WO2022028391A1 - 数据云服务方法及通信装置 - Google Patents

数据云服务方法及通信装置 Download PDF

Info

Publication number
WO2022028391A1
WO2022028391A1 PCT/CN2021/110212 CN2021110212W WO2022028391A1 WO 2022028391 A1 WO2022028391 A1 WO 2022028391A1 CN 2021110212 W CN2021110212 W CN 2021110212W WO 2022028391 A1 WO2022028391 A1 WO 2022028391A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
node
path
public key
data packet
Prior art date
Application number
PCT/CN2021/110212
Other languages
English (en)
French (fr)
Inventor
彭琨
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2022028391A1 publication Critical patent/WO2022028391A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0442—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0407—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the identity of one or more communicating identities is hidden
    • H04L63/0421—Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H04L9/3257—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures using blind signatures

Definitions

  • the present application relates to the field of communications, and in particular, to a data cloud service method and a communication device.
  • Cloud services refer to the services that users obtain through the Internet. For example, users do not need to download and install software on terminal devices, but can use related services of the software only through the Internet, and the software can be stored in the cloud server of the cloud service provider. .
  • the user provides ciphertext information to the cloud server without hiding the identity information, so as to protect the privacy of the user.
  • the financial information is encrypted by the homomorphic encryption algorithm to obtain the ciphertext information, and then the ciphertext information is provided to the cloud server.
  • the cloud server does not decrypt the information. , directly perform ciphertext calculation on the ciphertext information, and after obtaining the calculation result, return the calculation result to the user. In this way, the cloud server does not know the specific content of the financial information in the ciphertext information, so that the privacy of the user can be protected.
  • the homomorphic encryption algorithm is relatively complex, and the encryption efficiency is low, and the cloud server directly calculates the ciphertext information, which increases the computational complexity, leads to low computational efficiency, and affects service performance and response speed. .
  • Embodiments of the present application provide a data cloud service method and a communication device, which can reduce the computational complexity of the cloud service process, thereby improving service performance and response speed.
  • a data cloud service method includes: receiving and parsing a first data packet through a first path to obtain original data, encrypting the feedback data according to a second public key set, generating a second data packet, sending and parsing the second data packet through a second path data pack.
  • the first data packet includes original data
  • the first data packet is generated according to the first public key set and the original data
  • the first path includes at least one node
  • the first public key set includes at least one first public key
  • a The first public key corresponds to a node in the first path
  • the feedback data is determined according to the original data
  • the second data packet is generated according to the second public key set and the feedback data
  • the second public key set includes at least One second public key
  • one second public key corresponds to one node in the second path
  • the second path includes at least one node.
  • the terminal device submits the first data packet after encrypting the original data to the cloud service platform to ensure that the user's identity information is not leaked, and finally the cloud service platform obtains plaintext data, that is, the original data.
  • the server calculates the ciphertext data
  • the calculation process of the present application is simpler and the calculation efficiency is higher, so that the service performance and response speed can be improved.
  • the first path may be a path starting with a terminal device, ending with a target server, and using at least one first node as an intermediate node, and the at least one first node is sequentially determined by the user. That is to say, the first path is the path for sending the first data packet.
  • the user can determine the first node in the path and the sequence between the first nodes according to his own wishes, and the cloud service platform does not need to determine the first path. The security in the cloud service process can be further improved.
  • the first data packet may include a second path
  • the second path may be a path starting with the target server, ending with a terminal device, and using at least one second node as an intermediate node; at least one The second node is sequentially determined by the user. That is to say, the second path is the path for returning data, so that the cloud service platform can successfully return data without knowing the identity information of the user.
  • the data cloud service method described in the first aspect may further include: sending indication information to the terminal device.
  • the indication information may be used to instruct the terminal device to display a service page
  • the service page may include a node list and a data start address
  • the node list may be used by the user to sequentially determine at least one first node of the first path and sequentially determine the first node through the terminal device.
  • At least one second node of the two paths, the data starting address can be used for the user to provide the original data through the terminal device.
  • the above-mentioned sending and parsing the second data packet through the second path may include: analyzing the second data packet through the second public key corresponding to at least one second node in sequence, and obtaining the third data packet , and send the third data packet to the terminal device.
  • the third data packet may carry the data encrypted by using the second public key corresponding to the terminal device to the feedback data. In this way, in the process of returning the feedback data, the specific content of the feedback data cannot be obtained, thereby ensuring that the privacy of the user is not leaked.
  • receiving and parsing the first data packet through the first path to obtain the original data may include: parsing the first data through the first public key corresponding to at least one first node and the target server in sequence package to get the raw data. That is to say, in the process of obtaining the original data, the cloud service platform receives the ciphertext information, that is, the first data packet. After parsing layer by layer, the plaintext data, that is, the original data, is obtained. However, the cloud service platform The identity information of the user cannot be obtained, and the identity of the user who provided the original data cannot be known, which can ensure that the privacy of the user is not leaked.
  • the data cloud service method described in the first aspect may further include: obtaining the authorization information of the user, according to the authorization information to determine whether to grant the user authorization.
  • the authorization information may be obtained by blindly signing the user's identity information. That is to say, the cloud service platform cannot obtain the user's identity information through the authorization information, so that it can not only verify whether the anonymous user is authorized, but also ensure that the user's privacy is not leaked.
  • the data cloud service method described in the first aspect may further include: if it is determined to grant the user authorization, recording the authorization information. That is, if the cloud service platform determines that the authorization has been given to the user, the authorization information is recorded to prevent the authorization information from being reused.
  • the first data packet may include authorization information. That is to say, the cloud service platform can obtain authorization information in the process of obtaining the original data.
  • a data cloud service method includes: generating a first data packet, sending the first data packet, and acquiring feedback data.
  • the first data package includes original data
  • the first data package is generated according to the first public key set and the original data
  • the first public key set includes at least one first public key
  • one first public key corresponds to A node in the first path is used for a node in the first path to encrypt the original data
  • the first path includes at least one node
  • the feedback data is determined according to the original data.
  • the first path may be a path starting with a terminal device, ending with a target server, and using at least one first node as an intermediate node, and the at least one first node is sequentially determined by the user.
  • the first data packet may include a second public key set, the second public key set includes at least one second public key, and one second public key corresponds to the second public key in the second path.
  • the first data packet may include a second path, and the second path may be a path starting with the target server, ending with a terminal device, and using at least one second node as an intermediate node. At least one The second node is sequentially determined by the user.
  • the data cloud service method described in the second aspect may further include: receiving indication information from the target server.
  • the indication information can be used to instruct the terminal device to display a service page, the service page includes a node list and a data start address, and the node list can be used by the user to sequentially determine at least one first node of the first path and sequentially determine the second node through the terminal device.
  • At least one second node of the path, the data start address can be used by the user to provide the original data through the terminal device.
  • obtaining the feedback data may include: receiving a third data packet, and analyzing the third data packet by using a second public key corresponding to the terminal device to obtain the feedback data.
  • the third data packet may carry the data encrypted by using the second public key corresponding to the terminal device to the feedback data.
  • the first data packet may include authorization information
  • the authorization information may be obtained by blindly signing the user's identity information
  • the authorization information may be used to determine whether to grant the user authorization
  • a communication device in a third aspect, includes: a processing unit and a transceiver unit.
  • the transceiver unit is configured to receive the first data packet through the first path.
  • the first data package includes original data
  • the first data package is generated according to the first public key set and the original data
  • the first public key set includes at least one first public key
  • one first public key corresponds to A node in a first path, the first path including at least one node.
  • the processing unit is used for parsing the first data packet to obtain original data.
  • the processing unit is further configured to encrypt the feedback data according to the second public key set to generate a second data packet.
  • the feedback data is determined according to the original data
  • the second data packet is generated according to the second public key set and the feedback data
  • the second public key set includes at least one second public key, one second public key
  • the key corresponds to a node in the second path, and the second path includes at least one node.
  • the transceiver unit is further configured to send the second data packet through the second path.
  • the processing unit is further configured to parse the second data packet.
  • the first path may be a path starting with the terminal device, ending with the target server of the communication device, and taking at least one first node as an intermediate node, and the at least one first node is sequentially determined by the user .
  • the first data packet may include a second path
  • the second path may be a path starting with a target server of the communication apparatus, ending with a terminal device, and using at least one second node as an intermediate node , at least one second node is sequentially determined by the user.
  • the transceiver unit is further configured to send indication information to the terminal device.
  • the indication information may be used to instruct the terminal device to display a service page
  • the service page may include a node list and a data start address
  • the node list may be used by the user to sequentially determine at least one first node of the first path and sequentially determine the first node through the terminal device.
  • At least one second node of the two paths, the data starting address can be used for the user to provide the original data through the terminal device.
  • the processing unit is further configured to parse the second data packet through the second public key corresponding to the at least one second node in sequence to obtain the third data packet.
  • the third data packet may carry the data encrypted by using the second public key corresponding to the terminal device to the feedback data.
  • the transceiver unit is further configured to send a third data packet to the terminal device.
  • the processing unit is further configured to parse the first data packet through at least one first node and the first public key corresponding to the target server of the communication device in sequence to obtain the original data.
  • the processing unit is further configured to obtain authorization information of the user.
  • the authorization information may be obtained by blindly signing the user's identity information.
  • the processing unit is further configured to determine whether to grant the user authorization according to the authorization information.
  • the processing unit is further configured to record the authorization information if it is determined to grant the user authorization.
  • the first data packet may include authorization information.
  • the transceiver unit described in the third aspect may include a receiving unit and a sending unit.
  • the receiving unit is used for receiving data and/or signaling from the terminal equipment;
  • the sending unit is used for sending data and/or signaling to the terminal equipment.
  • the present application does not specifically limit the specific implementation manner of the transceiver unit.
  • the communication apparatus described in the third aspect may further include a storage unit, where the storage unit stores programs or instructions.
  • the processing unit executes the program or instruction
  • the communication apparatus described in the third aspect can execute the method described in the first aspect.
  • the communication device described in the third aspect may be a cloud service platform, or may be a chip (system) or other components or components that can be provided in the cloud service platform, which is not limited in this application.
  • a communication device in a fourth aspect, includes: a processing unit and a transceiver unit.
  • the processing unit is used to generate the first data packet.
  • the first data package includes original data
  • the first data package is generated according to the first public key set and the original data
  • the first public key set includes at least one first public key
  • one first public key corresponds to A node in the first path is used for encrypting the original data by a node in the first path
  • the first path includes at least one node.
  • the transceiver unit is used for sending the first data packet.
  • the processing unit is also used to obtain feedback data.
  • the feedback data is determined according to the original data.
  • the first path may be a path with the communication device as the starting point, the target server as the end point, and at least one first node as an intermediate node, and the at least one first node is sequentially determined by the user.
  • the first data packet may include a second public key set, the second public key set may include at least one second public key, and one second public key corresponds to the second public key in the second path.
  • the first data packet may include a second path, and the second path may be a path starting with the target server, ending with the communication device, and using at least one second node as an intermediate node. At least one The second node is sequentially determined by the user.
  • the transceiver unit is further configured to receive indication information from the target server.
  • the indication information may be used to instruct the communication device to display a service page
  • the service page may include a node list and a data start address
  • the node list may be used by the user to sequentially determine at least one first node of the first path and to sequentially determine the first node through the communication device.
  • At least one second node of the two paths, the data start address can be used by the user to provide the original data through the communication device.
  • the transceiver unit is further configured to receive the third data packet.
  • the third data packet may carry data encrypted by using the second public key corresponding to the communication device to the feedback data.
  • the processing unit is further configured to parse the third data packet through the second public key corresponding to the communication device to obtain feedback data.
  • the first data packet may include authorization information
  • the authorization information may be obtained by blindly signing the user's identity information
  • the authorization information may be used to determine whether to grant the user authorization
  • the transceiver unit described in the fourth aspect may include a receiving unit and a sending unit.
  • the receiving unit is used for receiving data and/or signaling from the cloud service platform;
  • the sending unit is used for sending data and/or signaling to the cloud service platform.
  • the present application does not specifically limit the specific implementation manner of the transceiver unit.
  • the communication device may further include a storage unit, where the storage unit stores programs or instructions.
  • the processing unit executes the program or instruction
  • the communication apparatus described in the fourth aspect can execute the method described in the second aspect.
  • the communication device described in the fourth aspect may be a terminal device, or may be a chip (system) or other components or components that can be provided in the terminal device, which is not limited in this application.
  • a communication device in a fifth aspect, includes: a processor and a communication interface.
  • the processor is configured to communicate with other devices through the communication interface, and execute the data cloud service method described in any one of the possible implementation manners of the first aspect to the second aspect.
  • the communication interface may be a transceiver circuit for the communication device to communicate with other communication devices.
  • the communication apparatus described in the fifth aspect may further include a memory.
  • the memory is used to store computer programs.
  • the transceiver may be used for the communication device to communicate with other communication devices.
  • the communication apparatus described in the fifth aspect may be a terminal device or a cloud service platform or server, or a chip (system) or other components or components that may be provided in the terminal device, cloud service platform or server.
  • a communication system in a sixth aspect, includes one or more terminal devices and a cloud service platform.
  • the cloud service platform may include one or more nodes and one or more servers.
  • a computer-readable storage medium comprising: the computer-readable storage medium includes a computer program or instruction; when the computer program or instruction is run on a computer, the computer is made to execute the first aspect to the second aspect
  • the data cloud service method described in any of the possible implementation manners.
  • a computer program product including a computer program or instructions, which, when the computer program or instructions are run on a computer, cause the computer to execute any one of the possible implementations described in the first aspect to the second aspect. data cloud service method.
  • FIG. 1 is a schematic structural diagram of a communication system provided by an embodiment of the present application.
  • FIG. 2 is a schematic structural diagram 1 of a communication device provided by an embodiment of the present application.
  • FIG. 3 is a schematic flowchart 1 of a data cloud service method provided by an embodiment of the present application.
  • FIG. 4 is a schematic structural diagram of a first data packet provided by an embodiment of the present application.
  • FIG. 5 is a schematic structural diagram of data transmission provided by an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of a second data packet provided by an embodiment of the present application.
  • FIG. 7 is a second schematic structural diagram of a communication device according to an embodiment of the present application.
  • FIG. 8 is a third schematic structural diagram of a communication apparatus according to an embodiment of the present application.
  • the network architecture and service scenarios described in the embodiments of the present application are for the purpose of illustrating the technical solutions of the embodiments of the present application more clearly, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application.
  • the evolution of the architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.
  • FIG. 1 is a schematic structural diagram of a communication system to which the data cloud service method provided by the embodiment of the present application is applied. To facilitate understanding of the embodiments of the present application, firstly, a communication system applicable to the embodiments of the present application is described in detail by taking the communication system shown in FIG. 1 as an example.
  • the communication system includes a cloud service platform and at least one terminal device.
  • the cloud service platform may include a communication network and at least one server.
  • the above-mentioned communication network may include at least one node, and the node may be referred to as a router, an onion router, a gateway device, or the like.
  • the nodes of the existing communication network only support one-way transmission of data.
  • the communication network includes Onion Router 1, Onion Router 2, and Onion Router 3. If data is supported to be transmitted from Onion Router 1 to Onion Router 3 via Onion Router 2, it does not.
  • the support data is transmitted from onion router 3 to onion router 1 via onion router 2.
  • the above-mentioned communication network is used for transmitting data packets, and the nodes in the embodiments of the present application are used for receiving data packets and decrypting the outermost layer of the data packets.
  • the above-mentioned server is a device located on the cloud service platform side of the above-mentioned communication system and has a cloud service function, or a chip or a chip system that can be provided in the device.
  • the server may also be referred to as a service device, a service device, a cloud server, a cloud computing server, or a cloud host.
  • the servers in the embodiments of the present application may provide services corresponding to systems such as accounting systems, collaboration software, customer relationship management, management information systems, enterprise resource planning, invoicing systems, human resource management, content management, and/or service desk management.
  • the server in the embodiment of the present application may be configured to receive data packets transmitted by the communication network, decrypt the outermost layer of the data packets, obtain original data, and provide services required by users for the original data.
  • the above-mentioned terminal equipment is a terminal that is connected to the above-mentioned communication system and has a wireless transceiver function, or a chip or a chip system that can be provided in the terminal.
  • the terminal equipment may also be referred to as user equipment, access terminal, subscriber unit, subscriber station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication device, user agent, or user equipment.
  • the terminal device in the embodiment of the present application may be a mobile phone (mobile phone), a tablet computer (Pad), a computer with a wireless transceiver function, a virtual reality (virtual reality, VR) terminal device, an augmented reality (augmented reality, AR) terminal equipment, wireless terminals in industrial control, wireless terminals in self driving, wireless terminals in remote medical, wireless terminals in smart grid, transportation security ( Wireless terminals in transportation safety), wireless terminals in smart cities, wireless terminals in smart homes, vehicle-mounted terminals, RSUs with terminal functions, etc.
  • a virtual reality virtual reality
  • VR virtual reality
  • AR augmented reality terminal equipment
  • wireless terminals in industrial control wireless terminals in self driving
  • wireless terminals in remote medical wireless terminals in smart grid
  • transportation security Wireless terminals in transportation safety
  • wireless terminals in smart cities wireless terminals in smart homes, vehicle-mounted terminals, RSUs with terminal functions, etc.
  • FIG. 1 is only a simplified schematic diagram for easy understanding, and the communication system may also include other devices, and/or other terminal devices, which are not shown in FIG. 1 .
  • FIG. 2 is a schematic structural diagram of a communication apparatus 200 that can be used to execute the data cloud service method provided by the embodiment of the present application.
  • the communication apparatus 200 may be a terminal device, or may be a chip applied in the terminal device or other components with terminal functions.
  • the communication apparatus 200 may be a cloud service platform, or may be a chip applied in the cloud service platform or other components having the function of the cloud service platform.
  • the communication apparatus 200 includes a processor 201 and a communication interface 202 .
  • the processor 201 may be integrated with the communication interface 202, or may exist independently.
  • the communication apparatus 200 may further include a memory 203, and the memory 203 may be integrated with the processor 201, or may exist independently, which is not specifically limited in this embodiment of the present application.
  • the processor 201 is the control center of the communication device 200, and may be a processor or a general term for multiple processing elements.
  • the processor 201 is one or more central processing units (CPUs), and may also be a specific integrated circuit (application specific integrated circuit, ASIC), or is configured to implement one or more embodiments of the present application.
  • An integrated circuit such as: one or more microprocessors (digital signal processor, DSP), or, one or more field programmable gate array (field programmable gate array, FPGA).
  • the processor 201 can execute various functions of the communication device 200 by running or executing software programs stored in the memory 203 and calling data stored in the memory 203 .
  • the processor 201 may include one or more CPUs, such as CPU0 and CPU1 shown in FIG. 2 .
  • the communication apparatus 200 may also include multiple processors, for example, the processor 201 and the processor 204 shown in FIG. 2 .
  • processors can be a single-core processor (single-CPU) or a multi-core processor (multi-CPU).
  • a processor herein may refer to one or more communication devices, circuits, and/or processing cores for processing data (eg, computer program instructions).
  • the memory 203 may be a read-only memory (ROM) or other type of static storage communication device that can store static information and instructions, random access memory (RAM) or other type of static storage communication device that can store information and instructions.
  • ROM read-only memory
  • RAM random access memory
  • dynamic storage communication device it can also be electrically erasable programmable read-only memory (electrically erasable programmable read-only memory, EEPROM), compact disc read-only memory (CD-ROM) or other optical disk storage, Optical disc storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage communication devices, or capable of carrying or storing desired program code in the form of instructions or data structures and Any other medium that can be accessed by a computer, but is not limited to this.
  • the memory 203 is used for storing the software program for executing the solution of the present application, and the execution is controlled by the processor 201 .
  • the processor 201 controls the execution of the software program for executing the solution of the present application.
  • the communication interface 202 which can be a transceiver circuit, is used for communication with other communication devices.
  • the communication apparatus 200 is a cloud service platform, and the communication interface 202 can be used to communicate with the terminal device.
  • the communication apparatus 200 is a terminal device, and the communication interface 202 can be used to communicate with the cloud service platform.
  • the transceiver circuit may be a device such as a transceiver or a transceiver.
  • the communication interface 202 may also be an input/output (I/O) circuit of the processor 201 , which is used to realize the signal input and signal output of the processor 201 .
  • the structure of the communication device 200 shown in FIG. 2 does not constitute a limitation on the communication device, and an actual communication device may include more or less components than those shown in the figure, or combine some components, or Different component arrangements.
  • FIG. 3 is a schematic flowchart 1 of a data cloud service method provided by an embodiment of the present application.
  • the data cloud service method can be applied between the communication device shown in FIG. 1 and the nodes of the cloud service platform, between each node of the cloud service platform, and between the nodes of the cloud service platform and the server.
  • the data cloud service method includes the following steps:
  • a terminal device generates a first data packet.
  • the first data package includes original data, and the first data package is generated according to the first public key set and the original data.
  • the original data is data that needs to be subjected to cloud services or cloud computing
  • the terminal device may encrypt the original data by using one or more first public keys to obtain the first data packet.
  • the first public key set includes at least one first public key, and one first public key corresponds to one node in the first path, and the first path includes at least one node.
  • FIG. 4 is a schematic structural diagram of a first data packet provided by an embodiment of the present application.
  • the first path including three nodes as an example, such as node 1-node 2-node 3, node 1 corresponds to key 1, node 2 corresponds to key 2, node 3 corresponds to key 3, and the first set of public keys can be Key 1-Key 2-Key 3, the original data can be encrypted by using the key 3, the key 2, and the key 1 in sequence, to obtain the first data packet as shown in FIG. 4 .
  • the first public key set may be a Diffie-Hellman root obtained according to a key exchange protocol (Diffie-Hellman key exchange agreement), and may be a key chain composed of multiple keys.
  • a key exchange protocol Diffie-Hellman key exchange agreement
  • the first path is a path with a terminal device as a starting point, a target server as an end point, and at least one first node as an intermediate node, and the at least one first node is sequentially determined by the user.
  • the first node may be the node shown in FIG. 1 , such as a router.
  • the target server can be any of the servers shown in FIG. 1 , and can provide users with corresponding cloud services.
  • the first path may be a path through which the terminal device transmits data to the target server via the at least one first node.
  • the first path is the path for sending the first data packet.
  • the user can determine the first node in the path and the sequence between the first nodes according to his own wishes, and the cloud service platform does not need to determine the first path.
  • the security in the cloud service process can be further improved.
  • FIG. 5 is a schematic structural diagram of data transmission provided by an embodiment of the present application.
  • the first path is terminal device-first node 1-first node 2-first node 3-target server
  • first node 1 corresponds to key 1
  • first node 2 corresponds to key 2
  • the first node corresponds to key 2.
  • a node 3 corresponds to key 3
  • the target server corresponds to key D
  • the first public key set can be key 1-key 2-key 3-key D
  • the first key set is used to encrypt the original data
  • the data Msg can be original data
  • the first data packet 123D Msg can be obtained.
  • the first data packet is obtained through layer-by-layer encryption, and each node in the first path cannot obtain the entire first path and the address corresponding to the terminal device, so that the user's identity information can be used for the target server. Anonymous, it can ensure that the user's privacy is not leaked.
  • the first data packet may include a first path, and a first set of public keys may be used to encrypt the first path, and specifically, at least one first public key may be used to encrypt the identifier of at least one node, The identifier of the node can be used to indicate the address of the node.
  • the identity of the first node 1 does not need to be encrypted, and the key 1 can be used to encrypt the identity of the first node 2, and the key 2 can be used to encrypt the
  • the identifier of 3 is encrypted, and the identifier of the first node 4 is encrypted by using the key 3 .
  • the first data packet may include a second public key set, the second public key set includes at least one second public key, and one second public key corresponds to a node in the second path, The second path includes at least one node.
  • the second node 4 corresponds to the key 4
  • the second node 5 corresponds to the key 5
  • the second node 6 corresponds to the key 6
  • the terminal device corresponds to the key S
  • the second public key set may be the key 4-Key 5-Key 6-Key S.
  • the second public key set may be a Diffie-Hellman root obtained according to a key exchange protocol, and may be a key chain composed of one or more second public keys.
  • the first data packet may include a second path, where the second path is a path starting from the target server, ending with a terminal device, and taking at least one second node as an intermediate node, and the at least one second node is composed of The user determines in turn.
  • the second node may be the node shown in FIG. 1 , such as a router.
  • the target server can be any of the servers shown in FIG. 1 , and can provide users with corresponding cloud services.
  • the first path may be a path for the target server to return the calculation result of the original data.
  • the second path is the path for returning data. Users can determine the second node in the path and the sequence between the second nodes according to their own wishes.
  • the cloud service platform does not need to determine the second path, which can further improve the Security during cloud services.
  • the second path is the target server-second node 4-second node 5-second node 6-terminal device.
  • the second path may be encrypted by using a second set of public keys, specifically, at least one second public key may be used to encrypt the identifier of at least one node, and the identifier of the node may be used to indicate the address of the node. .
  • the key D can be used to encrypt the identifier of the second node 4
  • the data Msg can include the identifier of the second node 4
  • the key 4 can be used to encrypt the identifier of the second node 4.
  • the identifier of the second node 5 is encrypted
  • the identifier of the second node 6 is encrypted by using the key 5
  • the identifier of the terminal device is encrypted by using the key 6.
  • the first data packet may include authorization information obtained by blindly signing the user's identity information, and the authorization information is used to determine whether to grant the user authorization.
  • the blind signature may be a blind signature algorithm based on the RSA encryption algorithm, which is a special digital signature technology adopted under the condition that the signer cannot obtain the specific content of the signed information. That is to say, although the user's identity is blindly signed, the user's identity information is not known during the process of blindly signing, so that the user's identity information is not leaked.
  • the RSA encryption algorithm which is a special digital signature technology adopted under the condition that the signer cannot obtain the specific content of the signed information. That is to say, although the user's identity is blindly signed, the user's identity information is not known during the process of blindly signing, so that the user's identity information is not leaked.
  • the authorization information may be encrypted using the first set of public keys.
  • the first public key set may be key 1-key 2-key 3-key D
  • the first key set is used to encrypt the authorization information
  • the data Msg may include the authorization information.
  • the method provided in this embodiment of the present application may further include: the terminal device obtains authorization information.
  • obtaining the authorization information by the terminal device may include the following steps 1 to 4:
  • Step 1 the cloud service platform selects an RSA parameter N, selects an RSA private key d, and publishes the public key e.
  • p and q are the largest prime numbers, and the operation symbol mod is a modulo operation.
  • Step 2 the terminal device determines a one-way and collision-proof hash function H() from Z L to Z t ;
  • L is a security parameter
  • Z L represents L integers between 0 and (L-1)
  • Z N represents t integers between 0 and (N-1).
  • the method provided by the embodiment of the present application may also include the following steps 5 to 6:
  • Step 5 The terminal device sends an authentication request to the cloud service device.
  • the cloud service device receives the authentication request sent by the terminal device.
  • the authentication request is used to authenticate the user.
  • the user requests to log in to the software that provides the cloud service through a thin client of the terminal device, such as a web browser.
  • Step 6 the cloud service device sends an authentication response to the terminal device. Accordingly, the terminal device receives the authentication response from the cloud service device.
  • the authentication response is used to indicate whether the authentication is passed. If the authentication is passed, the user logs in successfully, and if the authentication fails, the user is instructed to register or log in again.
  • the method provided in this embodiment of the present application may further include: the cloud service device may send indication information to the terminal device.
  • the terminal device receives the indication information from the target server.
  • the indication information may be used to instruct the terminal device to display a service page
  • the service page may include a node list and a data start address.
  • the node list may include at least one node, and the node list may be used by the user to sequentially determine at least one first node of the first path and at least one second node of the second path sequentially through the terminal device.
  • the node list includes node 1, node 2, node 3, node 4, node 5, node 6, node 7, and node 8, it can be determined that the order of at least one first node and at least one first node is a node 1.
  • the order of node 2, node 3, at least one second node and at least one second node is node 4, node 5, node 6, so the first path is terminal device - node 1 - node 2 - node 3 - target server , and the second path is the target server-node 4-node 5-node 6-terminal device.
  • the data start address may be used by the user to provide original data through the terminal device.
  • the terminal device sends a first data packet.
  • the first data packet sent by the terminal device is 123D Msg
  • 1 is the first public key corresponding to the first node 1
  • 2 is the first public key corresponding to the first node 2
  • the first public key, 3 is the first public key corresponding to the first node 3
  • D is the first public key corresponding to the target server
  • the data Msg may include original data. If the first data packet includes: original data, second path, second public key set and authorization information, the first data packet is 123D Msg456, and the data Msg may include original data and authorization information.
  • the cloud service platform receives and parses the first data packet through the first path to obtain original data.
  • the cloud service platform receives and parses the first data packet through the first path to obtain the original data, which may include: sequentially passing through at least one first node and the first public secret corresponding to the target server.
  • the key parses the first data packet to obtain the original data.
  • the terminal device sends the first data packet 123D Msg456 to the first node 1 according to the identification of the first node 1.
  • the first node 1 receives the first data packet 123D Msg456, and parses the outermost layer of the first data packet according to the first public key corresponding to the first node 1, and obtains the identification of the data packet 23D Msg456 and the first node 2, Send the data packet 23D Msg456 to the first node 2 according to the identification of the first node 2;
  • the first node 2 receives the data packet 23D Msg456, and parses the outermost layer of the data packet 23D Msg456 according to the first public key corresponding to the first node 2, and obtains the data packet 3D Msg456 and the first node 3 IDs, Send the data packet 3D Msg456 to the first node 3 according to the identification of the first node 3;
  • the first node 3 receives the data packet 3D Msg456, and parses the outermost layer of the data packet 3D Msg456 according to the first public key corresponding to the first node 3, and obtains the data packet D Msg456 and the identification of the target server. Identifies sending a packet D Msg456 to the target server;
  • the target server receives the data packet D Msg456, and parses the outermost layer of the data packet D Msg according to the first public key corresponding to the target server to obtain the data Msg456.
  • the user anonymously submits ciphertext information, such as the first data packet, to the cloud service platform, and the target server obtains the plaintext data, such as the original data, and the target server can obtain the specific content of the original data, but the cloud service platform cannot obtain the user. It does not know the identity information of the user who provided the original data, so as to ensure that the privacy of the user is not leaked.
  • the method provided by the embodiments of the present application may further include: the cloud service platform obtains the encrypted second path.
  • the cloud service platform may receive and parse the first data packet through the first path to obtain the encrypted second path and the original data.
  • the target server obtains the data Msg 456 , the data Msg may include original data, 456 is the second path encrypted with the second public key set, and the target server can also obtain the identifier of the second node 4 .
  • the cloud service platform receives and parses the first data packet through the first path, and after obtaining the original data, the following steps 7 to 9 are further included:
  • Step 7 the cloud service platform obtains the authorization information of the user.
  • the cloud service platform may receive and parse the first data packet through the first path to obtain the authorization information.
  • the cloud service platform can obtain authorization information in the process of obtaining the original data.
  • the data Msg may include original data and authorization information.
  • the authorization information may be obtained by blindly signing the user's identity information, and the specific implementation of the authorization information may refer to the above S301, which will not be repeated here.
  • the cloud service platform cannot obtain the user's identity information through the authorization information, so that it can not only verify whether the anonymous user is authorized, but also ensure that the user's privacy is not leaked.
  • Step 8 The cloud service platform determines whether to grant the user authorization according to the authorization information.
  • the cloud service platform searches the locally stored authorization information database to determine whether the authorization information belongs to the authorization information database.
  • the authorization information database is used authorization information.
  • the authorization information is the used authorization information, and the verification fails.
  • Step 9 the cloud service platform records the authorization information.
  • the target server of the cloud service platform determines that the authorization has been granted to the user in the above-mentioned step 8, the authorization information is recorded to prevent the authorization information from being reused.
  • step ten the target server performs cloud computing on the original data to obtain feedback data.
  • the target server of the cloud service platform performs cloud computing on unencrypted plaintext data, such as raw data.
  • the server calculates plaintext data
  • the calculation process is simpler and the calculation efficiency is higher than that in the prior art, which can improve service performance and response speed.
  • the cloud service platform encrypts the feedback data according to the second public key set to generate a second data packet.
  • the feedback data is determined according to the original data.
  • the cloud service platform encrypts the calculation result, such as the feedback data, according to the second public key set, which can ensure that the user's privacy is not leaked during the process of returning the feedback data.
  • the second data packet is generated according to the second public key set and the feedback data
  • the second public key set includes at least one second public key
  • one second public key corresponds to the second path.
  • One node in the second path includes at least one node.
  • FIG. 6 is a schematic structural diagram of a second data packet provided by an embodiment of the present application.
  • the second path including 3 nodes as an example, such as node 4-node 5-node 6, node 4 corresponds to key 4, node 5 corresponds to key 5, node 6 corresponds to key 6, and the second set of public keys can be Key 4-Key 5-Key 6, the feedback data can be encrypted by using the key 6, the key 5, and the key 4 in sequence to obtain the second data packet as shown in FIG. 6 .
  • the second path is a path with the target server as the starting point, the terminal device as the end point, and at least one second node as an intermediate node, and the at least one second node is sequentially determined by the user.
  • the second path is target server-second node 4-second node 5-second node 6-terminal device
  • data Rst is feedback data
  • the second public key set is key 4-key 5-Key 6-Key S, use the second public key set to encrypt the feedback data to obtain the second data packet 456S Rst.
  • the second node 4 corresponds to the key 4
  • the second node 5 corresponds to the key 5
  • the second node 6 corresponds to the key 6
  • the terminal device corresponds to the key S.
  • the cloud service platform sends and parses the second data packet through the second path.
  • the second data packet is sent and parsed through the target server - the second node 4 - the second node 5 - the second node 6 in sequence.
  • sending and parsing the second data packet through the second path includes the following steps eleven to twelve:
  • Step 11 The cloud service platform parses the second data packet through the second public key corresponding to at least one second node in sequence, and obtains the third data packet.
  • the third data packet carries the data encrypted by using the second public key corresponding to the terminal device to the feedback data.
  • the target server sends the second data packet 456S Rst to the second node 4 according to the identification of the second node 4.
  • the second node 4 receives the second data packet 456S Rst, and parses the outermost layer of the second data packet according to the second public key corresponding to the second node 4, and obtains the data packet 56S Rst and the identification of the second node 5, Send the data packet 56S Rst to the second node 5 according to the identification of the second node 5;
  • the second node 5 receives the data packet 56S Rst, and parses the outermost layer of the data packet 56S Rst according to the second public key corresponding to the second node 5, and obtains the data packet 6S Rst and the identifier of the second node 6. According to the first The identification of the two nodes 6 sends the data packet 6S Rst to the second node 6;
  • the second node 6 receives the data packet 6S Rst, and parses the outermost layer of the data packet 6S Rst according to the second public key corresponding to the second node 6, and obtains the third data packet S Rst and the identification of the terminal device.
  • step 12 the cloud service platform sends a third data packet to the terminal device.
  • the second node 6 sends a third data packet S Rst to the terminal device according to the identification of the terminal device.
  • the node adjacent to the terminal device cannot obtain the specific content of the feedback data in the process of returning the feedback data, so as to ensure that the privacy of the user is not leaked.
  • the terminal device acquires feedback data.
  • the terminal device obtains the feedback data, which may include the following steps thirteen to fourteen:
  • Step 13 the terminal device receives the third data packet.
  • the terminal device receives the third data packet S Rst.
  • Step 14 the terminal device parses the third data packet through the second public key corresponding to the terminal device to obtain feedback data.
  • the terminal device parses the third data packet S Rst through the second public key corresponding to the terminal device, and obtains the feedback data Rst.
  • the cloud service platform receives and parses the first data packet through the first path including at least one node, and obtains the original data, where the original data is generated according to the first public key set and the original data of. Then, the service requested by the user is directly performed on the original data to obtain feedback data, and then the feedback data is encrypted according to a second public key set including at least one second public key to generate a second data packet. Finally, the second data packet including the feedback data is sent and parsed through the second path including at least one node, so that the terminal device obtains the feedback data.
  • the terminal device submits the ciphertext information to the cloud service platform to ensure that the user's identity information is not leaked, and finally the cloud service platform obtains the plaintext data, that is, the original data, and directly calculates the original data, which is different from that in the prior art.
  • the calculation process of the present application is simpler and the calculation efficiency is higher, so that the service performance and response speed can be improved.
  • the data cloud service method provided by the embodiments of the present application has been described in detail above with reference to FIGS. 3 to 6 .
  • the communication apparatus provided by the embodiments of the present application is described in detail below with reference to FIGS. 7-8 .
  • FIG. 7 is a second schematic structural diagram of a communication apparatus provided by an embodiment of the present application.
  • the communication device is applicable to the communication system shown in FIG. 1 , and performs the function of the cloud service platform in the data cloud service method shown in FIG. 3 .
  • FIG. 7 only shows the main components of the communication device.
  • the communication apparatus 700 includes: a processing unit 702 and a transceiver unit 701 .
  • the transceiver unit 701 is configured to receive the first data packet through the first path.
  • the first data package includes original data
  • the first data package is generated according to the first public key set and the original data
  • the first public key set includes at least one first public key
  • one first public key corresponds to A node in a first path, the first path including at least one node.
  • the processing unit 702 is configured to parse the first data packet to obtain original data.
  • the processing unit 702 is further configured to encrypt the feedback data according to the second public key set to generate a second data packet.
  • the feedback data is determined according to the original data
  • the second data packet is generated according to the second public key set and the feedback data
  • the second public key set includes at least one second public key, one second public key
  • the key corresponds to a node in the second path, and the second path includes at least one node.
  • the transceiver unit 701 is further configured to send the second data packet through the second path.
  • the processing unit 702 is further configured to parse the second data packet.
  • the first path may be a path starting with the terminal device, ending with the target server of the communication apparatus 700, and using at least one first node as an intermediate node, and the at least one first node is followed by the user.
  • the first data packet may include a second path, and the second path may be a destination server of the communication apparatus 700 as a starting point, a terminal device as an end point, and at least one second node as an intermediate node. path, at least one second node is sequentially determined by the user.
  • the transceiver unit 701 is further configured to send indication information to the terminal device.
  • the indication information may be used to instruct the terminal device to display a service page
  • the service page may include a node list and a data start address
  • the node list may be used by the user to sequentially determine at least one first node of the first path and the first node of the first path through the terminal device.
  • At least one second node of the two paths, the data starting address can be used for the user to provide the original data through the terminal device.
  • the processing unit 702 is further configured to parse the second data packet through the second public key corresponding to the at least one second node in sequence to obtain the third data packet.
  • the third data packet may carry the data encrypted by using the second public key corresponding to the terminal device to the feedback data.
  • the transceiver unit 701 is further configured to send a third data packet to the terminal device.
  • the processing unit 702 is further configured to parse the first data packet through at least one first node and the first public key corresponding to the target server of the communication device 700 in sequence to obtain the original data.
  • the processing unit 702 is further configured to acquire authorization information of the user.
  • the authorization information may be obtained by blindly signing the user's identity information.
  • the processing unit 702 is further configured to determine whether to grant the user authorization according to the authorization information.
  • the processing unit 702 is further configured to record the authorization information if it is determined to grant the user authorization.
  • the first data packet may include authorization information.
  • the transceiver unit 701 may include a receiving unit and a sending unit (not shown in FIG. 7 ). Wherein, the receiving unit is used for receiving data and/or signaling from the terminal equipment; the sending unit is used for sending data and/or signaling to the terminal equipment. This application does not specifically limit the specific implementation manner of the transceiver unit 701 .
  • the communication apparatus 700 may further include a storage unit (not shown in FIG. 7 ), where the storage unit stores programs or instructions.
  • the processing unit executes the program or the instruction, the communication apparatus 700 can perform the function of the cloud service platform in the data cloud service method shown in FIG. 3 .
  • the communication device 700 may be the cloud service platform shown in FIG. 1 or the communication device 200 shown in FIG. 2 , or may be a chip (system) or other components or components that can be set on the cloud service platform. This is not limited.
  • FIG. 8 is a third schematic structural diagram of a communication apparatus provided by an embodiment of the present application.
  • the communication apparatus is applicable to the communication system shown in FIG. 1 , and performs the functions of the terminal device in the data cloud service method shown in FIG. 3 .
  • FIG. 8 only shows the main components of the communication device.
  • the communication apparatus 800 includes: a processing unit 802 and a transceiver unit 801 .
  • the processing unit 802 is configured to generate a first data packet.
  • the first data package includes original data
  • the first data package is generated according to the first public key set and the original data
  • the first public key set includes at least one first public key
  • one first public key corresponds to A node in the first path is used for encrypting the original data by a node in the first path
  • the first path includes at least one node.
  • the transceiver unit 801 is used for sending a first data packet.
  • the processing unit 802 is further configured to acquire feedback data.
  • the feedback data is determined according to the original data.
  • the first path may be a path starting with the communication device 800, ending with the target server, and using at least one first node as an intermediate node, and the at least one first node is sequentially determined by the user.
  • the first data packet may include a second public key set, the second public key set may include at least one second public key, and one second public key corresponds to the second public key in the second path.
  • the first data packet may include a second path, and the second path may be a path starting with the target server, ending with the communication device 800, and using at least one second node as an intermediate node, at least A second node is sequentially determined by the user.
  • the transceiver unit 801 is further configured to receive indication information from the target server.
  • the indication information may be used to instruct the communication device 800 to display a service page
  • the service page may include a node list and a data start address
  • the node list may be used by the user to sequentially determine at least one first node of the first path through the communication device 800 and the sequence At least one second node of the second path is determined
  • the data start address can be used for the user to provide the original data through the communication device 800 .
  • the transceiver unit 801 is further configured to receive the third data packet.
  • the third data packet may carry data encrypted by using the second public key corresponding to the communication device 800 to the feedback data.
  • the processing unit 802 is further configured to parse the third data packet through the second public key corresponding to the communication device 800 to obtain feedback data.
  • the first data packet may include authorization information
  • the authorization information may be obtained by blindly signing the user's identity information
  • the authorization information may be used to determine whether to grant the user authorization
  • the transceiver unit 801 may include a receiving unit and a sending unit (not shown in FIG. 8 ).
  • the receiving unit is used for receiving data and/or signaling from the cloud service platform; the sending unit is used for sending data and/or signaling to the cloud service platform.
  • This application does not specifically limit the specific implementation manner of the transceiver unit 801 .
  • the communication apparatus 800 may further include a storage unit (not shown in FIG. 8 ), where the storage unit stores programs or instructions.
  • the processing unit 802 executes the program or instruction
  • the communication apparatus 800 can execute the function of the terminal device in the data cloud service method shown in FIG. 3 .
  • the communication apparatus 800 may be the terminal equipment shown in FIG. 1 or the communication apparatus 200 shown in FIG. 2 , or may be a chip (system) or other components or components that can be provided in the terminal equipment. Not limited.
  • Embodiments of the present application provide a communication system.
  • the system includes one or more terminal devices and a cloud service platform.
  • the cloud service platform may include one or more nodes and one or more servers.
  • An embodiment of the present application provides a computer-readable storage medium, where the computer-readable storage medium includes a computer program or instruction; when the computer program or instruction is run on a computer, the computer is made to execute the data cloud described in the above method embodiments service method.
  • Embodiments of the present application provide a computer program product, including computer programs or instructions, which, when the computer program or instructions are run on a computer, cause the computer to execute the data cloud service method described in the above method embodiments.
  • processors in the embodiments of the present application may be a central processing unit (central processing unit, CPU), and the processor may also be other general-purpose processors, digital signal processors (digital signal processors, DSP), dedicated integrated Circuit (application specific integrated circuit, ASIC), off-the-shelf programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.
  • a general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.
  • the memory in the embodiments of the present application may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory.
  • the non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically programmable Erase programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • Volatile memory may be random access memory (RAM), which acts as an external cache.
  • RAM random access memory
  • SRAM static random access memory
  • DRAM dynamic random access memory
  • DRAM synchronous dynamic random access memory
  • SDRAM synchronous dynamic random access memory
  • DDR SDRAM double data rate synchronous dynamic random access memory
  • enhanced SDRAM enhanced synchronous dynamic random access memory
  • SLDRAM synchronous connection dynamic random access memory Fetch memory
  • direct memory bus random access memory direct rambus RAM, DR RAM
  • the above embodiments may be implemented in whole or in part by software, hardware (eg, circuits), firmware, or any other combination.
  • the above-described embodiments may be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated.
  • the computer may be a general purpose computer, special purpose computer, computer network, or other programmable device.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be downloaded from a website site, computer, server, or data center Transmission to another website site, computer, server, or data center by wire (eg, infrared, wireless, microwave, etc.).
  • the computer-readable storage medium may be any available medium that a computer can access, or a data storage device such as a server, a data center, or the like containing one or more sets of available media.
  • the usable media may be magnetic media (eg, floppy disks, hard disks, magnetic tapes), optical media (eg, DVDs), or semiconductor media.
  • the semiconductor medium may be a solid state drive.
  • At least one means one or more, and “plurality” means two or more.
  • At least one item(s) below” or similar expressions thereof refer to any combination of these items, including any combination of single item(s) or plural items(s).
  • at least one item (a) of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple .
  • the size of the sequence numbers of the above-mentioned processes does not mean the sequence of execution, and the execution sequence of each process should be determined by its functions and internal logic, and should not be dealt with in the embodiments of the present application. implementation constitutes any limitation.
  • the disclosed system, apparatus and method may be implemented in other manners.
  • the apparatus embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented.
  • the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the functions, if implemented in the form of software functional units and sold or used as independent products, may be stored in a computer-readable storage medium.
  • the technical solution of the present application can be embodied in the form of a software product in essence, or the part that contributes to the prior art or the part of the technical solution.
  • the computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage medium includes: U disk, removable hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk and other media that can store program codes .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computing Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本申请提供一种数据云服务方法及装置，能够降低云服务过程的计算复杂度，从而提高服务性能和响应速度，可应用于具有云服务功能的通信系统中。该方法包括: 云服务平台通过包括至少一个节点的第一路径接收并解析第一数据包，得到原始数据，该原始数据是根据第一公开密钥集合和原始数据生成的，然后，直接对原始数据执行用户请求的服务，获得反馈数据，接着根据包括至少一个第二公开密钥的第二公开密钥集合对反馈数据加密，生成第二数据包，最后，通过包括至少一个节点的第二路径发送并解析包括反馈数据的第二数据包，使终端设备获取反馈数据。

Description

数据云服务方法及通信装置 技术领域
本申请涉及通信领域，尤其涉及一种数据云服务方法及通信装置。
背景技术
云服务是指用户通过互联网获取需要的服务，例如，用户不需要在终端设备下载和安装软件，仅通过互联网即可使用该软件的相关服务，该软件可存储在云服务提供商的云服务器中。
现有技术中，用户在不隐藏身份信息的情况下，向云服务器提供密文信息，以保护用户的隐私。以会计软件为例，在用户向云服务器提供财务信息前，先采用同态加密算法对财务信息进行加密，得到密文信息，然后向云服务器提供该密文信息，云服务器在不解密的情况下，直接对密文信息进行密文计算，得出计算结果后，将该计算结果返回给用户。如此，云服务器并不知道密文信息中财务信息的具体内容，从而可以保护用户的隐私。
发明人发现现有技术中存在以下问题：同态加密算法比较复杂，加密效率低，并且云服务器直接对密文信息进行计算，增加了计算复杂度，导致计算效率低，影响服务性能和响应速度。
发明内容
本申请实施例提供一种数据云服务方法及通信装置，能够降低云服务过程的计算复杂度，从而提高服务性能和响应速度。
为达到上述目的，本申请采用如下技术方案：
第一方面，提供一种数据云服务方法。该数据云服务方法包括：通过第一路径接收并解析第一数据包，得到原始数据，根据第二公开密钥集合对反馈数据加密，生成第二数据包，通过第二路径发送并解析第二数据包。第一数据包包括原始数据，第一数据包是根据第一公开密钥集合和原始数据生成的，第一路径包括至少一个节点，第一公开密钥集合包括至少一个第一公开密钥，一个第一公开密钥对应第一路径中的一个节点，反馈数据是根据原始数据确定的，第二数据包是根据第二公开密钥集合和反馈数据生成的，第二公开密钥集合中包括至少一个第二公开密钥，一个第二公开密钥对应第二路径中的一个节点，第二路径包括至少一个节点。
基于第一方面所述的数据云服务方法，终端设备提交对原始数据加密后的第一数据包给云服务平台，以保证用户的身份信息不被泄露，最终云服务平台获得明文数据，即原始数据，并直接对原始数据进行计算，与现有技术中，服务器对密文数据进行计算相比，本申请的计算过程更加简单，计算效率更高，从而可以提高服务性能和响应速度。
在一种可能的设计方案中，第一路径可以为以终端设备为起点，以目标服务器为终点，以至少一个第一节点为中间节点的路径，至少一个第一节点由用户依次确定。 也就是说，第一路径是发送第一数据包的路径，用户可以根据自身的意愿确定路径中的第一节点以及第一节点之间的先后顺序，不需要云服务平台确定该第一路径，可以进一步提高云服务过程中的安全性。
在一种可能的设计方案中，第一数据包可以包括第二路径，第二路径可以为以目标服务器为起点、以终端设备为终点、以至少一个第二节点为中间节点的路径；至少一个第二节点由用户依次确定。也就是说，第二路径是返回数据的路径，可以使云服务平台在不知道用户的身份信息的情况下，成功返回数据。
在一种可能的设计方案中，在上述通过第一路径接收并解析第一数据包，得到原始数据前，第一方面所述的数据云服务方法还可以包括：向终端设备发送指示信息。其中，指示信息可以用于指示终端设备显示服务页面，服务页面可以包括节点列表、数据起始地址，节点列表可以用于用户通过终端设备依次确定第一路径的至少一个第一节点以及依次确定第二路径的至少一个第二节点，数据起始地址可以用于用户通过终端设备提供原始数据。
在一种可能的设计方案中，上述通过第二路径发送并解析第二数据包，可以包括：依次经过至少一个第二节点对应的第二公开密钥解析第二数据包，得到第三数据包，向终端设备发送第三数据包。其中，第三数据包可以携带采用终端设备对应的第二公开密钥对反馈数据加密后的数据。如此，在向返回反馈数据的过程中，并不能获得反馈数据的具体内容，从而可以保证用户的隐私不被泄露。
在一种可能的设计方案中，上述通过第一路径接收并解析第一数据包，得到原始数据，可以包括：依次经过至少一个第一节点和目标服务器对应的第一公开密钥解析第一数据包，得到原始数据。也就是说，在获得原始数据的过程中，云服务平台接收的是密文信息，即第一数据包，经过一层一层地解析后，获得明文数据，即原始数据，但是，云服务平台并不能获得用户的身份信息，并不知道提供该原始数据的用户的身份，可以保证用户的隐私不被泄露。
在一种可能的设计方案中，在上述通过第一路径接收并解析第一数据包，得到原始数据后，第一方面所述的数据云服务方法还可以包括：获取用户的授权信息，根据授权信息确定是否给予用户授权。其中，授权信息可以是通过对用户的身份信息进行盲签名得到的。也就是说，云服务平台并不能通过授权信息获得用户的身份信息，从而既能验证是否给予匿名用户授权，又能保证用户的隐私不被泄露。
在一种可能的设计方案中，第一方面所述的数据云服务方法还可以包括：若确定给予用户授权，则记录授权信息。也就是说，若云服务平台确定已给予用户授权，则记录该授权信息，以防止该授权信息被重复使用。
可选地，第一数据包可以包括授权信息。也就是说，云服务平台可以在获取原始数据的过程中，获取授权信息。
第二方面，提供一种数据云服务方法。该数据云服务方法包括：生成第一数据包，发送第一数据包，获取反馈数据。其中，第一数据包包括原始数据，第一数据包是根据第一公开密钥集合和原始数据生成的，第一公开密钥集合包括至少一个第一公开密钥，一个第一公开密钥对应第一路径中的一个节点，用于第一路径中的一个节点对原始数据进行加密，第一路径包括至少一个节点，反馈数据是根据原始数据确定的。
在一种可能的设计方案中，第一路径可以为以终端设备为起点，以目标服务器为终点，以至少一个第一节点为中间节点的路径，至少一个第一节点由用户依次确定。
在一种可能的设计方案中，第一数据包可以包括第二公开密钥集合，第二公开密钥集合中包括至少一个第二公开密钥，一个第二公开密钥对应第二路径中的一个节点，用于第二路径中的一个节点对反馈数据进行加密，第二路径包括至少一个节点。
在一种可能的设计方案中，第一数据包可以包括第二路径，第二路径可以为以目标服务器为起点、以终端设备为终点、以至少一个第二节点为中间节点的路径，至少一个第二节点由用户依次确定。
在一种可能的设计方案中，在上述生成第一数据包前，第二方面所述的数据云服务方法还可以包括：收来自目标服务器的指示信息。其中，指示信息可以用于指示终端设备显示服务页面，服务页面包括节点列表、数据起始地址，节点列表可以用于用户通过终端设备依次确定第一路径的至少一个第一节点以及依次确定第二路径的至少一个第二节点，数据起始地址可以用于用户通过终端设备提供原始数据。
在一种可能的设计方案中，上述获取反馈数据，可以包括：接收第三数据包，通过终端设备对应的第二公开密钥解析第三数据包，得到反馈数据。其中，第三数据包可以携带采用终端设备对应的第二公开密钥对反馈数据加密后的数据。
在一种可能的设计方案中，第一数据包可以包括授权信息，授权信息可以是通过对用户的身份信息进行盲签名得到的，授权信息可以用于确定是否给予用户授权。
此外，第二方面所述的数据云服务方法的技术效果可以参考第一方面所述的数据云服务方法的技术效果，此处不再赘述。
第三方面，提供一种通信装置。该通信装置包括：处理单元和收发单元。
其中，收发单元，用于通过第一路径接收第一数据包。其中，第一数据包包括原始数据，第一数据包是根据第一公开密钥集合和原始数据生成的，第一公开密钥集合包括至少一个第一公开密钥，一个第一公开密钥对应第一路径中的一个节点，第一路径包括至少一个节点。
处理单元，用于解析第一数据包，得到原始数据。
处理单元，还用于根据第二公开密钥集合对反馈数据加密，生成第二数据包。其中，反馈数据是根据原始数据确定的，第二数据包是根据第二公开密钥集合和反馈数据生成的，第二公开密钥集合中包括至少一个第二公开密钥，一个第二公开密钥对应第二路径中的一个节点，第二路径包括至少一个节点。
收发单元，还用于通过第二路径发送第二数据包。
处理单元，还用于解析第二数据包。
在一种可能的设计方案中，第一路径可以为以终端设备为起点，以通信装置的目标服务器为终点，以至少一个第一节点为中间节点的路径，至少一个第一节点由用户依次确定。
在一种可能的设计方案中，第一数据包可以包括第二路径，第二路径可以为以通信装置的目标服务器为起点、以终端设备为终点、以至少一个第二节点为中间节点的路径，至少一个第二节点由用户依次确定。
在一种可能的设计方案中，收发单元，还用于向终端设备发送指示信息。其中， 指示信息可以用于指示终端设备显示服务页面，服务页面可以包括节点列表、数据起始地址，节点列表可以用于用户通过终端设备依次确定第一路径的至少一个第一节点以及依次确定第二路径的至少一个第二节点，数据起始地址可以用于用户通过终端设备提供原始数据。
在一种可能的设计方案中，处理单元，还用于依次经过至少一个第二节点对应的第二公开密钥解析第二数据包，得到第三数据包。其中，第三数据包可以携带采用终端设备对应的第二公开密钥对反馈数据加密后的数据。收发单元，还用于向终端设备发送第三数据包。
在一种可能的设计方案中，处理单元，还用于依次经过至少一个第一节点和通信装置的目标服务器对应的第一公开密钥解析第一数据包，得到原始数据。
在一种可能的设计方案中，处理单元，还用于获取用户的授权信息。其中，授权信息可以是通过对用户的身份信息进行盲签名得到的。处理单元，还用于根据授权信息确定是否给予用户授权。
在一种可能的设计方案中，处理单元，还用于若确定给予用户授权，则记录授权信息。
可选地，第一数据包可以包括授权信息。
需要说明的是，第三方面所述的收发单元可以包括接收单元和发送单元。其中，接收单元用于接收来自终端设备的数据和/或信令；发送单元用于向终端设备发送数据和/或信令。本申请对于收发单元的具体实现方式，不做具体限定。
可选地，第三方面所述的通信装置还可以包括存储单元，该存储单元存储有程序或指令。当处理单元执行该程序或指令时，使得第三方面所述的通信装置可以执行第一方面所述的方法。
需要说明的是，第三方面所述的通信装置可以是云服务平台，也可以是可设置于云服务平台的芯片(系统)或其他部件或组件，本申请对此不做限定。
此外，第三方面所述的通信装置的技术效果可以参考第一方面中的任意一种实现方式所述的数据云服务方法的技术效果，此处不再赘述。
第四方面，提供一种通信装置。该通信装置包括：处理单元和收发单元。
其中，处理单元，用于生成第一数据包。其中，第一数据包包括原始数据，第一数据包是根据第一公开密钥集合和原始数据生成的，第一公开密钥集合包括至少一个第一公开密钥，一个第一公开密钥对应第一路径中的一个节点，用于第一路径中的一个节点对原始数据进行加密，第一路径包括至少一个节点。
收发单元，用于发送第一数据包。
处理单元，还用于获取反馈数据。其中，反馈数据是根据原始数据确定的。
在一种可能的设计方案中，第一路径可以为以通信装置为起点，以目标服务器为终点，以至少一个第一节点为中间节点的路径，至少一个第一节点由用户依次确定。
在一种可能的设计方案中，第一数据包可以包括第二公开密钥集合，第二公开密钥集合可以包括至少一个第二公开密钥，一个第二公开密钥对应第二路径中的一个节点，用于第二路径中的一个节点对反馈数据进行加密，第二路径包括至少一个节点。
在一种可能的设计方案中，第一数据包可以包括第二路径，第二路径可以为以目 标服务器为起点、以通信装置为终点、以至少一个第二节点为中间节点的路径，至少一个第二节点由用户依次确定。
在一种可能的设计方案中，收发单元，还用于接收来自目标服务器的指示信息。其中，指示信息可以用于指示通信装置显示服务页面，服务页面可以包括节点列表、数据起始地址，节点列表可以用于用户通过通信装置依次确定第一路径的至少一个第一节点以及依次确定第二路径的至少一个第二节点，数据起始地址可以用于用户通过通信装置提供原始数据。
在一种可能的设计方案中，收发单元，还用于接收第三数据包。其中，第三数据包可以携带采用通信装置对应的第二公开密钥对反馈数据加密后的数据。处理单元，还用于通过通信装置对应的第二公开密钥解析第三数据包，得到反馈数据。
在一种可能的设计方案中，第一数据包可以包括授权信息，授权信息可以是通过对用户的身份信息进行盲签名得到的，授权信息可以用于确定是否给予用户授权。
需要说明的是，第四方面所述的收发单元可以包括接收单元和发送单元。其中，接收单元用于接收来自云服务平台的数据和/或信令；发送单元用于向云服务平台发送数据和/或信令。本申请对于收发单元的具体实现方式，不做具体限定。
可选地，第四方面所述的通信装置还可以包括存储单元，该存储单元存储有程序或指令。当处理单元执行该程序或指令时，使得第四方面所述的通信装置可以执行第二方面所述的方法。
需要说明的是，第四方面所述的通信装置可以是终端设备，也可以是可设置于终端设备的芯片(系统)或其他部件或组件，本申请对此不做限定。
此外，第四方面所述的通信装置的技术效果可以参考第二方面中任一种可能的实现方式所述的数据云服务方法的技术效果，此处不再赘述。
第五方面，提供一种通信装置。该通信装置包括：处理器和通信接口。该处理器用于通过所述通信接口与其它装置通信，并执行如第一方面至第二方面中任意一种可能的实现方式所述的数据云服务方法。该通信接口可以是收发电路，用于该通信装置与其他通信装置通信。
在一种可能的设计中，第五方面所述的通信装置还可以包括存储器。该存储器用于存储计算机程序。所述收发器可以用于该通信装置与其他通信装置通信。
在本申请中，第五方面所述的通信装置可以为终端设备或云服务平台或服务器，或者可设置于终端设备或云服务平台或服务器的芯片(系统)或其他部件或组件。
此外，第五方面所述的通信装置的技术效果可以参考第一方面至第二方面中的任意一种实现方式所述的数据云服务方法的技术效果，此处不再赘述。
第六方面，提供一种通信系统。该系统包括一个或多个终端设备，以及云服务平台。可选地，云服务平台可以包括一个或多个节点以及一个或多个服务器。
第七方面，提供一种计算机可读存储介质，包括：该计算机可读存储介质包括计算机程序或指令；当该计算机程序或指令在计算机上运行时，使得该计算机执行第一方面至第二方面中任意一种可能的实现方式所述的数据云服务方法。
第八方面，提供一种计算机程序产品，包括计算机程序或指令，当该计算机程序或指令在计算机上运行时，使得该计算机执行第一方面至第二方面中任意一种可能的 实现方式所述的数据云服务方法。
附图说明
图1为本申请实施例提供的通信系统的架构示意图；
图2为本申请实施例提供的通信装置的结构示意图一；
图3为本申请实施例提供的数据云服务方法的流程示意图一；
图4为本申请实施例提供的第一数据包的结构示意图；
图5为本申请实施例提供的数据传输的架构示意图；
图6为本申请实施例提供的第二数据包的结构示意图；
图7为本申请实施例提供的通信装置的结构示意图二。
图8为本申请实施例提供的通信装置的结构示意图三。
具体实施方式
下面将结合附图，对本申请中的技术方案进行描述。
本申请将围绕可包括多个设备、组件、模块等的系统来呈现各个方面、实施例或特征。应当理解和明白的是，各个系统可以包括另外的设备、组件、模块等，并且/或者可以并不包括结合附图讨论的所有设备、组件、模块等。此外，还可以使用这些方案的组合。
另外，在本申请实施例中，“示例地”、“例如”等词用于表示作例子、例证或说明。本申请中被描述为“示例”的任何实施例或设计方案不应被解释为比其它实施例或设计方案更优选或更具优势。确切而言，使用示例的一词旨在以具体方式呈现概念。
本申请实施例中，“信息(information)”，“信号(signal)”，“消息(message)”，“信道(channel)”、“信令(singalling)”有时可以混用，应当指出的是，在不强调其区别时，其所要表达的含义是一致的。“的(of)”，“相应的(corresponding，relevant)”和“对应的(corresponding)”有时可以混用，应当指出的是，在不强调其区别时，其所要表达的含义是一致的。
本申请实施例中，有时候下标如W 1可能会笔误为非下标的形式如W1，在不强调其区别时，其所要表达的含义是一致的。
本申请实施例描述的网络架构以及业务场景是为了更加清楚的说明本申请实施例的技术方案，并不构成对于本申请实施例提供的技术方案的限定，本领域普通技术人员可知，随着网络架构的演变和新业务场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
图1为本申请实施例提供的数据云服务方法所适用的一种通信系统的架构示意图。为便于理解本申请实施例，首先以图1中示出的通信系统为例详细说明适用于本申请实施例的通信系统。
如图1所示，该通信系统包括云服务平台和至少一个终端设备。其中，云服务平台可以包括通信网络和至少一个服务器。
其中，上述通信网络可以包括至少一个节点，该节点可以称为路由器、洋葱路由器、网关设备等。现有的通信网络的节点只支持单向传输数据，例如，通信网络包括 洋葱路由器1、洋葱路由器2和洋葱路由器3，若支持数据从洋葱路由器1经由洋葱路由器2传输至洋葱路由器3，则不支持数据从洋葱路由器3经由洋葱路由器2传输至洋葱路由器1。上述通信网络用于传输数据包，本申请的实施例中的节点用于接收数据包并将数据包的最外层解密。
上述服务器为位于上述通信系统的云服务平台侧，且具有云服务功能的设备或可设置于该设备的芯片或芯片系统。该服务器也可以称为服务设备、服务装置、云服务器、云计算服务器、云主机。本申请的实施例中的服务器可提供会计系统、协同软件、客户关系管理、管理信息系统、企业资源计划、开票系统、人力资源管理、内容管理、和/或服务台管理等系统对应的服务。本申请的实施例中的服务器可用于接收通信网络传输的数据包，并将数据包的最外层解密，获取原始数据，为该原始数据提供用户需求的服务。
上述终端设备为接入上述通信系统，且具有无线收发功能的终端或可设置于该终端的芯片或芯片系统。该终端设备也可以称为用户装置、接入终端、用户单元、用户站、移动站、移动台、远方站、远程终端、移动设备、用户终端、终端、无线通信设备、用户代理或用户装置。本申请的实施例中的终端设备可以是手机(mobile phone)、平板电脑(Pad)、带无线收发功能的电脑、虚拟现实(virtual reality，VR)终端设备、增强现实(augmented reality，AR)终端设备、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端、车载终端、具有终端功能的RSU等。
需要说明的是，本申请实施例提供的数据云服务方法，可以适用于图1所示的通信设备与云服务平台之间、云服务平台的各个节点之间、云服务平台的节点与服务器之间。
应理解，图1仅为便于理解而示例的简化示意图，该通信系统中还可以包括其他设备，和/或，其他终端设备，图1中未予以画出。
图2为可用于执行本申请实施例提供的数据云服务方法的一种通信装置200的结构示意图。通信装置200可以是终端设备，也可以是应用于终端设备中的芯片或者其他具有终端功能的部件。或者，通信装置200可以是云服务平台，也可以是应用于云服务平台中的芯片或者其他具有云服务平台功能的部件。
如图2所示，通信装置200包括处理器201和通信接口202。其中，处理器201可以与通信接口202集成在一起，也可以独立存在。可选地，通信装置200还可以包括存储器203，存储器203可以和处理器201集成在一起，也可以独立存在，本申请实施例对此不作具体限定。
下面结合图2对通信装置200的各个构成部件进行具体的介绍：
处理器201是通信装置200的控制中心，可以是一个处理器，也可以是多个处理元件的统称。例如，处理器201是一个或多个中央处理器(central processing unit，CPU)，也可以是特定集成电路(application specific integrated circuit，ASIC)，或者是被配置成实施本申请实施例的一个或多个集成电路，例如：一个或多个微处理器(digital signal  processor，DSP)，或，一个或者多个现场可编程门阵列(field programmable gate array，FPGA)。
其中，处理器201可以通过运行或执行存储在存储器203内的软件程序，以及调用存储在存储器203内的数据，执行通信装置200的各种功能。
在具体实现中，作为一种实施例，处理器201可以包括一个或多个CPU，例如图2中所示的CPU0和CPU1。
在具体实现中，作为一种实施例，通信装置200也可以包括多个处理器，例如图2中所示的处理器201和处理器204。这些处理器中的每一个可以是一个单核处理器(single-CPU)，也可以是一个多核处理器(multi-CPU)。这里的处理器可以指一个或多个通信设备、电路、和/或用于处理数据(例如计算机程序指令)的处理核。
存储器203可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储通信设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其他类型的动态存储通信设备，也可以是电可擦可编程只读存储器(electrically erasable programmable read-only memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储通信设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。
其中，所述存储器203用于存储执行本申请方案的软件程序，并由处理器201来控制执行。上述具体实现方式可以参考下述方法实施例，此处不再赘述。
通信接口202，可以是收发电路，用于与其他通信装置之间的通信。例如，通信装置200为云服务平台，通信接口202可以用于与终端设备通信。又例如，通信装置200为终端设备，通信接口202可以用于与云服务平台通信。此外，所述收发电路可以是收发器、收发机一类的装置。通信接口202也可以是处理器201的输入/输出(input/output，I/O)电路，用以实现处理器201的信号输入和信号输出。
需要说明的是，图2中示出的通信装置200的结构并不构成对该通信装置的限定，实际的通信装置可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。
下面将结合图3-图6对本申请实施例提供的数据云服务方法进行具体阐述。
图3为本申请实施例提供的数据云服务方法的流程示意图一。该数据云服务方法可以适用于图1所示的通信设备与云服务平台的节点之间、云服务平台的各个节点之间、云服务平台的节点与服务器之间。
如图3所示，该数据云服务方法包括如下步骤：
S301，终端设备生成第一数据包。
其中，第一数据包包括原始数据，第一数据包是根据第一公开密钥集合和原始数据生成的。
也就是说，原始数据是需要被进行云服务或云计算的数据，终端设备可以采用一个或多个第一公开密钥对原始数据进行加密，获得第一数据包。
示例性地，第一公开密钥集合包括至少一个第一公开密钥，一个第一公开密钥对 应第一路径中的一个节点，第一路径包括至少一个节点。
图4为本申请实施例提供的第一数据包的结构示意图。以第一路径包括3个节点为例，如节点1-节点2-节点3，节点1对应密钥1，节点2对应密钥2，节点3对应密钥3，第一公开密钥集合可以为密钥1-密钥2-密钥3，可以依次采用密钥3、密钥2、密钥1对原始数据进行加密，获得如图4所示的第一数据包。
示例性地，第一公开密钥集合可以是根据密钥交换协议(Diffie-Hellman key exchange agreement)获得的Diffie-Hellman根，可以是由多个密钥组成的密钥链。
在一些实施例中，第一路径为以终端设备为起点，以目标服务器为终点，以至少一个第一节点为中间节点的路径，至少一个第一节点由用户依次确定。
示例性地，第一节点可以为图1所示的节点，如路由器。目标服务器可以是图1所示的任一服务器，能为用户提供对应云服务的服务器。第一路径可以为终端设备经由至少一个第一节点向目标服务器传输数据的路径。
也就是说，第一路径是发送第一数据包的路径，用户可以根据自身的意愿确定路径中的第一节点以及第一节点之间的先后顺序，不需要云服务平台确定该第一路径，可以进一步提高云服务过程中的安全性。
图5为本申请实施例提供的数据传输的架构示意图。
如图5所示，第一路径为终端设备-第一节点1-第一节点2-第一节点3-目标服务器，第一节点1对应密钥1，第一节点2对应密钥2，第一节点3对应密钥3，目标服务器对应密钥D，第一公开密钥集合可以为密钥1-密钥2-密钥3-密钥D，采用第一密钥集合对原始数据进行加密，数据Msg可以为原始数据，可以获得第一数据包123D Msg。
如此，第一数据包是经过一层一层加密获得的，第一路径中的每个节点均无法获得整个第一路径以及终端设备对应的地址，从而使得用户的身份信息对于目标服务器来说是匿名的，可以保证用户的隐私不被泄露。
可选地，第一数据包可以包括第一路径，可以采用第一公开密钥集合对第一路径进行加密，具体地，可以采用至少一个第一公开密钥对至少一个节点的标识进行加密，节点的标识可以用于指示节点的地址。
以图5中包括的第一密钥集合和第一路径为例，第一节点1的标识不用加密，可以采用密钥1对第一节点2的标识进行加密，采用密钥2对第一节点3的标识进行加密，采用密钥3对第一节点4的标识进行加密。
在一些实施例中，第一数据包可以包括第二公开密钥集合，第二公开密钥集合中包括至少一个第二公开密钥，一个第二公开密钥对应第二路径中的一个节点，第二路径包括至少一个节点。
如图5所示，第二节点4对应密钥4，第二节点5对应密钥5，第二节点6对应密钥6，终端设备对应密钥S，第二公开密钥集合可以为密钥4-密钥5-密钥6-密钥S。
示例性地，第二公开密钥集合可以是根据密钥交换协议获得的Diffie-Hellman根，可以是一个或多个第二公开密钥组成的密钥链。
在一些实施例中，第一数据包可以包括第二路径，第二路径为以目标服务器为起点、以终端设备为终点、以至少一个第二节点为中间节点的路径，至少一个第二节点由用户依次确定。
示例性地，第二节点可以为图1所示的节点，如路由器。目标服务器可以是图1所示的任一服务器，能为用户提供对应云服务的服务器。第一路径可以为目标服务器返回对原始数据的计算结果的路径。
也就是说，第二路径是返回数据的路径，用户可以根据自身的意愿确定路径中的第二节点以及第二节点之间的先后顺序，不需要云服务平台确定该第二路径，可以进一步提高云服务过程中的安全性。
如图5所示，第二路径为目标服务器-第二节点4-第二节点5-第二节点6-终端设备。
可选地，可以采用第二公开密钥集合对第二路径进行加密，具体地，可以采用至少一个第二公开密钥对至少一个节点的标识进行加密，节点的标识可以用于指示节点的地址。
以图5中包括的第二密钥集合和第二路径为例，可以采用密钥D对第二节点4的标识进行加密，数据Msg可以包括第二节点4的标识，可以采用密钥4对第二节点5的标识进行加密，采用密钥5对第二节点6的标识进行加密，采用密钥6对终端设备的标识进行加密。
在一些实施例中，第一数据包可以包括授权信息，授权信息是通过对用户的身份信息进行盲签名得到的，授权信息用于确定是否给予用户授权。
示例性地，盲签名(blind signature)可以是基于RSA加密算法的盲签名算法，是不让签名者获得签署的信息的具体内容下所采取的一种特殊的数字签名技术。也就是说，虽然对用户的身份进行了盲签名，但是进行盲签名的过程中，不知道用户的身份信息，从而用户的身份信息不被泄露。
可选地，可以采用第一公开密钥集合对授权信息进行加密。
结合图5，第一公开密钥集合可以为密钥1-密钥2-密钥3-密钥D，采用第一密钥集合对授权信息进行加密，数据Msg可以包括授权信息。
可选地，在上述S301，终端设备生成第一数据包之前，本申请实施例提供的方法还可以包括：终端设备获得授权信息。
可选地，终端设备获得授权信息，可以包括下述步骤一至步骤四：
步骤一，云服务平台选择一个RSA参数N、选择一个RSA私钥d，并且公布公钥e。
示例性地，参数N满足下述公式：N＝p*q，公钥e满足下述公式e＝d -1mod N。
其中，p和q是最大素数，运算符号mod为取模运算。
步骤二，终端设备从Z L至Z t之间确定一个单向并且防撞的哈希函数H()；
其中，L为安全参数，Z L表示0至(L-1)之间的L个整数，Z N表示0至(N-1)之间的t个整数。
终端设备从Z L中随机确定一个整数t，并且计算t’＝H(t)；
终端设备从Z N中随机确定一个整数r，并且计算T＝t’*r e mod N；
购买云服务对应软件的使用权，并请求软件提供方对T数字签名。
步骤三，云服务平台收费后，向终端设备发送用户收据T’＝T d mod N。
步骤四，终端设备计算k＝T’/r mod N，确定授权信息为(t，k)。
在一种可能的设计方案中，在上述S301，终端设备生成第一数据包之前，本申请 实施例提供的方法还可以包括下述步骤五至步骤六：
步骤五，终端设备向云服务设备发送鉴权请求。相应地，云服务设备接收终端设备发送的鉴权请求。
可选地，鉴权请求用于对用户进行身份鉴权。
也就是说，用户通过终端设备的精简客户端，如网页浏览器，请求登录提供云服务的软件。
步骤六，云服务设备向终端设备发送鉴权响应。相应地，终端设备接收来自云服务设备的鉴权响应。
可选地，鉴权响应用于指示是否通过鉴权，若鉴权通过，则用户成功登录，若未通过，则指示用户进行注册或重新登录。
在一种可能的设计方案中，在上述S301，终端设备生成第一数据包前，本申请实施例提供的方法还可以包括：云服务设备可以向终端设备发送指示信息。相应地，终端设备接收来自目标服务器的指示信息。
可选地，指示信息可以用于指示终端设备显示服务页面，服务页面可以包括节点列表、数据起始地址。
其中，节点列表可以包括至少一个节点，节点列表可以用于用户通过终端设备依次确定第一路径的至少一个第一节点以及依次确定第二路径的至少一个第二节点。
示例性地，假设节点列表包括节点1、节点2、节点3、节点4、节点5、节点6、节点7和节点8，可以确定至少一个第一节点以及至少一个第一节点的顺序的为节点1、节点2、节点3，至少一个第二节点以及至少一个第二节点的顺序为节点4、节点5、节点6，从而第一路径为终端设备-节点1-节点2-节点3-目标服务器，第二路径为目标服务器-节点4-节点5-节点6-终端设备。
可选地，数据起始地址可以用于用户通过终端设备提供原始数据。
S302，终端设备发送第一数据包。
如图5所示，若第一数据包包括：原始数据，终端设备发送的第一数据包为123D Msg，1为第一节点1对应的第一公开密钥，2为第一节点2对应的第一公开密钥，3为第一节点3对应的第一公开密钥，D为目标服务器对应的第一公开密钥，数据Msg可以包括原始数据。若第一数据包包括：原始数据、第二路径、第二公开密钥集合和授权信息，第一数据包为123D Msg456，数据Msg可以包括原始数据和授权信息。
S303，云服务平台通过第一路径接收并解析第一数据包，得到原始数据。
在一种可能的设计方案中，上述S303，云服务平台通过第一路径接收并解析第一数据包，得到原始数据，可以包括：依次经过至少一个第一节点和目标服务器对应的第一公开密钥解析第一数据包，得到原始数据。
如图5所示，首先，终端设备根据第一节点1的标识，向第一节点1发送第一数据包123D Msg456。第一节点1接收第一数据包123D Msg456，并根据第一节点1对应的第一公开密钥对第一数据包的最外层进行解析，获得数据包23D Msg456和第一节点2的标识，根据第一节点2的标识向第一节点2发送数据包23D Msg456；
其次，第一节点2接收数据包23D Msg456，并根据第一节点2对应的第一公开密钥对数据包23D Msg456的最外层进行解析，获得数据包3D Msg456和第一节点3的 标识，根据第一节点3的标识向第一节点3发送数据包3D Msg456；
第一节点3接收数据包3D Msg456，并根据第一节点3对应的第一公开密钥对数据包3D Msg456的最外层进行解析，获得数据包D Msg456和目标服务器的标识，根据目标服务器的标识向目标服务器发送数据包D Msg456；
最后，目标服务器接收数据包D Msg456，并根据目标服务器对应的第一公开密钥对数据包D Msg的最外层进行解析，获得数据Msg456。
也就是说，用户匿名向云服务平台提交密文信息，如第一数据包，目标服务器获得明文数据，如原始数据，目标服务器能够获得原始数据的具体内容，但是，云服务平台并不能获得用户的身份信息，并不知道提供该原始数据的用户的身份信息，从而可以保证用户的隐私不被泄露。
在一些实施例中，本申请实施例提供的方法还可以包括：云服务平台获得加密后的第二路径。
示例性地，第一数据包包括第二路径和第二公开密钥集合时，云服务平台可以通过第一路径接收并解析第一数据包，得到加密后的第二路径和原始数据。
如图5所示，目标服务器获得数据Msg456，数据Msg可以包括原始数据，456为采用第二公开密钥集合加密后的第二路径，目标服务器还可以获得第二节点4的标识。
在一种可能的设计方案中，在上述S303，云服务平台通过第一路径接收并解析第一数据包，得到原始数据之后，还包括下述步骤七至步骤九：
步骤七，云服务平台获取用户的授权信息。
示例性地，云服务平台可以通过第一路径接收并解析第一数据包，得到授权信息。
也就是说，云服务平台可以在获取原始数据的过程中，获取授权信息。结合图5，数据Msg可以包括原始数据和授权信息。
可选地，授权信息可以是通过对用户的身份信息进行盲签名得到的，授权信息的具体实现方式可参照上述S301，此处不再赘述。
也就是说，云服务平台并不能通过授权信息获得用户的身份信息，从而既能验证是否给予匿名用户授权，又能保证用户的隐私不被泄露。
步骤八，云服务平台根据授权信息确定是否给予用户授权。
具体地，云服务平台搜索本地存储的授权信息数据库，确定该授权信息是否属于授权信息数据库。其中，该授权信息数据库为已使用过的授权信息。
若属于，则该授权信息为已使用过的授权信息，验证失败。
若不属于，结合上述步骤一至步骤四，则验证k＝H(t) d mod N，若验证通过，则执行下述步骤九和步骤十。
步骤九，云服务平台记录授权信息。
也就是说，若在上述步骤八，云服务平台的目标服务器确定已给予用户授权，则记录该授权信息，以防止该授权信息被重复使用。
步骤十，目标服务器对原始数据进行云计算，得到反馈数据。
也就是说，云服务平台的目标服务器对未加密的明文数据，如原始数据，进行云计算。服务器对明文数据进行计算的方法，与现有技术中，服务器对密文数据进行计 算相比，计算过程更加简单，计算效率更高，从而可以提高服务性能和响应速度。
S304，云服务平台根据第二公开密钥集合对反馈数据加密，生成第二数据包。
其中，反馈数据是根据原始数据确定的。
也就是说，云服务平台根据第二公开密钥集合对计算结果，如反馈数据，进行加密，可以保证在返回反馈数据的过程中，用户的隐私不被泄露。
示例性地，第二数据包是根据第二公开密钥集合和所述反馈数据生成的，第二公开密钥集合中包括至少一个第二公开密钥，一个第二公开密钥对应第二路径中的一个节点，第二路径包括至少一个节点。
图6为本申请实施例提供的第二数据包的结构示意图。以第二路径包括3个节点为例，如节点4-节点5-节点6，节点4对应密钥4，节点5对应密钥5，节点6对应密钥6，第二公开密钥集合可以为密钥4-密钥5-密钥6，可以依次采用密钥6、密钥5、密钥4对反馈数据进行加密，获得如图6所示的第二数据包。
可选地，第二路径为以目标服务器为起点、以终端设备为终点、以至少一个第二节点为中间节点的路径，至少一个第二节点由用户依次确定。
如图5所示，第二路径为目标服务器-第二节点4-第二节点5-第二节点6-终端设备，数据Rst为反馈数据，第二公开密钥集合为密钥4-密钥5-密钥6-密钥S，采用第二公开密钥集合对反馈数据进行加密，获得第二数据包456S Rst。
其中，第二节点4对应密钥4，第二节点5对应密钥5，第二节点6对应密钥6，终端设备对应密钥S。
S305，云服务平台通过第二路径发送并解析第二数据包。
如图5所示，依次通过目标服务器-第二节点4-第二节点5-第二节点6发送并解析第二数据包。
在一种可能的设计方案中，通过第二路径发送并解析第二数据包，包括下述步骤十一至步骤十二：
步骤十一，云服务平台依次经过至少一个第二节点对应的第二公开密钥解析第二数据包，得到第三数据包。
其中，第三数据包携带采用终端设备对应的第二公开密钥对反馈数据加密后的数据。
如图5所示，目标服务器根据第二节点4的标识，向第二节点4发送第二数据包456S Rst。
第二节点4接收第二数据包456S Rst，并根据第二节点4对应的第二公开密钥对第二数据包的最外层进行解析，获得数据包56S Rst和第二节点5的标识，根据第二节点5的标识向第二节点5发送数据包56S Rst；
第二节点5接收数据包56S Rst，并根据第二节点5对应的第二公开密钥对数据包56S Rst的最外层进行解析，获得数据包6S Rst和第二节点6的标识，根据第二节点6的标识向第二节点6发送数据包6S Rst；
第二节点6接收数据包6S Rst，并根据第二节点6对应的第二公开密钥对数据包6S Rst的最外层进行解析，获得第三数据包S Rst和终端设备的标识，。
步骤十二，云服务平台向终端设备发送第三数据包。
如图5所示，第二节点6根据终端设备的标识，向终端设备发送第三数据包S Rst。
也就是说，与终端设备相邻的节点在向返回反馈数据的过程中，并不能获得反馈数据的具体内容，从而可以保证用户的隐私不被泄露。
S306，终端设备获取反馈数据。
在一些实施例中，上述S306，终端设备获取反馈数据，可以包括下述步骤十三至步骤十四：
步骤十三，终端设备接收第三数据包。
如图5所示，终端设备接收第三数据包S Rst。
步骤十四，终端设备通过终端设备对应的第二公开密钥解析第三数据包，得到反馈数据。
如图5所示，终端设备通过终端设备对应的第二公开密钥解析第三数据包S Rst，得到反馈数据Rst。
本申请实施例提供的数据云服务方法，云服务平台通过包括至少一个节点的第一路径接收并解析第一数据包，得到原始数据，该原始数据是根据第一公开密钥集合和原始数据生成的。然后，直接对原始数据执行用户请求的服务，获得反馈数据，接着根据包括至少一个第二公开密钥的第二公开密钥集合对反馈数据加密，生成第二数据包。最后，通过包括至少一个节点的第二路径发送并解析包括反馈数据的第二数据包，使终端设备获取反馈数据。如此，终端设备提交密文信息给云服务平台，以保证用户的身份信息不被泄露，最终云服务平台获得明文数据，即原始数据，并直接对原始数据进行计算，与现有技术中，服务器对密文数据进行计算相比，本申请的计算过程更加简单，计算效率更高，从而可以提高服务性能和响应速度。
以上结合图3-图6详细说明了本申请实施例提供的数据云服务方法。以下结合图7-图8详细说明本申请实施例提供的通信装置。
图7是本申请实施例提供的通信装置的结构示意图二。该通信装置可适用于图1所示出的通信系统中，执行图3所示的数据云服务方法中云服务平台的功能。为了便于说明，图7仅示出了该通信装置的主要部件。
如图7所示，通信装置700包括：处理单元702和收发单元701。
其中，收发单元701，用于通过第一路径接收第一数据包。其中，第一数据包包括原始数据，第一数据包是根据第一公开密钥集合和原始数据生成的，第一公开密钥集合包括至少一个第一公开密钥，一个第一公开密钥对应第一路径中的一个节点，第一路径包括至少一个节点。
处理单元702，用于解析第一数据包，得到原始数据。
处理单元702，还用于根据第二公开密钥集合对反馈数据加密，生成第二数据包。其中，反馈数据是根据原始数据确定的，第二数据包是根据第二公开密钥集合和反馈数据生成的，第二公开密钥集合中包括至少一个第二公开密钥，一个第二公开密钥对应第二路径中的一个节点，第二路径包括至少一个节点。
收发单元701，还用于通过第二路径发送第二数据包。
处理单元702，还用于解析第二数据包。
在一种可能的设计方案中，第一路径可以为以终端设备为起点，以通信装置700 的目标服务器为终点，以至少一个第一节点为中间节点的路径，至少一个第一节点由用户依次确定。
在一种可能的设计方案中，第一数据包可以包括第二路径，第二路径可以为以通信装置700的目标服务器为起点、以终端设备为终点、以至少一个第二节点为中间节点的路径，至少一个第二节点由用户依次确定。
在一种可能的设计方案中，收发单元701，还用于向终端设备发送指示信息。其中，指示信息可以用于指示终端设备显示服务页面，服务页面可以包括节点列表、数据起始地址，节点列表可以用于用户通过终端设备依次确定第一路径的至少一个第一节点以及依次确定第二路径的至少一个第二节点，数据起始地址可以用于用户通过终端设备提供原始数据。
在一种可能的设计方案中，处理单元702，还用于依次经过至少一个第二节点对应的第二公开密钥解析第二数据包，得到第三数据包。其中，第三数据包可以携带采用终端设备对应的第二公开密钥对反馈数据加密后的数据。收发单元701，还用于向终端设备发送第三数据包。
在一种可能的设计方案中，处理单元702，还用于依次经过至少一个第一节点和通信装置700的目标服务器对应的第一公开密钥解析第一数据包，得到原始数据。
在一种可能的设计方案中，处理单元702，还用于获取用户的授权信息。其中，授权信息可以是通过对用户的身份信息进行盲签名得到的。处理单元702，还用于根据授权信息确定是否给予用户授权。
在一种可能的设计方案中，处理单元702，还用于若确定给予用户授权，则记录授权信息。
可选地，第一数据包可以包括授权信息。
需要说明的是，收发单元701可以包括接收单元和发送单元(图7中未示出)。其中，接收单元用于接收来自终端设备的数据和/或信令；发送单元用于向终端设备发送数据和/或信令。本申请对于收发单元701的具体实现方式，不做具体限定。
可选地，通信装置700还可以包括存储单元(图7中未示出)，该存储单元存储有程序或指令。当处理单元执行该程序或指令时，使得通信装置700可以执行图3所示的数据云服务方法中云服务平台的功能。
需要说明的是，通信装置700可以是图1所示的云服务平台或图2所示的通信装置200，也可以是可设置于云服务平台的芯片(系统)或其他部件或组件，本申请对此不做限定。
此外，通信装置700的技术效果可以参考图3所示的数据云服务方法的技术效果，此处不再赘述。
图8是本申请实施例提供的通信装置的结构示意图三。该通信装置可适用于图1所示出的通信系统中，执行图3所示的数据云服务方法中终端设备的功能。为了便于说明，图8仅示出了该通信装置的主要部件。
如图8所示，通信装置800包括：处理单元802和收发单元801。
其中，处理单元802，用于生成第一数据包。其中，第一数据包包括原始数据，第一数据包是根据第一公开密钥集合和原始数据生成的，第一公开密钥集合包括至少 一个第一公开密钥，一个第一公开密钥对应第一路径中的一个节点，用于第一路径中的一个节点对原始数据进行加密，第一路径包括至少一个节点。
收发单元801，用于发送第一数据包。
处理单元802，还用于获取反馈数据。其中，反馈数据是根据原始数据确定的。
在一种可能的设计方案中，第一路径可以为以通信装置800为起点，以目标服务器为终点，以至少一个第一节点为中间节点的路径，至少一个第一节点由用户依次确定。
在一种可能的设计方案中，第一数据包可以包括第二公开密钥集合，第二公开密钥集合可以包括至少一个第二公开密钥，一个第二公开密钥对应第二路径中的一个节点，用于第二路径中的一个节点对反馈数据进行加密，第二路径包括至少一个节点。
在一种可能的设计方案中，第一数据包可以包括第二路径，第二路径可以为以目标服务器为起点、以通信装置800为终点、以至少一个第二节点为中间节点的路径，至少一个第二节点由用户依次确定。
在一种可能的设计方案中，收发单元801，还用于接收来自目标服务器的指示信息。其中，指示信息可以用于指示通信装置800显示服务页面，服务页面可以包括节点列表、数据起始地址，节点列表可以用于用户通过通信装置800依次确定第一路径的至少一个第一节点以及依次确定第二路径的至少一个第二节点，数据起始地址可以用于用户通过通信装置800提供原始数据。
在一种可能的设计方案中，收发单元801，还用于接收第三数据包。其中，第三数据包可以携带采用通信装置800对应的第二公开密钥对反馈数据加密后的数据。处理单元802，还用于通过通信装置800对应的第二公开密钥解析第三数据包，得到反馈数据。
在一种可能的设计方案中，第一数据包可以包括授权信息，授权信息可以是通过对用户的身份信息进行盲签名得到的，授权信息可以用于确定是否给予用户授权。
需要说明的是，收发单元801可以包括接收单元和发送单元(图8中未示出)。其中，接收单元用于接收来自云服务平台的数据和/或信令；发送单元用于向云服务平台发送数据和/或信令。本申请对于收发单元801的具体实现方式，不做具体限定。
可选地，通信装置800还可以包括存储单元(图8中未示出)，该存储单元存储有程序或指令。当处理单元802执行该程序或指令时，使得通信装置800可以执行图3所示的数据云服务方法中终端设备的功能。
需要说明的是，通信装置800可以是图1所示的终端设备或图2所示的通信装置200，也可以是可设置于终端设备的芯片(系统)或其他部件或组件，本申请对此不做限定。
此外，通信装置800的技术效果可以参考图3所示的数据云服务方法的技术效果，此处不再赘述。
本申请实施例提供一种通信系统。该系统包括一个或多个终端设备，以及云服务平台。可选地，云服务平台可以包括一个或多个节点以及一个或多个服务器。
本申请实施例提供一种计算机可读存储介质，该计算机可读存储介质包括计算机程序或指令；当该计算机程序或指令在计算机上运行时，使得该计算机执行上述方法 实施例所述的数据云服务方法。
本申请实施例提供一种计算机程序产品，包括计算机程序或指令，当该计算机程序或指令在计算机上运行时，使得该计算机执行上述方法实施例所述的数据云服务方法。
应理解，在本申请实施例中的处理器可以是中央处理单元(central processing unit，CPU)，该处理器还可以是其他通用处理器、数字信号处理器(digital signal processor，DSP)、专用集成电路(application specific integrated circuit，ASIC)、现成可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
还应理解，本申请实施例中的存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的随机存取存储器(random access memory，RAM)可用，例如静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(direct rambus RAM，DR RAM)。
上述实施例，可以全部或部分地通过软件、硬件(如电路)、固件或其他任意组合来实现。当使用软件实现时，上述实施例可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令或计算机程序。在计算机上加载或执行所述计算机指令或计算机程序时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以为通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集合的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质。半导体介质可以是固态硬盘。
应理解，本文中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况，其中A,B可以是单数或者复数。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系，但也可能表示的是一种“和/或”的关系，具体可参考前后文进行理解。
本申请中，“至少一个”是指一个或者多个，“多个”是指两个或两个以上。“以下至少一项(个)”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a,b,或c中的至少一项(个)，可以表示：a,b,c,a-b,a-c,b-c,或a-b-c，其中a,b,c可以是单个，也可以是多个。
应理解，在本申请的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (17)

  1. 一种数据云服务方法，其特征在于，包括：
    通过第一路径接收并解析第一数据包，得到原始数据；所述第一数据包包括所述原始数据，所述第一数据包是根据第一公开密钥集合和所述原始数据生成的，所述第一路径包括至少一个节点，所述第一公开密钥集合包括至少一个第一公开密钥，一个第一公开密钥对应所述第一路径中的一个节点；
    根据第二公开密钥集合对反馈数据加密，生成第二数据包；所述反馈数据是根据所述原始数据确定的，所述第二数据包是根据第二公开密钥集合和所述反馈数据生成的，所述第二公开密钥集合中包括至少一个第二公开密钥，一个第二公开密钥对应第二路径中的一个节点，所述第二路径包括至少一个节点；
    通过所述第二路径发送并解析所述第二数据包。
  2. 根据权利要求1所述的数据云服务方法，其特征在于，所述第一路径为以终端设备为起点，以目标服务器为终点，以至少一个第一节点为中间节点的路径，所述至少一个第一节点由用户依次确定。
  3. 根据权利要求1或2所述的数据云服务方法，其特征在于，所述第一数据包还包括所述第二路径，所述第二路径为以目标服务器为起点、以终端设备为终点、以至少一个第二节点为中间节点的路径，所述至少一个第二节点由用户依次确定。
  4. 根据权利要求2或3所述的数据云服务方法，其特征在于，在所述通过第一路径接收并解析第一数据包，得到原始数据前，还包括：
    向所述终端设备发送指示信息；所述指示信息用于指示所述终端设备显示服务页面，所述服务页面包括节点列表、数据起始地址，所述节点列表用于所述用户通过所述终端设备依次确定所述第一路径的至少一个第一节点以及依次确定所述第二路径的至少一个第二节点，所述数据起始地址用于所述用户通过所述终端设备提供所述原始数据。
  5. 根据权利要求3所述的数据云服务方法，其特征在于，所述通过第二路径发送并解析所述第二数据包，包括：
    依次经过所述至少一个第二节点对应的第二公开密钥解析所述第二数据包，得到第三数据包，所述第三数据包携带采用所述终端设备对应的第二公开密钥对所述反馈数据加密后的数据；
    向所述终端设备发送所述第三数据包。
  6. 根据权利要求2所述的数据云服务方法，其特征在于，通过第一路径接收并解析第一数据包，得到原始数据，包括：
    依次经过所述至少一个第一节点和所述目标服务器对应的第一公开密钥解析所述第一数据包，得到所述原始数据。
  7. 根据权利要求1-6中任一项所述的数据云服务方法，其特征在于，在所述通过第一路径接收并解析第一数据包，得到原始数据后，还包括：
    获取用户的授权信息；所述授权信息是通过对所述用户的身份信息进行盲签名得到的；
    根据所述授权信息确定是否给予所述用户授权。
  8. 一种数据云服务方法，其特征在于，包括：
    生成第一数据包；所述第一数据包包括原始数据，所述第一数据包是根据第一公开密钥集合和所述原始数据生成的，所述第一公开密钥集合包括至少一个第一公开密钥，一个第一公开密钥对应第一路径中的一个节点，用于所述第一路径中的一个节点对所述原始数据进行加密，所述第一路径包括至少一个节点；
    发送所述第一数据包；
    获取反馈数据；所述反馈数据是根据所述原始数据确定的。
  9. 根据权利要求8所述的数据云服务方法，其特征在于，所述第一路径为以终端设备为起点，以目标服务器为终点，以至少一个第一节点为中间节点的路径，所述至少一个第一节点由用户依次确定。
  10. 根据权利要求8或9所述的数据云服务方法，其特征在于，所述第一数据包还包括第二公开密钥集合，所述第二公开密钥集合中包括至少一个第二公开密钥，一个第二公开密钥对应第二路径中的一个节点，用于所述第二路径中的一个节点对所述反馈数据进行加密，所述第二路径包括至少一个节点。
  11. 根据权利要求8-10中任一项所述的数据云服务方法，其特征在于，所述第一数据包还包括第二路径，所述第二路径为以目标服务器为起点、以终端设备为终点、以至少一个第二节点为中间节点的路径，所述至少一个第二节点由用户依次确定。
  12. 根据权利要求9-11中任一项所述的数据云服务方法，其特征在于，在生成第一数据包前，还包括：
    接收来自所述目标服务器的指示信息；所述指示信息用于指示所述终端设备显示服务页面，所述服务页面包括节点列表、数据起始地址，所述节点列表用于所述用户通过所述终端设备依次确定所述第一路径的至少一个第一节点以及依次确定所述第二路径的至少一个第二节点，所述数据起始地址用于所述用户通过所述终端设备提供所述原始数据。
  13. 一种通信装置，其特征在于，包括：处理单元和收发单元；
    所述收发单元，用于通过第一路径接收第一数据包；所述第一数据包包括所述原始数据，所述第一数据包是根据第一公开密钥集合和所述原始数据生成的，所述第一公开密钥集合包括至少一个第一公开密钥，一个第一公开密钥对应第一路径中的一个节点，所述第一路径包括至少一个节点；
    所述处理单元，用于解析所述第一数据包，得到原始数据；
    所述处理单元，还用于根据第二公开密钥集合对反馈数据加密，生成第二数据包；所述反馈数据是根据所述原始数据确定的，所述第二数据包是根据第二公开密钥集合和所述反馈数据生成的，所述第二公开密钥集合中包括至少一个第二公开密钥，一个第二公开密钥对应第二路径中的一个节点，所述第二路径包括至少一个节点；
    所述收发单元，还用于通过所述第二路径发送所述第二数据包；
    所述处理单元，还用于解析所述第二数据包。
  14. 一种通信装置，其特征在于，包括：处理单元和收发单元；
    所述处理单元，用于生成第一数据包；所述第一数据包包括原始数据，所述第一数据包是根据第一公开密钥集合和所述原始数据生成的，所述第一公开密钥集合包括 至少一个第一公开密钥，一个第一公开密钥对应第一路径中的一个节点，用于所述第一路径中的一个节点对所述原始数据进行加密，所述第一路径包括至少一个节点；
    所述收发单元，用于发送所述第一数据包；
    所述处理单元，还用于获取反馈数据；所述反馈数据是根据所述原始数据确定的。
  15. 一种通信装置，其特征在于，所述通信装置包括：处理器和通信接口；其中，
    所述处理器，用于通过所述通信接口与其它装置通信，并执行如权利要求1-12中任一项所述的数据云服务方法。
  16. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质包括计算机程序或指令，当所述计算机程序或指令在计算机上运行时，使得所述计算机执行如权利要求1-12中任一项所述的数据云服务方法。
  17. 一种计算机程序产品，其特征在于，所述计算机程序产品包括：计算机程序或指令，当所述计算机程序或指令在计算机上运行时，使得所述计算机执行如权利要求1-12中任一项所述的数据云服务方法。
PCT/CN2021/110212 2020-08-03 2021-08-03 数据云服务方法及通信装置 WO2022028391A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010769023.4 2020-08-03
CN202010769023.4A CN114095192A (zh) 2020-08-03 2020-08-03 数据云服务方法及通信装置

Publications (1)

Publication Number Publication Date
WO2022028391A1 true WO2022028391A1 (zh) 2022-02-10

Family

ID=80119951

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/110212 WO2022028391A1 (zh) 2020-08-03 2021-08-03 数据云服务方法及通信装置

Country Status (2)

Country Link
CN (1) CN114095192A (zh)
WO (1) WO2022028391A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114584615A (zh) * 2022-03-01 2022-06-03 阿里巴巴（中国）有限公司 云服务协同交互方法、装置以及设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060136714A1 (en) * 2003-05-19 2006-06-22 Fujitsu Limited Method and apparatus for encryption and decryption, and computer product
CN101431411A (zh) * 2007-11-09 2009-05-13 康佳集团股份有限公司 一种网络游戏数据的动态加密方法
CN105656624A (zh) * 2016-02-29 2016-06-08 浪潮(北京)电子信息产业有限公司 一种客户端、服务器、数据传输方法与系统
CN110516464A (zh) * 2019-09-02 2019-11-29 深圳市网心科技有限公司 基于神经网络计算的数据保护方法及相关设备

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060136714A1 (en) * 2003-05-19 2006-06-22 Fujitsu Limited Method and apparatus for encryption and decryption, and computer product
CN101431411A (zh) * 2007-11-09 2009-05-13 康佳集团股份有限公司 一种网络游戏数据的动态加密方法
CN105656624A (zh) * 2016-02-29 2016-06-08 浪潮(北京)电子信息产业有限公司 一种客户端、服务器、数据传输方法与系统
CN110516464A (zh) * 2019-09-02 2019-11-29 深圳市网心科技有限公司 基于神经网络计算的数据保护方法及相关设备

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114584615A (zh) * 2022-03-01 2022-06-03 阿里巴巴（中国）有限公司 云服务协同交互方法、装置以及设备

Also Published As

Publication number Publication date
CN114095192A (zh) 2022-02-25

Similar Documents

Publication Publication Date Title
US10375067B2 (en) Mutual authentication with symmetric secrets and signatures
US10785019B2 (en) Data transmission method and apparatus
RU2756048C2 (ru) Адресация доверенной среды исполнения с использованием ключа шифрования
CN110214440B (zh) 计算系统，传送受保护数据的方法和可读存储介质
US8462955B2 (en) Key protectors based on online keys
US11134069B2 (en) Method for authorizing access and apparatus using the method
KR102489790B1 (ko) 서명키를 사용한 신뢰 실행 환경의 어드레싱 기법
US10148438B2 (en) Methods and apparatus for protecting sensitive data in distributed applications
US8555069B2 (en) Fast-reconnection of negotiable authentication network clients
US10341118B2 (en) SSL gateway with integrated hardware security module
CN108155994B (zh) 应用于rsa解密的安全外包计算方法
CN113037484B (zh) 数据传输方法、装置、终端、服务器及存储介质
CN106941404B (zh) 密钥保护方法及装置
Chang et al. A practical secure and efficient enterprise digital rights management mechanism suitable for mobile environment
CN114553590A (zh) 数据传输方法及相关设备
JP2022546470A (ja) トランスポート層セキュリティおよび他のコンテキストでのデータの検証のための非集中型技術
WO2022028391A1 (zh) 数据云服务方法及通信装置
US11496287B2 (en) Privacy preserving fully homomorphic encryption with circuit verification
US11902428B2 (en) Key exchange system, communication apparatus, key exchange method and program
JP6320943B2 (ja) 鍵共有装置、鍵共有システム、鍵共有方法、プログラム
CN114153382A (zh) 云存储中支持数据可验证删除的高效数据迁移方法、系统
Gagged et al. Improved secure dynamic bit standard technique for a private cloud platform to address security challenges
Chen et al. Applications of multi-channel safety authentication protocols in wireless networks
Kumar Yadav et al. An Efficient Approach for Security in Cloud Computing
CN117675244A (zh) 基于集群环境下任务密钥分发方法及装置

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21853208

Country of ref document: EP

Kind code of ref document: A1