WO2019184027A1 - 共享数据处理方法、通信装置及通信设备 - Google Patents

共享数据处理方法、通信装置及通信设备 Download PDF

Info

Publication number
WO2019184027A1
WO2019184027A1 PCT/CN2018/083979 CN2018083979W WO2019184027A1 WO 2019184027 A1 WO2019184027 A1 WO 2019184027A1 CN 2018083979 W CN2018083979 W CN 2018083979W WO 2019184027 A1 WO2019184027 A1 WO 2019184027A1
Authority
WO
WIPO (PCT)
Prior art keywords
shared
user
terminal
shared key
data
Prior art date
Application number
PCT/CN2018/083979
Other languages
English (en)
French (fr)
Inventor
李雪峰
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to CN201880077309.7A priority Critical patent/CN111418181B/zh
Publication of WO2019184027A1 publication Critical patent/WO2019184027A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords

Definitions

  • the present application relates to the field of security technologies.
  • the technical field of the present application relates to a shared data processing method, a communication device, and a communication device.
  • Data sharing is a common form of business. Users who use different terminals in different places can read data shared by others and perform various operations, operations and analysis on shared data. They are mostly used for photo sharing based on friend relationship. Document sharing of colleague relationships, etc.
  • the data sharing needs to upload the shared data to the data storage server by the user sharing the data through the terminal device, and the user specifies the sharing group, and only the terminal device bound and used by the shared user in the sharing group has the right to the data.
  • the storage server obtains and views the shared data uploaded by the user.
  • the terminal device used by the user creates a shared key before uploading the shared data, and uses the shared key to encrypt the shared data that the user specifies to upload to the data storage server. Moreover, after the shared device creates the shared key, the terminal device uploads and stores the shared key in the key server, and the designated shared user obtains the key from the key server to decrypt the shared data of the user. Therefore, in the prior art, the data storage server only stores the ciphertext of the user shared data, and the key server only stores the shared key used to encrypt the shared data, even if the data storage server is compromised due to security problems, only the shared data is leaked. The ciphertext does not directly reveal user data.
  • the present application provides a shared data processing method, a communication device, and a communication device, which ensures that a user who is unshared cannot obtain shared data uploaded by a user who shares data after being released from the relationship, thereby improving the security of the shared data.
  • the first aspect of the present application provides a shared data processing method, including:
  • the first terminal acquires the first shared data specified by the first user
  • the first terminal sends the first identification information and the first shared data encrypted by the first shared key to the data storage server, where the first identifier information is used to identify the first shared key;
  • the first terminal calculates a second shared key according to the first shared key, where the sharing in the shared group The terminal bound by the user has the right to acquire the shared data of the first user from the data storage server;
  • the first terminal acquires second shared data specified by the first user
  • the calculating, by the first terminal, the second shared key according to the first shared key includes:
  • the first terminal calculates, by using a one-way function, the first shared key as an input, and outputs the second shared key.
  • the one-way function is a one-way trapdoor function
  • the first terminal has a trapdoor of the one-way trapdoor function
  • the first terminal calculates and outputs the second shared key by using the first shared key as an input by using a one-way function, including:
  • the first terminal calculates, by using the one-way trapdoor function, the first shared key and the trapdoor as input, and outputs the second shared key.
  • the first identifier information is information that the number of times of using the one-way trapdoor function is accumulated when the first terminal calculates the first shared key
  • the first terminal When the second identifier information is that the first terminal calculates the second shared key, the first terminal accumulates the number of times of using the one-way trapdoor function.
  • the shared user in the shared group specified by the first user changes, including:
  • the user of the first terminal performs a delete or replace operation on the shared user in the shared group.
  • the first terminal when detecting, by the first terminal, that the shared user in the shared group specified by the first user is changed, the first terminal is configured to encrypt the first shared data.
  • the first shared key calculates the second shared key, and encrypts the second shared data specified by the user using the second shared key and uploads the data to the data storage server. Therefore, even if the user who owns the first shared key obtains the second shared data ciphertext added by the first user in the data storage server by other means, the ciphertext cannot be decrypted, thereby improving the security of the shared data and ensuring the security of the shared data.
  • the shared user deleted from the shared group cannot acquire the second shared data that the first user specifies to upload after being released from the sharing relationship.
  • the second aspect of the present application provides a shared data processing method, including:
  • the second terminal acquires the second shared key, where the second shared key is the first user bound if the shared user in the shared group specified by the first user is detected to be changed.
  • the terminal calculates the second shared key according to the first shared key, where the first shared key is used by the first terminal to encrypt the first shared data specified by the first user, and the second shared secret The key is used by the first terminal to encrypt the second shared data specified by the first user, and the terminal bound by the shared user in the shared group has the right to acquire the share of the first user from the data storage server.
  • the second terminal receives the first identification information that is sent by the data storage server and the first shared data that is encrypted by the first shared key, where the first identification information is used to identify the first shared key;
  • the second terminal calculates the first shared key according to the second shared key and the first identification information
  • the second terminal decrypts the first shared data according to the first shared key.
  • the calculating, by the second terminal, the first shared key according to the second shared key and the first identifier information includes:
  • the second terminal calculates, by using a one-way function, the second shared key and the first identification information as input, and outputs the first shared key.
  • the one-way function is a one-way trapdoor function
  • the first terminal has a trapdoor of the one-way trapdoor function
  • the first identifier information is information that the number of times of using the one-way trapdoor function is accumulated when the first terminal calculates the first shared key
  • the first terminal When the second identifier information is that the first terminal calculates the second shared key, the first terminal accumulates the number of times of using the one-way trapdoor function.
  • the second terminal acquires the second shared key that is used by the first terminal to encrypt the shared data specified by the first user, and acquires the data sent by the data storage server.
  • An identification information and first shared data of the first user encrypted by the first shared key the second terminal is capable of calculating the first shared key according to the first identification information and the second shared key, and adopting the first shared key Decrypt the first shared data.
  • the second terminal bound by the shared user added by the first user in the shared group can decrypt the second shared data specified by the user according to the second shared key, and can also be based on the second shared key and the first After the identifier is calculated, the first shared data specified by the user is decrypted according to the first shared key.
  • the user who owns the first shared key cannot obtain the second shared data ciphertext added by the first user in the data storage server through other means, and the ciphertext cannot be decrypted, thereby improving the security of the shared data. , ensuring that the shared user deleted from the shared group cannot obtain the second shared data that the first user specifies to upload after being released from the sharing relationship.
  • a third aspect of the present application provides a communication apparatus, including:
  • An obtaining module configured to acquire first shared data specified by the first user
  • a sending module configured to send, to the data storage server, the first identifier information and the first shared data that is encrypted by using the first shared key, where the first identifier information is used to identify the first shared key;
  • a processing module configured to calculate, according to the first shared key, a second shared key, if the shared user in the shared group specified by the first user changes, wherein the sharing in the shared group
  • the terminal bound by the user has the right to acquire the shared data of the first user from the data storage server;
  • the obtaining module is further configured to acquire second shared data specified by the first user
  • the processing module is further configured to send the second identification information and the second shared data encrypted by the second shared key to the data storage server, where the second identifier information is used to identify the The second shared key.
  • processing module is specifically configured to:
  • the second shared key is calculated and output by using a one-way function with the first shared key as an input.
  • the one-way function is a one-way trapdoor function
  • the first terminal has a trapdoor of the one-way trapdoor function
  • the processing module is specifically configured to: if the shared user in the shared group specified by the first user changes, the first shared key and the trapdoor are used by the one-way trapdoor function Input, calculate and output the second shared key.
  • the first identifier information is information that the number of times of using the one-way trapdoor function is accumulated when the first terminal calculates the first shared key
  • the second identification information is information that the number of times of using the one-way trapdoor function is accumulated when the first terminal calculates the second shared key.
  • the shared user in the shared group specified by the first user changes, including:
  • the first user performs a delete or replace operation on the shared user in the shared group.
  • the communication apparatus when detecting that the shared user in the shared group specified by the first user is changed, according to the first shared key for encrypting the first shared data.
  • the second shared key is calculated, and the second shared data specified by the user is encrypted and uploaded to the data storage server by using the second shared key. Therefore, even if the user who owns the first shared key obtains the second shared data ciphertext added by the first user in the data storage server by other means, the ciphertext cannot be decrypted, thereby improving the security of the shared data and ensuring the security of the shared data.
  • the shared user deleted from the shared group cannot acquire the second shared data that the first user specifies to upload after being released from the sharing relationship.
  • the fourth aspect of the present application provides a communication apparatus, including: an obtaining module, configured to acquire a second shared key, where the second shared key is within a shared group specified by the first user The first user is bound to obtain the second shared key according to the first shared key, and the first shared key is used by the first terminal to encrypt the first a first shared data designated by the user, the second shared key is used by the first terminal to encrypt the second shared data specified by the first user, and the terminal bound by the shared user in the shared group has the right Acquiring the shared data of the first user from the data storage server;
  • the acquiring module is further configured to receive the first identification information that is sent by the data storage server and the first shared data that is encrypted by using the first shared key, where the first identifier information is used to identify the first shared key. ;
  • a processing module configured to calculate the first shared key according to the second shared key and the first identification information
  • the processing module is further configured to decrypt the first shared data according to the first shared key.
  • the processing module is configured to calculate, by using a one-way function, the second shared key and the first identification information as input, and output the first share. Key.
  • the one-way function is a one-way trapdoor function
  • the first terminal has a trapdoor of the one-way trapdoor function
  • the first identifier information is information that the number of times of using the one-way trapdoor function is accumulated when the first terminal calculates the first shared key
  • the second identification information is information that the number of times of using the one-way trapdoor function is accumulated when the first terminal calculates the second shared key.
  • the acquiring module acquires a second shared key that is used by the first terminal to encrypt the shared data specified by the first user, and obtains the first identifier sent by the data storage server.
  • the information and the first shared data of the first user encrypted by the first shared key, the processing module is capable of calculating the first shared key according to the first identification information and the second shared key, and is first by the first shared key pair Share data for decryption.
  • the second terminal bound by the shared user added by the first user in the shared group can decrypt the second shared data specified by the user according to the second shared key, and can also be based on the second shared key and the first After the identifier is calculated, the first shared data specified by the user is decrypted according to the first shared key.
  • the user who owns the first shared key cannot obtain the second shared data ciphertext added by the first user in the data storage server through other means, and the ciphertext cannot be decrypted, thereby improving the security of the shared data. , ensuring that the shared user deleted from the shared group cannot obtain the second shared data that the first user specifies to upload after being released from the sharing relationship.
  • the application provides a communication device, including:
  • the processor is configured to perform the shared data processing method of the first aspect.
  • the communication device in the fifth aspect may be a terminal device or a chip; the interface may be integrated on the same chip as the processor, or may be separately disposed on different chips.
  • the application provides a communication device, including:
  • the processor is configured to perform the shared data processing method of the second aspect.
  • the communication device in the sixth aspect may be a terminal device or a chip; the interface may be integrated on the same chip as the processor, or may be separately disposed on different chips.
  • the present application provides a computer readable storage medium having stored therein a computer program that, when run on a computer, causes the computer to perform the method of the first aspect.
  • the present application provides a computer readable storage medium having stored therein a computer program that, when run on a computer, causes the computer to perform the method of the second aspect.
  • the present application provides a computer program for performing the method of the first aspect when the computer program is executed by a computer.
  • the program in the ninth aspect may be stored in whole or in part on a storage medium packaged with the processor, or partially or entirely on a memory not packaged with the processor.
  • the application provides a computer program for performing the method of the second aspect when the computer program is executed by a computer.
  • the program in the tenth aspect may be stored in whole or in part on a storage medium packaged with the processor, or partially or entirely on a memory not packaged with the processor.
  • the application provides a communication device, including:
  • a memory and a processor the memory being coupled to the processor
  • the processor is for performing the method of the first aspect.
  • the communication device in the eleventh aspect may be a terminal device or a chip; the memory may be integrated on the same chip as the processor, or may be separately disposed on different chips.
  • the application provides a communication device, including:
  • a memory and a processor the memory being coupled to the processor
  • the processor is for performing the method of the second aspect.
  • the communication device in the twelfth aspect may be a terminal device or a chip; the memory may be integrated on the same chip as the processor, or may be separately disposed on different chips.
  • the application provides a processor, the processor includes:
  • At least one circuit configured to acquire first shared data specified by the first user
  • At least one circuit configured to send the first identification information and the first shared data encrypted by the first shared key to the data storage server, where the first identification information is used to identify the first shared key;
  • At least one circuit configured to calculate, according to the first shared key, a second shared key, if the shared user in the shared group specified by the first user changes, wherein the shared group The terminal bound by the shared user has the right to acquire the shared data of the first user from the data storage server;
  • At least one circuit configured to acquire second shared data specified by the first user
  • the processor in the thirteenth aspect may be a chip.
  • the present application provides a processor, the processor comprising:
  • At least one circuit configured to acquire a second shared key, where the second shared key is a first user binding if a shared user in the shared group specified by the first user is detected to be changed
  • the first terminal calculates the second shared key according to the first shared key, where the first shared key is used by the first terminal to encrypt the first shared data specified by the first user, where the first terminal
  • the second shared key is used by the first terminal to encrypt the second shared data specified by the first user, and the terminal bound by the shared user in the shared group has the right to obtain the first from the data storage server.
  • At least one circuit configured to receive first identification information sent by the data storage server and first shared data encrypted by the first shared key, where the first identification information is used to identify the first shared key;
  • At least one circuit configured to calculate the first shared key according to the second shared key and the first identification information
  • At least one circuit for decrypting the first shared data according to the first shared key At least one circuit for decrypting the first shared data according to the first shared key.
  • the processor in the fourteenth aspect may be a chip.
  • the second terminal calculates the second according to the first shared key used to encrypt the first shared data.
  • the shared key is encrypted, and the second shared data specified by the user is encrypted and uploaded to the data storage server. Therefore, even if the user who owns the first shared key obtains the second shared data ciphertext added by the first user in the data storage server by other means, the ciphertext cannot be decrypted, thereby improving the security of the shared data and ensuring the security of the shared data.
  • the shared user deleted from the shared group cannot acquire the second shared data that the first user specifies to upload after being released from the sharing relationship.
  • FIG. 1 is a schematic structural diagram of a data sharing system of the present application.
  • FIG. 2 is a schematic flowchart of an embodiment of a shared data processing method according to the present application.
  • FIG. 3 is a schematic flowchart of an embodiment of a shared data processing method according to the present application.
  • FIG. 4 is a schematic flowchart of an embodiment of a shared data processing method according to the present application.
  • FIG. 5 is a schematic flowchart diagram of an embodiment of a shared data processing method according to the present application.
  • FIG. 6 is a schematic flowchart of an embodiment of a shared data processing method according to the present application.
  • FIG. 7 is a schematic structural diagram of an embodiment of a communication device according to the present application.
  • FIG. 8 is a schematic structural diagram of an embodiment of a communication device according to the present application.
  • FIG. 9 is a schematic structural diagram of an embodiment of a terminal device according to the present application.
  • FIG. 10 is a schematic structural diagram of an embodiment of a terminal device according to the present application.
  • FIG. 11 is a schematic structural diagram of an embodiment of a terminal device according to the present application.
  • FIG. 1 is a schematic structural diagram of a data sharing system of the present application.
  • the data sharing system provided in this embodiment is used to provide data sharing services for a user, and specifically includes at least two terminals 101, a shared server 102, a key server 103, and a data storage server 104.
  • the user after the user binds the terminal 101 and accesses the Internet 105, the user can access the shared server 102, the key server 103, and the data storage server 104 in the data sharing system through the bound terminal 101, and enjoy Data sharing service.
  • the user can log in and bind the terminal 101 by using user identification information (for example, an account number and a password).
  • the terminal 101 may specifically be a desktop computer, a notebook, a tablet, a smart phone, a smart watch, a smart glasses, a workstation, a database, or a server.
  • One or more of the electronic devices that handle the function and are capable of connecting to the Internet For example, after the users labeled 1-6 in FIG.
  • any user-bound terminal as shown in FIG. 1 can upload shared data to the data storage server 104 and authorize other users to read, and can also read data shared by other users from the data storage server 104.
  • the sharing server 102 is for managing the relationship between the user who uploads the shared data and the shared user. Specifically, after the user uploading the shared data uploads the shared data to the data storage server 104, the shared group needs to be determined, and only the terminal bound by the shared user in the shared group has the right to read the user in the data storage server 104. Share data. For example, after the user 1 uploads the shared data of the user 1 to the data storage server 104 through the terminal A, the shared user included in the shared group is designated as the user 2 by the terminal A, and sends the right to view the sharing of the user 1 to the shared server 102. A list of shared users within the shared group of data.
  • the sharing server 102 acquires and stores information such as an ID account or an IP address of the specified user 2, which can identify the identity of the user 2.
  • the sharing server 102 then sends a sharing notification message to the terminal B to which the user 2 is bound, and the user 2 using the terminal B can know that it is authorized by the user 1 to view the shared data uploaded by the user 1 to the data storage server 104.
  • the identity needs to be verified first by the shared server 102.
  • the user 2 sends an authentication request including the user 2 information to the shared server 102 through the bound terminal B, and the sharing server 102 determines whether the user 2 is in the shared group specified by the user 1, that is, whether the user has access to the data management server.
  • User 1 's shared data in 104. If the sharing server 102 determines that the user 2 is a shared user in the shared group specified by the user 1, the authentication server 102 returns the verification success information to the terminal B bound to the user 2, and can carry the user 1 in the verification success information.
  • the storage location of the shared data in the data storage server 104 Only when the terminal B acquires the specific storage location of the user 1 in the data storage server, the terminal B can request the shared data of the user 1 from the data storage server 104 according to the specific storage location.
  • the key server 103 is for storing a shared key used by the terminal 101 to encrypt shared data. Specifically, when the terminal 101 uploading the shared data creates a shared key before uploading the shared data of the bound user to the data storage server 104, the terminal 101 uploads the bound user to the data storage server 104 using the shared key. The shared data is encrypted. After the terminal 101 generates a shared key for the bound user, the terminal 101 encrypts and uploads the generated shared key to the key server 103 for managing the key, which is specifically set in the data sharing system, for storage.
  • the key server 103 stores the shared password when each user uploads the shared data, for example, when the terminal F used by the user 6 accesses the shared upload by the user 1.
  • the shared key of the user 1 needs to be requested from the key server.
  • the key server 103 records the shared key of each user who uploads the shared data, and provides the shared key to the authorized shared user.
  • the data storage server 104 is configured to store shared data encrypted by the shared key by each user through the bound terminal 101. And when the terminal 101 that shares the user binding transmits the data request message, the requested shared data is returned to the terminal 101. Since the shared data is stored in the data storage server 104 and the shared key of the encrypted shared data is stored in the key server 103, the terminal 101 bound by the shared user who has the right to acquire the shared data in the shared group must acquire the data storage server at the same time. After the shared data in 104 and the shared key in the key server 103, the shared data can be obtained by decryption of the shared key. Only the terminal 101 bound by the shared user designated in the shared group can view and decrypt the shared data, thereby realizing the end-to-end security of the shared data.
  • the data storage server 104 and the key server 103 can be independently set and adopt different network security protection methods, so that one of the servers is not cracked in the same way when one of them is cracked, and the storage method is separated by the key and the data. To ensure the security of shared data.
  • the deployment manner of the shared server 102, the key server 103, and the data storage server 104 may be very flexible.
  • the shared server 102, the key server 103, and the data storage server 104 may be separately deployed and may be centralized.
  • the deployment (for example, deployment in the same server, etc.) can also be deployed with other devices, which is not specifically limited in this application.
  • the shared data is leaked.
  • the terminal 101 bound by the user sharing the data creates a shared key before uploading the shared data, and encrypts the shared data of the user by using the shared key, and then uploads the encrypted shared data to the data storage server 104. .
  • the terminal 101 also uploads the generated shared key to the key server 102.
  • the terminal 101 must acquire the shared data in the data storage server 104 and the shared key in the key server 103 at the same time, before the shared data can be decrypted by the shared key, and only the sharing within the sharing group specified by the user is obtained.
  • the terminal 101 to which the user is bound can view and decrypt the shared data. Therefore, the data storage server 104 stores only the ciphertext of the user shared data, and the key server 102 stores only the shared key for encrypting the shared data, even if the data storage server 104 is compromised due to security issues, only the ciphertext of the shared data is leaked. User-uploaded shared data will not be directly leaked.
  • the data sharing system in the prior art still has the following problem: when the user uploading the shared data adjusts the sharing relationship between the user and the shared user in the sharing group (for example, the user 1 specifies the sharing right to access the shared data)
  • the shared user included in the group is User 2 and User 3, and then the user 3 in the shared group is unshared. Then the shared group includes only the user 2), and the shared server 102 records the shared relationship updated by the user. .
  • the terminal C used by the shared user (user 3) who is de-shared still has the shared key before the unshared relationship, once the data storage server 104 is compromised, the terminal C can still be from the data storage server 104. View and decrypt the shared data uploaded by User 1 after being unshared.
  • the shared data of the user is encrypted by the shared key, but the security of the shared data is still not high.
  • the embodiment of the present application provides a shared data processing method, which ensures that the user who is released from the sharing relationship cannot obtain the upload of the user who uploads the shared data after being released from the relationship. Share data to increase the security of shared data.
  • FIG. 2 is a schematic flowchart diagram of an embodiment of a shared data processing method according to the present application. As shown in FIG. 2, in the embodiment of the shared data processing method of the present application,
  • the first terminal acquires the first shared data specified by the first user, and encrypts the first shared data by using the first shared key, and then sends the upload to the data storage server.
  • the first terminal also sends the first identifier information for identifying the first shared key to the data storage server, where the first identifier information is in one-to-one correspondence with the first shared key, and the terminal bound by the shared user specified by the first user is
  • the first shared key that encrypts the first shared data can be determined by the first identification information.
  • the first terminal detects that the shared user in the shared group specified by the first user changes, the first terminal calculates a second shared key according to the first shared key, where the shared user in the shared group is bound by The terminal has the right to obtain the shared data of the first user from the data storage server.
  • the first terminal acquires the second shared data specified by the first user, and encrypts the second shared data by using the second shared key, and then sends the upload to the data storage server.
  • the first terminal also sends the second identifier information for identifying the second shared key to the data storage server.
  • the second identifier information is in one-to-one correspondence with the second shared key, and the terminal bound by the shared user specified by the first user is The second shared key that encrypts the second shared data can be determined by the second identification information.
  • the first terminal when the first user needs to upload the first shared data to the data storage server by using the first terminal, the first terminal generates the first shared key, and after using the shared data encrypted by the first shared key, The first shared data encrypted by the first shared key and the first identification information of the first shared key are uploaded to the data storage server.
  • the first user also specifies the shared group by using the first terminal, and the terminal bound by the shared user in the shared group has the right to access the shared data uploaded by the first user to the data storage server, that is, the first user and the designated shared group. There is a sharing relationship among shared users.
  • the shared user in the shared group of the first user has the right to obtain the first shared data of the first user encrypted by the first shared key in the data storage server through the bound terminal, so the terminal bound by the shared user can The first shared data of the first user is obtained by decrypting the first shared key.
  • the first terminal When the first terminal detects that the shared group of the first user changes, the first terminal updates the first shared key, and calculates a new second shared key by using the first shared key.
  • the change of the shared group of the first user may be that the first user deletes or replaces the shared user in the shared group by using the first terminal.
  • the updated second shared key is sent to the shared user in the sharing group at this time.
  • the sending manner may be that the first terminal sends the second shared key to the key server, and the key server forwards the terminal to the shared user in the shared group, or the first terminal binds to the shared user by means of encrypted broadcast.
  • the terminal sends the second shared key, and the encryption mode can be determined by performing key negotiation between the first terminal and the terminal bound by the shared user.
  • the first user uploads the second shared data of the data storage server by using the first terminal, and the second shared data that is added by the first terminal after the sharing relationship is changed by the second share
  • the key is encrypted, and the encrypted second shared data and the second identification information of the second shared key are jointly sent to the data storage server.
  • the shared user in the shared group of the first user not only has the right to acquire the first shared data of the first user encrypted by the first shared key in the data storage server through the bound terminal, but also has the right to bind through the binding.
  • the terminal acquires the second shared data of the first user encrypted by the second shared key in the data storage server.
  • the terminal bound by the shared user that is not in the shared group at this time cannot acquire any shared data of the first user in the data storage server.
  • the shared user in a shared user sharing group changes within the shared group of the first user before the change occurs, the shared user in the shared group is deleted by the first user after the shared user changes, the shared user There is also only the first shared key used by the first terminal to encrypt the shared data, so even if the user obtains the second shared data through other means, since the terminal to which the user is bound does not have the second shared key, The second shared data cannot be decrypted by the second shared key, thereby ensuring the security of the first user sharing the data.
  • the first terminal encrypts the shared data of the first user by using a different shared key (the first shared key, the second shared key) before and after the change of the shared user of the shared group specified by the first user. Therefore, in order for the second terminal used by the shared user to acquire the shared data of the first user in the data storage server and decrypt using the correct shared key, the first terminal sends the shared data encrypted by the shared key to the data storage server. At the same time, the identification information of the shared key used to encrypt the shared data is sent to the data storage server at the same time. Therefore, the terminal bound by the shared user determines that the acquired shared data is the shared data of the data storage server that is sent to the first terminal before or after the sharing relationship changes, and uses the shared key corresponding to the identification information. Decrypt the shared data.
  • a different shared key the first shared key, the second shared key
  • the user 1 uploads the shared data of the user 1 encrypted by the first shared key to the data storage server 104 through the terminal A (smartphone) used by the user 1, and specifies the sharing group.
  • the user 3 and the user 5 are included as shared users having the right to access the shared data of the user 1.
  • the user 3 and the user 5 request the data storage server 104 to transmit the first shared data of the user 1 through the bound terminal C and the terminal E, respectively.
  • the terminal A bound by the user 1 calculates the updated second shared key by using the first shared key, and passes the The second shared key encrypts the second shared data that the user 1 then sends to the data storage server.
  • the operation of changing the shared user in the shared group includes one or more of the following: deleting the user 3, only the user 5 as the shared user, adding the user 2 as the shared user, or replacing the user 5 with the user 6 .
  • the above operations can be regarded as the first user adjusting and updating the relationship with the shared user, and changing the relationship between the first user and the shared user.
  • the first terminal may carry the identification information of the first shared key, such as the number “1”, to the shared data encrypted by the first shared key before the shared user of the shared group specified by the first user changes;
  • the shared data encrypted by the second shared key carries the identification information of the second shared key, such as the number “2”.
  • the shared user's terminal obtains the shared data whose identification information is "1" from the data storage server, the first shared data is decrypted by the first shared key.
  • the shared data whose identification information is "2" is obtained from the data storage server, the second shared data is decrypted by the second shared key.
  • the second user is a shared user in the shared group specified by the first user
  • the second terminal that is bound by the second user acquires the second shared second data.
  • a key and receiving the first identification information sent by the data storage server and the first shared data encrypted by the first shared key, calculating the first shared key according to the second shared key and the first identification information, and The first shared key corresponding to the first identification information decrypts the first shared data.
  • the first shared data specified by the first user is encrypted by the first shared key, and carries the identifier of the first shared key.
  • the information of the first terminal is changed by the first user in the shared group specified by the first user, the first user is encrypted by the second shared key and carries the second shared key.
  • the identification information is as the number "2". If the second terminal receives the first shared data whose identity information is "1" sent by the data storage server, and compares with the newly received second identifier information "2", the second terminal needs to pass the second share. After the key calculation and the first identification information are calculated to obtain the first shared key, the shared data is obtained by decrypting the first shared key.
  • the second terminal receives the second shared data whose identifier information is “2” sent by the data storage server, and compares with the newly received second identifier information “2”, and the two identifiers are the same, the shared secret is not calculated.
  • the key directly decrypts the shared data using the second shared key.
  • the second shared key acquired by the second terminal is a shared key used by the first terminal to update the shared data when the first user uploads the shared user in the shared group.
  • the second terminal may be stored in the storage device of the second terminal for use in subsequent calculations.
  • the manner in which the second terminal obtains the second shared key may include the following two types:
  • the first type the second terminal receives the second shared key sent by the key server.
  • the key server only sends the second shared key that is used by the first terminal when the first terminal uploads the shared data to the second terminal.
  • the first shared key and the shared key used by the first terminal before the first shared key are all calculated by the second terminal by using the second shared key and the identification information of the shared data.
  • the second terminal decrypts the shared data, the shared key is judged and calculated in real time, thereby improving the processing efficiency of the shared key.
  • the second terminal may send a query request to the key server before receiving the second shared key sent by the key server. The query request is used to query the key server whether the first terminal updates the shared key of the shared data.
  • the second terminal receives the second shared key of the first terminal encrypted broadcast.
  • the first terminal updates the first shared key to the second shared key
  • the shared user that is still in the shared group specified by the first user after the shared user changes in the shared group is bound to
  • the terminal encrypts and broadcasts the second shared key.
  • the encryption mode can be determined by performing key negotiation between the first terminal and the second terminal. In order to reduce the number of interactions between the terminal and the key server, the end-to-end data sharing is directly performed, and the processing efficiency of the shared key is improved.
  • the shared user in the shared group specified by the first user may change multiple times at different times, and the behavior of uploading the shared data may occur at any time, and the first terminal may pass the first share.
  • the second shared key is obtained after the key is calculated a plurality of times. And the terminal bound by the shared user also performs multiple calculations through the second shared key to calculate the first shared key.
  • the first shared key and the second shared key are calculated by using one update, and the calculation method and principle of multiple times are the same as the embodiment of the single update calculation, only For the superposition of the number of calculations, it will not be described again.
  • the first terminal detects that the shared user in the shared group specified by the first user is changed, the first terminal is configured according to the first used to encrypt the first shared data.
  • the shared key calculates the second shared key, and encrypts the second shared data specified by the user using the second shared key and uploads the data to the data storage server.
  • the second terminal is enabled to calculate the first shared key according to the first identification information and the second shared key, and decrypt the first shared data by using the first shared key. Therefore, the second terminal bound by the shared user added by the first user in the shared group can decrypt the second shared data specified by the user according to the second shared key, and can also be based on the second shared key and the first identifier. After calculating the first shared key, the first shared data specified by the user is decrypted according to the first shared key.
  • the shared user who is released from the shared relationship only has the first shared secret key, so even if the second shared data ciphertext newly added by the first user in the data storage server after releasing the sharing relationship is obtained through other means, The ciphertext is decrypted, thereby improving the security of the shared data, and ensuring that the shared user deleted from the shared group cannot obtain the second shared data that the first user specifies to upload after being deleted.
  • the first terminal calculates the second shared key according to the first shared key, and may output, by using a one-way function, the second shared key by using the first shared key as an input.
  • the one-way function may be a one-way trapdoor function, and in the above embodiment, only the first terminal bound by the first user has a trapdoor of the one-way trapdoor function, and the terminal used by other shared users. There is no trapdoor for the one-way trap function. Then, the first terminal inputs the first shared key and the trapdoor through the one-way trapdoor function, and calculates and outputs the second shared key.
  • the one-way trapdoor function is a special one-way function with a trapdoor, which has the characteristics of unidirectionality and trapdoor.
  • the naming of a one-way function is due to its fact that only one direction can be calculated.
  • the first terminal sends the first shared key x to the one-way trapdoor function f() having the trapdoor, and uses the trapdoor to cause the one-way trapdoor function to output the second shared key. y. Therefore, only the first terminal used by the first user uploading the shared data has a trapdoor function of the one-way trapdoor function, and only the first terminal can perform the one-way update of the shared key through the trapdoor, by the first shared secret.
  • the key is calculated to obtain the second shared key.
  • the other users may not use the first shared key to calculate the updated second shared key, but may calculate the second shared key by using the second shared key.
  • the first shared key before the shared key update.
  • the second identifier information is: the number of times the first terminal accumulates the one-way trapdoor function when the first terminal calculates the second shared key. information.
  • the first identification information is that the first terminal calculates the first shared key
  • the first terminal accumulates the number of times of using the one-way trapdoor function.
  • FIG. 3 is a schematic flowchart of an embodiment of a shared data processing method according to the present application, and shows a process for calculating and updating a shared key by using a one-way trapdoor function multiple times. The shared data sent by the first terminal of the different batches to the data storage server from top to bottom in FIG.
  • the shared data of the first batch is encrypted using the shared key AK1.
  • the shared key AK1 is calculated by the one-way trapdoor function to generate the shared key AK2, and the second added by the user after the AK2 is generated.
  • the shared data of the batch is encrypted by AK2.
  • the first terminal can be marked to have used the one-way trap function once.
  • the first terminal When the shared user in the shared group specified by the first user changes again, the first terminal generates a shared key AK3 through the one-way trap function according to the shared key AK2, and generates a third batch added by the user after the AK3 is generated.
  • the shared data of the second time is encrypted by AK3.
  • the first terminal is marked to have used the one-way trap function twice.
  • the first terminal When the shared user in the shared group specified by the first user changes again, the first terminal generates a shared key AK4 through the one-way trap function according to the shared key AK3, and the fourth batch added by the user after the AK4 is generated.
  • the shared data of the second time is encrypted by AK4.
  • the first terminal is marked to have used the one-way trap function three times. Then, when the second terminal used by the shared user acquires the shared key of the shared data of any batch in FIG. 3 and uses the one-way trapdoor function, the accumulated calculation times information may calculate the corresponding shared key according to the number of times information.
  • the identification information of the shared data acquired by the second terminal is “the number of times information is 1”. Then, the second terminal determines that the shared data is the second batch according to the “number of times information is 1”, and the shared key is AK2. Then, the shared user substitutes the shared key AK4 into the one-way trapdoor function to obtain the shared key AK3 in reverse, and substitutes the AK3 into the one-way trapdoor function to obtain the shared key AK2 in reverse.
  • the sharing user in the shared group specified by the first user changes, and the specific user may include: deleting, adding, or replacing the shared user in the shared group by the first user.
  • the user 1 uploads the shared data to the data storage server through the terminal A used by the user 1, and specifies that the sharing group includes two shared users, user 3 and user 5, and user 3 and user 5 It is authorized to request the shared data of the user 1 stored in the data storage server through the terminal C and the terminal E in the figure, respectively.
  • the shared user in the shared group of the user 1 changes, including one or more of the following operations: 1.
  • the user 1 releases the sharing relationship with the user 3 through the terminal A, and deletes the user 3 from the shared group. That is, the user 3 is prohibited from requesting the shared data of the user 1; 2.
  • the user 1 adds the sharing relationship between the user 1 and the user 2 through the terminal A, and joins the shared user 2 to the shared group, that is, the user 2 is allowed to request data through the smart phone.
  • the shared data of the user 1 in the storage server is stored; 3.
  • the user 1 replaces the shared relationship between the user 1 and the user 5 with the shared relationship between the user 1 and the user 6 through the terminal A, and replaces the user 5 included in the shared group with the user 6.
  • FIG. 4 is a schematic flowchart of an embodiment of a method for processing shared data in the present application.
  • the figure shows a relationship between a first user of a first terminal deleting a shared user in a shared group.
  • the user A uploads the first shared data encrypted by the first shared key and the first identification information of the first shared key to the data sharing system through the computer, and the user A specifies the shared group through the computer.
  • the shared users within are User B and User C.
  • the computer used by the user B and the user C has the right to obtain the first shared data encrypted by the first shared key of the user A in the data sharing system and the first identification information of the first shared key.
  • the user A releases the sharing relationship with the user C, and the user C is deleted from the shared group, that is, the user C is prohibited from accessing the shared data of the user A.
  • the computer used by the user A updates the first shared key to the second shared key, and uploads the second shared data and the second shared key encrypted by the second shared key to the data sharing system.
  • the computer used by the user B has the right to obtain the second shared data encrypted by the second shared key of the user A in the data sharing system and the second shared information of the second shared key, and the computer used by the user C has no right. Acquiring the second shared data encrypted by the second shared key of the user A in the data sharing system and the identification information of the second shared key.
  • the first shared key is sent to the key server for storage.
  • the first terminal sends the updated second shared key to the key server, and the second shared key is stored by the key server.
  • the original first shared key may be deleted, or the second shared key may be notified by the key server to all the terminals bound by the shared user having the shared relationship with the user of the first terminal.
  • two photos uploaded by the user 1 through the first terminal A are encrypted by the first shared key, and the user 5 and the user 6 are designated as shared users in the shared group.
  • the user 5 and the user 6 respectively have the right to view the two photos stored in the data storage server 104 through the terminal E and the terminal F, and request the first shared key from the key server to decrypt it.
  • the first terminal A updates the first shared key to the second shared key and uploads the second shared key to the key server.
  • the key server receives and stores the new second shared key. And sending a notification carrying the second shared key to the terminal F used by the user 6 according to the new sharing relationship, so that the user 6 can acquire the second shared key; and the terminal E used by the user 5 does not receive the key server.
  • the sharing relationship between the first user and the shared user of the first user changes, and the first terminal may send the change of the sharing relationship to the relationship management server.
  • the user 1 deletes the shared user of the user 5 in the shared group and joins the user 6 to the shared group
  • the user 6 acts as a shared user who has the right to access the shared data of the user 1.
  • the first terminal A may send the change of the relationship between the shared user 5 and the user 6 in the shared group of the user 1 to the shared server 102, so that the shared server 102 shares the user 1
  • the shared user 5 in the group is replaced with the user 6 and stored.
  • the sharing server determines that the user 5 is not in the shared group specified by the user 1, thereby refusing to provide the shared data of the user 1 to the terminal E.
  • the storage address of the data storage server and other related information is not in the shared group specified by the user 1, thereby refusing to provide the shared data of the user 1 to the terminal E.
  • FIG. 5 is a schematic flowchart diagram of an embodiment of a shared data processing method according to the present application. As shown in FIG. 5, the shared data processing method provided in this embodiment includes:
  • the first terminal stores, in the form of a data table, a shared user designated by the first user to access the shared data, and the terminal used by the shared user in the table may be regarded as a group of the terminal, the group.
  • the terminal in the group can access the shared data of the first user upload data storage server.
  • the user 1 uploads the shared data to the data storage server 104 through the terminal A it uses, and specifies that the user 3 and the user 5 have the right to access the shared data, and the user 3 and the user 5
  • the terminal C and the terminal E bound by the user identifier respectively access the shared data of the user 1 stored in the data storage server 104.
  • the user 1 needs to update the shared user relationship of the shared data, it includes one or more of the following operations: deleting the user 3, the user 2 as the shared user, and replacing the user 5 with the user 6.
  • the above operations can be regarded as the relationship of the first user adjusting the shared user whose shared data is updated, and the relationship between the first user and the shared user is changed.
  • the relationship between the first user and the shared user described in this embodiment is changed, which is equivalent to the change of the shared user in the shared group specified by the first user in the foregoing embodiment. That is, the first user has a sharing relationship with the shared user in the specified shared group.
  • the first terminal acquires an update of the sharing relationship by the first user, and determines that the change is changed to the shared server when the sharing relationship between the first user and the shared user changes.
  • the user of the first terminal that is, the user 1 replaces the shared user of the shared data of the user 1 from the user 5 to the user 6 on the application of the first terminal, and the first terminal acquires the update of the user to the shared user relationship.
  • the request to update the sharing relationship is transmitted to the sharing server 102, so that the sharing server 102 replaces the shared user of the shared data of the user 1 with the user 5 by the user 5 and stores it according to the received request.
  • the sharing server determines that the user 5 has no authority, and refuses to provide the user 5 with the storage address of the data storage server of the user 1 and other related information.
  • the first terminal in each example of the present application refers to a terminal that uploads and binds the user who uploads the shared data through its identification information.
  • the data sharing system in FIG. 1 can provide an account and a password to the user who applies for the service, and the user can access the system through the Internet through any terminal through the account password, and enjoy the server for data sharing.
  • the first terminal is bound to the identification information of the user.
  • the user 1 uploads the data that the user 1 needs to share through the smart phone bound by the user ID.
  • the smart phone A is the first terminal in the example.
  • the user After uploading the data, if user 1 releases the binding of the user identifier and smartphone A, the user logs in and binds to another desktop computer C through the user ID of the user 1, and views and manages the shared data through the desktop computer.
  • the desktop computer C is the first terminal in the example.
  • users of other labels in FIG. 1 can also upload shared data to the data storage server through the terminal whose user ID is bound, and then the owner of the shared data that has been uploaded is used by the owner.
  • the terminal is the first terminal in each example of the application.
  • the sharing server After updating the relationship between the first user and the shared user, the sharing server feeds back the sharing relationship update result to the first terminal to notify the first terminal to complete the update of the sharing relationship.
  • the sharing server sends a revocation notification to the terminal bound by the shared user whose access to the shared data is revoked, and after receiving the notification, the terminal deletes all related information such as the address and name of the previously stored shared data, so that the revoked shared user is deleted.
  • the terminal bound by its user ID can no longer access the shared data uploaded by the user of the first terminal stored by the data storage server.
  • the user 1 generates a first shared key through the bound first terminal, sends a first shared key to the key server, and uploads two photos encrypted by the first shared key to the data storage server, and the user 1
  • the designated user 5 is a shared user, and the shared user relationship is sent to the shared server, so that the terminal E used by the user 5 can obtain the first shared key from the key server and the user 1 from the data storage server after the authentication is passed through the shared server. Two photos encrypted by the first shared key.
  • the user 1 changes the sharing relationship, and the shared user is replaced by the user 6 with the user 5 by sending the sharing relationship change message to the sharing server by the first terminal, and the first terminal updates the shared key for encrypting the shared data, and the first The shared key is updated to the second shared key.
  • the user 5 cannot authenticate through the shared server through the server to which the user binds, and the two photos encrypted by the first shared key uploaded by the user 1 cannot be obtained from the data storage server.
  • the first terminal encrypts the two compressed packets by using the second shared key, and then uploads the data storage server.
  • the user 1 encrypts two photos and two compressed packets respectively uploaded before and after the first terminal by using different shared keys, wherein the two photos are also encrypted by using the first shared key before the shared key update, and No changes are made after the shared key is updated; the two compressed packages encrypt the second shared key after the shared key is updated.
  • the user 5 that deletes the sharing relationship can decrypt the two photos through the previous first shared key in the terminal E even if the shared data of the user 1 in the data storage server is acquired by means of cracking or the like, and the user 1 is After the two compressed packets uploaded by the user 5 are deleted by the second shared key, even if the user 5 obtains the ciphertext data of the shared data of the user 1, the user cannot obtain two decryptions by using the second shared key.
  • the original data of the package is compressed, thereby improving the security of the shared data by updating the shared key used to encrypt the shared data.
  • the first terminal may update the first shared key to the second shared key by using a one-way trapdoor function.
  • the one-way trapdoor function is a special one-way function with a trapdoor, which has unidirectionality and features of trapdoors.
  • the naming of a one-way function is due to its fact that only one direction can be calculated.
  • the first terminal has a trapdoor for the one-way trapdoor function, and the first terminal sends the first shared key x to the one-way trapdoor function f() having the trapdoor, and uses the trapdoor to make the single
  • the second shared key y is output to the trapdoor function.
  • the first terminal used by the user uploading the shared data has a trapdoor function of the one-way trapdoor function, and only the first terminal can perform the one-way update of the shared key through the trapdoor, which is calculated by the first shared key.
  • Get the second shared key The other shared users cannot calculate the updated second shared key by using the first shared key, whether they are designated by the user of the first terminal and authorized as the shared user, but the shared key can be shared by the second shared key.
  • the first shared key before the key is updated.
  • the step of calculating, by using the first shared key, the second shared key is performed by the first terminal used by the user who uploads the shared data, and in order to implement the method of the present application, an agent that specifically calculates the shared key may also be configured.
  • the server performs derivation of the key, and the first terminal interacts with the proxy server each time and acquires the updated second shared key.
  • the proxy server can provide the shared key calculation and update service for all terminals that upload data, which are all within the protection scope of the present application.
  • the first terminal sends the updated second shared key to the key server, and the second shared key is stored by the key server, and the original first shared key is deleted. Specifically, when the first user updates the relationship of the shared user, the first terminal updates the first shared key to the second shared key, and encrypts the subsequently uploaded shared data by using the second shared key; the first terminal may pass the secret
  • the key server notifies the second shared key to other shared users that have not been deleted. For example, the two photos uploaded by the user 1 through the first terminal are encrypted by the first shared key, and the user 5 and the user 6 are designated as the shared user to view. After the user 1 deletes the sharing relationship of the user 5, the first terminal updates the first shared key to the second shared key, and uploads the second shared key to the key server.
  • the key server receives and stores the new second shared key, and sends a notification carrying the second shared key to the terminal F bound to the user 6 according to the new sharing relationship, so that the user 6 can acquire the second shared key.
  • the terminal E bound by the user 5 does not have the right to acquire the second shared key.
  • the key server needs to manage the shared key of each user, and the shared data of each user and the shared key of the user can be distinguished by the identification information of the user. For example, the latest updated shared key of the first shared data uploaded by the terminal A bound by the user 1 is 123, and the latest updated shared key of the second shared data uploaded by the terminal B bound by the user 2 is ABC.
  • the key server stores the mapping relationship between "user 1 - first shared data - 123" and "user 2 - second shared data - ABC".
  • the terminal E bound by the user 5 requests the user 1 or the first from the key server.
  • the key server feeds back "123”.
  • the terminal F bound by the user 6 requests the shared key corresponding to the user 2 or the second shared data from the key server, the key server feeds back " ABC".
  • the method of transmitting the second shared key in this step is to notify the shared user through the specially set key server.
  • the user can also: 1. After the key server sends the notification to the shared user, each shared user The terminal queries the key server for the latest shared key of the shared data of the first user before requesting the shared data. 2. The terminal of each shared user actively queries the key server for the shared data of the first user. Whether to update the shared key; 3. After the first terminal derives a new shared key according to the first shared key, directly transmits the first shared terminal of the shared user who has access to the shared data by means of broadcast encryption or the like
  • the shared data processing method of the present embodiment is not limited, and the shared data is not limited.
  • S407 The first terminal feeds back the update result of the sharing relationship to the user, prompts that the first user sharing relationship has been changed, and uploads the newly added shared data with the updated key.
  • S408 The first user uploads the newly added shared data to the first terminal, or specifies part of the data in the first terminal as the newly added shared data.
  • S409 The first terminal encrypts the shared data added by the user by using the second shared key.
  • S4010 The first terminal uploads the newly added shared data encrypted by the second shared key to the data storage server.
  • the shared data uploaded by the first user stored in the data storage server by the first terminal is different before and after the sharing relationship is updated. That is, the shared data of the first user before the change of the shared user's relationship is encrypted by the first shared key; the shared data of the first user after the change of the shared user's relationship is encrypted by the second shared key.
  • the shared data is encrypted by different shared keys before and after the change of the shared user relationship of the data shared by the first user, in order to enable the shared user terminal of the shared data to receive the shared data and decrypt using the correct shared key.
  • the identifier information of the second shared key is added to the newly added shared data, so that the second terminal used by the shared user obtains
  • the identification information indicates that the shared data is the shared key of the batch in which the first terminal is located, thereby decrypting the shared data by using the shared key corresponding to the identification information.
  • the shared data encrypted by the first shared key carries the identification information of the first shared key, such as the number “1”, and the relationship of the shared user is changed in the first user.
  • the shared key After the shared key is updated, the shared data encrypted by the second shared key carries the identification information of the second shared key, such as the number “2”.
  • the shared user After the shared user receives the shared data whose identification information is "1", it compares with the newly received second shared key identification information "2", and the result shows that the shared key identification information used by the shared data is greater than
  • the identification information of the second shared key is small, that is, the second shared key needs to be forwarded once by the one-way trapdoor function to obtain the first shared key, and then the shared data is decrypted by the first shared key. If the shared user receives the shared data with the identification information of “2” and compares the identification information “2” of the newly received second shared key, the second shared share is directly used without calculating the shared key. The key decrypts the shared data. It should be noted that, in this embodiment, the first shared key to the second shared key are respectively calculated by using one update calculation.
  • the user uploading the shared data through the first terminal may perform the process of uploading the shared data.
  • the first shared key is obtained by the calculation of the one-time trapdoor function, and the second shared key is obtained.
  • the calculation method and principle are the same as those in the foregoing embodiment, and are not described again.
  • S4012 The first terminal feeds back, to the first user, an upload result of the newly added shared data. So far, the first terminal completes the update of the shared key and encrypts the newly uploaded shared data of the first user using the updated shared key.
  • the first user For the shared user who is released from the shared relationship, after the first user releases the sharing relationship with the user, only the first shared key before the shared relationship is released, and the first terminal is not updated after the shared relationship is released.
  • the second shared key Therefore, even if the ciphertext of all the shared data can be obtained through a vulnerability or other way of the data storage server, the plaintext of the shared data before the unshared relationship can be decrypted and obtained by the first shared key, and the decryption cannot be decrypted.
  • the first user After the shared relationship is released, the first user newly uploads the shared data ciphertext.
  • the terminal used by the shared user that has not been unshared will be distributed to the updated second share.
  • the key so the terminal used by the shared user that is not unshared can decrypt the shared data added by the first user after modifying the sharing relationship by using the second shared key, and can also decrypt the first terminal by using the second shared key.
  • the user edits the shared data before the sharing relationship.
  • the first shared key may be called from the storage device by the terminal used by the shared user that is not unshared, or calculated by the second shared key through the one-way trapdoor function as described in the above embodiment. This is not limited.
  • the shared data is stored locally from the data storage server, and then the shared data is stored locally, and then the first terminal will be the first share.
  • the shared key of the previous shared data is not changed for the first shared key, and the shared user that has not been unshared does not need to reacquire the previously acquired shared data, but only It is necessary to incrementally acquire the shared data added by the user of the first terminal after changing the shared user relationship, and decrypt using the second shared key.
  • the terminal used by the shared user is distributed with the second shared key updated by the first terminal, and may be shared by the second shared secret according to the same one-way trapdoor function as the first terminal.
  • the key calculates the first shared key before the update.
  • the shared data uploaded by the first user is obtained from the data storage server, and the shared data is decrypted by using the shared key corresponding to the identification information according to the identification information of the shared key of the shared data.
  • the detailed process is as shown in FIG. 5 below. example.
  • the first user uploading shared data through the first terminal may perform multiple changes of the sharing relationship in the process of uploading the shared data, and the shared key may be updated multiple times, so
  • the shared user and the newly added shared user that are not unshared, the received ciphertext of the shared data also carries the identification information of the shared key used to encrypt the shared data, and the terminal determines the update of the shared key according to the identification information.
  • the number of times, and according to the latest second shared key, the one-way trap function is forwarded to the corresponding number of times to obtain the previous shared key (the first shared key is calculated once), and the corresponding information is identified by the identification information.
  • the shared key decrypts the shared data.
  • FIG. 6 is a schematic flowchart of an embodiment of a shared data processing method according to the present application.
  • the embodiment shown in FIG. 6 shows a second user added as a shared user.
  • the processing flow of the shared data by the terminal specifically includes:
  • the second user is the shared user specified by the first user, and the second terminal that is bound by the user identifier of the second user is used to view the shared data of the first user, where the second terminal in each example of the present application refers to: upload sharing.
  • the terminal bound by the shared user receives the related notification message, so the second user can view the shared data of the first user uploading the data storage server through the second terminal.
  • the sharing server determines that the second user bound by the second terminal is allowed to access the shared data by the first user, and returns the sharing permission to the second terminal, where the sharing permission may be the shared data uploaded by the first user in the data storage server.
  • the storage location in the storage and other stored related information causes the second terminal to request data from the data storage server according to the storage information.
  • S504 The second terminal requests a second shared key from the shared server, where the second shared key is a newly used shared key when the first terminal uploads the shared data of the first user.
  • the key server sends the second shared key to the second terminal.
  • the key server only sends the second shared key that is used by the first terminal when the first terminal uploads the shared data to the second terminal.
  • the previous first shared key is not sent to the second terminal, but is calculated by the second terminal through the second shared key and the one-way trapdoor function to reduce the amount of communication data between the server and the terminal, and reduce
  • the second terminal determines and calculates the shared key in real time when the second terminal decrypts the shared data for the storage space of the shared key, thereby improving the processing efficiency of the shared key.
  • S506 The second terminal requests the data storage server to share the data according to the information of the shared data received in S503.
  • the data storage server sends the requested ciphertext of the shared data uploaded by the first user to the second terminal, and the identification information of the shared key used to encrypt the shared data.
  • the shared data is encrypted by different shared keys before and after the change of the shared user relationship of the data shared by the user of the first terminal, and the shared user terminal of the shared data needs to use the correct shared key after receiving the shared data.
  • Decrypt When the second terminal used by the second user acquires the shared data uploaded by the first terminal in the data storage server, it is known by the identification information that the shared data is the shared key of the batch of the first terminal, and thus the identifier and the identifier are used.
  • the shared key corresponding to the information decrypts the shared data. For example, before the first user changes the relationship of the shared user, the shared data encrypted by the first shared key carries the identification information of the first shared key, such as the number “1”, and the shared user is changed in the first user.
  • the shared data encrypted by the second shared key carries the identification information of the second shared key, such as the number "2".
  • the second terminal receives the shared data whose identification information is “1”, it compares with the newly received second shared key identification information “2”, and the shared key identification information used by the shared data is displayed.
  • the identification information of the shared key is small, that is, the second shared key needs to be forwarded once by the one-way trapdoor function to obtain the first shared key, and then the shared data is decrypted by the first shared key.
  • the second shared terminal does not need to calculate the shared key, and directly uses the second shared secret.
  • the key decrypts the shared data.
  • the first shared key to the second shared key are respectively calculated by using one update calculation.
  • the user uploading the shared data through the first terminal may perform the process of uploading the shared data.
  • the first shared key may obtain the second shared key after multiple calculations of the one-way trapdoor function, and the second terminal may perform multiple times by using the second shared key.
  • the calculation of the gate function can obtain the first shared key, and the calculation manner and principle thereof are the same as those in the above embodiment, and will not be described again.
  • S509 The second terminal decrypts the ciphertext of the shared data according to the first shared key to obtain the plaintext data of the shared data.
  • the second terminal presents the acquired shared data to the second user. So far, the second user completes the acquisition of the shared data ciphertext of the first user, the update of the shared key, and the decryption of the shared data by using the second terminal, and finally obtains the ciphertext of the shared data.
  • the shared data processing method provided by the present application encrypts the shared data of the terminal uploading server by using a shared key to ensure that the shared data is encrypted away from the terminal, thereby ensuring the security of the shared data from the end to the end. And when the shared user relationship of the shared data changes, the shared key is updated by the one-way trapdoor function, so that the user who has revoked the sharing right cannot decrypt the new shared data through other means, thereby updating A shared key used to encrypt shared data further enhances the security of shared data.
  • FIG. 7 is a schematic structural diagram of an embodiment of a communication device according to the present application.
  • the terminal 70 in this embodiment includes: an obtaining module 701, a sending module 702, and a processing module 703.
  • the obtaining module 701 is configured to acquire the first shared data that is specified by the first user
  • the sending module 702 is configured to send the first identifier information and the first shared data that is encrypted by using the first shared key to the data storage server, where the first The identification information is used to identify the first shared key
  • the processing module 703 is configured to: when detecting that the shared user in the shared group specified by the first user changes, calculate the second shared key according to the first shared key, where, the sharing The terminal bound to the shared user in the group has the right to acquire the shared data of the first user from the data storage server;
  • the obtaining module 701 is further configured to acquire the second shared data specified by the first user;
  • the processing module 703 is further configured to: Sending the second identification information and the second shared data encrypted by the second shared key to the data
  • the processing module 703 is specifically configured to: if it is detected that the shared user in the shared group specified by the first user changes, calculate the output by using the first shared key as a input by using a one-way function. The second shared key.
  • the one-way function is a one-way trapdoor function
  • the first terminal has a trapdoor of a one-way trapdoor function
  • the processing module 703 is specifically configured to: when detecting that the shared user in the shared group specified by the first user changes, calculate, output the second shared key by using the first shared key and the trapdoor as input by the one-way trapdoor function .
  • the first identifier information is the number of times of using the one-way trapdoor function when the first terminal calculates the first shared key
  • the second identifier information is that the first terminal calculates the second shared key. The number of times the one-way trapdoor function is used is accumulated.
  • the shared user in the shared group specified by the first user changes, including: deleting, replacing, by the first user, the shared user in the shared group.
  • the communication device of the embodiment shown in FIG. 7 can be used to perform the technical solution of the foregoing method embodiment, and the implementation principle and the technical effect are similar, and details are not described herein again.
  • each module of the above communication device is only a division of a logical function, and the actual implementation may be integrated into one physical entity in whole or in part, or may be physically separated.
  • these modules can all be implemented by software in the form of processing component calls; or all of them can be implemented in the form of hardware; some modules can be implemented by software in the form of processing component calls, and some modules are realized by hardware.
  • the control module may be a separate processing component, or may be integrated in a communication device, such as a chip of a terminal device, or may be stored in a memory of the communication device in the form of a program, by a certain communication device.
  • a processing component calls and executes the functions of each of the above modules.
  • the implementation of other modules is similar.
  • each step of the above method or each of the above modules may be completed by an integrated logic circuit of hardware in the processor element or an instruction in a form of software.
  • the above modules may be one or more integrated circuits configured to implement the above methods, such as one or more Application Specific Integrated Circuits (ASICs), or one or more microprocessors (digital) Singnal processor (DSP), or one or more Field Programmable Gate Array (FPGA).
  • ASICs Application Specific Integrated Circuits
  • DSP digital Singnal processor
  • FPGA Field Programmable Gate Array
  • the processing component can be a general purpose processor, such as a central processing unit (CPU) or other processor that can invoke the program.
  • these modules can be integrated and implemented in the form of a system-on-a-chip (SOC).
  • SOC system-on-a-chip
  • FIG. 8 is a schematic structural diagram of an embodiment of a communication device according to the present application.
  • the communication device 80 in this embodiment includes an acquisition module 801 and a processing module 802.
  • the obtaining module 801 is configured to acquire a second shared key, where the second shared key is a first user that is bound by the first user according to the change of the shared user in the shared group specified by the first user.
  • the first shared key is used by the first terminal to encrypt the first shared data of the first user, and the second shared key is used by the first terminal to encrypt the first user specified
  • the second shared data the terminal bound by the shared user in the shared group has the right to obtain the shared data of the first user from the data storage server;
  • the obtaining module 801 is further configured to receive the first identifier information sent by the data storage server And the first shared data encrypted by the first shared key, where the first identification information is used to identify the first shared key;
  • the processing module 802 is configured to calculate the first shared secret according to the second shared key and the first identification information.
  • the key module is further configured to decrypt the first shared data according to the first shared key.
  • the processing module 802 is specifically configured to calculate, by using a one-way function, the second shared key and the first identification information as input, and output the first shared key.
  • the one-way function is a one-way trapdoor function
  • the first terminal has a trapdoor of a one-way trapdoor function
  • the first identifier information is the number of times of using the one-way trapdoor function when the first terminal calculates the first shared key
  • the second identifier information is that the first terminal calculates the second shared key. The number of times the one-way trapdoor function is used is accumulated.
  • the communication device of the embodiment shown in FIG. 8 can be used to perform the technical solution of the foregoing method embodiment, and the implementation principle and the technical effect are similar, and details are not described herein again.
  • each module of the above communication device is only a division of a logical function, and the actual implementation may be integrated into one physical entity in whole or in part, or may be physically separated.
  • these modules can all be implemented by software in the form of processing component calls; or all of them can be implemented in the form of hardware; some modules can be implemented by software in the form of processing component calls, and some modules are realized by hardware.
  • the control module may be a separate processing component, or may be integrated in a communication device, such as a chip of a terminal device, or may be stored in a memory of the communication device in the form of a program, by a certain communication device.
  • a processing component calls and executes the functions of each of the above modules.
  • the implementation of other modules is similar.
  • each step of the above method or each of the above modules may be completed by an integrated logic circuit of hardware in the processor element or an instruction in a form of software.
  • the above modules may be one or more integrated circuits configured to implement the above methods, such as one or more Application Specific Integrated Circuits (ASICs), or one or more microprocessors (digital) Singnal processor (DSP), or one or more Field Programmable Gate Array (FPGA).
  • ASICs Application Specific Integrated Circuits
  • DSP digital Singnal processor
  • FPGA Field Programmable Gate Array
  • the processing component can be a general purpose processor, such as a central processing unit (CPU) or other processor that can invoke the program.
  • these modules can be integrated and implemented in the form of a system-on-a-chip (SOC).
  • SOC system-on-a-chip
  • FIG. 9 is a schematic structural diagram of an embodiment of a terminal device according to the present application.
  • the terminal device 90 includes a processor 901, a memory 902, and an interface 903.
  • the memory 902 is configured to store a computer program; the processor 901 calls the computer program, and when the computer program is executed, is configured to: acquire the first shared data specified by the first user; and send the first data to the data storage server An identification information and first shared data encrypted by the first shared key, where the first identification information is used to identify the first shared key; if it is detected that the shared user in the shared group specified by the first user changes, Calculating a second shared key according to the first shared key, where the terminal bound by the shared user in the shared group has the right to acquire the shared data of the first user from the data storage server; and obtain the second specified by the first user. Sharing the data; transmitting the second identification information and the second shared data encrypted by the second shared key to the data storage server, wherein the second identification information is used to identify the second shared key.
  • the processor 901 is specifically configured to: when the shared user in the shared group specified by the first user is changed, use the first shared key as the input by using a one-way function. , calculate the output second shared key.
  • the one-way function is a one-way trapdoor function
  • the first terminal has a trapdoor of a one-way trapdoor function
  • the processor 901 is specifically configured to: when detecting that the shared user in the shared group specified by the first user changes, calculate, output the second shared key by using the first shared key and the trapdoor as input by the one-way trapdoor function .
  • the first identifier information is the number of times of using the one-way trapdoor function when the first terminal calculates the first shared key
  • the second identifier information is that the first terminal calculates the second shared key. The number of times the one-way trapdoor function is used is accumulated.
  • the shared user in the shared group specified by the first user changes, including: deleting, replacing, by the first user, the shared user in the shared group.
  • the memory 902 is used to store the program of the above method embodiment, or the modules of the embodiment shown in FIG. 7, and the processor 901 calls the program to perform the operations of the above method embodiments to implement the modules shown in FIG.
  • the above modules may also be implemented by being embedded in a chip of the terminal device in the form of an integrated circuit. And they can be implemented separately or integrated. That is, the above modules may be configured to implement one or more integrated circuits of the above method, such as: one or more Application Specific Integrated Circuits (ASICs), or one or more microprocessors (digital singnal processor) , DSP), or one or more Field Programmable Gate Arrays (FPGAs).
  • ASICs Application Specific Integrated Circuits
  • DSP digital singnal processor
  • FPGAs Field Programmable Gate Arrays
  • FIG. 10 is a schematic structural diagram of an embodiment of a terminal device according to the present application.
  • the terminal device 100 includes a processor 1001, a memory 1002, and an interface 1003.
  • the memory 1002 is configured to store a computer program; the processor 1001 invokes the computer program, and when the computer program is executed, is configured to: acquire a second shared key, where the second shared key is detected
  • the shared user in the shared group specified by the first user changes, and the first terminal bound by the first user calculates the second shared key according to the first shared key, and the first shared key is used for the first terminal encryption.
  • the second shared key is used by the first terminal to encrypt the second shared data specified by the first user, and the terminal bound by the shared user in the shared group is authorized to obtain the data from the data storage server.
  • the key and the first identification information calculate a first shared key; the first shared data is decrypted according to the first shared key.
  • the processor 1001 is specifically configured to calculate, by using a one-way function, the second shared key and the first identification information as input, and output the first shared key.
  • the one-way function is a one-way trapdoor function
  • the first terminal has a trapdoor of a one-way trapdoor function
  • the first identifier information is the number of times of using the one-way trapdoor function when the first terminal calculates the first shared key
  • the second identifier information is that the first terminal calculates the second shared key. The number of times the one-way trapdoor function is used is accumulated.
  • the memory 1002 is configured to store a program for implementing the above method embodiments, or the modules of the embodiment shown in FIG. 8, and the processor 1001 calls the program to perform the operations of the above method embodiments to implement the modules shown in FIG.
  • the above modules may also be implemented by being embedded in a chip of the terminal device in the form of an integrated circuit. And they can be implemented separately or integrated. That is, the above modules may be configured to implement one or more integrated circuits of the above method, such as: one or more Application Specific Integrated Circuits (ASICs), or one or more microprocessors (digital singnal processor) , DSP), or one or more Field Programmable Gate Arrays (FPGAs).
  • ASICs Application Specific Integrated Circuits
  • DSP digital singnal processor
  • FPGAs Field Programmable Gate Arrays
  • FIG. 11 is a schematic structural diagram of an embodiment of a terminal device according to the present application.
  • the terminal device may be a mobile phone.
  • the mobile phone 11 includes: a radio frequency (RF) circuit 110, a power source 120, a processor 130, a memory 140, an input unit 150, and a display unit. 160, sensor 170, audio circuit 180, and wireless fidelity (WIFI) module 190 and other components.
  • RF radio frequency
  • WIFI wireless fidelity
  • the handset structure illustrated in Figure 10 does not constitute a limitation to a handset, and may include more or fewer components than those illustrated, or some components may be combined, or different components may be arranged.
  • the main components involved in the present application include a radio frequency circuit 110, a processor 130, a wireless module 190, and a software design on an operating system running on the processor 130.
  • the components of the mobile phone 11 will be specifically described below with reference to FIG.
  • the RF circuit 110 can be used for receiving and transmitting signals during the transmission or reception of information or during a call. For example, after receiving the downlink information of the base station, the RF circuit 110 transmits the downlink information to the processor 130, and the processor 130 processes the downlink information.
  • the RF circuit 110 can also communicate with the network and other devices via wireless communication.
  • the mobile phone 11 in FIG. 11 can serve as the first terminal in the foregoing embodiment, and send the first identification information and the first shared data encrypted by the first shared key to the data storage server through the radio frequency circuit 110, or pass the radio frequency.
  • the circuit 110 transmits second identification information and second shared data encrypted by the second shared key to the data storage server.
  • the mobile phone 11 in FIG. 11 can be used as the second terminal in the foregoing embodiment, and receives the first identification information sent by the data storage server and the first shared data encrypted by the first shared key through the radio frequency circuit 110.
  • the memory 140 can be used to store software programs and modules, and the processor 130 executes various functional applications and data processing of the mobile phone 11 by running software programs, modules, operating system firmware codes and the like stored in the memory 140, such as the communication device of the above embodiment.
  • the execution of functions such as obtaining modules, sending modules, and processing modules.
  • the memory 140 may mainly include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application required for at least one function (such as a network access function, a shared data display function, etc.), and the like; the storage data area may be stored. Data created according to the use of the mobile phone 11 (such as shared data, shared key, etc.) and the like.
  • memory 140 can include high speed random access memory, and can also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other volatile solid state storage device.
  • the input unit 150 can be configured to receive input numeric or character information and to generate key signal inputs related to user settings and function control of the handset 11.
  • the display unit 160 can be used to display information input by the user or information provided to the user and various menus of the mobile phone 11.
  • the display unit 160 may include a display panel 161.
  • the display panel 161 may be configured in the form of an LCD, an OLED, or the like.
  • the touch panel 151 can cover the display panel 161. When the touch panel 151 detects a touch operation on or near the touch panel 151, the touch panel 151 transmits to the processor 130 to determine the type of the touch event, and then the processor 130 according to the touch event. The type provides a corresponding visual output on display panel 161.
  • the processor 130 is the control center of the handset 11, connecting various portions of the entire handset using various interfaces and lines, by running or executing software programs and/or modules stored in the memory 140, and recalling data stored in the memory 140, The various functions and processing data of the mobile phone 11 are executed, thereby realizing various services based on the mobile phone.
  • the mobile phone 11 in FIG. 11 can be used as the first terminal in the foregoing embodiment, and the processor 130 of the mobile phone 11 displays the interface and menu of the shared data to the user through the display unit 160, and the user can pass the input unit 150.
  • the processor 130 issues a command after performing data processing, and controls the radio frequency circuit 110 to send the first shared key encryption to the data storage server.
  • a shared data The user can also specify, through the input unit 150, that the shared user within the sharing group has changed. Then, the input signal of the input unit 150 is transmitted to the processor 130, and the processor 130 updates the first shared key to obtain a second shared key.
  • the user can also specify the second shared data through the input unit 150.
  • the processor 130 issues a command after performing data processing, and controls the radio frequency circuit 110 to send the data to the data storage server.
  • the second shared data encrypted by the shared key.
  • the first shared data and the second shared data specified by the user may be data stored in the memory 140.
  • the mobile phone and the mobile terminal 101 in FIG. 11 can be used as the second terminal in the foregoing embodiment, and receive, by using the radio frequency circuit 110, the first identification information sent by the data storage server and the first shared data encrypted by the first shared key, and the processing is performed.
  • the identifier 130 decrypts the first shared data by using the first shared key.
  • the processor 130 may also issue a command to the user to display the first shared data to the user after the data processing is performed.
  • the processor 103 may receive the second shared key transmitted by the server through the radio frequency circuit 110, or the processor 103 may read the second shared key from the memory 140.
  • WIFI belongs to short-range wireless transmission technology.
  • the mobile phone 11 can help users to send and receive emails, browse web pages and access streaming media through the WIFI module 190, and provides wireless broadband Internet access for users.
  • FIG. 11 shows the WIFI module 190, it can be understood that it does not belong to the essential configuration of the mobile phone 11, and may be omitted as needed within the scope of not changing the essence of the invention.
  • the handset 11 also includes a power source 120 (such as a battery) that powers the various components that can be logically coupled to the processor 130 via a power management system to enable management of charging, discharging, and power consumption functions through the power management system.
  • a power source 120 such as a battery
  • the mobile phone 11 may further include a camera, a Bluetooth module, and the like, and details are not described herein.
  • the terminal of the embodiment shown in FIG. 11 can be used to implement the technical solutions of the foregoing method embodiments, and the implementation principles and technical effects are similar, and details are not described herein again.
  • the embodiment of the present application further provides a computer readable storage medium, where the computer readable storage medium stores a computer program, and when executed on the computer, causes the computer to execute the network switching method described in the foregoing embodiment.
  • the computer program product includes one or more computer instructions.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable device.
  • the computer instructions can be stored in a computer readable storage medium or transferred from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions can be from a website site, computer, server or data center Transfer to another website site, computer, server, or data center via wired (eg, coaxial cable, fiber optic, digital subscriber line) or wireless (eg, infrared, wireless, microwave, etc.).
  • the computer readable storage medium can be any available media that can be accessed by a computer or a data storage device such as a server, data center, or the like that includes one or more available media.
  • the usable medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (eg, a solid state hard disk, Solid State Disk), or the like.
  • a magnetic medium eg, a floppy disk, a hard disk, a magnetic tape
  • an optical medium eg, a DVD
  • a semiconductor medium eg, a solid state hard disk, Solid State Disk

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Storage Device Security (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

本申请提供一种共享数据处理方法、通信装置及通信设备。其中方法包括：第一终端获取第一用户指定的第一共享数据；第一终端向数据存储服务器发送第一标识信息和通过第一共享密钥加密的第一共享数据；若检测到第一用户指定的共享群组内的共享用户发生变化，第一终端根据第一共享密钥计算第二共享密钥；第一终端获取第一用户指定的第二共享数据；第一终端向数据存储服务器发送第二标识信息和通过第二共享密钥加密的第二共享数据。从而提高了共享数据的安全性，确保了在从共享群组内被删除的共享用户无法获取在被解除共享关系后，第一用户指定上传的第二共享数据。

Description

共享数据处理方法、通信装置及通信设备
本申请要求于2018年03月28日提交中国专利局、申请号为201810266990.1、申请名称为“共享密钥更新方法、装置及系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及安全技术领域，本申请的技术领域尤其涉及一种共享数据处理方法、通信装置及通信设备。
背景技术
数据共享是一种常见的业务形式，可以让不同地方使用不同终端的用户能够读取他人共享的数据并对共享数据进行各种操作、运算和分析，多应用于基于好友关系的照片共享、基于同事关系的文档共享等。数据共享需要由共享数据的用户通过终端设备将共享数据上传到数据存储服务器，并由该用户指定共享群组，只有共享群组内的共享用户所绑定并使用的终端设备有权能够从数据存储服务器获取并查看用户上传的共享数据。
现有技术中，为了确保共享数据的安全，用户所使用的终端设备在上传共享数据前先创建一个共享密钥，并使用该共享密钥对用户指定上传到数据存储服务器的共享数据进行加密。并且，终端设备在创建共享密钥后，将共享密钥上传并存储在密钥服务器，被指定的共享用户从密钥服务器获取该密钥后方可解密用户的共享数据。因此，在现有技术中，数据存储服务器只存储用户共享数据的密文，而密钥服务器只存储用于加密共享数据的共享密钥，即使数据存储服务器由于安全问题被攻破也只泄露共享数据的密文而不会直接泄露用户数据。
采用现有技术，当上传共享数据的用户调整与共享群组内的共享用户的共享关系，将共享群组内原有的一个或多个共享用户删除以解除共享关系，使得该些被解除共享关系的共享用户没有权限从数据存储服务器接收并查看共享数据。由于该些被解除共享关系的共享用户的终端设备仍然拥有被解除共享关系前的共享密钥，一旦数据存储服务器被攻破，还是能够从中查看并解密在被解除共享关系后共享数据的用户上传的共享数据，造成了共享数据的安全性不高。因此，如何确保被解除共享关系的用户无法获取在被解除共享关系后共享数据的用户上传的共享数据，是目前亟待解决的技术问题。
发明内容
本申请提供一种共享数据处理方法、通信装置及通信设备，确保了被解除共享关 系的用户无法获取在被解除关系后共享数据的用户上传的共享数据，从而提高了共享数据的安全性。
本申请第一方面提供一种共享数据处理方法，包括：
第一终端获取第一用户指定的第一共享数据；
所述第一终端向数据存储服务器发送第一标识信息和通过第一共享密钥加密的所述第一共享数据，其中，所述第一标识信息用于标识所述第一共享密钥；
若检测到所述第一用户指定的共享群组内的共享用户发生变化，所述第一终端根据所述第一共享密钥计算第二共享密钥，其中，所述共享群组内的共享用户所绑定的终端有权从所述数据存储服务器中获取所述第一用户的共享数据；
所述第一终端获取所述第一用户指定的第二共享数据；
所述第一终端向所述数据存储服务器发送第二标识信息和通过所述第二共享密钥加密的所述第二共享数据，其中，所述第二标识信息用于标识所述第二共享密钥。
在第一方面的另一种可能实现方式中，所述第一终端根据所述第一共享密钥计算第二共享密钥，包括：
所述第一终端通过单向函数以所述第一共享密钥为输入，计算输出所述第二共享密钥。
在第一方面的另一种可能实现方式中，所述单向函数为单向陷门函数，所述第一终端拥有所述单向陷门函数的陷门；
所述第一终端通过单向函数以所述第一共享密钥为输入计算输出所述第二共享密钥，包括：
所述第一终端通过所述单向陷门函数以所述第一共享密钥和所述陷门为输入，计算输出所述第二共享密钥。
在第一方面的另一种可能实现方式中，所述第一标识信息为所述第一终端计算所述第一共享密钥时累计使用所述单向陷门函数的次数信息；
所述第二标识信息为所述第一终端计算所述第二共享密钥时，所述第一终端累计使用所述单向陷门函数的次数信息。
在第一方面的另一种可能实现方式中，第一用户指定的共享群组内的共享用户发生变化，包括：
所述第一终端的用户对所述共享群组内的共享用户进行删除或替换操作。
综上，在本申请第一方面提供的共享数据处理方法中，第一终端在检测到绑定的第一用户指定的共享群组内的共享用户发生变化时，根据用于加密第一共享数据的第一共享密钥计算第二共享密钥，并使用第二共享密钥对用户所指定的第二共享数据进行加密后上传至数据存储服务器。使得仅拥有第一共享密钥用户即使通过其他途径获取到数据存储服务器中第一用户新增的第二共享数据密文，也无法对密文进行解密，从而提高了共享数据的安全性，确保了在从共享群组内被删除的共享用户无法获取在被解除共享关系后，第一用户指定上传的第二共享数据。
本申请第二方面提供一种共享数据处理方法，包括：
第二终端获取第二共享密钥，其中，所述第二共享密钥为若检测到所述第一用户指定的共享群组内的共享用户发生变化，所述第一用户绑定的第一终端根据第一共享 密钥计算得到所述第二共享密钥，所述第一共享密钥用于所述第一终端加密所述第一用户指定的第一共享数据，所述第二共享密钥用于所述第一终端加密第一用户指定的第二共享数据，所述共享群组内的共享用户所绑定的终端有权从所述数据存储服务器中获取所述第一用户的共享数据；
第二终端接收数据存储服务器发送的第一标识信息和通过第一共享密钥加密的第一共享数据，其中，所述第一标识信息用于标识所述第一共享密钥；
所述第二终端根据所述第二共享密钥和所述第一标识信息计算所述第一共享密钥；
所述第二终端根据所述第一共享密钥解密所述第一共享数据。
在第二方面的另一种可能实现方式中，所述第二终端根据第二共享密钥和所述第一标识信息计算所述第一共享密钥，包括：
所述第二终端通过单向函数以所述第二共享密钥和所述第一标识信息为输入，计算输出所述第一共享密钥。
在第二方面的另一种可能实现方式中，所述单向函数为单向陷门函数，所述第一终端拥有所述单向陷门函数的陷门。
在第二方面的另一种可能实现方式中，所述第一标识信息为所述第一终端计算所述第一共享密钥时累计使用所述单向陷门函数的次数信息；
所述第二标识信息为所述第一终端计算所述第二共享密钥时，所述第一终端累计使用所述单向陷门函数的次数信息。
综上，在本申请第二方面提供的共享数据处理方法中，第二终端获取第一终端最新用于加密第一用户指定的共享数据的第二共享密钥，还获取数据存储服务器发送的第一标识信息和通过第一共享密钥加密的第一用户的第一共享数据，第二终端能够根据第一标识信息和第二共享密钥计算第一共享密钥，并通过第一共享密钥对第一共享数据进行解密。使得在第一用户在共享群组中新增的共享用户所绑定的第二终端，能够根据第二共享密钥解密用户指定的第二共享数据，也能够根据第二共享密钥和第一标识计算第一共享密钥后，根据第一共享密钥解密用户指定的第一共享数据。同时还使得仅拥有第一共享密钥用户即使通过其他途径获取到数据存储服务器中第一用户新增的第二共享数据密文，也无法对密文进行解密，从而提高了共享数据的安全性，确保了在从共享群组内被删除的共享用户无法获取在被解除共享关系后，第一用户指定上传的第二共享数据。
本申请第三方面提供一种通信装置，包括：
获取模块，用于获取第一用户指定的第一共享数据
发送模块，用于向数据存储服务器发送第一标识信息和通过第一共享密钥加密的所述第一共享数据，其中，所述第一标识信息用于标识所述第一共享密钥；
处理模块，用于若检测到所述第一用户指定的共享群组内的共享用户发生变化，根据所述第一共享密钥计算第二共享密钥，其中，所述共享群组内的共享用户所绑定的终端有权从所述数据存储服务器中获取所述第一用户的共享数据；
所述获取模块还用于，获取所述第一用户指定的第二共享数据；
所述处理模块还用于，向所述数据存储服务器发送第二标识信息和通过所述第二共享密钥加密的所述第二共享数据，其中，所述第二标识信息用于标识所述第二共享 密钥。
在第三方面的另一种可能实现方式中，所述处理模块具体用于，
若检测到所述第一用户指定的共享群组内的共享用户发生变化，通过单向函数以所述第一共享密钥为输入，计算输出所述第二共享密钥。
在第三方面的另一种可能实现方式中，所述单向函数为单向陷门函数，所述第一终端拥有所述单向陷门函数的陷门；
所述处理模块具体用于，若检测到所述第一用户指定的共享群组内的共享用户发生变化，通过所述单向陷门函数以所述第一共享密钥和所述陷门为输入，计算输出所述第二共享密钥。
在第三方面的另一种可能实现方式中，所述第一标识信息为所述第一终端计算所述第一共享密钥时累计使用所述单向陷门函数的次数信息；
所述第二标识信息为所述第一终端计算所述第二共享密钥时累计使用所述单向陷门函数的次数信息。
在第三方面的另一种可能实现方式中，所述第一用户指定的共享群组内的共享用户发生变化，包括：
所述第一用户对所述共享群组内的共享用户进行删除或替换操作。
综上，在本申请第三方面提供的通信装置，在检测到绑定的第一用户指定的共享群组内的共享用户发生变化时，根据用于加密第一共享数据的第一共享密钥计算第二共享密钥，并使用第二共享密钥对用户所指定的第二共享数据进行加密后上传至数据存储服务器。使得仅拥有第一共享密钥用户即使通过其他途径获取到数据存储服务器中第一用户新增的第二共享数据密文，也无法对密文进行解密，从而提高了共享数据的安全性，确保了在从共享群组内被删除的共享用户无法获取在被解除共享关系后，第一用户指定上传的第二共享数据。
本申请第四方面提供一种通信装置，包括：获取模块，用于获取第二共享密钥，其中，所述第二共享密钥为若检测到所述第一用户指定的共享群组内的共享用户发生变化，所述第一用户绑定的第一终端根据第一共享密钥计算得到所述第二共享密钥，所述第一共享密钥用于所述第一终端加密所述第一用户指定的第一共享数据，所述第二共享密钥用于所述第一终端加密第一用户指定的第二共享数据，所述共享群组内的共享用户所绑定的终端有权从所述数据存储服务器中获取所述第一用户的共享数据；
所述获取模块还用于，接收数据存储服务器发送的第一标识信息和通过第一共享密钥加密的第一共享数据，其中，所述第一标识信息用于标识所述第一共享密钥；
处理模块，用于根据所述第二共享密钥和所述第一标识信息计算所述第一共享密钥；
所述处理模块还用于，根据所述第一共享密钥解密所述第一共享数据。
在第四方面的另一种可能实现方式中，所述处理模块具体用于，通过单向函数以所述第二共享密钥和所述第一标识信息为输入，计算输出所述第一共享密钥。
在第四方面的另一种可能实现方式中，所述单向函数为单向陷门函数，所述第一终端拥有所述单向陷门函数的陷门。
在第四方面的另一种可能实现方式中，所述第一标识信息为所述第一终端计算所 述第一共享密钥时累计使用所述单向陷门函数的次数信息；
所述第二标识信息为所述第一终端计算所述第二共享密钥时累计使用所述单向陷门函数的次数信息。
综上，在本申请第四方面提供的通信装置中，通过获取模块获取第一终端最新用于加密第一用户指定的共享数据的第二共享密钥，还获取数据存储服务器发送的第一标识信息和通过第一共享密钥加密的第一用户的第一共享数据，处理模块能够根据第一标识信息和第二共享密钥计算第一共享密钥，并通过第一共享密钥对第一共享数据进行解密。使得在第一用户在共享群组中新增的共享用户所绑定的第二终端，能够根据第二共享密钥解密用户指定的第二共享数据，也能够根据第二共享密钥和第一标识计算第一共享密钥后，根据第一共享密钥解密用户指定的第一共享数据。同时还使得仅拥有第一共享密钥用户即使通过其他途径获取到数据存储服务器中第一用户新增的第二共享数据密文，也无法对密文进行解密，从而提高了共享数据的安全性，确保了在从共享群组内被删除的共享用户无法获取在被解除共享关系后，第一用户指定上传的第二共享数据。
第五方面，本申请提供一种通信设备，包括：
接口和处理器，所述接口和所述处理器耦合；
所述处理器用于执行第一方面所述的共享数据处理方法。
在一种可能的设计中，第五方面中的通信设备可以为终端设备，也可以为芯片；接口可以与处理器集成在同一块芯片上，也可以分别设置在不同的芯片上。
第六方面，本申请提供一种通信设备，包括：
接口和处理器，所述接口和所述处理器耦合；
所述处理器用于执行第二方面所述的共享数据处理方法。
在一种可能的设计中，第六方面中的通信设备可以为终端设备，也可以为芯片；接口可以与处理器集成在同一块芯片上，也可以分别设置在不同的芯片上。
第七方面，本申请提供一种计算机可读存储介质，该计算机可读存储介质中存储有计算机程序，当其在计算机上运行时，使得计算机执行如第一方面所述的方法。
第八方面，本申请提供一种计算机可读存储介质，该计算机可读存储介质中存储有计算机程序，当其在计算机上运行时，使得计算机执行如第二方面所述的方法。
第九方面，本申请提供一种计算机程序，当所述计算机程序被计算机执行时，用于执行第一方面所述的方法。
在一种可能的设计中，第九方面中的程序可以全部或者部分存储在与处理器封装在一起的存储介质上，也可以部分或者全部存储在不与处理器封装在一起的存储器上。
第十方面，本申请提供一种计算机程序，当所述计算机程序被计算机执行时，用于执行第二方面所述的方法。
在一种可能的设计中，第十方面中的程序可以全部或者部分存储在与处理器封装在一起的存储介质上，也可以部分或者全部存储在不与处理器封装在一起的存储器上。
第十一方面，本申请提供一种通信设备，包括：
存储器和处理器，所述存储器和所述处理器耦合；
所述处理器用于执行如第一方面所述的方法。
在一种可能的设计中，第十一方面中的通信设备可以为终端设备，也可以为芯片；存储器可以与处理器集成在同一块芯片上，也可以分别设置在不同的芯片上。
第十二方面，本申请提供一种通信设备，包括：
存储器和处理器，所述存储器和所述处理器耦合；
所述处理器用于执行如第二方面所述的方法。
在一种可能的设计中，第十二方面中的通信设备可以为终端设备，也可以为芯片；存储器可以与处理器集成在同一块芯片上，也可以分别设置在不同的芯片上。
第十三方面，本申请提供一种处理器，该处理器包括：
至少一个电路，用于获取第一用户指定的第一共享数据；
至少一个电路，用于向数据存储服务器发送第一标识信息和通过第一共享密钥加密的所述第一共享数据，其中，所述第一标识信息用于标识所述第一共享密钥；
至少一个电路，用于若检测到所述第一用户指定的共享群组内的共享用户发生变化，根据所述第一共享密钥计算第二共享密钥，其中，所述共享群组内的共享用户所绑定的终端有权从所述数据存储服务器中获取所述第一用户的共享数据；
至少一个电路，用于获取所述第一用户指定的第二共享数据；
至少一个电路，用于向所述数据存储服务器发送第二标识信息和通过所述第二共享密钥加密的所述第二共享数据，其中，所述第二标识信息用于标识所述第二共享密钥。
在一种可能的设计中，第十三方面中的处理器可以为芯片。
第十四方面，本申请提供一种处理器，该处理器包括：
至少一个电路，用于获取第二共享密钥，其中，所述第二共享密钥为若检测到所述第一用户指定的共享群组内的共享用户发生变化，所述第一用户绑定的第一终端根据第一共享密钥计算得到所述第二共享密钥，所述第一共享密钥用于所述第一终端加密所述第一用户指定的第一共享数据，所述第二共享密钥用于所述第一终端加密第一用户指定的第二共享数据，所述共享群组内的共享用户所绑定的终端有权从所述数据存储服务器中获取所述第一用户的共享数据；
至少一个电路，用于接收数据存储服务器发送的第一标识信息和通过第一共享密钥加密的第一共享数据，其中，所述第一标识信息用于标识所述第一共享密钥；
至少一个电路，用于根据所述第二共享密钥和所述第一标识信息计算所述第一共享密钥；
至少一个电路，用于根据所述第一共享密钥解密所述第一共享数据。
在一种可能的设计中，第十四方面中的处理器可以为芯片。
可见，在以上各个方面，当第一终端在检测到绑定的第一用户指定的共享群组内的共享用户发生变化时，根据用于加密第一共享数据的第一共享密钥计算第二共享密钥，并使用第二共享密钥对用户所指定的第二共享数据进行加密后上传至数据存储服务器。使得仅拥有第一共享密钥用户即使通过其他途径获取到数据存储服务器中第一用户新增的第二共享数据密文，也无法对密文进行解密，从而提高了共享数据的安全性，确保了在从共享群组内被删除的共享用户无法获取在被解除共享关系后，第一用户指定上传的第二共享数据。
附图说明
图1为本申请数据共享系统的结构示意图；
图2为本申请共享数据处理方法实施例的流程示意图；
图3为本申请共享数据处理方法实施例的流程示意图；
图4为本申请共享数据处理方法实施例的流程示意图；
图5为本申请共享数据处理方法实施例的流程示意图；
图6为本申请共享数据处理方法实施例的流程示意图；
图7为本申请通信装置实施例的结构示意图；
图8为本申请通信装置实施例的结构示意图；
图9为本申请终端设备实施例的结构示意图；
图10为本申请终端设备实施例的结构示意图；
图11为本申请终端设备实施例的结构示意图。
具体实施方式
图1为本申请数据共享系统的结构示意图。如图1所示，本实施例提供的数据共享系统用于为用户提供数据共享的业务，具体包括：至少两个终端101、共享服务器102、密钥服务器103和数据存储服务器104。
本申请实施例中，用户通过绑定终端101并接入互联网105后，用户可以通过所绑定的终端101访问数据共享系统中的共享服务器102、密钥服务器103和数据存储服务器104，并享受数据共享服务。可选地，用户可以通过用户标识信息(例如：账号和密码)登陆并绑定终端101。其中，终端101具体可以是台式计算机(Computer)、笔记本电脑(Notebook)、平板电脑(Pad)、智能手机(Smart Phone)、智能手表(Smart Watch)、智能眼镜、工作站、数据库或服务器等具备数据处理功能且能够连接互联网的电子设备的一种或多种。例如图1中的标号为1-6的用户分别绑定标号为A-F的终端101后，与用户1-6绑定的终端A-F均接入互联网105，并通过互联网105访问共享服务器102、密钥服务器103和数据存储服务器104。在图1的示例中，用户1和用户2通过绑定的智能手机接入互联网，用户3和用户4通过绑定的台式计算机接入互联网，用户5和用户6通过绑定的数据库接入互联网。应理解，上述举例仅是为说明，不应构成具体限定。此外，如图1所示的任意一个用户绑定的终端，既可以上传共享数据至数据存储服务器104并授权其他用户读取，也可以从数据存储服务器104读取其他用户共享的数据。
共享服务器102用于管理上传共享数据的用户与共享用户之间的关系。具体地，上传共享数据的用户将共享数据上传至数据存储服务器104之后，需要确定共享群组，只有共享群组内的共享用户绑定的终端才有权读取数据存储服务器104中该用户的共享数据。例如，用户1通过终端A将用户1的共享数据上传至数据存储服务器104之后，再通过终端A指定共享群组包括的共享用户为用户2，并向共享服务器102发送有权查看用户1的共享数据的共享群组内的共享用户名单。则共享服务器102获取并 存储指定的用户2的ID账号或IP地址等能够标识用户2身份的信息。随后共享服务器102向用户2绑定的终端B发送共享通知消息，使用终端B的用户2能够获知其被用户1授权查看用户1上传至数据存储服务器104的共享数据。则当用户2通过终端B接入互联网105并访问数据存储服务器104前，需要先通过共享服务器102验证身份。例如：用户2通过所绑定的终端B向共享服务器102发送包含用户2信息的身份验证请求，共享服务器102判断用户2是否在用户1指定的共享群组内，即是否有权限访问数据管理服务器104中用户1的共享数据。如果共享服务器102判断用户2是用户1指定的共享群组内的共享用户则验证通过，共享服务器102向用户2绑定的终端B返回验证成功信息，并可以在验证成功信息中携带用户1的共享数据在数据存储服务器104中的存储位置。只有当终端B获取用户1在数据存储服务器中的具体存储位置，终端B才能根据具体存储位置向数据存储服务器104请求用户1的共享数据。
密钥服务器103用于存储终端101加密共享数据所用的共享密钥。具体地，当上传共享数据的终端101在向数据存储服务器104上传绑定的用户的共享数据前先创建一个共享密钥，终端101使用该共享密钥对绑定的用户上传到数据存储服务器104的共享数据进行加密。在终端101为绑定的用户生成共享密钥之后，终端101将生成的共享密钥加密上传至数据共享系统中专门设置的用于管理密钥的密钥服务器103进行存储。而在其他共享用户的终端101需要访问数据存储服务器104中的共享数据时，还需要向密钥服务器103请求加密共享数据所使用的共享密钥后，才能通过共享密钥解密得到共享数据。可以理解的是，由于每个用户都可以通过终端101上传共享数据，密钥服务器103会存储各个用户上传共享数据时的共享密码，则例如当用户6所使用的终端F访问用户1上传的共享数据时，需要向密钥服务器请求用户1的共享密钥，用户6所使用的终端F访问用户2上传的共享数据时需要向密钥服务器请求用户2的共享密钥，其他用户以此类推。因此，密钥服务器103会记录每个上传共享数据的用户的共享密钥，并向授权的共享用户提供共享密钥。
数据存储服务器104用于存储各个用户通过绑定的终端101上传的、通过共享密钥加密的共享数据。并在共享用户绑定的终端101发送数据请求消息时，向该终端101返回所请求的共享数据。由于数据存储服务器104中存储共享数据、密钥服务器103中存储加密共享数据的共享密钥，因此共享群组内的有权获取共享数据的共享用户所绑定的终端101必须同时获取数据存服务器104中的共享数据和密钥服务器103中的共享密钥之后，才能通过共享密钥解密获得共享数据。而只有被指定在共享群组内的共享用户绑定的终端101才能查看并解密共享数据，实现了共享数据端到端的安全。数据存储服务器104与密钥服务器103可以独立设置，并采取不同的网络安全保护方式，使得其中之一被破解时另一服务器不会因相同的方式被破解，通过密钥和数据分离存储的方式来保证共享数据的安全。
可选地，上述的共享服务器102、密钥服务器103和数据存储服务器104的部署方式可以是非常灵活的，例如，共享服务器102、密钥服务器103和数据存储服务器104可以分别单独部署，可以集中部署(例如，部署在同一服务器中等等)，也可以和其他的设备部署在一起，本申请不作具体限定。
如上述图1中的数据共享系统在现有的应用中，为了保证用户通过绑定的终端上 传至数据存储服务器104的共享数据的安全、防止数据存储服务器104被恶意攻破时共享数据泄露，上传共享数据的用户所绑定的终端101在上传共享数据前先创建一个共享密钥，并使用该共享密钥对用户的共享数据进行加密后，再将加密后的共享数据上传至数据存储服务器104。同时，终端101还将生成的共享密钥上传至密钥服务器102。从而使得终端101必须同时获取数据存服务器104中的共享数据和密钥服务器103中的共享密钥之后，才能通过共享密钥解密获得共享数据，并且只有被该用户指定的共享群组内的共享用户所绑定的终端101才能查看并解密共享数据。因此，数据存储服务器104只存储用户共享数据的密文、密钥服务器102只存储用于加密共享数据的共享密钥，即使数据存储服务器104由于安全问题被攻破也只泄露共享数据的密文而不会直接泄露用户上传的共享数据。
但是现有技术中的数据共享系统仍然存在如下问题：当上传共享数据的用户调整该用户与共享群组内的共享用户之间的共享关系(例如用户1指定的有权访问其共享数据的共享群组包括的共享用户为用户2和用户3，随后又将共享群组中的用户3解除共享关系，则共享群组此时仅包括用户2)，共享服务器102会记录该用户更新的共享关系。但是由于该些被解除共享关系的共享用户(用户3)所使用的终端C仍然拥有被解除共享关系之前的共享密钥，一旦数据存储服务器104被攻破，终端C还是能够从中数据存储服务器104中查看并解密在被解除共享关系后用户1上传的的共享数据。造成了用户的共享数据虽然通过共享密钥进行加密，但是共享数据的安全性仍然不高。
基于上述的数据共享系统中共享密钥存在的问题，本申请实施例提供一种共享数据处理方法，确保了被解除共享关系的用户无法获取在被解除关系后，上传共享数据的用户所上传的共享数据，从而提高了共享数据的安全性。
图2为本申请共享数据处理方法实施例的流程示意图。如图2所，在本申请共享数据处理方法的实施例中，
第一终端获取第一用户指定的第一共享数据，并通过第一共享密钥加密第一共享数据后向数据存服务器发送上传。第一终端同时还向数据存储服务器发送用于标识第一共享密钥的第一标识信息，第一标识信息与第一共享密钥一一对应，第一用户指定的共享用户所绑定的终端能够通过第一标识信息确定加密第一共享数据的第一共享密钥。
若第一终端检测到第一用户指定的共享群组内的共享用户发生变化，第一终端根据第一共享密钥计算第二共享密钥，其中，共享群组内的共享用户所绑定的终端有权从数据存储服务器中获取第一用户的共享数据。
第一终端获取第一用户指定的第二共享数据，并通过第二共享密钥加密第二共享数据后向数据存服务器发送上传。第一终端同时还向数据存储服务器发送用于标识第二共享密钥的第二标识信息，第二标识信息与第二共享密钥一一对应，第一用户指定的共享用户所绑定的终端能够通过第二标识信息确定加密第二共享数据的第二共享密钥。
具体地，当第一用户需要通过绑定的第一终端向数据存储服务器上传第一共享数据时，第一终端生成第一共享密钥，并使用第一共享密钥加密的共享数据后，将第一 共享密钥加密的第一共享数据、第一共享密钥的第一标识信息上传至数据存储服务器。第一用户还通过第一终端指定共享群组，共享群组内的共享用户所绑定的终端有权访问第一用户上传至数据存储服务器的共享数据，即第一用户与其指定的共享群组内的共享用户存在共享关系。此时，第一用户的共享群组内的共享用户有权通过绑定的终端获取数据存储服务器中第一共享密钥加密的第一用户的第一共享数据，因此共享用户绑定的终端能够通过第一共享密钥解密得到第一用户的第一共享数据。
而当在第一终端检测到第一用户的共享群组发生变化，则第一终端对第一共享密钥进行更新，通过第一共享密钥计算得到新的第二共享密钥。其中，第一用户的共享群组发生变化可以是第一用户通过第一终端对共享群组内的共享用户进行删除或者替换操作。
可选地，当第一终端计算得到第二共享密钥后，向此时共享群组内的共享用户发送更新后的第二共享密钥。发送方式可以是第一终端将第二共享密钥发送至密钥服务器，由密钥服务器转发至共享群组内共享用户绑定的终端，或者第一终端通过加密广播的方式向共享用户绑定的终端发送第二共享密钥，加密方式可以通过第一终端和共享用户绑定的终端进行密钥协商的方式进行确定。
对于共享群组内的共享用户发生变化后，第一用户通过第一终端上传数据存储服务器的第二共享数据，第一终端将该些共享关系变化后新增的第二共享数据通过第二共享密钥进行加密，并将加密后的第二共享数据和第二共享密钥的第二标识信息共同发送至数据存储服务器。可选地，由第一终端检测第一用户的共享群组是否发生变化，或者，由专门设置的服务器检测第一用户的共享群组是否发生变化。
此时，第一用户的共享群组内的共享用户不仅有权通过绑定的终端获取数据存储服务器中第一共享密钥加密的第一用户的第一共享数据，还有权通过绑定的终端获取数据存储服务器中第二共享密钥加密的第一用户的第二共享数据。而此时不在共享群组内的共享用户所绑定的终端无法获取数据存储服务器中第一用户的任何共享数据。即使某一共享用户共享群组内的共享用户发生变化前在第一用户的共享群组内，但是共享群组内的共享用户发生变化后被第一用户从共享群组内删除，该共享用户也仅拥有第一终端加密共享数据所使用的第一共享密钥，因此即使该用户通过其他途径取得了第二共享数据，但是由于该用户所绑定的终端没有第二共享密钥，因此也不能通过第二共享密钥解密第二共享数据，从而保证了第一用户共享数据的安全性。
由于第一用户指定的共享群组的共享用户发生变化前后，第一终端使用不同的共享密钥(第一共享密钥、第二共享密钥)加密第一用户的共享数据。因此为了使共享用户所使用的第二终端获取到数据存储服务器中第一用户的共享数据后使用正确的共享密钥进行解密，第一终端在向数据存储服务器发送经过共享密钥加密的共享数据时，会同时向数据存储服务器发送加密共享数据所使用的共享密钥的标识信息。从而使得共享用户绑定的终端通过标识信息确定获取的共享数据是第一终端在共享关系发生变化前或后，发送至的数据存储服务器的共享数据，并使用与标识信息相对应的共享密钥对共享数据进行解密。
例如：在图1所示的数据共享系统中，用户1通过其使用的终端A(智能手机)向数据存储服务器104上传通过第一共享密钥加密的用户1的共享数据，并指定共享群 组中包括用户3和用户5作为共享用户有权能够访问用户1的共享数据。则用户3和用户5分别通过绑定的终端C和终端E请求数据存储服务器104发送用户1的第一共享数据。随后，当第一终端检测到用户1改变其与用户3和用户5的共享关系，则用户1所绑定的终端A通过第一共享密钥计算得到更新后的第二共享密钥，并通过第二共享密钥加密随后用户1再向数据存储服务器发送的第二共享数据。其中，指定共享群组内的共享用户发生变化的操作包括如下的一种或多种：删除用户3、仅将用户5为共享用户，添加用户2为共享用户，或者将用户5替换为用户6。上述操作均可以看作是第一用户调整更新其与共享用户的关系，并使得第一用户与共享用户之间关系发生变化。同时，第一终端在第一用户指定的共享群组的共享用户发生变化前，可以对通过第一共享密钥加密的共享数据都携带第一共享密钥的标识信息如数字“1”；并在第一用户指定的共享群组的共享用户发生变化后，对通过第二共享密钥加密的共享数据都携带第二共享密钥的标识信息如数字“2”。使得共享用户的终端从数据存储服务器中获取到标识信息为“1”的共享数据后，通过第一共享密钥解密得到第一共享数据。从数据存储服务器中获取到标识信息为“2”的共享数据后，通过第二共享密钥解密得到第二共享数据。
具体地，如图2所示，第二用户为第一用户指定的共享群组中的共享用户，则对于第二用户绑定的第二终端，获取第一终端加密第二数据的第二共享密钥，并接收数据存储服务器发送的第一标识信息和通过第一共享密钥加密的第一共享数据后，根据第二共享密钥和第一标识信息计算第一共享密钥，并通过与第一标识信息对应的第一共享密钥解密第一共享数据。
例如：第一终端在第一用户指定的共享群组内的共享用户发生变化前，对第一用户指定的第一共享数据均通过第一共享密钥加密，并携带第一共享密钥的标识信息如数字“1”，第一终端在第一用户指定的共享群组内的共享用户发生变化后，对第一用户指定的均通过第二共享密钥加密，并携带第二共享密钥的标识信息如数字“2”。则若第二终端接收到数据存储服务器发送的标识信息为“1”的第一共享数据后，与最新接收的第二标识信息“2”进行比对，标识信息不同，则需要通过第二共享密钥计算和第一标识信息计算得到第一共享密钥后，通过第一共享密钥解密得到共享数据。若第二终端接收到数据存储服务器发送的标识信息为“2”的第二共享数据后，与最新接收的第二标识信息“2”进行比对，两个标识信息相同，则不用计算共享密钥，直接使用第二共享密钥对共享数据进行解密。
具体地，第二终端获取的第二共享密钥为第一终端最新更新共享群组内的共享用户后，第一终端上传的第一用户共享数据时，加密共享数据所使用的共享密钥。同时，第二终端获取第二共享密钥后，可以存储在第二终端的存储设备中，以备后续计算时使用。而第二终端获取第二共享密钥的方式可以包括以下两种：
第一种：第二终端接收密钥服务器发送的第二共享密钥。其中，密钥服务器只向第二终端发送第一终端上传共享数据时最新的使用的第二共享密钥。而第一共享密钥及第一共享密钥之前第一终端所使用的共享密钥的都由第二终端通过第二共享密钥和共享数据的标识信息进行计算。以减少服务器与终端之间通信数据量，并且减少第二终端用于存储共享密钥的存储空间。第二终端对共享数据进行解密时，实时判断并计 算共享密钥，从而提高了共享密钥的处理效率。而可选地，第二终端在接收密钥服务器发送的第二共享密钥之前，可以向密钥服务器发送查询请求。其中查询请求用于向密钥服务器查询第一终端是否更新共享数据的共享密钥。
第二种：第二终端接收第一终端加密广播的第二共享密钥。其中，当第一终端将第一共享密钥更新为第二共享密钥之后，向共享群组内共享用户发生变化后仍存在于第一用户指定的共享群组内的共享用户所绑定的终端加密广播第二共享密钥。加密方式可以通过第一终端和第二终端进行密钥协商的方式进行确定。以减少终端与密钥服务器之间的交互次数，直接进行端到端的数据共享，提高了共享密钥的处理效率。
需要说明的是。在实际应用中，第一用户指定的共享群组内的共享用户可能会在不同时刻多次发生变化，而上传共享数据的行为可能发生在任意时刻，则上述的第一终端会通过第一共享密钥经过多次计算后才获得上述的第二共享密钥。并且共享用户所绑定的终端通过第二共享密钥也会执行多次计算才能计算第一共享密钥。而在本实施例的举例中第一共享密钥与第二共享密钥之间相互之间均通过一次更新计算得到，而多次的计算方式及原理与单次更新计算的实施例相同，仅为计算次数的叠加，不再赘述。
综上，在上述实施例提供的共享数据处理方法中，第一终端若检测到绑定的第一用户指定的共享群组内的共享用户发生变化，根据用于加密第一共享数据的第一共享密钥计算第二共享密钥，并使用第二共享密钥对用户所指定的第二共享数据进行加密后上传至数据存储服务器。第二终端获取第一终端最新用于加密第一用户指定的共享数据的第二共享密钥，还获取数据存储服务器发送的第一标识信息和通过第一共享密钥加密的第一用户的第一共享数据。使得第二终端能够根据第一标识信息和第二共享密钥计算第一共享密钥，并通过第一共享密钥对第一共享数据进行解密。因此第一用户在共享群组中新增的共享用户所绑定的第二终端，能够根据第二共享密钥解密用户指定的第二共享数据，也能够根据第二共享密钥和第一标识计算第一共享密钥后，根据第一共享密钥解密用户指定的第一共享数据。同时还使得被解除共享关系的共享用户仅拥有第一共享密钥，因此即使通过其他途径获取到数据存储服务器中第一用户在解除其共享关系后新增的第二共享数据密文，也无法对密文进行解密，从而提高了共享数据的安全性，确保了从共享群组内被删除的共享用户无法获取在被删除后，第一用户指定上传的第二共享数据。
可选地，在上述实施例中，第一终端根据第一共享密钥计算第二共享密钥，可以具体通过单向函数以第一共享密钥为输入计算输出第二共享密钥。
更为具体地，单向函数可以是单向陷门函数，并且在上述实施例中，仅第一用户绑定的第一终端拥有单向陷门函数的陷门，其他共享用户所使用的终端都没有单向陷门函数的陷门。则第一终端通过单向陷门函数以第一共享密钥和陷门为输入，计算输出第二共享密钥。其中，单向陷门函数是有一个陷门的一类特殊单向函数，具有单向性以及存在陷门的特征。所谓单向性，也称不可逆性，即对于一个函数y＝f(x)，若已知x要计算出y很容易，但是已知y要计算出x＝f^(-1)(y)则很困难。单向函数的命名就是源于其只有一个方向能够计算。所谓陷门，也称为后门，对于单向函数，若存在一个z使得知道z则可以很容易地计算出x＝f^(-1)(y)，而不知道z则无法计算出 x＝f^(-1)(y)，则称函数y＝f(x)为单向陷门函数，而z称为陷门。具体地，在上述实施例中，第一终端将第一共享密钥x送入拥有陷门的单向陷门函数f()，并利用陷门使得单向陷门函数输出第二共享密钥y。因此，只有上传共享数据的第一用户所使用的第一终端拥有单向陷门函数的陷门，也只有第一终端通过陷门才能对共享密钥进行单向的更新，由第一共享密钥计算得到第二共享密钥。其他用户不论是否为第一终端共享群组内的共享用户，其他用户所使用的终端都不能通过第一共享密钥计算得到更新后的第二共享密钥，但是可以通过第二共享密钥计算出共享密钥更新前的第一共享密钥。
进一步地，在上述实施例中，当单向函数为单向陷门函数，则第二标识信息为：第一终端计算第二共享密钥时，第一终端累计使用单向陷门函数的次数信息。相应地，第一标识信息为第一终端计算第一共享密钥时，第一终端累计使用单向陷门函数的次数信息。例如：图3为本申请共享数据处理方法实施例的流程示意图，图中示出了使用多次使用单向陷门函数计算更新共享密钥的流程。如图3中由上至下为不同批次的第一终端向数据存储服务器发送的共享数据，其中第一批次的共享数据使用共享密钥AK1进行加密。当第一终端在第一用户指定的共享群组内的共享用户发生变化后，将共享密钥AK1通过单向陷门函数计算生成共享密钥AK2，并将生成AK2之后用户新增的第二批次的共享数据都通过AK2进行加密。此时可标记第一终端已经使用单向陷门函数1次。当第一用户指定的共享群组内的共享用户再次发生变化，第一终端根据共享密钥AK2通过单向陷门函数计算生成共享密钥AK3，并将生成AK3之后用户新增的第三批次的共享数据都通过AK3进行加密。此时标记第一终端已经使用单向陷门函数2次。当第一用户指定的共享群组内的共享用户再次发生变化，第一终端根据共享密钥AK3通过单向陷门函数计算生成共享密钥AK4，并将生成AK4之后用户新增的第四批次的共享数据都通过AK4进行加密。此时标记第一终端已经使用单向陷门函数3次。则当共享用户所使用的第二终端获取图3中任意批次的共享数据的共享密钥使用单向陷门函数时，累计的计算次数信息，可以根据次数信息计算得到相应的共享密钥。例如：第二终端获取的共享数据的标识信息为“次数信息为1”。则第二终端根据“次数信息为1”确定共享数据为第二批次，且共享密钥为AK2。则共享用户将共享密钥AK4代入单向陷门函数后反向得到共享密钥AK3，将AK3再次代入单向陷门函数后反向得到共享密钥AK2。
可选地，在上述各实施例中，第一用户指定的共享群组内的共享用户发生变化，具体可以包括：第一用户对共享群组内的共享用户进行删除、添加或替换操作。
例如，在图1所示的数据共享系统中，用户1通过其使用的终端A上传共享数据至数据存服务器，并指定共享群组包括用户3和用户5两个共享用户，用户3和用户5有权分别通过图中的终端C和终端E请求数据存储服务器内存储的用户1的共享数据。而用户1的共享群组内的共享用户发生变化，包括如下操作的一种或多种：1、用户1通过终端A解除与用户3之间的共享关系，将用户3从共享群组中删除，即禁止用户3请求用户1的共享数据；2、用户1通过终端A新增用户1与用户2的共享关系，向共享群组中加入共享用户2，，即允许用户2通过智能手机请求数据存储服务器内用户1的共享数据；3、用户1通过终端A将用户1与用户5的共享关系替换为用户1 与用户6的共享关系，将共享群组内包括的用户5替换为用户6。
图4为本申请共享数据处理方法实施例的流程示意图，图中示出了第一终端的第一用户对共享群组内的共享用户进行删除的关系示意。其中，在删除共享用户前，用户A通过电脑向数据共享系统上传通过第一共享密钥加密的第一共享数据和第一共享密钥的第一标识信息，并且用户A通过电脑指定共享群组内的共享用户为用户B和用户C。则用户B和用户C所使用的电脑有权获取数据共享系统中用户A的第一共享密钥加密的第一共享数据和第一共享密钥的第一标识信息。在删除共享用户后，用户A解除与用户C的共享关系，将用户C从共享群组中删除，即禁止用户C访问用户A的共享数据。则用户A所使用的电脑将第一共享密钥更新为第二共享密钥，并向数据共享系统上传通过第二共享密钥加密的第二共享数据和第二共享密钥的标识信息。此时，用户B所使用的电脑有权获取数据共享系统中用户A的第二共享密钥加密的第二共享数据和第二共享密钥的第二标识信息，用户C所使用的电脑无权获取数据共享系统中用户A的第二共享密钥加密的第二共享数据和第二共享密钥的标识信息。
可选地，在上述各实施例中，第一终端根据第一共享密钥计算得到第二共享密钥后，将得到的第二共享密钥发送至密钥服务器进行存储。具体地，第一终端将更新后得到的第二共享密钥发送至密钥服务器，由密钥服务器对第二共享密钥进行存储。并可以将原有的第一共享密钥进行删除，也可以由密钥服务器通过广播等方式将第二共享密钥通知所有与第一终端的用户存在共享关系的共享用户所绑定的终端。例如图1的系统中，用户1通过第一终端A上传的两张照片通过第一共享密钥进行加密，并指定用户5和用户6为共享群组内的共享用户。用户5和用户6分别有权通过终端E和终端F查看数据存储服务器104内存储的两张照片，并从密钥服务器请求第一共享密钥对其进行解密。当用户1删除共享群组内用户5的共享用户后，第一终端A将第一共享密钥更新为第二共享密钥并向密钥服务器上传第二共享密钥。密钥服务器接收并存储新的第二共享密钥。并根据新的共享关系向用户6所使用的终端F发送携带第二共享密钥的通知，使得用户6能够获取第二共享密钥；而用户5所使用的终端E不会接收到密钥服务器发送的第二共享密钥。
可选地，在上述各实施例中，第一用户与第一用户的共享用户之间共享关系发生变化，第一终端可以向关系管理服务器发送该共享关系的变化。例如：用户1删除共享群组内用户5的共享用户、并将用户6加入共享群组，则用户6作为有权能够访问用户1共享数据的共享用户。第一终端A获取用户1对共享群组内共享用户的更新后，可以向共享服务器102发送用户1的共享群组内共享用户5和用户6关系的变化，使得共享服务器102将用户1的共享群组内的共享用户5替换为用户6并进行存储。使得随后用户5所使用的终端E向共享服务器102请求访问用户1的共享数据时，共享服务器判断用户5不在用户1指定的共享群组内，从而拒绝向终端E提供用户1的共享数据的在数据存储服务器的存储地址及其他相关信息。
图5为本申请共享数据处理方法实施例的流程示意图。如图5所示，本实施例提供的共享数据处理方法为包括：
S401：已上传共享数据的第一用户需要更改有权访问其共享数据的共享用户时，通过在第一用户标识绑定的第一终端上进行操作，进行添加共享用户、删除共享用户 或者替换共享用户的操作，改变该用户与共享用户之间的共享关系。具体实现时，第一终端以数据表格的形式存储第一用户指定的有权访问其共享数据的共享用户，在该表格中的共享用户所使用的终端可以被看作一个终端的群组，群组内的终端才可以访问第一用户上传数据存储服务器的共享数据。例如，在图1所示的数据共享系统中，用户1通过其使用的终端A上传共享数据至数据存服务器104，并指定用户3和用户5有权能够访问其共享数据，则用户3和用户5分别通过用户标识绑定的终端C和终端E访问数据存储服务器104内存储的用户1的共享数据。当用户1需要更新共享数据的共享用户关系，包括如下操作的一种或多种：删除用户3、用户2为共享用户以及将用户5替换为用户6。上述操作均可以看作是第一用户调整更新其共享数据的共享用户的关系，并使得第一用户与共享用户之间关系发生变化。本实施中所述的第一用户与共享用户之间关系发生变化，等同于上述实施例中第一用户指定的共享群组内的共享用户发生变化。即第一用户与其指定的共享群组内的共享用户存在共享关系。
S402：第一终端获取第一用户对共享关系的更新，并判断第一用户与共享用户之间共享关系发生变化时，向共享服务器更新该变化。例如：第一终端的使用者，即用户1在第一终端的应用程序上，将用户1的共享数据的共享用户从用户5替换为用户6，第一终端获取用户对共享用户关系的更新后，向共享服务器102发送更新共享关系的请求，使得共享服务器102根据接收到的请求，将用户1的共享数据的共享用户由用户5替换为用户6并进行存储。使得随后用户5向共享服务器请求访问用户1的共享数据时，共享服务器判断用户5已没有权限，并拒绝向用户5提供用户1的共享数据的在数据存储服务器的存储地址及其他相关信息。
需要说明的是，本申请各示例中的第一终端指：上传共享数据的用户通过其标识信息登录并绑定的终端。图1中的数据共享系统可以向申请服务的用户提供账号和密码，用户通过账号密码通过任意终端即可通过互联网接入系统，并享受数据共享的服务器。用户通过账号密码通过第一终端的应用程序登录后，第一终端即与用户的标识信息绑定。例如：在图1的系统中用户1通过其用户标识绑定的智能手机上传用户1需要共享的数据，此时智能手机A为本示例中的第一终端。而当上传完数据后若用户1解除用户标识与智能手机A的绑定退出登录，并通过用户1的用户标识登录并绑定另一台式电脑C，并通过该台式电脑查看及管理其共享数据，此时台式电脑C为本示例中的第一终端。相应地，如图1中的其他标号的用户也均可以通过其用户标识绑定的终端向数据存储服务器上传共享数据，则对于已上传的共享数据的拥有者来说，该拥有者所使用的终端即为本申请各示例中的第一终端。
S403：共享服务器更新第一用户与其共享用户之间的关系后，向第一终端反馈共享关系更新结果，以告知第一终端完成共享关系的更新。可选地，共享服务器向被撤销共享数据访问权限的共享用户绑定的终端发送撤销通知，终端收到通知后删除之前存储的共享数据的地址及名称等所有相关信息，使得被撤销的共享用户无法再通过其用户标识绑定的终端访问数据存储服务器存储的第一终端的用户上传的共享数据。
S404：当第一用户与其共享用户关系发生变化，需要确保被删除权限的共享用户无法获取第一用户新的共享数据，则第一终端通过向共享关系服务器更新共享结果，使得被删除的共享用户无法获取数据。但是，由于被删除的共享用户的终端设备拥有 用户之前所上传的共享数据的密钥，一旦数据存储服务器被攻破，还是能够从中查看并解密共享数据。因此，在本步骤中，当第一终端接收到共享服务器发送的共享关系更新结果，确定共享关系已经更新后，更新共享密钥，并使用更新后的共享密钥加密第一用户更新共享用户关系之后再上传至数据存储服务器的共享数据。
例如：用户1通过绑定的第一终端生成第一共享密钥，向密钥服务器发送第一共享密钥，并向数据存储服务器上传了通过第一共享密钥加密的两张照片，用户1指定用户5为共享用户，向共享服务器发送共享用户关系，使得用户5所使用的终端E能够通过共享服务器验证通过后，从密钥服务器获取第一共享密钥、从数据存储服务器获取用户1上传的通过第一共享密钥加密的两张照片。随后，用户1更改共享关系，通过第一终端向共享服务器发送共享关系更改消息将共享用户由用户6替换为用户5，同时，第一终端更新用于加密共享数据的共享密钥，将第一共享密钥更新为第二共享密钥。则用户5通过其绑定的服务器就不能通过共享服务器的验证，也就不能从数据存储服务器获取用户1上传的通过第一共享密钥加密的两张照片。并且用户1在之后通过第一终端再上传两个压缩包时，第一终端将两个压缩包通过第二共享密钥进行加密后，上传数据存储服务器。则用户1通过第一终端前后分别上传的两张照片和两个压缩包使用不同的共享密钥进行加密，其中，两张照片还通过共享密钥更新之前的第一共享密钥进行加密，且共享密钥更新后也不进行更改；两个压缩包为共享密钥更新后的第二共享密钥进行加密。使得被删除共享关系的用户5即使通过破解等手段获取数据存储服务器中用户1的所有共享数据，也只能通过终端E中之前的第一共享密钥对两张照片进行解密，而用户1在删除用户5的共享关系之后上传的两个压缩包由于通过第二共享密钥进行加密，用户5即使取得了用户1的共享数据的密文数据，也无法通过第二共享密钥解密获取两个压缩包的原始数据，从而通过更新用于加密共享数据的共享密钥，提高了共享数据的安全性。
可选地，本步骤中，第一终端可以通过单向陷门函数将第一共享密钥更新文第二共享密钥。具体地，单向陷门函数是有一个陷门的一类特殊单向函数，具有单向性以及存在陷门的特征。所谓单向性，也称不可逆性，即对于一个函数y＝f(x)，若已知x要计算出y很容易，但是已知y要计算出x＝f^(-1)(y)则很困难。单向函数的命名就是源于其只有一个方向能够计算。所谓陷门，也称为后门，对于单向函数，若存在一个z使得知道z则可以很容易地计算出x＝f^(-1)(y)，而不知道z则无法计算出x＝f^(-1)(y)，则称函数y＝f(x)为单向陷门函数，而z称为陷门。则在本步骤中，第一终端拥有单向陷门函数的陷门，第一终端将第一共享密钥x送入拥有陷门的单向陷门函数f()，并利用陷门使得单向陷门函数输出第二共享密钥y。因此，只有上传共享数据的用户所使用的第一终端拥有单向陷门函数的陷门，也只有第一终端通过陷门才能对共享密钥进行单向的更新，由第一共享密钥计算得到第二共享密钥。其他共享用户不论是否被第一终端的用户指定并授权为共享用户，都不能通过第一共享密钥计算得到更新后的第二共享密钥，但是却都可以通过第二共享密钥计算出共享密钥更新前的第一共享密钥。
可选地，步骤中通过第一共享密钥计算第二共享密钥由上传共享数据的用户所使用的第一终端执行，而为了实现本申请方法，还可以设置一专门计算共享密钥的代理 服务器进行密钥的派生，第一终端每次与代理服务器进行交互并获取更新后的第二共享密钥。而代理服务器可以为所有上传数据的终端提供共享密钥的计算与更新服务，均在本申请的保护范围之内。
S405：第一终端将更新后的第二共享密钥发送至密钥服务器，由密钥服务器对第二共享密钥进行存储，并将原有的第一共享密钥进行删除。具体地，当第一用户更新共享用户的关系，第一终端将第一共享密钥更新为第二共享密钥，并通过第二共享密钥加密随后上传的共享数据；第一终端可以通过密钥服务器将第二共享密钥通知其他未被删除的共享用户。例如：用户1通过第一终端上传的两张照片通过第一共享密钥进行加密，并指定用户5和用户6为共享用户有权查看。当用户1删除用户5的共享关系后，第一终端将第一共享密钥更新为第二共享密钥，并向密钥服务器上传第二共享密钥。密钥服务器接收并存储新的第二共享密钥，并根据新的共享关系，向用户6所绑定的终端F发送携带第二共享密钥的通知，使得用户6能够获取第二共享密钥而用户5所绑定的终端E无权获取第二共享密钥。
其中，密钥服务器需要管理每个用户的共享密钥，可以通过用户的标识信息区分每个用户的共享数据及用户的共享密钥。例如：用户1所绑定的终端A上传的第一共享数据的最新更新的共享密钥为123，用户2所绑定的终端B上传的第二共享数据的最新更新的共享密钥为ABC，则密钥服务器中存储“用户1-第一共享数据-123”和“用户2-第二共享数据-ABC”的映射关系，当用户5绑定的终端E向密钥服务器请求用户1或第一共享数据对应的共享密钥时，密钥服务器反馈“123”，当用户6绑定的终端F向密钥服务器请求用户2或第二共享数据对应的共享密钥时，密钥服务器反馈“ABC”。
本步骤中传递第二共享密钥的方式是通过专门设置的密钥服务器向共享用户进行通知，此外，可选地，还可以通过：1、密钥服务器向共享用户发送通知后，各共享用户的终端每次请求共享数据前，再向密钥服务器查询第一用户的共享数据最新的共享密钥；2、各共享用户的终端主动间隔预设时间向密钥服务器查询第一用户的共享数据是否更新共享密钥；3、第一终端根据第一共享密钥派生新的共享密钥后，直接通过广播加密等通信方式向其他未被删除的有权访问共享数据的共享用户的终端发送第二共享密钥；或者其他方式使得未被删除的共享用户获知第一终端更新的第二共享密钥，均可实现本实施例的共享数据处理方法，在此不做限定。
S406：密钥服务器向第一终端反馈密钥更新结果。
S407：第一终端向用户反馈共享关系的更新结果，提示第一用户共享关系已进行更改，可与使用更新后的密钥上传新增的共享数据。
S408：第一用户向第一终端上传新增的共享数据，或者指定第一终端内的部分数据为新增的共享数据。
S409：第一终端将用户新增的共享数据通过第二共享密钥进行加密。
S4010：第一终端向数据存储服务器上传经过第二共享密钥加密的新增共享数据。
其中，数据存储服务器中存储的第一用户通过第一终端上传的共享数据，在共享关系更新前后的共享密钥不同。即，第一用户在共享用户的关系发生变化前的共享数据通过第一共享密钥加密；第一用户在共享用户的关系发生变化后的共享数据通过第 二共享密钥加密。
由于第一用户所共享的数据的共享用户的关系发生变化前后共享数据由不同的共享密钥进行加密，为了使得共享数据的共享用户的终端接收到共享数据后使用正确的共享密钥进行解密，本步骤中第一终端在上传经过第二共享密钥加密的新增共享数据时，会在新增的共享数据中加入第二共享密钥的标识信息，使得共享用户使用的第二终端获取到数据存储服务器中第一终端上传的共享数据时，通过标识信息得知该共享数据是第一终端在哪一批次的共享密钥，从而使用与标识信息对应的共享密钥对共享数据进行解密。例如：第一终端在用户改变共享用户的关系前，对通过第一共享密钥加密的共享数据都携带第一共享密钥的标识信息如数字“1”，在第一用户改变共享用户的关系并更新共享密钥后，对通过第二共享密钥加密的共享数据都携带第二共享密钥的标识信息如数字“2”。使得共享用户的终端接收到标识信息为“1”的共享数据后，与最新接收的第二共享密钥的标识信息“2”进行比对，结果显示共享数据所使用的共享密钥标识信息比第二共享密钥的标识信息小1，即需要将第二共享密钥通过单向陷门函数向前推算一次得到第一共享密钥后，通过第一共享密钥解密得到共享数据。若共享用户的终端接收到标识信息为“2”的共享数据后，与最新接收的第二共享密钥的标识信息“2”进行比对相同，则不用计算共享密钥，直接使用第二共享密钥对共享数据进行解密。需要说明的是，本实施例中第一共享密钥到第二共享密钥之间通过一次更新计算进行举例，实际使用时通过第一终端上传共享数据用户可能会在上传共享数据的过程中进行多次共享关系的更改，第一共享密钥也会经过多次单向陷门函数的计算后才获得第二共享密钥，其计算方式及原理与上述实施例相同，不再赘述。
S4011：数据存储服务器接收并存储新增共享数据后，向第一终端反馈新增共享数据的上传结果。
S4012：第一终端向第一用户反馈新增共享数据的上传结果。至此，第一终端完成共享密钥的更新并使用更新后的共享密钥加密第一用户新上传的共享数据。
对于被解除共享关系的共享用户，在被通过第一用户解除与该用户的共享关系后，只拥有被解除共享关系前的第一共享密钥，而不拥有被解除共享关系后第一终端更新的第二共享密钥。所以即使通过能够通过数据存储服务器的某个漏洞或者其他途径获取到所有共享数据的密文，也只能通过第一共享密钥解密并获取被解除共享关系前的共享数据的明文，而无法解密被解除共享关系后第一用户新增上传的共享数据密文。
对于未被解除共享关系的共享用户，在第一终端将第一共享密钥更新为第二共享密钥之后，未被解除共享关系的共享用户所使用的终端会被分发更新后的第二共享密钥，因此未被解除共享关系的共享用户所使用的终端能通过第二共享密钥解密第一用户修改共享关系之后新增的共享数据，也能够通过第二共享密钥解密第一终端的用户修改共享关系之前的共享数据。而第一共享密钥可以由未被解除共享关系的共享用户所使用的终端从存储设备中调用，或者如上述实施例中所述通过单向陷门函数由第二共享密钥计算得到，在此不作限定。
而如果该未被解除共享关系的共享用户所使用的终端在处理共享数据时，会从数据存储服务器获取共享数据后将共享数据存储在本地再进行处理，那么由于当第一终端将第一共享密钥更新为第二共享密钥之后，之前的共享数据的共享密钥还为第一共 享密钥不作更改，未被解除共享关系的共享用户不需要重新获取之前已获取的共享数据，而只需增量获取第一终端的用户在变更共享用户关系后新增的共享数据，并使用第二共享密钥进行解密。
对于第一用户新增的共享用户，共享用户使用的终端会被分发第一终端最新更新的第二共享密钥，并可以根据通过与第一终端相同的单向陷门函数由第二共享密钥计算更新前的第一共享密钥。随后从数据存储服务器获取第一用户上传的共享数据并根据共享数据的共享密钥的标识信息，利用与标识信息对应的共享密钥对共享数据进行解密，详细流程见下图5所示的实施例。
需要说明的是，本实施例中通过第一终端上传共享数据第一用户可能会在上传共享数据的过程中进行多次共享关系的更改，也会使得共享密钥进行多次的更新，因此对于未被解除共享关系的共享用户和新增的共享用户，接收到的共享数据的密文也会携带加密该共享数据所使用的共享密钥的标识信息，终端根据标识信息判断共享密钥的更新的次数，并根据最新的第二共享密钥由单向陷门函数向前推算相应的次数得到之前的共享密钥(向前推算一次即为第一共享密钥)，并通过标识信息对应的共享密钥解密共享数据。
具体地，对于新增的共享用户，图6为本申请共享数据处理方法实施例的流程示意图，如图6所示的实施例示出了新增的第二用户作为共享用户所绑定的第二终端对共享数据的处理流程，具体包括：
S501：第二用户作为第一用户指定的共享用户，通过第二用户的用户标识绑定的第二终端查看第一用户的共享数据，其中，本申请各示例中的第二终端指：上传共享数据的第一用户指定的、有权查看其共享数据的共享用户，通过该共享用户其标识信息登录并绑定的终端。上传共享数据的用户指定一共享用户有权查看其共享数据时，共享用户绑定的终端会接收相关的通知消息，因此第二用户能够通过第二终端查看第一用户上传数据存储服务器的共享数据。
S502：第二用户需要查看共享数据时，第二终端向共享服务器请求共享权限。
S503：共享服务器判断第二终端绑定的第二用户被第一用户指定可以访问共享数据，则向第二终端返回共享权限，其中，共享权限可以是第一用户上传的共享数据在数据存储服务器中的存储位置及其他存储的相关信息，使得第二终端根据存储信息向数据存储服务器请求数据。
S504：第二终端向共享服务器请求第二共享密钥，其中，第二共享密钥为第一终端在上传第一用户的共享数据时，最新使用的共享密钥。
S505：密钥服务器向第二终端发送第二共享密钥。其中，密钥服务器只向第二终端发送第一终端上传共享数据时最新的使用的第二共享密钥。之前的第一共享密钥则不向第二终端进行发送，而是由第二终端通过第二共享密钥和单向陷门函数进行计算，以减少服务器与终端之间通信数据量，并且减少第二终端对于共享密钥的存储空间，第二终端对共享数据进行解密时实时判断并计算共享密钥，从而提高了共享密钥的处理效率。
S506：第二终端根据S503中接收到的共享数据的信息向数据存储服务器请求共享数据。
S507：数据存储服务器向第二终端发送所请求的、第一用户上传的共享数据的密文，以及加密共享数据所使用的共享密钥的标识信息。
S508：由于第一终端的用户所共享的数据的共享用户的关系发生变化前后共享数据由不同的共享密钥进行加密，共享数据的共享用户的终端接收到共享数据后需要使用正确的共享密钥进行解密。其中，第二用户使用的第二终端获取到数据存储服务器中第一终端上传的共享数据时，通过标识信息知道该共享数据是第一终端在哪一批次的共享密钥，从而使用与标识信息对应的共享密钥对共享数据进行解密。例如：第一终端在第一用户改变共享用户的关系前，对通过第一共享密钥加密的共享数据都携带第一共享密钥的标识信息如数字“1”，在第一用户改变共享用户的关系并更新共享密钥后，对通过第二共享密钥加密的共享数据都携带第二共享密钥的标识信息如数字“2”。使得第二终端接收到标识信息为“1”的共享数据后，与最新接收的第二共享密钥的标识信息“2”进行比对，结果显示共享数据所使用的共享密钥标识信息比第二共享密钥的标识信息小1，即需要将第二共享密钥通过单向陷门函数向前推算一次得到第一共享密钥后，通过第一共享密钥解密得到共享数据。若第二终端接收到标识信息为“2”的共享数据后，与最新接收的第二共享密钥的标识信息“2”进行比对相同，则不用计算共享密钥，直接使用第二共享密钥对共享数据进行解密。需要说明的是，本实施例中第一共享密钥到第二共享密钥之间通过一次更新计算进行举例，实际使用时通过第一终端上传共享数据用户可能会在上传共享数据的过程中进行多次共享关系的更改，第一共享密钥会经过多次单向陷门函数的计算后才获得第二共享密钥，而第二终端通过第二共享密钥也会执行多次单向陷门函数的计算才能获得第一共享密钥，其计算方式及原理与上述实施例相同，不再赘述。
S509：第二终端根据第一共享密钥解密共享数据的密文得到共享数据的明文数据。
S5010：第二终端向第二用户呈现获取的共享数据。至此第二用户使用第二终端完成第一用户的共享数据密文的获取、共享密钥的更新及共享数据的解密最终得到共享数据的密文。
结合上述各实施例，本申请提供的一种共享数据处理方法，通过共享密钥将终端上传服务器的共享数据进行加密，确保共享数据离开终端即加密，确保了共享数据从端到端的安全。并且在共享数据的共享用户关系变化时，通过单向陷门函数对共享密钥进行更新，以使被撤销共享权限的用户即使通过其他途径获取到新的共享数据也无法进行解密，从而通过更新用于加密共享数据的共享密钥，进一步地提高了共享数据的安全性。
图7为本申请通信装置实施例的结构示意图。如图7所示，本实施例中的终端70包括：获取模块701，发送模块702和处理模块703。其中，获取模块701用于获取第一用户指定的第一共享数据；发送模块702用于向数据存储服务器发送第一标识信息和通过第一共享密钥加密的第一共享数据，其中，第一标识信息用于标识第一共享密钥；处理模块703用于若检测到第一用户指定的共享群组内的共享用户发生变化，根据第一共享密钥计算第二共享密钥，其中，共享群组内的共享用户所绑定的终端有权从数据存储服务器中获取第一用户的共享数据；获取模块701还用于，获取第一用户指定的第二共享数据；处理模块703还用于，向数据存储服务器发送第二标识信息和 通过第二共享密钥加密的第二共享数据，其中，第二标识信息用于标识第二共享密钥。
可选地，在上述实施例中，处理模块703具体用于，若检测到第一用户指定的共享群组内的共享用户发生变化，通过单向函数以第一共享密钥为输入，计算输出第二共享密钥。
可选地，在上述实施例中，单向函数为单向陷门函数，第一终端拥有单向陷门函数的陷门；
处理模块703具体用于，若检测到第一用户指定的共享群组内的共享用户发生变化，通过单向陷门函数以第一共享密钥和陷门为输入，计算输出第二共享密钥。
可选地，在上述实施例中，第一标识信息为第一终端计算第一共享密钥时累计使用单向陷门函数的次数信息；第二标识信息为第一终端计算第二共享密钥时累计使用单向陷门函数的次数信息。
可选地，在上述实施例中，第一用户指定的共享群组内的共享用户发生变化，包括：第一用户对共享群组内的共享用户进行删除或替换操作。
图7所示实施例的通信装置可用于执行上述方法实施例的技术方案，其实现原理和技术效果类似，此处不再赘述。
应理解以上通信装置的各个模块的划分仅仅是一种逻辑功能的划分，实际实现时可以全部或部分集成到一个物理实体上，也可以物理上分开。且这些模块可以全部以软件通过处理元件调用的形式实现；也可以全部以硬件的形式实现；还可以部分模块以软件通过处理元件调用的形式实现，部分模块通过硬件的形式实现。例如，控制模块可以为单独设立的处理元件，也可以集成在通信装置，例如终端设备的某一个芯片中实现，此外，也可以以程序的形式存储于通信装置的存储器中，由通信装置的某一个处理元件调用并执行以上各个模块的功能。其它模块的实现与之类似。此外这些模块全部或部分可以集成在一起，也可以独立实现。这里所述的处理元件可以是一种集成电路，具有信号的处理能力。在实现过程中，上述方法的各步骤或以上各个模块可以通过处理器元件中的硬件的集成逻辑电路或者软件形式的指令完成。
例如，以上这些模块可以是被配置成实施以上方法的一个或多个集成电路，例如：一个或多个特定集成电路(Application Specific Integrated Circuit，ASIC)，或，一个或多个微处理器(digital singnal processor，DSP)，或，一个或者多个现场可编程门阵列(Field Programmable Gate Array，FPGA)等。再如，当以上某个模块通过处理元件调度程序的形式实现时，该处理元件可以是通用处理器，例如中央处理器(Central Processing Unit，CPU)或其它可以调用程序的处理器。再如，这些模块可以集成在一起，以片上系统(system-on-a-chip，SOC)的形式实现。
图8为本申请通信装置实施例的结构示意图。如图8所示，本实施例中的通信装置80包括：获取模块801和处理模块802。其中，获取模块801用于获取第二共享密钥，其中，第二共享密钥为若检测到第一用户指定的共享群组内的共享用户发生变化，第一用户绑定的第一终端根据第一共享密钥计算得到第二共享密钥，第一共享密钥用于第一终端加密第一用户在指定的第一共享数据，第二共享密钥用于第一终端加密第一用户指定的第二共享数据，共享群组内的共享用户所绑定的终端有权从数据存储服务器中获取第一用户的共享数据；获取模块801还用于，接收数据存储服务器发送的 第一标识信息和通过第一共享密钥加密的第一共享数据，其中，第一标识信息用于标识第一共享密钥；处理模块802用于根据第二共享密钥和第一标识信息计算第一共享密钥；处理模块802还用于，根据第一共享密钥解密第一共享数据。
可选地，在上述实施例中，处理模块802具体用于，通过单向函数以第二共享密钥和第一标识信息为输入，计算输出第一共享密钥。
可选地，在上述实施例中，单向函数为单向陷门函数，第一终端拥有单向陷门函数的陷门。
可选地，在上述实施例中，第一标识信息为第一终端计算第一共享密钥时累计使用单向陷门函数的次数信息；第二标识信息为第一终端计算第二共享密钥时累计使用单向陷门函数的次数信息。
图8所示实施例的通信装置可用于执行上述方法实施例的技术方案，其实现原理和技术效果类似，此处不再赘述。
应理解以上通信装置的各个模块的划分仅仅是一种逻辑功能的划分，实际实现时可以全部或部分集成到一个物理实体上，也可以物理上分开。且这些模块可以全部以软件通过处理元件调用的形式实现；也可以全部以硬件的形式实现；还可以部分模块以软件通过处理元件调用的形式实现，部分模块通过硬件的形式实现。例如，控制模块可以为单独设立的处理元件，也可以集成在通信装置，例如终端设备的某一个芯片中实现，此外，也可以以程序的形式存储于通信装置的存储器中，由通信装置的某一个处理元件调用并执行以上各个模块的功能。其它模块的实现与之类似。此外这些模块全部或部分可以集成在一起，也可以独立实现。这里所述的处理元件可以是一种集成电路，具有信号的处理能力。在实现过程中，上述方法的各步骤或以上各个模块可以通过处理器元件中的硬件的集成逻辑电路或者软件形式的指令完成。
例如，以上这些模块可以是被配置成实施以上方法的一个或多个集成电路，例如：一个或多个特定集成电路(Application Specific Integrated Circuit，ASIC)，或，一个或多个微处理器(digital singnal processor，DSP)，或，一个或者多个现场可编程门阵列(Field Programmable Gate Array，FPGA)等。再如，当以上某个模块通过处理元件调度程序的形式实现时，该处理元件可以是通用处理器，例如中央处理器(Central Processing Unit，CPU)或其它可以调用程序的处理器。再如，这些模块可以集成在一起，以片上系统(system-on-a-chip，SOC)的形式实现。
图9为本申请终端设备实施例的结构示意图。如图9所示，终端设备90包括：处理器901，存储器902和接口903。其中，存储器902用于存储计算机程序；处理器901调用所述计算机程序，当计算机程序被执行时，用于执行以下操作：获取第一用户在指定的第一共享数据；向数据存储服务器发送第一标识信息和通过第一共享密钥加密的第一共享数据，其中，第一标识信息用于标识第一共享密钥；若检测到第一用户指定的共享群组内的共享用户发生变化，根据第一共享密钥计算第二共享密钥，其中，共享群组内的共享用户所绑定的终端有权从数据存储服务器中获取第一用户的共享数据；获取第一用户指定的第二共享数据；向数据存储服务器发送第二标识信息和通过第二共享密钥加密的第二共享数据，其中，第二标识信息用于标识第二共享密钥。
可选地，可选地，在上述实施例中，处理器901具体用于若检测到第一用户指定 的共享群组内的共享用户发生变化，通过单向函数以第一共享密钥为输入，计算输出第二共享密钥。
可选地，在上述实施例中，单向函数为单向陷门函数，第一终端拥有单向陷门函数的陷门；
处理器901具体用于，若检测到第一用户指定的共享群组内的共享用户发生变化，通过单向陷门函数以第一共享密钥和陷门为输入，计算输出第二共享密钥。
可选地，在上述实施例中，第一标识信息为第一终端计算第一共享密钥时累计使用单向陷门函数的次数信息；第二标识信息为第一终端计算第二共享密钥时累计使用单向陷门函数的次数信息。
可选地，在上述实施例中，第一用户指定的共享群组内的共享用户发生变化，包括：第一用户对共享群组内的共享用户进行删除或替换操作。
该存储器902用于存储实现以上方法实施例，或者图7所示实施例各个模块的程序，处理器901调用该程序，执行以上方法实施例的操作，以实现图7所示的各个模块。
或者，以上各个模块的部分或全部也可以通过集成电路的形式内嵌于该终端设备的某一个芯片上来实现。且它们可以单独实现，也可以集成在一起。即以上这些模块可以被配置成实施以上方法的一个或多个集成电路，例如：一个或多个特定集成电路(Application Specific Integrated Circuit，ASIC)，或，一个或多个微处理器(digital singnal processor，DSP)，或，一个或者多个现场可编程门阵列(Field Programmable Gate Array，FPGA)等。
图10为本申请终端设备实施例的结构示意图。如图10所示，终端设备100包括：处理器1001，存储器1002和接口1003。其中，存储器1002用于存储计算机程序；处理器1001调用所述计算机程序，当计算机程序被执行时，用于执行以下操作：获取第二共享密钥，其中，第二共享密钥为若检测到第一用户指定的共享群组内的共享用户发生变化，第一用户绑定的第一终端根据第一共享密钥计算得到第二共享密钥，第一共享密钥用于第一终端加密第一用户指定的第一共享数据，第二共享密钥用于第一终端加密第一用户指定的第二共享数据，共享群组内的共享用户所绑定的终端有权从数据存储服务器中获取第一用户的共享数据；接收数据存储服务器发送的第一标识信息和通过第一共享密钥加密的第一共享数据，其中，第一标识信息用于标识第一共享密钥；根据第二共享密钥和第一标识信息计算第一共享密钥；根据第一共享密钥解密第一共享数据。
可选地，在上述实施例中，处理器1001具体用于，通过单向函数以第二共享密钥和第一标识信息为输入，计算输出第一共享密钥。
可选地，在上述实施例中，单向函数为单向陷门函数，第一终端拥有单向陷门函数的陷门。
可选地，在上述实施例中，第一标识信息为第一终端计算第一共享密钥时累计使用单向陷门函数的次数信息；第二标识信息为第一终端计算第二共享密钥时累计使用单向陷门函数的次数信息。
该存储器1002用于存储实现以上方法实施例，或者图8所示实施例各个模块的程 序，处理器1001调用该程序，执行以上方法实施例的操作，以实现图8所示的各个模块。
或者，以上各个模块的部分或全部也可以通过集成电路的形式内嵌于该终端设备的某一个芯片上来实现。且它们可以单独实现，也可以集成在一起。即以上这些模块可以被配置成实施以上方法的一个或多个集成电路，例如：一个或多个特定集成电路(Application Specific Integrated Circuit，ASIC)，或，一个或多个微处理器(digital singnal processor，DSP)，或，一个或者多个现场可编程门阵列(Field Programmable Gate Array，FPGA)等。
图11为本申请终端设备实施例的结构示意图。如图11所示，该终端设备具体可以是手机，如图10所示，手机11包括：射频(Radio Frequency，RF)电路110、电源120、处理器130、存储器140、输入单元150、显示单元160、传感器170、音频电路180、以及无线保真(wireless fidelity，WIFI)模块190等部件。可以理解，图10中示出的手机结构并不构成对手机的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。本申请涉及的主要部件包括射频电路110、处理器130、无线模块190以及运行于处理器130上的操作系统上的软件设计。下面结合图10对手机11的各个构成部件进行具体的介绍。
射频电路110可用于收发信息或通话过程中信号的接收和发送，例如，射频电路110接收基站的下行信息后，将该下行信息传输给处理器130，处理器130对该下行信息进行处理；此外，射频电路110还可以通过无线通信与网络和其他设备通信。一方面，图11中的手机11可以作为上述实施例中的第一终端，通过射频电路110向数据存储服务器发送第一标识信息和通过第一共享密钥加密的第一共享数据，或者通过射频电路110向数据存储服务器发送第二标识信息和通过第二共享密钥加密的第二共享数据。另一方面，图11中的手机11可以作为上述实施例中的第二终端，通过射频电路110接收数据存储服务器发送的第一标识信息和通过第一共享密钥加密的第一共享数据。
存储器140可用于存储软件程序以及模块，处理器130通过运行存储在存储器140的软件程序、模块以及操作系统固件代码等，从而执行手机11的各种功能应用以及数据处理，如上述实施例通信装置中获取模块、发送模块和处理模块等功能的执行。存储器140可主要包括存储程序区和存储数据区，其中，存储程序区可存储操作系统、至少一个功能所需的应用程序(比如网络访问功能、共享数据展示功能等)等；存储数据区可存储根据手机11的使用所创建的数据(比如共享数据、共享密钥等)等。此外，存储器140可以包括高速随机存取存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件、闪存器件、或其他易失性固态存储器件。
输入单元150可用于接收输入的数字或字符信息，以及产生与手机11的用户设置以及功能控制有关的键信号输入。
显示单元160可用于显示由用户输入的信息或提供给用户的信息以及手机11的各种菜单。显示单元160可包括显示面板161，可选的，可以采用LCD、OLED等形式来配置显示面板161。进一步的，触控面板151可覆盖显示面板161，当触控面板151检测到在其上或附近的触摸操作后，传送给处理器130以确定触摸事件的类型，随后 处理器130根据触摸事件的类型在显示面板161上提供相应的视觉输出。
处理器130是手机11的控制中心，利用各种接口和线路连接整个手机的各个部分，通过运行或执行存储在存储器140内的软件程序和/或模块，以及调用存储在存储器140内的数据，执行手机11的各种功能和处理数据，从而实现基于手机的多种业务。
具体地，一方面，图11中的手机11可以作为上述实施例中的第一终端，手机11的处理器130通过显示单元160向用户展示的共享数据的界面与菜单，用户可以通过输入单元150指定第一共享数据，当输入单元150的输入信号传入到处理器130，处理器130对进行数据处理后下发命令，控制射频电路110向数据存储服务器发送经过第一共享密钥加密的第一共享数据。用户还可以通过输入单元150指定共享群组内的共享用户发生变化。则输入单元150的输入信号传入到处理器130，处理器130对第一共享密钥进行更新得到第二共享密钥。用户还可通过输入单元150指定第二共享数据，当输入单元150的输入信号传入到处理器130，处理器130对进行数据处理后下发命令，控制射频电路110向数据存储服务器发送经过第二共享密钥加密的第二共享数据。用户指定的第一共享数据和第二共享数据可以是存储器140中存储的数据。
另一方面，图11中的手机及101可以作为上述实施例中的第二终端，通过射频电路110接收数据存储服务器发送的第一标识信息和第一共享密钥加密的第一共享数据，处理器130根据第二共享密钥和第一标识信息计算第一共享密钥后，通过第一共享密钥解密第一共享数据。处理器130还可以对进行数据处理后下发命令控制显示单元160向用户展示第一共享数据。处理器103可以通过射频电路110接收服务器发送的第二共享密钥，或者处理器103从存储器140中读取第二共享密钥。
WIFI属于短距离无线传输技术，手机11通过WIFI模块190可以帮助用户收发电子邮件、浏览网页和访问流式媒体等，它为用户提供了无线的宽带互联网访问。虽然图11示出了WIFI模块190，但是可以理解的是，其并不属于手机11的必须构成，完全可以根据需要在不改变发明的本质的范围内而省略。
手机11还包括给各个部件供电的电源120(比如电池)，该电源可以通过电源管理系统与处理器130逻辑相连，从而通过该电源管理系统实现管理充电、放电、以及功耗等功能。尽管未示出，手机11还可以包括摄像头、蓝牙模块等，在此不再赘述。
图11所示实施例的终端可用于执行上述各方法实施例的技术方案，其实现原理和技术效果类似，此处不再赘述。
另外，本申请实施例还提供一种计算机可读存储介质，该计算机可读存储介质中存储有计算机程序，当其在计算机上运行时，使得计算机执行上述实施例所述的网络切换方法。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例 如同轴电缆、光纤、数字用户线)或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘，Solid State Disk)等。
最后应说明的是：以上各实施例仅用以说明本发明的技术方案，而非对其限制；尽管参照前述各实施例对本发明进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分或者全部技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本发明各实施例技术方案的范围。

Claims (20)

  1. 一种共享数据处理方法，其特征在于，包括：
    第一终端获取第一用户指定的第一共享数据；
    所述第一终端向数据存储服务器发送第一标识信息和通过第一共享密钥加密的所述第一共享数据，其中，所述第一标识信息用于标识所述第一共享密钥；
    若检测到所述第一用户指定的共享群组内的共享用户发生变化，所述第一终端根据所述第一共享密钥计算第二共享密钥，其中，所述共享群组内的共享用户所绑定的终端有权从所述数据存储服务器中获取所述第一用户的共享数据；
    所述第一终端获取所述第一用户指定的第二共享数据；
    所述第一终端向所述数据存储服务器发送第二标识信息和通过所述第二共享密钥加密的所述第二共享数据，其中，所述第二标识信息用于标识所述第二共享密钥。
  2. 根据权利要求1所述的方法，其特征在于，所述第一终端根据所述第一共享密钥计算第二共享密钥，包括：
    所述第一终端通过单向函数以所述第一共享密钥为输入，计算输出所述第二共享密钥。
  3. 根据权利要求2所述的方法，其特征在于，所述单向函数为单向陷门函数，所述第一终端拥有所述单向陷门函数的陷门；
    所述第一终端通过单向函数以所述第一共享密钥为输入计算输出所述第二共享密钥，包括：
    所述第一终端通过所述单向陷门函数以所述第一共享密钥和所述陷门为输入，计算输出所述第二共享密钥。
  4. 根据权利要求3所述的方法，其特征在于，
    所述第一标识信息为所述第一终端计算所述第一共享密钥时累计使用所述单向陷门函数的次数信息；
    所述第二标识信息为所述第一终端计算所述第二共享密钥时累计使用所述单向陷门函数的次数信息。
  5. 根据权利要求1-4任一项所述的方法，其特征在于，所述第一用户指定的共享群组内的共享用户发生变化，包括：
    所述第一用户对所述共享群组内的共享用户进行删除或替换操作。
  6. 一种共享数据处理方法，其特征在于，包括：
    第二终端获取第二共享密钥，其中，所述第二共享密钥为若检测到所述第一用户指定的共享群组内的共享用户发生变化，所述第一用户绑定的第一终端根据第一共享密钥计算得到所述第二共享密钥，所述第一共享密钥用于所述第一终端加密所述第一用户指定的第一共享数据，所述第二共享密钥用于所述第一终端加密第一用户指定的第二共享数据，所述共享群组内的共享用户所绑定的终端有权从所述数据存储服务器中获取所述第一用户的共享数据；
    第二终端接收数据存储服务器发送的第一标识信息和通过第一共享密钥加密的第一共享数据，其中，所述第一标识信息用于标识所述第一共享密钥；
    所述第二终端根据所述第二共享密钥和所述第一标识信息计算所述第一共享密钥；
    所述第二终端根据所述第一共享密钥解密所述第一共享数据。
  7. 根据权利要求6所述的方法，其特征在于，所述第二终端根据第二共享密钥和所述第一标识信息计算所述第一共享密钥，包括：
    所述第二终端通过单向函数以所述第二共享密钥和所述第一标识信息为输入，计算输出所述第一共享密钥。
  8. 根据权利要求7所述的方法，其特征在于，所述单向函数为单向陷门函数，所述第一终端拥有所述单向陷门函数的陷门。
  9. 根据权利要求8所述的方法，其特征在于，
    所述第一标识信息为所述第一终端计算所述第一共享密钥时累计使用所述单向陷门函数的次数信息；
    所述第二标识信息为所述第一终端计算所述第二共享密钥时累计使用所述单向陷门函数的次数信息。
  10. 一种通信装置，其特征在于，所述通信装置包括：
    获取模块，用于获取第一用户指定的第一共享数据；
    发送模块，用于向数据存储服务器发送第一标识信息和通过第一共享密钥加密的所述第一共享数据，其中，所述第一标识信息用于标识所述第一共享密钥；
    处理模块，用于若检测到所述第一用户指定的共享群组内的共享用户发生变化，根据所述第一共享密钥计算第二共享密钥，其中，所述共享群组内的共享用户所绑定的终端有权从所述数据存储服务器中获取所述第一用户的共享数据；
    所述获取模块还用于，获取所述第一用户指定的第二共享数据；
    所述处理模块还用于，向所述数据存储服务器发送第二标识信息和通过所述第二共享密钥加密的所述第二共享数据，其中，所述第二标识信息用于标识所述第二共享密钥。
  11. 根据权利要求10所述的通信装置，其特征在于，所述处理模块具体用于，
    若检测到所述第一用户指定的共享群组内的共享用户发生变化，通过单向函数以所述第一共享密钥为输入，计算输出所述第二共享密钥。
  12. 根据权利要求11所述的通信装置，其特征在于，所述单向函数为单向陷门函数，所述第一终端拥有所述单向陷门函数的陷门；
    所述处理模块具体用于，若检测到所述第一用户指定的共享群组内的共享用户发生变化，通过所述单向陷门函数以所述第一共享密钥和所述陷门为输入，计算输出所述第二共享密钥。
  13. 根据权利要求12所述的通信装置，其特征在于，
    所述第一标识信息为所述第一终端计算所述第一共享密钥时累计使用所述单向陷门函数的次数信息；
    所述第二标识信息为所述第一终端计算所述第二共享密钥时累计使用所述单向陷门函数的次数信息。
  14. 根据权利要求10-13任一项所述的通信装置，其特征在于，所述第一用户指定的共享群组内的共享用户发生变化，包括：
    所述第一用户对所述共享群组内的共享用户进行删除或替换操作。
  15. 一种通信装置，其特征在于，所述通信装置包括：
    获取模块，用于获取第二共享密钥，其中，所述第二共享密钥为若检测到所述第一用户指定的共享群组内的共享用户发生变化，所述第一用户绑定的第一终端根据第一共享密钥计算得到所述第二共享密钥，所述第一共享密钥用于所述第一终端加密所述第一用户指定的第一共享数据，所述第二共享密钥用于所述第一终端加密第一用户指定的第二共享数据，所述共享群组内的共享用户所绑定的终端有权从所述数据存储服务器中获取所述第一用户的共享数据；
    所述获取模块还用于，接收数据存储服务器发送的第一标识信息和通过第一共享密钥加密的第一共享数据，其中，所述第一标识信息用于标识所述第一共享密钥；
    处理模块，用于根据所述第二共享密钥和所述第一标识信息计算所述第一共享密钥；
    所述处理模块还用于，根据所述第一共享密钥解密所述第一共享数据。
  16. 根据权利要求15所述的通信装置，其特征在于，所述处理模块具体用于，
    通过单向函数以所述第二共享密钥和所述第一标识信息为输入，计算输出所述第一共享密钥。
  17. 根据权利要求16所述的通信装置，其特征在于，所述单向函数为单向陷门函数，所述第一终端拥有所述单向陷门函数的陷门。
  18. 根据权利要求17所述的通信装置，其特征在于，
    所述第一标识信息为所述第一终端计算所述第一共享密钥时累计使用所述单向陷门函数的次数信息；
    所述第二标识信息为所述第一终端计算所述第二共享密钥时累计使用所述单向陷门函数的次数信息。
  19. 一种通信设备，其特征在于，包括：
    接口和处理器，所述接口和处理器耦合；
    所述处理器用于执行权利要求1-9任一项所述的方法。
  20. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有计算机程序，当其在计算机上运行时，使得计算机执行如权利要求1-9任一项所述的方法。
PCT/CN2018/083979 2018-03-28 2018-04-20 共享数据处理方法、通信装置及通信设备 WO2019184027A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201880077309.7A CN111418181B (zh) 2018-03-28 2018-04-20 共享数据处理方法、通信装置及通信设备

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810266990 2018-03-28
CN201810266990.1 2018-03-28

Publications (1)

Publication Number Publication Date
WO2019184027A1 true WO2019184027A1 (zh) 2019-10-03

Family

ID=68059155

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/083979 WO2019184027A1 (zh) 2018-03-28 2018-04-20 共享数据处理方法、通信装置及通信设备

Country Status (2)

Country Link
CN (1) CN111418181B (zh)
WO (1) WO2019184027A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114884939A (zh) * 2022-05-07 2022-08-09 中国银行股份有限公司 屏幕共享方法、装置及系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101626370A (zh) * 2008-07-07 2010-01-13 华为技术有限公司 节点间密钥的分配方法、系统及设备
CN104219663A (zh) * 2013-05-30 2014-12-17 江苏大学 一种对车辆身份进行认证的方法和系统
CN104917787A (zh) * 2014-03-11 2015-09-16 中国电信股份有限公司 基于群组密钥的文件安全共享方法和系统
CN106998252A (zh) * 2017-05-18 2017-08-01 西安电子科技大学 基于云数据库的轻量级rfid群组标签认证方法

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
DE102014204044A1 (de) * 2014-03-05 2015-09-10 Robert Bosch Gmbh Verfahren zum Widerrufen einer Gruppe von Zertifikaten
CN105933345B (zh) * 2016-06-28 2019-10-18 电子科技大学 一种基于线性秘密共享的可验证外包属性基加密方法
CN107135062B (zh) * 2017-05-08 2020-10-30 桂林电子科技大学 一种改进的大文件的加密方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101626370A (zh) * 2008-07-07 2010-01-13 华为技术有限公司 节点间密钥的分配方法、系统及设备
CN104219663A (zh) * 2013-05-30 2014-12-17 江苏大学 一种对车辆身份进行认证的方法和系统
CN104917787A (zh) * 2014-03-11 2015-09-16 中国电信股份有限公司 基于群组密钥的文件安全共享方法和系统
CN106998252A (zh) * 2017-05-18 2017-08-01 西安电子科技大学 基于云数据库的轻量级rfid群组标签认证方法

Also Published As

Publication number Publication date
CN111418181A (zh) 2020-07-14
CN111418181B (zh) 2021-09-07

Similar Documents

Publication Publication Date Title
KR102013091B1 (ko) 보안 통신 채널을 설정하기 위한 방법들 및 장치
EP2820792B1 (en) Method of operating a computing device, computing device and computer program
US9876772B1 (en) Encrypting and transmitting data
US9356994B2 (en) Method of operating a computing device, computing device and computer program
US10084789B2 (en) Peer to peer enterprise file sharing
US11457018B1 (en) Federated messaging
EP2820585B1 (en) Method of operating a computing device, computing device and computer program
KR20120113690A (ko) 전자 액세스 클라이언트들을 저장하기 위한 장치 및 방법들
US10255446B2 (en) Clipboard management
US11349659B2 (en) Transmitting an encrypted communication to a user in a second secure communication network
CN107113164B (zh) 加密数据的重复删除的方法、装置和计算机可读介质
US9571288B2 (en) Peer to peer enterprise file sharing
US9584508B2 (en) Peer to peer enterprise file sharing
CN113454626B (zh) 内容的安全离线流式传输
CN112425130A (zh) 使用与装置相关联的身份数据来将通信引导至另一装置
US10791196B2 (en) Directory lookup for federated messaging with a user from a different secure communication network
WO2019184027A1 (zh) 共享数据处理方法、通信装置及通信设备
US11368442B2 (en) Receiving an encrypted communication from a user in a second secure communication network
CN113169965A (zh) 一种资源配置方法、设备及存储介质
JP2015230520A (ja) 認証装置、認証方法、認証プログラム、及び認証システム

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18912690

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18912690

Country of ref document: EP

Kind code of ref document: A1