc. Systems and methods for managing access to benefits associated with products
JP6019453B2 (ja) * 2012-07-05 2016-11-02 株式会社クリプト・ベーシック 暗号化装置、復号化装置、及びプログラム
CN103973736B (zh) * 2013-01-30 2017-12-29 华为终端（东莞）有限公司 一种数据共享的方法及装置
CN103442059B (zh) * 2013-08-27 2017-02-01 华为终端有限公司 一种文件共享方法及装置
CN103561034B (zh) * 2013-11-11 2016-08-17 武汉理工大学 一种安全文件共享系统
CN104980477B (zh) * 2014-04-14 2019-07-09 航天信息股份有限公司 云存储环境下的数据访问控制方法和系统
US9769664B1 (en) * 2014-09-04 2017-09-19 Sensys Networks Nonce silent and replay resistant encryption and authentication wireless sensor network
US20160379220A1 (en) * 2015-06-23 2016-12-29 NXT-ID, Inc. Multi-Instance Shared Authentication (MISA) Method and System Prior to Data Access
US11121867B2 (en) * 2016-02-19 2021-09-14 Micro Focus Llc Encryption methods based on plaintext length
KR101783281B1 (ko) * 2016-03-11 2017-09-29 주식회사 다날 신분증 데이터의 안전 보관이 가능한 전자 단말 장치 및 그 동작 방법
US10137860B2 (en) * 2016-11-17 2018-11-27 Ford Global Technologies, Llc Remote keyless entry message authentication
JP6302592B2 (ja) * 2017-06-23 2018-03-28 株式会社エヌ・ティ・ティ・データ 情報処理装置、情報処理方法およびプログラム

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106612275A (zh) * 2015-10-27 2017-05-03 连株式会社 用于传送和接收消息的用户终端和方法
US20170177898A1 (en) * 2015-12-16 2017-06-22 International Business Machines Corporation Personal ledger blockchain
CN107196900A (zh) * 2017-03-24 2017-09-22 阿里巴巴集团控股有限公司 一种共识校验的方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3618394A4 *

Cited By (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11194918B2 (en) * 2019-07-10 2021-12-07 International Business Machines Corporation Data transmission based on verification codes
US11088833B1 (en) 2020-01-26 2021-08-10 International Business Machines Corporation Decentralized secure data sharing
US11271742B2 (en) 2020-01-26 2022-03-08 International Business Machines Corporation Decentralized secure data sharing
US11356260B2 (en) 2020-01-26 2022-06-07 International Business Machines Corporation Decentralized secure data sharing
JP2021136694A (ja) * 2020-02-26 2021-09-13 バイドゥ オンライン ネットワーク テクノロジー （ベイジン） カンパニー リミテッド ブロックチェーンネットワークに基づくデータ共有方法、装置、機器及び媒体
JP7096920B2 (ja) 2020-02-26 2022-07-06 バイドゥ オンライン ネットワーク テクノロジー（ペキン） カンパニー リミテッド ブロックチェーンネットワークに基づくデータ共有方法、装置、機器及び媒体
CN112333199A (zh) * 2020-11-17 2021-02-05 珠海大横琴科技发展有限公司 一种数据处理的方法和装置
CN112333199B (zh) * 2020-11-17 2023-04-21 珠海大横琴科技发展有限公司 一种数据处理的方法和装置

Also Published As

Publication number Publication date
JP2021502023A (ja) 2021-01-21
CN107979590B (zh) 2020-01-17
JP6961818B2 (ja) 2021-11-05
US20200084037A1 (en) 2020-03-12
US11223477B2 (en) 2022-01-11
EP3618394A4 (en) 2020-07-01
KR102219008B1 (ko) 2021-02-22
EP3618394A1 (en) 2020-03-04
CN107979590A (zh) 2018-05-01
KR20200002985A (ko) 2020-01-08
EP3618394B1 (en) 2022-03-30

Similar Documents

Publication Publication Date Title
WO2019085699A1 (zh) 数据共享方法、客户端、服务器、计算设备及存储介质
TWI725793B (zh) 用於將分散識別符映射到真實世界實體的系統及方法
US20200084045A1 (en) Establishing provenance of digital assets using blockchain system
WO2021003980A1 (zh) 黑名单共享方法、装置、计算机设备和存储介质
US20170346802A1 (en) Out of box experience application api integration
EP3537684B1 (en) Apparatus, method, and program for managing data
US11917088B2 (en) Integrating device identity into a permissioning framework of a blockchain
US20230108366A1 (en) Systems for encryption using blockchain distributed ledgers
TW201729121A (zh) 雲端服務伺服器及用來管理一雲端服務伺服器之方法
US11314885B2 (en) Cryptographic data entry blockchain data structure
KR102125042B1 (ko) 블록체인 네트워크를 구성하는 노드 장치 및 그 노드 장치의 동작 방법
WO2023207086A1 (zh) 一种基于区块链的用户数据流转方法、装置及设备
US11604784B2 (en) Establishing decentralized identifiers for algorithms, data schemas, data sets, and algorithm execution requests
WO2023244993A1 (en) Systems and methods for mitigating network congestion on blockchain networks by supporting blockchain operations through off-chain interactions
US20220309463A1 (en) Systems and methods for trade partner information sharing
US20170373842A1 (en) System and Method for Authenticating Public Artworks and Providing Associated Information
CN112766755A (zh) 一种业务处理方法、装置、设备及介质
WO2024109575A1 (en) Method to validate ownership and authentication of a digital asset
WO2024021785A1 (zh) 一种数字实体的处理方法、装置、设备、介质及程序产品
US20240089105A1 (en) Systems and methods for user control and exclusion of cryptographic tokenized data
US20240086549A1 (en) Systems and methods for user characteristic determination through cryptographic tokenized data
KR20230118304A (ko) 웹 토큰이 포함된 온라인 저작물 발급 및 인증 시스템 및 방법
JP2020201660A (ja) 情報処理システム

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18872127

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 20197034696

Country of ref document: KR

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 2018872127

Country of ref document: EP

Effective date: 20191126

ENP Entry into the national phase

Ref document number: 2020524318

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE