WO2022156694A1 - 数据共享方法、装置、系统、服务器和计算机存储介质 - Google Patents

数据共享方法、装置、系统、服务器和计算机存储介质 Download PDF

Info

Publication number
WO2022156694A1
WO2022156694A1 PCT/CN2022/072684 CN2022072684W WO2022156694A1 WO 2022156694 A1 WO2022156694 A1 WO 2022156694A1 CN 2022072684 W CN2022072684 W CN 2022072684W WO 2022156694 A1 WO2022156694 A1 WO 2022156694A1
Authority
WO
WIPO (PCT)
Prior art keywords
entity
data
resource
access control
resources
Prior art date
Application number
PCT/CN2022/072684
Other languages
English (en)
French (fr)
Inventor
赵君杰
Original Assignee
京东方科技集团股份有限公司
北京京东方技术开发有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 京东方科技集团股份有限公司, 北京京东方技术开发有限公司 filed Critical 京东方科技集团股份有限公司
Priority to US18/272,876 priority Critical patent/US20240305641A1/en
Publication of WO2022156694A1 publication Critical patent/WO2022156694A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/1095—Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/12—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/55—Push-based network services
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/70—Services for machine-to-machine communication [M2M] or machine type communication [MTC]

Definitions

  • the present disclosure relates to the field of data processing, and more particularly, to a data sharing method, apparatus, system, server and computer storage medium.
  • device A generates a large amount of data and sends it to platform A for use by application A
  • device B generates a large amount of data and sends it to platform B
  • device C generates a large amount of data to send to platform C for use by application B.
  • This model is suitable for enterprises with the ability to build their own platforms. Such a scenario is shown in Figure 1A.
  • the data sharing may be data sharing between application entities, data sharing between other entities (eg, public service entities), or data sharing between application entities and other entities.
  • a data sharing method comprising: receiving a data acquisition request from a first entity, wherein the data acquisition request includes an identifier of a resource of a second entity storing target data, and sharing operation indication information and setting the respective resource access control policies of the first entity and the second entity based on the data acquisition request, so that the first entity and the second entity can access each other's resources to realize data sharing; and sending a data acquisition response to the first entity, wherein the data acquisition response includes the target data.
  • the sharing operation indication information includes: the identifier of the resource of the first entity; or, the identifier of the sharing operation; or, the identifier of the sharing operation and the identifier of the resource of the first entity; wherein , setting the respective resource access control policies of the first entity and the second entity based on the data acquisition request, including: based on the identification of the resources of the first entity and/or the identification of the shared operation and the second entity identification of an entity's resource determining that the first entity desires data sharing with the second entity; and determining whether the first entity satisfies a resource access control policy of the second entity, and setting the the respective resource access control policies of the first entity and the second entity.
  • the sharing operation indication information only includes: the identifier of the sharing operation; or, the identifier of the sharing operation and the identifier of the resource of the first entity, wherein the first entity is set based on the data acquisition request.
  • the respective resource access control policies of an entity and the second entity include: determining, based on at least the identification of the sharing operation, that the first entity desires to share data with the second entity, and setting the first entity and the second entity to perform data sharing. the respective resource access control policies of the second entities.
  • setting the respective resource access control policies of the first entity and the second entity includes: updating the resource access control policies of the first entity, updating the resource access control policies of the second entity control strategy; or create a temporary access control strategy of the first entity, create a temporary access control strategy of the second entity; or update the resource access control strategy of the first entity, create a temporary resource access control strategy of the second entity; or update The resource access control policy of the second entity creates a temporary access control policy of the first entity.
  • updating the resource access control policy of the first entity includes: making the accessor identifiers in the resource access control policy include identifiers of the first entity and the second entity, and the accessor identifiers indicate permission the identifier of the entity accessing the resource of the first entity; and updating the resource access control policy of the second entity comprises: making the accessor identifier in the resource access control policy include identifiers of the first entity and the second entity, the The accessor identification indicates the identification of the entity that is allowed to access the resource of the second entity.
  • the creating a temporary access control policy of the first entity includes: creating a temporary access party identifier, and including an identifier of the second entity therein, the temporary access party identifier indicating that temporary access is permitted the identity of the entity of the resource of the first entity; and the creating a temporary access control policy of the second entity comprises: creating a temporary accessor identity, and including the identity of the first entity therein, the temporary accessor identity indicating that the permission is allowed The identity of the entity temporarily accessing the resources of the second entity.
  • updating the resource access control policy of the first entity or the second entity further includes: adding a data amount limit, indicating that the resources obtained from the resources of the first entity or the resources of the second entity are allowed to be acquired Data volume upper limit threshold; or wherein, creating the resource access control policy of the first entity or the second entity further includes: creating a data volume limit, indicating that the resources obtained from the resources of the first entity or the resources of the second entity through temporary access are allowed Data volume upper limit threshold; wherein, when the amount of data obtained from the resources of the first entity or the resources of the second entity through temporary access reaches the upper limit threshold of data volume, it is prohibited to continue to obtain data from the resources of the first entity or the second entity resource to obtain data.
  • creating the temporary access control policy of the first entity or the second entity further comprises: creating a temporary access time limit, indicating that temporary access to the resources of the first entity or the first entity is permitted The time of the resources of the two entities.
  • the method further includes: determining whether the data type of the resource of the first entity is the same as the data type of the resource of the second entity, wherein, in the case of determining that the types of the two are the same, Updating the resource access control policy or creating a temporary access control policy also includes: adding a data sharing rule to limit the upper limit threshold of the same type of data obtained by both parties from the other party to be equal; wherein, in the case where it is determined that the types of the two are different In the future, updating the resource access control policy or creating a temporary access control policy also includes: adding data sharing rules to limit the upper limit thresholds of the different types of data obtained by both parties from the other party to be equal; and adding data volume conversion rules. Convert the amount of data obtained from the resource.
  • the data under the resource of each entity has a content value attribute
  • the value of the content value attribute is positively correlated and predefined with the usefulness of the data under the resource of the entity
  • the data volume The conversion rule includes: multiplying the data volume of the data obtained from the resource by the value of the content value attribute of the data to obtain the converted data volume, and wherein, when the converted data volume exceeds the upper limit threshold of the data volume, Prohibits further fetching of data from the resource.
  • the first entity is associated with a first public service entity
  • the second entity is associated with a second public service entity
  • the first public service entity is associated with the second public service entity
  • Public service entities register with each other
  • receiving a data acquisition request from a first entity includes: receiving, by the first public service entity, the data acquisition request from the first entity; If the identifier of the resource of the second entity included in the data acquisition request determines that the second entity is not associated with it but is associated with the second public service entity, forwarding the data acquisition request to the second entity public service entity.
  • setting the respective resource access control policies of the first entity and the second entity based on the data acquisition request includes: acquiring by the second public service entity based on the data Request to set the resource access control policy of the second entity, so that the first entity can access its resources; the second public service entity returns a data acquisition response to the first public service entity, and the data acquisition response includes all the data of the target resource; the resource access control policy of the first entity is set by the first public service entity based on the data acquisition response, so that the second entity can access its resources; and the first public service entity is set by the first public service entity The data acquisition response is returned to the first entity.
  • a data sharing apparatus comprising: a receiving module configured to receive a data acquisition request from a first entity, wherein the data acquisition request includes resources of a second entity storing target data The identifier of the first entity and the shared operation indication information; the setting module is configured to set the respective resource access control policies of the first entity and the second entity based on the data acquisition request, so that the first entity and the The second entity can access resources of the counterparty to realize data sharing; and a sending module is configured to send a data acquisition response to the first entity, wherein the data acquisition response includes the target data.
  • the apparatus further includes: a determination module configured to determine whether the data type of the resource of the first entity is the same as the data type of the resource of the second entity, and send the determination result to the setting module , so that the setting module sets the respective resource access control policies of the first entity and the second entity according to the determination result.
  • a determination module configured to determine whether the data type of the resource of the first entity is the same as the data type of the resource of the second entity, and send the determination result to the setting module , so that the setting module sets the respective resource access control policies of the first entity and the second entity according to the determination result.
  • a data sharing system comprising: a first manufacturing equipment and a second manufacturing equipment; a first manufacturing application and a second manufacturing application, wherein the first manufacturing application and the first manufacturing equipment In association, the second manufacturing application is associated with the second manufacturing equipment; and the IoT platform is configured to: store the data uploaded by the first manufacturing equipment under the resources of the first manufacturing application, and the application data of the first manufacturing application Work together as the product data of the first manufacturing application, and store the data uploaded by the second manufacturing equipment under the resources of the second manufacturing application, and use the application data of the second manufacturing application as the product data of the second manufacturing application; the data acquisition request sent by the first manufacturing application, the data acquisition request including the identifier of the resource of the second manufacturing application storing the target product data and the product data sharing operation instruction information; setting the first manufacturing application based on the data acquisition request applying respective resource access control policies of the second manufacturing application and the first manufacturing application, so that the first manufacturing application and the second manufacturing application can access the resources of the other party to obtain product data
  • the first manufacturing application is configured to adjust the first manufacturing based on product data of the first manufacturing application and target product data obtained from resources of the second manufacturing application
  • the product data of the application makes the product data of the first manufacturing application compatible with the product data of the second manufacturing application.
  • a server comprising: a processor; and a memory having a program stored thereon, the program, when executed by the processor, causes the processor to be as described above Steps of the data sharing method.
  • a computer storage medium including a computer program, the computer program implementing the above-described data sharing method when executed by the processor.
  • FIG. 1A shows a schematic diagram of a scenario where different platforms serve different specific applications and devices
  • FIG. 1B shows a schematic diagram of a scenario where the general service platform serves different applications and devices
  • FIGS. 2A-2B show schematic flowcharts of a data sharing method according to an embodiment of the present disclosure
  • 3A-3B illustrate schematic diagrams of resource structures according to embodiments of the present disclosure
  • FIG. 4 shows a schematic diagram of an interaction flow of a data sharing method according to an embodiment of the present disclosure
  • FIG. 5 illustrates further details of the method of FIG. 2A with different entities registered to different communication service entities, according to an embodiment of the present disclosure
  • FIG. 6 shows a schematic diagram of an interaction flow of the data sharing method shown in FIG. 5 according to an embodiment of the present disclosure
  • FIG. 7 shows a structural block diagram of a data sharing apparatus according to an embodiment of the present disclosure
  • FIG. 8 shows a schematic diagram of a data sharing system according to an embodiment of the present disclosure.
  • FIG. 9 shows a schematic structural diagram of a server according to an embodiment of the present disclosure.
  • an IoT entity eg, a software module in an IoT terminal device or a node device
  • the data or information can be stored as a separate resource.
  • the Internet of Things entity may send a request to the public service entity, thereby updating the resource corresponding to the Internet of Things entity stored on the public service entity, so as to reflect the state of the device operated by the Internet of Things entity. This update can be real-time or periodic, or it can be triggered by a condition.
  • the resources referred to here include resources of various entities (eg, can be embodied as software modules in IoT devices, such as AE, CSE, etc.).
  • the entity may represent a software module of a communication device
  • the public service entity may represent a software module of a service platform, which may be local or remote.
  • attribute-based access control is usually used for access control of resources, and access to corresponding resources is achieved by setting each attribute in a resource access control policy (accessControlPolicy).
  • accessControlPolicy resource access control policy
  • a public service entity would create a resource for the entity and a resource access control policy for that entity would be created for that entity.
  • the resource access control policy is the content of the access control policy, that is, the content of the evaluation basis (access rule) for evaluating whether the request for accessing the target resource is authorized.
  • the request to access the target resource must pass the corresponding authorization verification in the access control policy before completing the request authorization operation.
  • the current resource access control policy may include an access limit (accessControlLimit), which is used to limit the number of times the resource can be accessed; the location region or IP address limit (accessControlLocationRegion or accessControlIPAddress) of the access requester, which is used to limit the access control. Which IP addresses (blocks) the access requester must be in or must have.
  • the resource access control policy may include a preset identifier of an entity that is allowed to initiate an access request to the resource.
  • a preset identifier of an entity that is allowed to initiate an access request to the resource.
  • the above-mentioned preset identification in the resource access control strategy for the resource of the entity only includes the identification of the entity, and only in the identification of the requesting party that initiates the access request and the preset identification The access request is authorized (access is allowed) only when the identifiers are the same.
  • an entity (such as the aforementioned application entity) can only obtain data associated with it from a public service entity.
  • an application entity can be understood to be mapped to a public service entity, the public service entity creates a resource for the application entity, and the application data of the application entity is stored under the resource; in addition, the terminal (device) associated with the application entity Also mapped to the public service entity, the public service entity creates a resource for the terminal, and the data uploaded by the terminal is stored under the resource; and through the coordination of the public service entity, the application entity can obtain storage under the public service entity. its own application data and the associated terminal data. Therefore, in the present disclosure, for ease of understanding, the data under the resources of the application entity may be understood as the data of the application entity itself and the data uploaded by the associated device (terminal).
  • a resource can have a unique identifier, which includes attributes and sub-resources, wherein the attributes are used to store information related to the resource, the sub-resource is the next-level resource of the resource, and the resource includes an index pointing to the sub-resource.
  • application B may wish to obtain application data of application A or device data uploaded by device A corresponding to application A, so as to adjust its own application data.
  • application B may wish to obtain the application data of application A and/or the device data uploaded by the corresponding device A, so that application B can comprehensively consider its own application data, application data of application A and/or
  • the device data uploaded by device A adjusts its own application data to be compatible with the product data of application A and/or the device data of device A, so that the products produced by device B can be unified in style with those produced by device A.
  • the present disclosure proposes a data sharing method, system and computer storage medium for data sharing among different entities.
  • the data sharing may be data sharing between application entities, data sharing between other entities (eg, public service entities), or data sharing between application entities and other entities.
  • the smart manufacturing scenario is used as an example to describe various aspects of the data sharing method
  • the data sharing method can be used in other application scenarios of the Internet of Things.
  • comprehensive application A including bicycle sharing services and business recommendation services, etc.
  • application A can use the data uploaded by type A bicycles (such as temperature, speed, location data, etc.)
  • application B It is also associated with the B-type bicycle through the same service platform, that is, the application B can use the data uploaded by the B-type bicycle.
  • the B-type bicycle can upload data to the service platform in real time for the B application to use.
  • the comprehensive application A can perform commercial recommendation services, but because it does not use the corresponding bicycle of type A, it cannot obtain the current riding-related information in real time. Therefore, the comprehensive application A also hopes to obtain the data uploaded by the type B bicycle to carry out Related recommendation services, therefore, in this case, application A may also wish to share data with application B.
  • FIGS. 2A-2B show schematic flowcharts of a data sharing method according to an embodiment of the present disclosure.
  • the method may be performed by a common service entity (universal service platform).
  • step S210 a data acquisition request is received from the first entity, wherein the data acquisition request includes an identifier of the resource of the second entity storing the target data, and sharing operation indication information.
  • the first entity may be the first application entity, and the second entity may be the second application entity.
  • the first entity may be the first public service entity, and the second entity may be the second public service entity, in which case the public service entity for coordinating and coordinating the various entities may be referred to as the hosting public service entity ( Hosting CSE). Both the first entity and the second entity are registered on the public service entity.
  • Hosting CSE hosting public service entity
  • the first entity may wish to acquire part of the data (target data) under the resources of the second entity, so the data acquisition request is sent to the public service entity by including the identification of the resources of the second entity storing the target data.
  • the first entity may first determine whether it satisfies the resource access control policy of the second entity. For example, if the first entity has previously shared data with the second entity and the previous resource access control policies of the first and second entities are still in effect (eg, no invalidation notification has been received from the public service entity), the first entity The data acquisition request may be sent directly to the public service entity without including the sharing operation indication information; otherwise, the first entity needs to resend the data acquisition request including the sharing operation indication information.
  • the data acquisition request may also include sharing operation indication information It is used to trigger a data sharing operation, so that the first entity can obtain the data under the resources of the second entity.
  • the shared operation indication information may be implicit or explicit.
  • the sharing operation indication information may include the identifier of the resource of the first entity, that is, the data acquisition request includes the identifier of the resource (target resource) of the second entity and the identifier of the resource (source resource) of the first entity, so as to Implicitly indicates the public service entity that the first entity desires data sharing with the second entity.
  • the sharing operation indication information may include: an identifier of the sharing operation; or, an identifier of the sharing operation and an identifier of the resource of the first entity.
  • the sharing operation indication information is the identifier of the sharing operation
  • the first entity that explicitly instructs the public service entity to send the request including the identifier of the sharing operation expects to communicate with the second entity (the identifier of the second entity is included in the data acquisition request) data sharing.
  • the public service entity can know who sent the request to it, and therefore can also know that the first entity sends the request to it.
  • the public service entity indicates that data under its resources is available for sharing with the second entity.
  • the first entity can receive a response that the data acquisition request fails when it does not have the access control authority to the resources of the second entity, and the first entity can finally obtain the data through a separate data acquisition request.
  • Obtaining the access control authority of the resources of the second entity simplifies the operation process of the first entity and reduces the workload of the first entity.
  • step S220 the respective resource access control policies of the first entity and the second entity are set based on the data acquisition request, so that the first entity and the second entity can access each other's resources to realize data sharing.
  • step S220 may include: determining the first entity based on the identifier of the resource of the first entity and the identifier of the resource of the second entity. an entity desires data sharing with the second entity, and the first entity does not satisfy the resource access control policy of the second entity; and setting each of the first entity and the second entity based on the determination resource access control policy.
  • the identity of application A (the first entity) must not be included in the preset identity of the access requestor who is allowed to access the resources of application B, so application A does not The resource access control policy of application B is satisfied, and the data acquisition request (access request) issued by the application B cannot be allowed according to the current resource access control policy. Therefore, the public service entity sets (modifies, updates, creates, etc.) the resource access control policies of application A and application B, so that application A and application B can access each other to realize data sharing.
  • a data acquisition failure response may be returned to the first entity first.
  • step S220 may include: determining, based on at least the identification of the sharing operation, that the first entity expects to communicate with the second entity.
  • the entities share data and set respective resource access control policies of the first entity and the second entity.
  • the public service entity may determine whether the first entity that initiates the data acquisition request and the second entity as the target are trusted parties before setting the respective resource access control policies of the first entity and the second entity, thereby improving security
  • the trust level of the first entity and the second entity can be determined by the historical interaction records of the first entity and the second entity with the public service entity, and only when the trust level meets the preset level, the first entity and the second entity are set Entities' respective resource access control policies.
  • the access policy of which security level (for example, full access, temporary access) to set may also be determined according to the trust levels of the first entity and the second entity.
  • setting the respective resource access control policies of the first entity and the second entity may include updating (modifying) the existing resource access control policies of the first entity and the second entity (corresponding to full access). ), that is, the first entity and the second entity are given full access rights to each other's resources (for example, the two parties are in a relationship of full trust), which may also include additionally creating new resource access control policies (corresponding to temporary access), That is, at least one of the first entity and the second entity may only be allowed to temporarily access the other's resources.
  • both application A and application B have high trust levels, so both application A and application B can access each other's resources at any time, or application A has a low trust level and application B has a high trust level, so in the application
  • the public service entity will create application B's resource access control policy to allow application A to temporarily access application B's resources, but update application A's resource access control policy to App B is allowed to access App A's resources at any time.
  • setting the respective resource access control policies of the first entity and the second entity may include the following situations: 1. Update the resource access control policies of the first entity and update the resource access control policies of the second entity Control strategy; 2. Create the temporary access control strategy of the first entity, and create the temporary access control strategy of the second entity; 3. Update the resource access control strategy of the first entity, and create the resource temporary access control strategy of the second entity; Or, 4. Update the resource access control policy of the second entity, and create a temporary access control policy of the first entity.
  • updating the resource access control policy of the first entity may include: making the accessor identifiers in the access control policy include identifiers of the first entity and the second entity, and the accessor identifiers indicate that access to the first entity is permitted.
  • the entity of the resource For example, for the application entity AE1, the preset identity included in the resource access control policy for its resources can be updated from only including the identity of the application entity AE1 to including the identity of the application entity AE1 and the identity of the application entity AE2, thereby allowing the application entity AE1 and the application entity AE2 access the resources of the application entity AE1.
  • updating the resource access control policy of the second entity may include: making the accessor identifiers in the access control policy include identifiers of the first entity and the second entity, and the accessor identifiers indicate that access to the second entity is permitted entity.
  • the preset identity included in the resource access control policy for its resources can be updated from the identity of only the application entity AE2 to the identity of the application entity AE1 and the application entity AE2, so that it can be The application entity AE1 and the application entity AE2 are allowed to access the resources of the application entity AE2.
  • both parties after updating the respective resource access control policies of the first entity and the second entity, both parties have the authority to access each other's resources, so that data sharing can be achieved.
  • the first entity may not want or be unable to share data with any other resources, for example, the data uploaded by the equipment associated with the first entity in these time periods is data with strong confidentiality, while at other times The segment (the confidential data has been acquired and no longer exists in the resource) can in turn allow other resources to access for data sharing with other resources.
  • the trust level of the entity requesting to access the resources of the first entity is not high, the time period during which it is allowed to access the resources of the first entity may be restricted for the entity, such as allowing the entity to time period to visit.
  • the embodiment of the present disclosure also proposes the concept of temporary access, that is, some resources may only be allowed to be accessed within a certain period of time, or some resources may only be accessed by certain entities within a certain period of time, so as to enhance the data of the resource security. This can be achieved by creating temporary access control policies for resources by public service entities.
  • the temporary access control policy can be similar to the existing resource access control policy, except that the specific content included is different due to the different access types.
  • the public service entity After creating, for example, a temporary access control policy of the second entity on the public service entity, the public service entity can make judgments about each access rule in the temporary access control policy.
  • creating a temporary access control policy for the first entity includes creating a temporary accessor identification and including therein an identification of the second entity, the temporary accessor identification indicating an entity that is permitted to temporarily access the first entity.
  • the temporary access party identifier in the created temporary access control policy for its resources may include the identifier of the application entity AE2, thereby allowing the application entity AE2 to temporarily access the resources of the application entity AE1.
  • creating a temporary access control policy for the second entity includes creating a temporary accessor identification and including therein an identification of the first entity, the temporary accessor identification indicating an entity that is permitted to temporarily access the second entity.
  • the temporary access party identifier in the created temporary access control policy for its resources may include the identifier of the application entity AE1, thereby allowing the application entity AE1 to temporarily access the resources of the application entity AE2.
  • both parties have the authority to temporarily access the resources of the other party, thereby realizing data sharing.
  • its access control policy may be updated for one of the first and second entities, and a temporary access policy may be created for the other of the first and second entities.
  • a temporary access policy may be created for the other of the first and second entities.
  • the temporary access party identifier in the temporary access control policy for its resources may include the identifier of the application entity AE1, thereby allowing the application entity AE1 to temporarily access the resources of the application entity AE2, and for the application entity AE1, for The preset identifier included in the resource access control policy of its resources can be updated to include the identifier of the application entity AE2 in addition to the identifier of the application entity AE1 itself, thereby allowing the application entity AE2 to fully access the resources of the application entity AE1.
  • the above-mentioned updating of the resource access control policy of the first entity or the second entity further includes: adding a data volume limit, indicating that the acquisition from the resources of the first entity or the resources of the second entity is allowed. or creating a resource access control policy (for temporary access) of the first entity or the second entity further comprising: creating a data volume limit indicating that the resources from the first entity or the resources of the second entity are allowed to The upper threshold of the amount of data obtained through temporary access.
  • the public service entity may perform statistics on the amount of data acquired by the first entity from the resources of the second entity (data acquired by having full access or temporary access). Obtain the statistical data volume, and compare it with the data volume limit (representing the data volume upper limit threshold) in the resource access control policy or the temporary access control policy of the second entity to determine whether the statistical data volume exceeds the data volume upper limit threshold, in the first After the amount of statistical data obtained by the entity from the resources of the second entity exceeds the upper limit threshold of the data amount, the access rule of limiting the amount of data is no longer satisfied. Therefore, the public service entity prohibits the first entity from continuing to obtain data from the resources of the second entity. Similarly, when the second entity shares data with the first entity, it can also obtain data from the resources of the first entity, and also needs to satisfy the access rule of the data volume limitation in the resource access control policy of the first entity.
  • the unit of data volume can be KB, MB, TB.
  • creating a temporary access control policy for the first entity or the second entity further includes creating a temporary access time limit indicating the time during which temporary access to the resources of the first entity or the second entity is permitted.
  • the resource can be temporarily accessed after a certain time point, or it can be set that the resource can be temporarily accessed within a certain period of time.
  • step S230 a data acquisition response is sent to the first entity, wherein the data acquisition response includes the target data.
  • the first entity and the second entity have been able to access each other, so the public service entity can return to the first entity the required target stored under the second entity data.
  • the first entity may adaptively adjust its own data based on the acquired target data. And, based on the data acquisition response, the first entity can determine that it has access to the resource of the second entity. After that, if the first entity again wants to acquire the relevant data stored at the same resource of the second entity on the public service entity, it can send a data acquisition request to the public service entity, and the data acquisition request can no longer include the sharing operation Indication information, but only needs to include the identifier of the same resource of the second entity (that is, the identifier of the target resource), so at the public service entity, since the resource access control policy of the second entity has been set, and the data acquisition request received at this time
  • the shared operation indication information is no longer included, so the public service entity will judge whether the first entity satisfies the current resource access control policy of the second entity based on the set resource access control policy (for example, the time when the first entity initiates the data acquisition request Whether the temporary access is allowed in the resource temporary access control policy of the second entity is
  • the general service entity may also send a notification to the second entity to inform the second entity that the data of the resources of the first entity can also be obtained.
  • the data types under the resource may be the same or different.
  • a data sharing rule can be added to the access control policy or a created temporary access control policy, wherein the data sharing rule defines the upper threshold of the data volume of the same type of data obtained by both parties from the other party. It needs to be equal, that is, at most the same amount of data of this type can be obtained from the other party. It should be noted that “equal” here can be understood in a relative sense, that is, a certain error range is allowed.
  • the method 200 may further include step S210', namely determining whether the data type of the resource of the first entity is the same as the data type of the resource of the second entity.
  • the determination process may be performed in Step S220 is before setting the respective resource access control policies of the first entity and the second entity.
  • the determination result of whether the data types are the same can also be used to set these resource access control policies.
  • a data sharing rule can be added to the access control policy or a data sharing rule can be added to the created temporary access control policy to limit the data of the same type of data obtained by both parties from the other party.
  • the volume upper thresholds must be equal.
  • a data sharing rule can be added to the resource access control policy to limit the converted upper limit thresholds of the different types of data obtained by both parties from the other party to be equal, and add data volume conversion Rules for scaling the amount of data obtained from the resource.
  • the converted data volume obtained by each can be compared with the upper limit threshold of the data volume, so that after the conversion obtained by the first entity or the second entity from the resources of the other party, After the data volume exceeds the upper limit threshold of the data volume, the first entity or the second entity is prohibited from continuing to acquire data from the other party's resources. In this way, even if the data types are different, the data volume upper thresholds are still the same to facilitate resource management.
  • each data under each resource has a content value attribute
  • the value of the content value attribute is positively correlated with the usefulness of each data under the resource
  • the data volume conversion rule includes: making the data of the data obtained from the resource. The amount of data is multiplied by the value of the content value attribute of the data to obtain the converted data amount.
  • the resources corresponding to the application may include temperature data and location data, and the content value of temperature data may be 1, while the content value of location data may be 2, because for bicycles, location data is important to It may be more useful for bike-sharing companies, such as location data to know which road segments have more users, so that they can put more bikes on these road segments, or for other companies that want to share data with them (with bike-sharing services). and business recommendation service), obtaining location data is more conducive to the business recommendation of the enterprise.
  • the content value corresponding to the data obtained by application A from the resources of application B is 1, while the content value corresponding to the data obtained by application B from the resources of application A is 1. If it is 2, it is assumed that both parties have obtained 2M of data, but in fact, it can be considered that the amount of converted data obtained by application A is 2M, and the amount of converted data obtained by application B is 4M. When the upper limit is 4M, App B will be prohibited from obtaining data from App A's resources, while App A can continue to obtain data from App B's resources.
  • FIGS. 3A-3B show the resource structure on the public service entity after the original resource access control policy is updated or the temporary access control policy is created.
  • the public service entity CSE is provided with the resources of the first entity (taking the resource as the application entity as an example, denoted as AE1) and the resources of the second entity (AE2), and the resources of the first entity (AE1) Sub-resources are set under the sub-resources, wherein the sub-resources include the resource access control policy of the first entity and a container.
  • the container can encapsulate and store application data from applications.
  • the resource of the first entity (AE1) is also provided with the associated device attribute of the device associated with the application entity, for example, the identifier of the device A associated with the application A, so as to link the application A and the device A, for example, in the device
  • the data value at the specific sub-resource storing the temperature data under the resource corresponding to the device A under the public service entity (device AE3 in FIG. 3A ) will change, and due to the public service entity
  • the service entity knows that the device A is associated with the application A, so the application A can also obtain the updated data of the device A from the public service entity.
  • the resources of the second entity (AE2) may have a similar structure to the resources of the first entity (AE1), or may set sub-resources at a lower level or add other resources at the same level according to their own conditions.
  • the first entity's resource access control policy is updated to include the identity of the second entity in addition to the identity of the original first entity in the preset identity of the access requester
  • the resource access control policy of the second entity is updated to include the identity of the second entity in the preset identity of the access requester except
  • the identifier of the first entity is also included.
  • the access control policy may further include data volume restrictions and data sharing rules.
  • the access control policy may also include other possible access rules, for example, data volume conversion rules (considering different data types of resources, etc.), Access restrictions (existing access rules), etc.
  • Fig. 3B is similar to Fig. 3A except that Fig. 3B shows the resource access control policy of the first entity (AE1) and the resource temporary access control policy of the second entity (AE2).
  • the temporary access control policy of the first entity may include: access requester restriction (the accessor who is allowed to temporarily access the first entity is identified as the identifier of the second entity (AE2)); access time restriction (allows access to the first entity) The time for temporary access to the first entity is the time period from 8:00 to 18:00 every day); data volume restrictions (the maximum amount of data that is allowed to be obtained from the first entity through temporary access is 10M); data volume conversion rules; and data sharing rules.
  • access requester restriction the accessor who is allowed to temporarily access the first entity is identified as the identifier of the second entity (AE2)
  • access time restriction (allows access to the first entity)
  • the time for temporary access to the first entity is the time period from 8:00 to 18:00 every day
  • data volume restrictions the maximum amount of data that is allowed to be obtained from the first entity through temporary access is 10M
  • data volume conversion rules data volume conversion rules
  • data sharing rules data sharing rules.
  • FIG. 4 shows a schematic flowchart of data sharing between the first entity and the second entity according to an embodiment of the present disclosure.
  • the first application entity (AE1) and the second application entity (AE2) register with the public service entity (CSE) respectively, so that the CSE can create resources for AE1 and AE2, for example, represented as ⁇ CSE/AE1> and ⁇ CSE, respectively /AE2>, the resource may include multiple sub-resources and may store various types of data of AE1 and AE2, such as respective application data and data uploaded by associated devices.
  • CSE creates the above resources, it returns registration responses to AE1 and AE2 respectively.
  • the AE1 sends a data acquisition request (for the first time) to the CSE, where the data acquisition request includes the identifier of the resource of the application entity (AE2) storing the target data and the sharing operation indication information.
  • the sharing operation indication information may include: the identifier of the resource of AE1; or, the identifier of the sharing operation; or, the identifier of the sharing operation and the identifier of the resource of AE1.
  • the data acquisition request may not include the sharing operation indication information, and the CSE receives the data acquisition request. After that, it is determined that AE1 satisfies the previous resource access control policy that is still valid in AE2, and the target data is directly returned to AE1.
  • this pre-operation for AE1 and CSE is optional.
  • the CSE determines (implicitly or explicitly indicated) that AE1 wishes to share data with AE2 (ie, access AE2's resources on the CSE, and can be accessed by AE2's own resources).
  • the CSE determines that the AE1 does not conform to the resource access control policy of AE2 (for example, by judging whether the identifier of AE1 (the identifier of AE1 can be determined according to the identifier of the resource of AE1) includes whether In the preset identification of the access requester that is allowed to access AE2, and if there is no previous sharing process, in the current resource access control policy, AE1 cannot directly issue an access request for the resources of AE2, the judgment result is No), so
  • the CSE sets the resource access control policies of AE1 and AE2 at the CSE, so that the two can mutually access each other's resources, and can optionally return a data acquisition failure
  • the CSE needs to reset the resource access control policy; or, in the case that the shared operation indication information includes at least the shared operation identifier, the CSE sets the resource access control policies of AE1 and AE2 at the CSE based on the shared operation identifier, which may be unnecessary. It is judged whether AE1 satisfies the resource access control policy of AE2, so that the two can mutually access each other's resources. In this case, optionally, the CSE may determine whether AE1 and AE2 that initiate the data acquisition request are trusted parties before setting the respective resource access control policies of AE1 and AE2, thereby improving security.
  • the access policy of which security level (for example, full access, temporary access) is set may also be determined according to the trust level of AE1 and AE2.
  • CSE can also determine whether the data types of the resources of AE1 and AE2 are the same, and if they are not, it should also determine and create or update the data volume conversion in the resource access control policy rule.
  • the CSE may acquire target data under the resources of AE2 registered with it and return a data acquisition response to AE1, the data acquisition response including the target data.
  • the AE1 can adaptively adjust its own data based on the acquired target data.
  • the CSE can also send a notification request to AE2 to notify AE2 that it can access the resources of AE1 for data sharing with AE1.
  • the notification request may include the resource access control policy of AE1.
  • AE2 may return a notification response to the CSE.
  • AE1 can determine that it has access to AE2's resources. After that, if AE1 wants to obtain the relevant data stored in the resources of AE2 on the CSE again, it can send a data acquisition request to the CSE.
  • the data acquisition request can no longer include the sharing operation indication information, but only needs to include the The identifier of the resource (that is, the identifier of the target resource), so at the CSE, since the resource access control policy of AE2 has been set, and the data acquisition request received at this time no longer includes the sharing operation indication information, the CSE will be based on the set resource.
  • Access control policy to determine whether AE1 satisfies the resource access control policy of AE2 (for example, whether the time when AE1 initiates a data acquisition request is within the time period that allows temporary access in the temporary access control policy of AE2 resources), and after judging that it is satisfied, send the AE1 returns a data acquisition response.
  • Figure 5 shows more details of the method 200 in the case where different entities are registered with different communication service entities.
  • the first entity is associated with the first public service entity (eg, registered with the first public service entity where the first public service entity creates resources and the original resource access control policy for the first entity)
  • the second entity is associated with the second public service entity (eg, registered with the second public service entity where the second public service entity creates resources and the original resource access control policy for the second entity)
  • the first public service entity The service entity and the second public service entity register with each other, so that the first public service entity and the second public service entity can mutually acquire each other's data and forward messages.
  • Step S210 may specifically include the following sub-steps.
  • sub-step S2101 a data acquisition request is received by the first public service entity from the first entity.
  • step S2102 if the first public service entity determines that the second entity is not associated with it but is associated with the second public service entity based on the identifier of the resource of the second entity included in the data acquisition request, the data The acquisition request is forwarded to the second public service entity.
  • the first public service entity Since the first entity and the second entity are registered with the first public service entity and the second public service entity respectively, the first public service entity does not have any resources created for the second entity, so the first entity and the second entity cannot be coordinated Data sharing between entities, and since the first public service entity and the second public service entity are registered with each other, the first public service entity knows that the second entity is registered with the second public service entity, so that the data can be The acquisition request is forwarded to the second public service entity. In addition, if the first public service entity determines that the second entity is not registered with the first public service entity and not registered with the second public service entity, an acquisition failure response is directly returned to the first entity.
  • step S220 may include the following sub-steps.
  • step S2201 a resource access control policy of the second entity is set by the second public service entity based on the data acquisition request, so that the first entity can access the resources of the second entity.
  • setting the resource access control policy of the second entity may include updating the resource access control policy or creating a new temporary resource access control policy.
  • the specific update and creation methods are the same as those described in detail above, and thus will not be repeated here.
  • step S2202 the second public service entity returns a data acquisition response to the first public service entity, where the data acquisition response includes target data.
  • the target data is stored under the resources of the second entity at the second public service entity, and the second public service entity retrieves the target data stored there, but cannot directly communicate with the first entity, so the target data is included in the The data acquisition response is returned to the first public service entity to which the data acquisition request is forwarded.
  • step S2203 the resource access control policy of the first entity is set by the first public service entity, so that the second entity can access the resources of the first entity.
  • the first public service entity may understand that the above-mentioned data acquisition response received from the second public service entity is that the second public service entity has allowed the first entity to access the requested resources of the second entity, based on this understanding of the first public service entity
  • the service entity may set the resource access control policy of the first entity so that the second entity can also access the resource of the first entity indicated by the identifier of the resource of the first entity included in the previous data acquisition request.
  • step S230 the first public service entity returns a data acquisition response to the first entity.
  • the first public service entity finally returns the requested target data to the first entity, so that the first entity can adapt its own data according to the target data.
  • FIG. 6 shows a schematic flowchart of data sharing between the first entity and the second entity registered to different public service platforms according to an embodiment of the present disclosure.
  • the first application entity (AE1) and the second application entity (AE2) register with the first public service entity (CSE1) and the second public service entity (CSE2), respectively, so that CSE1 and CSE2 can create AE1 and AE2 respectively
  • Resources for example represented as ⁇ CSE1/AE1> and ⁇ CSE2/AE2> respectively, may include multiple sub-resources and may store various types of data of AE1 and AE2, such as respective application data and data uploaded by associated devices.
  • CSE1 and CSE2 create the above resources, respectively, return registration responses to AE1 and AE2.
  • AE1 sends a data acquisition request (for the first time) to CSE1, where the data acquisition request includes the identifier of the resource of the application entity (AE2) storing the target data and the sharing operation indication information.
  • the sharing operation indication information may include: the identifier of the resource of AE1; or, the identifier of the sharing operation; or, the identifier of the sharing operation and the identifier of the resource of AE1.
  • CSE1 determines (implicitly or explicitly indicated) that AE1 wishes to share data with AE2 (ie, access the resources of AE2 on the CSE, and can be accessed by AE2 to its own resources), and determines that AE2 is not registered to CSE1 but is registered to CSE2, so CSE1 forwards the data fetch request to CSE2.
  • the data acquisition request may not include the sharing operation indication information, and CSE2 receives it.
  • CSE2 receives it.
  • the data acquisition request forwarded by CS1 it is determined that AE1 satisfies the previous resource access control policy that is still valid in AE2, and the target data is directly returned to AE1 via CSE1.
  • this pre-operation of AE1 and CSE1-CSE2 is optional.
  • CSE2 After CSE2 receives the data acquisition request (including the sharing operation indication information), in the case that the sharing operation indication information is the identifier of the resource of AE1, CSE2 judges that AE1 does not conform to the resource access control policy of AE2, so CSE2 sets AE2 at CSE2 The resource access control policy of AE2, so that AE1 can access the resources of AE2; or, in the case where the shared operation indication information includes at least the shared operation identifier, CSE2 sets the resource access control policy of AE2 at CSE2 based on the shared operation identifier, without the need for Determine whether AE1 satisfies the resource access control policy of AE2.
  • CSE2 needs to determine whether AE1 that initiates the data acquisition request is a trusted party before setting the resource access control policy of AE2, so as to improve security.
  • the access policy of which security level (for example, full access, temporary access) is set for the AE1 may also be determined according to the trust level of the AE1.
  • CSE2 can acquire target data under the resources of AE2 registered with it and return a data acquisition response to CSE1.
  • CSE1 can determine that CSE2 has allowed AE1 to access the requested resources of AE2, so CSE1 also sets the resource access control policy of AE1 (the specific setting process is the same as the previous one), so that AE2 can also access The resources of AE1 on CSE1 to realize data sharing.
  • CSE1 may also issue a notification request to CSE2 to notify AE2 via CSE2 that AE1's resources may be accessed for data sharing with AE1.
  • the notification request may include the resource access control policy of AE1.
  • AE2 After successfully receiving the notification request, AE2 can return a notification response to CSE2, which is then forwarded back to CSE1 by CSE2.
  • CSE1 After CSE1 receives the data acquisition response from CSE2, similarly, it can also first determine whether AE2 satisfies the current resource access control policy of AE1, and when it is determined that it is satisfied, directly returns data to AE1, and via The CSE sends a notification to the AE2 that the resources of the AE1 can be accessed, and does not carry out the subsequent process, and only continues to set the resource access control policy of the AE1 at the CSE1 when it is judged that it is not satisfied.
  • CSE1 returns a data acquisition response to AE1, the data acquisition response including the target data.
  • the AE1 can adaptively adjust its own data based on the acquired target data.
  • AE1 can determine that it has access to the resources of AE2 that were previously requested. After that, if AE1 wants to acquire the relevant data stored at the resource of AE2 on CSE2 again, it can send a data acquisition request to CSE1 and forward it to CSE2 via CSE1.
  • the data acquisition request can no longer include sharing Operation instruction information, but only needs to include the identifier of the resource of AE2 (that is, the identifier of the target resource), so at CSE2, since the resource access control policy of AE2 has been set, and the data acquisition request received at this time no longer includes the sharing operation instruction Therefore, CSE2 will judge whether AE1 satisfies AE2's resource access control policy based on the set resource access control policy (for example, whether the time when AE1 initiates the data acquisition request is within the time period that allows temporary access in AE2's resource temporary access control policy within), and after judging that it is satisfied, returns a data acquisition response to AE1 via CSE1.
  • FIG. 7 shows a structural block diagram of a data sharing apparatus 700 according to an embodiment of the present disclosure.
  • the data sharing apparatus 700 includes a receiving module 701 , a setting module 702 and a sending module 703 .
  • the receiving module 701 is configured to receive a data acquisition request from the first entity, wherein the data acquisition request includes an identifier of the resource of the second entity storing the target data, and sharing operation indication information.
  • the setting module 702 is configured to set the respective resource access control policies of the first entity and the second entity based on the data acquisition request, so that the first entity and the second entity can access each other's resources to Enable data sharing.
  • the sending module 703 is configured to send a data acquisition response to the first entity, wherein the data acquisition response includes the target data.
  • the data sharing apparatus 700 may further include a determination module 704, configured to determine whether the data type of the resource of the first entity is the same as the data type of the resource of the second entity, and send the determination result to the setting module. , so that the setting module sets the respective resource access control policies of the first entity and the second entity according to the determination result.
  • a determination module 704 configured to determine whether the data type of the resource of the first entity is the same as the data type of the resource of the second entity, and send the determination result to the setting module. , so that the setting module sets the respective resource access control policies of the first entity and the second entity according to the determination result.
  • the data sharing apparatus may further include more or less modules, which is not limited in the present disclosure.
  • a data sharing system includes: a first entity and a second entity; a public service entity; and a first device and a second device, wherein the first entity and the second entity and the first device and the second device are all registered with the public service entity , and the first entity and the second entity are associated with the first device and the second device.
  • the data sharing system may be a data sharing system for manufacturing.
  • FIG. 8 shows a schematic diagram of a data sharing system 800 according to an embodiment of the present disclosure.
  • the data sharing system includes: a first manufacturing equipment (D1) and a second manufacturing equipment (D2); a first manufacturing application (MAE1) and a second manufacturing application (MAE2), wherein the first manufacturing application (MAE1) is associated with a first manufacturing facility (D1), a second manufacturing application (MAE2) is associated with the second manufacturing facility (D2); and an IoT platform (P).
  • D1 first manufacturing equipment
  • D2 second manufacturing equipment
  • MAE1 first manufacturing application
  • MAE2 second manufacturing application
  • P IoT platform
  • the Internet of Things platform is configured to: store the data uploaded by the first manufacturing device under the resource of the first manufacturing application, use the application data of the first manufacturing application as the product data of the first manufacturing application, and store the data of the second manufacturing application.
  • the data uploaded by the manufacturing equipment is stored under the resources of the second manufacturing application, and is used together with the application data of the second manufacturing application as the product data of the second manufacturing application; a data acquisition request is received from the first manufacturing application, and the data acquisition request includes storing the target product
  • the identifier of the resource of the second manufacturing application of the data and the product data sharing operation instruction information; the respective resource access control policies of the first manufacturing application and the second manufacturing application are set based on the data acquisition request, so that the first manufacturing application and the second manufacturing application
  • the resources of the counterparty can be accessed to acquire the product data of the counterparty; and a data acquisition response is sent to the first manufacturing application, and the data acquisition response includes the data of the target resource.
  • the first manufacturing application (MAE1) may send the above data acquisition request to the IoT platform (P).
  • the first manufacturing application (MAE1) determines that the product data of the second manufacturing application (MAE2) cannot be acquired by other means. For example, if the first manufacturing application and the second manufacturing application have previously shared data, and the corresponding resource access control policy is still valid, the sharing operation indication information may not be included in the data acquisition request. On the contrary, if data sharing has not been performed, Or if the previous resource access control policy is invalid, you need to include the change sharing operation instruction information.
  • the first manufacturing application may adjust the product data of the first manufacturing application according to the product data of the first manufacturing application and the target product data obtained from the resources of the second manufacturing application such that the first manufacturing application
  • the product data is compatible with the product data of the second manufacturing application.
  • a manufacturer application for making wallpaper performs style matching based on product data obtained from a manufacturer application that makes sofas.
  • a server is also provided.
  • FIG. 9 shows a server 900 according to an embodiment of the present disclosure.
  • Server 900 may include processor 901 and memory 902 .
  • the processor 901 and the memory 902 may be connected by a bus 903 .
  • the processor 901 can perform various actions and processes according to programs stored in the memory 902 .
  • the processor can be caused to execute each step of the data sharing method according to the embodiment of the present disclosure.
  • the processor 901 may be an integrated circuit chip, which has signal processing capability.
  • the aforementioned processors may be general purpose processors, digital signal processors (DSPs), application specific integrated circuits (ASICs), off-the-shelf programmable gate arrays (FPGAs) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.
  • the general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc., and may be of an X99 architecture or an ARM architecture.
  • Memory 902 may be volatile memory or nonvolatile memory, or may include both volatile and nonvolatile memory.
  • the nonvolatile memory may be read only memory (ROM), programmable read only memory (PROM), erasable programmable read only memory (EPROM), electrically erasable programmable read only memory (EEPROM), or flash memory.
  • Volatile memory may be random access memory (RAM), which acts as an external cache.
  • RAM Random Access Memory
  • SRAM static random access memory
  • DRAM dynamic random access memory
  • SDRAM synchronous dynamic random access memory
  • DDR SDRAM double data rate synchronous dynamic random access memory
  • ESDRAM Enhanced Synchronous Dynamic Random Access Memory
  • SLDRAM Synchronous Linked Dynamic Random Access Memory
  • DR RAM Direct Memory Bus Random Access Memory
  • a computer storage medium on which a computer program is stored, and when executed by a processor, the computer program is used to implement the data sharing method according to the embodiment of the present disclosure.
  • aspects of this application may be illustrated and described in terms of several patentable classes or situations, including any new and useful process, machine, product, or combination of matter, or any combination thereof New and useful improvements. Accordingly, various aspects of the present application may be performed entirely by hardware, entirely by software (including firmware, resident software, microcode, etc.), or by a combination of hardware and software.
  • the above hardware or software may be referred to as a "data block”, “module”, “engine”, “unit”, “component” or “system”.
  • aspects of the present application may be embodied as a computer product comprising computer readable program code on one or more computer readable media.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Medical Informatics (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
  • Storage Device Security (AREA)

Abstract

本公开提供了一种数据共享方法、装置、系统、服务器和计算存储介质。数据共享方法包括：从第一实体接收数据获取请求，其中所述数据获取请求包括存储目标数据的第二实体的资源的标识、以及共享操作指示信息；以及基于所述数据获取请求设置所述第一实体和所述第二实体各自的资源访问控制策略，以使得所述第一实体和所述第二实体能够访问对方的资源以实现数据共享；以及向第一实体发送数据获取响应，其中所述数据获取响应中包括所述目标数据。

Description

数据共享方法、装置、系统、服务器和计算机存储介质
相关申请的交叉引用
本申请要求于2021年01月22日提交的中国专利申请第202110088792.2号的优先权。该中国专利申请的全文通过引用的方式结合于此以作为本申请的一部分。
技术领域
本公开涉及数据处理领域，更具体地，涉及一种数据共享方法、装置、系统、服务器和计算机存储介质。
背景技术
随着物联网、数字孪生技术的发展，大量的厂商提供“设备+服务”的商业模式，即，设备A产生大量的数据发送到平台A供应用A使用，设备B产生大量的数据发送到平台B供应用B使用，并且设备C产生大量的数据发送到平台C供应用B使用。该模式适用于具有自建平台能力的企业。这种场景如图1A所示。
对于缺乏自建能力的企业，通常将设备接入第三方的通用服务平台，各个应用通过访问通用服务平台为用户提供服务。各个企业的设备产生的数据发送到通用服务平台，各个企业的应用通过通用服务平台访问对应的设备的数据。这种场景如图1B所示。
但是，存在一个应用(应用A)想访问另一个应用(应用B)的数据的情况，或者一个应用(应用A)想访问另一个应用(应用B)相关联的设备(设备B)上传到平台的设备数据的情况。以智能制造中的C2M(Custom to Manufacture)为例，用户的需求可以经由应用然后通过通用服务平台发送给各个制造商以进行生产，例如用户的某一个产品想法A可以经由应用A通过通用服务平台发送给制造商A，另外一个产品想法B可能发送给制造商B。随着C2M的发展，越来越多的普通用户将会成为订单的发起者，由于普通用户设计知识有限，极有可能造成不同产品的风格不统一，例如将桌椅的想法经由应用A通过通用服务平台通知制造商A，并将家具的想法经由应用B通过通用服务平台通知制造商B，如果风格不统一，制造商A和制造商B制造 出的产品将会造成家庭环境不协调。
发明内容
为了解决上述问题，本公开的实施例提供了一种数据共享方法、装置、系统、服务器和计算机存储介质。该数据共享可以是应用实体之间的数据共享，也可以是其他实体(例如公共服务实体)之间的数据共享，或者应用实体与其他实体之间的数据共享。
根据本公开的一方面，提供了一种数据共享方法，包括：从第一实体接收数据获取请求，其中所述数据获取请求包括存储目标数据的第二实体的资源的标识、以及共享操作指示信息；以及基于所述数据获取请求设置所述第一实体和所述第二实体各自的资源访问控制策略，以使得所述第一实体和所述第二实体能够访问对方的资源以实现数据共享；以及向第一实体发送数据获取响应，其中所述数据获取响应中包括所述目标数据。
根据本公开的实施例，其中，共享操作指示信息包括：所述第一实体的资源的标识；或者，共享操作的标识；或者，共享操作的标识和所述第一实体的资源的标识；其中，基于所述数据获取请求设置所述第一实体和所述第二实体各自的资源访问控制策略，包括:基于所述第一实体的资源的标识和/或共享操作的标识以及所述第二实体的资源的标识确定所述第一实体期望与所述第二实体进行数据共享；以及确定所述第一实体是否满足所述第二实体的资源访问控制策略，并且基于所述确定设置所述第一实体和所述第二实体各自的资源访问控制策略。
根据本公开的实施例，其中，共享操作指示信息仅包括：共享操作的标识；或者，共享操作的标识和所述第一实体的资源的标识，其中，基于所述数据获取请求设置所述第一实体和所述第二实体各自的资源访问控制策略，包括:基于至少所述共享操作的标识确定所述第一实体期望与所述第二实体进行数据共享，并设置所述第一实体和所述第二实体各自的资源访问控制策略。
根据本公开的实施例，其中，设置所述第一实体和所述第二实体各自的资源访问控制策略包括：更新所述第一实体的资源访问控制策略，更新所述第二实体的资源访问控制策略；或者创建所述第一实体的临时访问控制策略，创建第二实体的临时访问控制策略；或者更新第一实体的资源访问控制策略， 创建第二实体的资源临时访问控制策略；或者更新第二实体的资源访问控制策略，创建第一实体的临时访问控制策略。
根据本公开的实施例，更新第一实体的资源访问控制策略包括：使资源访问控制策略中的访问方标识包括所述第一实体和所述第二实体的标识，所述访问方标识指示允许访问第一实体的资源的实体的标识；以及更新第二实体的资源访问控制策略包括：使资源访问控制策略中的访问方标识包括所述第一实体和所述第二实体的标识，所述访问方标识指示允许访问第二实体的资源的实体的标识。
根据本公开的实施例，其中，所述创建第一实体的临时访问控制策略包括：创建临时访问方标识，并在其中包括所述第二实体的标识，所述临时访问方标识指示允许临时访问第一实体的资源的实体的标识；以及所述创建第二实体的临时访问控制策略包括：创建临时访问方标识，并在其中包括所述第一实体的标识，所述临时访问方标识指示允许临时访问第二实体的资源的实体的标识。
根据本公开的实施例，其中，更新第一实体或第二实体的资源访问控制策略还包括：添加数据量限制，指示允许从所述第一实体的资源或所述第二实体的资源获取的数据量上限阈值；或者其中，创建第一实体或第二实体的资源访问控制策略还包括：创建数据量限制，指示允许从所述第一实体的资源或第二实体的资源通过临时访问获取的数据量上限阈值；其中，在从所述第一实体的资源或第二实体的资源通过临时访问获取的数据量达到数据量上限阈值时，禁止继续从所述第一实体的资源或第二实体的资源获取数据。
根据本公开的实施例，其中，创建所述第一实体或所述第二实体的临时访问控制策略还包括：创建临时访问时间限制，指示允许临时访问所述第一实体的资源或所述第二实体的资源的时间。
根据本公开的实施例，该方法还包括：确定所述第一实体的资源的数据类型与所述第二实体的资源的数据类型是否相同，其中，在确定两者的类型相同的情况下，更新资源访问控制策略或者创建临时访问控制策略还包括：添加数据共享规则，以限定双方各自从对方获取的该相同类型数据的数据量上限阈值需相等；其中，在确定两者的类型不同的情况下，更新资源访问控制策略或者创建临时访问控制策略还包括：添加数据共享规则，以限定双方各自从对方获取的不同类型数据的数据量上限阈值需相等；以及添加数据量 换算规则，用于对从资源获取的数据量进行换算。
根据本公开的实施例，其中，每个实体的资源下的数据具有内容价值属性，内容价值属性的值与该实体的资源下的数据的有用性正相关且预先定义，其中，所述数据量换算规则包括：使从资源获取的数据的数据量分别与该数据的内容价值属性的值相乘得到换算后的数据量，并且其中，在换算后的数据量超过数据量上限阈值的情况下，禁止继续从资源获取数据。
根据本公开的实施例，其中，所述第一实体与第一公共服务实体相关联，所述第二实体与第二公共服务实体相关联，并且所述第一公共服务实体与所述第二公共服务实体相互注册，其中，从第一实体接收数据获取请求，包括：由所述第一公共服务实体从第一实体接收所述数据获取请求；以及在所述第一公共服务实体基于所述数据获取请求中包括的第二实体的资源的标识确定所述第二实体未与其相关联但与所述第二公共服务实体相关联的情况下，将所述数据获取请求转发到所述第二公共服务实体。
根据本公开的实施例，，其中，基于所述数据获取请求设置所述第一实体和所述第二实体各自的资源访问控制策略，包括：由所述第二公共服务实体基于所述数据获取请求设置所述第二实体的资源访问控制策略，使得第一实体能够访问其资源；由所述第二公共服务实体向所述第一公共服务实体返回数据获取响应，所述数据获取响应包括所述目标资源的数据；由所述第一公共服务实体基于所述数据获取响应设置所述第一实体的资源访问控制策略，使得第二实体能够访问其资源；以及由所述第一公共服务实体向第一实体返回所述数据获取响应。
根据本公开的另一方面，还公开了一种数据共享装置，包括：接收模块，被配置为从第一实体接收数据获取请求，其中所述数据获取请求包括存储目标数据的第二实体的资源的标识、以及共享操作指示信息；设置模块，被配置为基于所述数据获取请求设置所述第一实体和所述第二实体各自的资源访问控制策略，以使得所述第一实体和所述第二实体能够访问对方的资源以实现数据共享；以及发送模块，被配置为向第一实体发送数据获取响应，其中所述数据获取响应中包括所述目标数据。
根据本公开的实施例，该装置还包括：确定模块，被配置为确定所述第一实体的资源的数据类型与所述第二实体的资源的数据类型是否相同，并且向设置模块发送确定结果，使得所述设置模块根据所述确定结果来设置所述 第一实体和所述第二实体各自的资源访问控制策略。
根据本公开的又一方面，还公开了一种数据共享系统，包括：第一制造设备和第二制造设备；第一制造应用和第二制造应用，其中，第一制造应用与第一制造设备相关联，第二制造应用与第二制造设备相关联；以及物联网平台，被配置为：将第一制造设备上传的数据存储在第一制造应用的资源下，和第一制造应用的应用数据共同作为第一制造应用的产品数据，并将第二制造设备上传的数据存储在第二制造应用的资源下，和第二制造应用的应用数据共同作为第二制造应用的产品数据；接收由所述第一制造应用发送的数据获取请求，所述数据获取请求包括存储目标产品数据的第二制造应用的资源的标识以及产品数据共享操作指示信息；基于所述数据获取请求设置所述第一制造应用和所述第二制造应用各自的资源访问控制策略，以使得所述第一制造应用和所述第二制造应用能够访问对方的资源从而获取对方的产品数据；以及向第一制造应用发送数据获取响应，所述数据获取响应中包括所述目标资源的数据。
根据本公开的实施例，其中，所述第一制造应用被配置为：根据所述第一制造应用的产品数据和从所述第二制造应用的资源获取的目标产品数据调整所述第一制造应用的产品数据，使得所述第一制造应用的产品数据和所述第二制造应用的产品数据兼容。
根据本公开的再一方面，还公开了一种服务器，包括：处理器；以及存储器，其上存储有程序，所述程序在被所述处理器执行时使得所述处理器如如上所述的数据共享方法的各步骤。
根据本公开的再一方面，还公开了一种计算机存储介质，包括计算机程序，所述计算机程序在被所述处理器执行时实现如上所述的数据共享方法。
附图说明
为了解释本公开的原理，将结合附图结合来描述本公开的实施例。应理解，图中所示的要素可能被实现为各种形式的硬件、软件或它们的组合。可选地，在一个或多个适当地编程的通用计算机设备上的硬件和软件的组合中实现这些要素。
图1A示出了一种不同的平台为不同的特定应用和设备服务的场景示意图；
图1B示出了通用服务平台为不同的应用和设备服务的场景示意图；
图2A-2B示出了根据本公开实施例的数据共享方法的流程示意图；
图3A-3B示出了根据本公开实施例的资源结构的示意图；
图4示出了根据本公开实施例的数据共享方法的交互流程示意图；
图5示出了根据本公开实施例的在不同的实体注册到不同的通信服务实体的情况下的图2A的方法的更多细节；
图6示出了根据本公开实施例的图5所示的数据共享方法的交互流程示意图；
图7示出了根据本公开实施例的数据共享装置的结构框图；
图8示出了根据本公开实施例的数据共享系统的示意图；以及
图9示出了根据本公开实施例的服务器的结构示意图。
具体实施方式
以下将参照附图更充分地描述本公开实施例，在附图中示出了本公开实施例。然而，可以用很多不同形式来实施本公开，并且本公开不应理解为受限于在此所阐述的实施例。在全文中，使用相似的标号表示相似的元件。
在此所使用的术语仅用于描述特定实施例的目的，而并非意欲限制本公开。如在此所使用的那样，单数形式的“一个”、“这个”意欲同样包括复数形式，除非上下文清楚地另有所指。还应当理解，当在此使用时，术语“包括”指定出现所声明的特征、整体、步骤、操作、元件和/或组件，但并不排除出现或添加一个或多个其它特征、整体、步骤、操作、元件、组件和/或其群组。
除非另外定义，否则在此所使用的术语(包括技术术语和科学术语)具有与本公开所属领域的普通技术人员所共同理解的相同意义。在此所使用的术语应解释为具有与其在该说明书的上下文以及有关领域中的意义一致的意义，而不能以理想化的或过于正式的意义来解释，除非在此特意如此定义。
当物联网实体(例如，物联网终端设备或者节点设备中的软件模块)将数据或信息传输到公共服务实体后，该数据或信息可以作为单独的资源进行存储。此外，物联网实体可以向公共服务实体发送请求，从而更新公共服务实体上存储的与该物联网实体对应的资源，以便反映该物联网实体所运行的设备的状态。这种更新可以是实时的或者是周期性的，抑或可以由某一条件进行触 发。应注意，这里所称的资源，包括各种实体(例如，可以体现为物联网设备中的软件模块，诸如AE、CSE等实体)的资源。实体可以表示一通信设备的软件模块，而公共服务实体可以表示服务平台的软件模块，而服务平台可以是本地的或者是远程的。
在物联网中，对于资源的访问控制通常使用基于属性的访问控制，通过设置资源访问控制策略(accessControlPolicy)中的各个属性来实现对应的资源的访问。例如，公共服务实体会为实体创建资源，并且针对该实体会创建该实体的资源访问控制策略。
资源访问控制策略中存储的是访问控制策略内容，即用于评价访问目标资源的请求可否被授权的评估依据内容(访问规则)。访问目标资源的请求要通过访问控制策略中对应的授权验证，才可完成请求授权操作。例如，目前的资源访问控制策略中可以包括访问次数限制(accessControlLimit)，用于限定该资源可以被访问的次数；访问请求方的位置区域或IP地址限制(accessControlLocationRegion或accessControlIPAddress)，分别用于限定允许发出访问请求的访问请求方必须在哪些区域内或者必须具有哪些IP地址(块)。此外，资源访问控制策略中可以包括允许对该资源发起访问请求的实体的预设标识，目前，仅支持实体访问与其相关联的资源(例如，应用A仅能访问通用服务平台中应用A的数据以及相关联的设备A的数据)，因此，针对该实体的资源的资源访问控制策略中的上述预设标识只包括该实体的标识，并且仅在发起访问请求的请求方的标识与该预设标识相同时，访问请求才被授权(允许访问)。
目前的物联网中的资源访问控制策略配置方案中，一个实体(如前面所述的应用实体)只能从公共服务实体获取到与其相关联的数据。例如，应用实体可以被理解为映射到公共服务实体，该公共服务实体为该应用实体创建资源，在该资源下存储了该应用实体的应用数据；此外，该应用实体相关联的终端(设备)也映射到该公共服务实体，该公共服务实体为该终端创建资源，在该资源下存储了该终端上传的数据；并且通过该公共服务实体的协调，该应用实体可以获取存储在公共服务实体下的自身的应用数据以及相关联的终端的数据。因此，在本公开中，为了便于理解，应用实体的资源下的数据可以被理解为应用实体本身的数据和相关联的设备(终端)上传的数据。
在本公开中，所描述的实体，例如应用实体AE，公共服务实体CSE，以 及数据等都可以通过资源进行表示。资源可以具有唯一的标识，其包括属性和子资源，其中属性用来存储资源相关的信息，子资源是资源的下一级资源，资源包括指向子资源的索引。
如前面所述，在制造场景中，应用B可能希望获取应用A的应用数据或者应用A对应的设备A上传的设备数据，以对自身的应用数据进行调整。例如，应用B在收到用户想法后，可能希望获取应用A的应用数据和/或对应的设备A上传的设备数据，从而应用B可以综合考虑自身的应用数据、应用A的应用数据和/或设备A上传的设备数据而对自身的应用数据进行调整，以兼容应用A的产品数据和/或设备A的设备数据，使得设备B生产的产品能够与设备A生产的产品风格统一。
因此，为了解决上述问题，本公开提出了一种数据共享方法、系统和计算机存储介质，以在不同的实体之间进行数据共享。该数据共享可以是应用实体之间的数据共享，也可以是其他实体(例如公共服务实体)之间的数据共享，或者应用实体与其他实体之间的数据共享。
应注意，在本公开的某些描述中，虽然以智能制造场景为例描述了数据共享方法的各方面，但是本领域技术人员应理解，该数据共享方法可以用于物联网的其他应用场景。例如，综合应用A(包括共享单车服务以及商业推荐服务等)与A类型单车经由服务平台相关联，即应用A可以使用A类型单车上传的数据(例如温度、速度、位置数据等)，应用B与B类型单车也经由同一服务平台相关联，即应用B可以使用B类型单车上传的数据。在用户使用应用B而骑行B类型单车时，B类型单车可以实时上传数据到服务平台以供B应用使用。同时，由于综合应用A可以进行商业推荐服务，但是由于没有使用其对应的A类型的单车，因此无法实时获取目前的骑行相关信息，因此综合应用A也希望获取B类型单车上传的数据来进行相关推荐服务，因此，这种情况下，应用A也可能希望与应用B进行数据共享。
下面参考图2A-9来描述根据本公开实施例的数据共享方法的各方面。
图2A-2B示出了根据本公开实施例的数据共享方法的流程示意图。该方法可以由公共服务实体(通用服务平台)来执行。
如图2A所示，在步骤S210中，从第一实体接收数据获取请求，其中所述数据获取请求包括存储目标数据的第二实体的资源的标识、以及共享操作指示信息。
在该实施例中，第一实体可以是第一应用实体，第二实体可以是第二应用实体。或者，第一实体可以是第一公共服务实体，第二实体可以是第二公共服务实体，在这种情况下，用于统筹和协调各个实体的公共服务实体可以被称为托管公共服务实体(Hosting CSE)。第一实体和第二实体均注册在公共服务实体上。
例如，第一实体可能期望获取第二实体的资源下的部分数据(目标数据)，因此将存储该目标数据的第二实体的资源的标识包括在数据获取请求中发送到公共服务实体。
可选地，在该步骤之前，第一实体可以先确定是否其满足第二实体的资源访问控制策略。例如，如果第一实体先前与第二实体共享过数据，且先前的第一实体和第二实体的资源访问控制策略仍然有效(例如，未从公共服务实体接收到失效通知)，则第一实体可以直接向公共服务实体发送数据获取请求且无需包括共享操作指示信息；反之，第一实体需要重新发送包括共享操作指示信息的数据获取请求。
此外，由于按照目前的资源访问控制策略，如果没有先前的数据共享操作，第一实体无法直接从第二实体的资源获取数据(第二实体的资源的数据仅能由其第二实体来发起访问请求并获取)，即，第一实体必然不满足第二实体的资源访问控制策略，因此必须触发第一实体和第二实体的数据共享操作，因此，数据获取请求中还可以包括共享操作指示信息用于触发数据共享操作，这样，第一实体可以获取第二实体的资源下的数据。
可选地，共享操作指示信息可以是隐式的或显式的。例如，共享操作指示信息可以包括所述第一实体的资源的标识，即数据获取请求里包括了第二实体的资源(目标资源)的标识以及第一实体的资源(源资源)的标识，以隐式地指示公共服务实体第一实体期望与第二实体进行数据共享。或者，共享操作指示信息可以包括：共享操作的标识；或者，共享操作的标识、所述第一实体的资源的标识。如果共享操作指示信息为共享操作的标识，则显式地指示公共服务实体发送包括该共享操作的标识的请求的第一实体期望与第二实体(数据获取请求中包括该第二实体的标识)进行数据共享。
此外，即使共享操作指示信息中未包括所述第一实体的资源的标识，即仅包括共享操作的标识，公共服务实体也能知道是谁向它发送了请求，因此也能知道第一实体向公共服务实体指示其资源下的数据可用于与第二实体共 享。
通过在数据获取请求包括共享操作指示信息，使得第一实体在不具有第二实体的资源的访问控制权限时接收到数据获取请求失败的响应，并且第一实体通过单独的数据获取请求就能最终获取第二实体的资源的访问控制权限(在后续步骤中通过公共服务实体来设置)，简化了第一实体的操作流程，降低了第一实体的工作负荷。
在步骤S220中，基于数据获取请求设置第一实体和第二实体各自的资源访问控制策略，以使得第一实体和第二实体能够访问对方的资源以实现数据共享。
可选地，对于共享操作指示信息仅包括第一实体的资源的标识的情况，步骤S220可以包括:基于所述第一实体的资源的标识和所述第二实体的资源的标识确定所述第一实体期望与所述第二实体进行数据共享，且所述第一实体不满足所述第二实体的资源访问控制策略；以及基于所述确定设置所述第一实体和所述第二实体各自的资源访问控制策略。
例如，如前面所描述的，如果先前未进行过数据共享，应用A(第一实体)的标识必然未被包括在允许访问应用B的资源的访问请求方的预设标识中，因此应用A不满足应用B的资源访问控制策略，其发出的数据获取请求(访问请求)按照目前的资源访问控制策略而无法被允许。因此，公共服务实体对应用A和应用B的资源访问控制策略进行设置(修改、更新、创建等)，使得应用A和应用B能够相互访问以实现数据共享。可选地，可以向第一实体先返回数据获取失败响应。
可选地，对于共享操作指示信息包括共享操作的标识或者包括共享操作的标识、所述第一实体的标识的情况，步骤S220可以包括：至少基于共享操作的标识确定第一实体期望与第二实体进行数据共享，并设置第一实体和第二实体各自的资源访问控制策略。
也就是说，只要接收到共享操作的标识，可以不用额外进行判断发出数据获取请求的资源(实体)是否符合目标资源的资源访问控制策略，直接设置第一实体和第二实体各自的资源访问控制策略即可。当然，也可以执行该判断步骤。
可选地，公共服务实体可以在设置第一实体和第二实体各自的资源访问控制策略之前确定发起数据获取请求的第一实体和作为目标的第二实体是否 是受信方，从而提高安全性，例如，可以通过第一实体和第二实体与公共服务实体的历史交互记录来确定第一实体和第二实体的受信级别，仅在受信级别满足预设级别时，才设置第一实体和第二实体各自的资源访问控制策略。可选地，还可以根据第一实体和第二实体的受信级别而确定设置哪种安全级别的访问策略(例如，完全访问、临时访问)。
更具体地，设置所述第一实体和所述第二实体各自的资源访问控制策略可以包括在第一实体和第二实体现有的资源访问控制策略上进行更新(修改)(对应于完全访问)，即第一实体和第二实体被给予对对方的资源的完全访问权限(例如，双方是完全信任的关系)，也可以包括额外地创建新的资源访问控制策略(对应于临时访问)，即，第一实体和第二实体中的至少一个可以仅被允许临时访问对方的资源。例如，应用A和应用B的受信级别均较高，因此可以应用A和应用B均可以随时访问对方的资源，或者应用A的受信级别较低，而应用B的受信级别较高，所以在应用A发出访问请求(数据获取请求)时，公共服务实体将对应用B的资源访问控制策略进行创建，以允许应用A临时访问应用B的资源，但是对应用A的资源访问控制策略进行更新，以允许应用B随时访问应用A的资源。
因此，设置所述第一实体和所述第二实体各自的资源访问控制策略可以包括以下几种情况：1.更新所述第一实体的资源访问控制策略，更新所述第二实体的资源访问控制策略；2.创建所述第一实体的临时访问控制策略，创建第二实体的临时访问控制策略；3.更新第一实体的资源访问控制策略，创建第二实体的资源临时访问控制策略；或者，4.更新第二实体的资源访问控制策略，创建第一实体的临时访问控制策略。
例如，更新第一实体的资源访问控制策略可以包括：使访问控制策略中的访问方标识包括所述第一实体和所述第二实体的标识，所述访问方标识指示允许访问第一实体的资源的实体。例如，对于应用实体AE1，针对其资源的资源访问控制策略中包括的预设标识可以从仅包括应用实体AE1的标识更新为包括应用实体AE1的标识和应用实体AE2的标识，从而可以允许应用实体AE1和应用实体AE2访问应用实体AE1的资源。
同样的，更新第二实体的资源访问控制策略可以包括：使访问控制策略中的访问方标识包括所述第一实体和所述第二实体的标识，所述访问方标识指示允许访问第二实体的实体。例如，同样的，对于应用实体AE2，针对其 资源的资源访问控制策略中包括的预设标识可以从仅包括应用实体AE2的标识更新为包括应用实体AE1的标识和应用实体AE2的标识，从而可以允许应用实体AE1和应用实体AE2访问应用实体AE2的资源。
因此，在对第一实体和所述第二实体各自的资源访问控制策略进行更新后，双方都具备访问对方资源的权限，从而可以实现数据共享。
另一方面，以下内容是对前文已经提及的临时访问进行进一步的描述。在有些时间段，例如第一实体可能并不希望或不能与其他任何资源进行数据共享，例如第一实体相关联的设备在这些时间段上传的数据是保密性较强的数据，而在其他时间段(保密性数据已被获取并不再存在该资源中)又可以允许其他资源访问以与其他资源进行数据共享。又或者，如前面所述，如果请求访问第一实体的资源的实体的受信级别不高，可以针对该实体对允许其访问第一实体的资源的时间段进行限制，如仅允许该实体在特定时间段进行访问。因此本公开的实施例还提出了临时访问的概念，即，有些资源可能仅允许在一部分时间段内被访问，或者有些资源仅允许某些实体在特定时间段内访问，以增强该资源的数据的安全性。这可以通过公共服务实体为资源创建临时访问控制策略来实现。
临时访问控制策略可以与现有的资源访问控制策略类似，只是针对的访问类型不同从而包括的具体内容会有所差异。在公共服务实体上创建了例如第二实体的临时访问控制策略之后，公共服务实体就可以进行关于该临时访问控制策略中的各个访问规则的判断。
例如，创建第一实体的临时访问控制策略包括：创建临时访问方标识，并在其中包括所述第二实体的标识，所述临时访问方标识指示允许临时访问第一实体的实体。例如，对于应用实体AE1，所创建的针对其资源的临时访问控制策略中的临时访问方标识可以包括应用实体AE2的标识，从而可以允许应用实体AE2临时访问应用实体AE1的资源。
同样地，创建第二实体的临时访问控制策略包括：创建临时访问方标识，并在其中包括所述第一实体的标识，所述临时访问方标识指示允许临时访问第二实体的实体。例如，对于应用实体AE2，所创建的针对其资源的临时访问控制策略中的临时访问方标识可以包括应用实体AE1的标识，从而可以允许应用实体AE1临时访问应用实体AE2的资源。
因此，通过针对第一实体和所述第二实体分别创建各自的临时访问控制 策略，双方都具备临时访问对方资源的权限，从而可以实现数据共享。
当然，如上面所述的，可以针对第一实体和第二实体中的一者而更新其访问控制策略，并针对第一实体和第二实体的另一者而创建临时访问策略。通过如此设置，针对第一实体和第二实体中的一者可以相互访问，只是其中一方仅有临时访问权限。例如，对于应用实体AE2，针对其资源的临时访问控制策略中的临时访问方标识可以包括应用实体AE1的标识，从而可以允许应用实体AE1临时访问应用实体AE2的资源，同时对于应用实体AE1，针对其资源的资源访问控制策略中包括的预设标识可以被更新为除了包括应用实体AE1本身的标识之外还包括应用实体AE2的标识，从而可以允许应用实体AE2完全访问应用实体AE1的资源。
可选地，为了提高安全性，有时候可能需要对外部资源访问时所获取的数据量进行限制，以防止恶意获取数据。因此在本公开的实施例中，还提出了可以在从资源获取的数据量方面进行进一步限定。
更具体地，上述更新第一实体或第二实体的资源访问控制策略(针对完全访问)还包括：添加数据量限制，指示允许从所述第一实体的资源或所述第二实体的资源获取的总数据量上限阈值；或者创建第一实体或第二实体的资源访问控制策略(针对临时访问)还包括：创建数据量限制，指示允许从所述第一实体的资源或第二实体的资源通过临时访问获取的数据量上限阈值。
可选地，当第一实体已经开始与第二实体共享数据之后，公共服务实体可以对第一实体从第二实体的资源获取的数据量(通过具有完全访问或临时访问获取的数据)进行统计得到统计数据量，以与第二实体的资源访问控制策略或者临时访问控制策略中的数据量限制(表示数据量上限阈值)进行比对以确定统计数据量是否超过数据量上限阈值，在第一实体从第二实体的资源获取的统计数据量超过该数据量上限阈值之后，即不再满足数据量限制这个访问规则，因此公共服务实体禁止第一实体再继续从第二实体的资源获取数据。同样的，第二实体在与第一实体共享数据时也可以从第一实体的资源获取数据，也需满足第一实体的资源访问控制策略中的数据量限制这个访问规则。
例如，数据量的单位可以是KB，MB,TB。
此外，对于临时访问这种情况，如前面所述，存在对允许临时访问的时 间段进行限制的需求，以提高资源下的数据的安全性。因此，创建第一实体或第二实体的临时访问控制策略还包括：创建临时访问时间限制，指示允许临时访问第一实体或第二实体的资源的时间。
可选地，可以设置在某个时间点之后可以对该资源进行临时访问，也可以设置在某个时间段内可以对该资源进行临时访问。
在步骤S230中，向第一实体发送数据获取响应，其中所述数据获取响应中包括所述目标数据。
例如，通过设置第一实体和第二实体的资源访问控制策略，第一实体和第二实体已经能够相互访问，因此公共服务实体可以向第一实体返回存储在第二实体下的所需要的目标数据。
例如，第一实体在接收到数据获取响应之后，可以基于该获取的目标数据而适应性地调整自身数据。并且，基于该数据获取响应，第一实体可以确定其能够访问第二实体的该资源。在此之后，如果第一实体再次想获取公共服务实体上的第二实体的相同资源处存储的相关数据，则可以向公共服务实体发送数据获取请求，该数据获取请求中可以不再包括共享操作指示信息，而仅需包括第二实体的相同资源的标识(即目标资源的标识)，因此在公共服务实体处由于第二实体的资源访问控制策略已经经过设置，并且此时接收的数据获取请求不再包括共享操作指示信息，因此公共服务实体将基于设置后的资源访问控制策略来判断第一实体是否满足第二实体的当前的资源访问控制策略(例如，第一实体发起数据获取请求的时间是否在第二实体的资源临时访问控制策略中允许临时访问的时间段内)，并在判断满足后，向第一实体返回数据获取响应。
可选地，通用服务实体在设置完第一和第二实体的资源访问控制策略之后，还可以向第二实体发送通知，以告知第二实体也可以获取第一实体的资源的数据。
此外，在一些实施例中，在两个实体可以相互访问资源并共享数据时，资源下的数据类型可能相同或不同。在共享数据时，双方从对方获取的数据的数据量上限阈值相等是所期望的，以便于资源管理以及实现对等原则。因此，类似地，可以在访问控制策略中添加数据共享规则或创建的临时访问控制策略中添加数据共享规则，其中，该数据共享规则限定双方各自从对方获取的该相同类型数据的数据量上限阈值需相等，即最多就能从对方获取到同 量的该类型数据。应注意，这里的“相等”可以被理解为是相对意义上的，即允许一定的误差范围。
然而，可能存在要进行数据共享的两个资源的资源类型(数据类型)不同的情况，在这种情况下，需要先进行数据量换算，并将上述数据共享规则应用于换算后的数据量。
因此，如图2B所示，方法200还可以包括步骤S210’，即确定所述第一实体的资源的数据类型与所述第二实体的资源的数据类型是否相同，例如，该确定过程可以在步骤S220的设置第一实体和第二实体各自的资源访问控制策略之前。并且，数据类型是否相同的确定结果也可以被用于设置这些资源访问控制策略。
例如，在确定两者的类型相同的情况下，可以在访问控制策略中添加数据共享规则或创建的临时访问控制策略中添加数据共享规则，以限定双方各自从对方获取的该相同类型数据的数据量上限阈值需相等。
在确定两者的类型不同的情况下，可以在资源访问控制策略中添加数据共享规则，以限定双方各自从对方获取的不同类型数据的换算后的数据量上限阈值需相等，并且添加数据量换算规则，用于对从资源获取的数据量进行换算。如此，可以在第一实体和第二实体进行共享操作时，将各自获取的换算后的数据量与数据量上限阈值进行比较，以在第一实体或第二实体从对方的资源获取的换算后的数据量超过该数据量上限阈值之后，而禁止第一实体或第二实体再继续从对方的资源获取数据。这样，即使数据类型不同，但是数据量上限阈值仍然是相等的，以便于资源管理。
可选地，每个资源下的各数据具有内容价值属性，内容价值属性的值与该资源下的各数据的有用性正相关，所述数据量换算规则包括：使从资源获取的数据的数据量与该数据的内容价值属性的值相乘得到换算后的数据量。
例如，内容价值属性的值越大，表示对应的数据的有用性更高。例如，对于共享单车应用，该应用对应的资源下可以包括温度数据和位置数据，而温度数据的内容价值可能为1，而位置数据的内容价值可能为2，因为对于单车来说，位置数据对于共享单车企业来说可能更有用，例如通过位置数据可以知道在哪些路段是用户较多的路段，从而可以在这些路段投放更多的单车，或者对于希望与其共享数据的其他企业(具有共享单车服务和商业推荐服务)来说，获取位置数据更有利于该企业的商业推荐。例如，如果双方可以相互 访问对方的资源时，对于相同类型的应用，应用A从应用B的资源获取的数据对应的内容价值为1，而应用B从应用A的资源获取的数据对应的内容价值为2，假设双方都获取了2M的数据，但实际上可以认为应用A获取的换算数据量是2M，应用B获取的换算数据量是4M。当上限是4M时，应用B将被禁止从应用A的资源获取数据，而应用A可以继续从应用B的资源获取数据。
为了便于说明，图3A-3B示出了更新了原有的资源访问控制策略或创建了临时访问控制策略之后，在公共服务实体上的资源结构。
如图3A所示，公共服务实体CSE下设置有第一实体(以资源为应用实体为例，表示为AE1)的资源和第二实体(AE2)的资源，在第一实体(AE1)的资源下设置有子资源，其中子资源包括第一实体的资源访问控制策略以及容器(container)，容器作为资源分配和调度的基本单位，可以将来自应用的应用数据进行封装并存储。
第一实体(AE1)的资源下还设置有与应用实体相关联的设备的关联设备属性，例如，应用A相关联的设备A的标识，以将应用A和设备A联系起来，例如，在设备A上传到公共服务实体的温度更新时，公共服务实体下该设备A对应的资源(如图3A中的设备AE3)下存储该温度数据的具体子资源处的数据值会发生改变，并且由于公共服务实体已知设备A和应用A相关联，因此应用A也可以从公共服务实体获取该设备A更新后的数据。第二实体(AE2)的资源可以具有与第一实体(AE1)的资源相似的结构，或者也可以根据自身情况而设置更下一级的子资源或增加同级别的其他资源。
对于每个实体(AE1、AE2或AE3)的资源下的针对该资源的资源访问控制策略，在图3A中示出了能被其他资源完全访问的情况，例如，第一实体的资源访问控制策略被更新以在访问请求方的预设标识中除了原始的第一实体的标识外还包括第二实体的标识，第二实体的资源访问控制策略被更新以在访问请求方的预设标识中除了原始的第二实体的标识外还包括第一实体的标识。此外，在图3A中还示出了该访问控制策略中还可以包括数据量限制以及数据共享规则。但是本领域技术人员应理解，虽然未在图3A中示出，但是该访问控制策略还可能包括的其他可能的访问规则，例如，数据量换算规则(考虑到资源的数据类型不同等情况)、访问次数限制(现有的访问规则)等等。
并且，对于一个资源下的子资源，即使针对该资源已经创建了资源访问控制策略，还可以针对该子资源再设置一个子资源访问控制策略。
图3B与图3A类似，只是图3B示出了第一实体(AE1)的资源访问控制策略以及第二实体(AE2)的资源临时访问控制策略。
如图3B中示出的，该临时访问控制策略是新创建的，原始的资源访问控制策略仍然保持原样。在图3B中，第一实体(AE1)的临时访问控制策略可以包括：访问请求方限制(允许临时访问第一实体的访问方标识为第二实体(AE2)的标识)；访问时间限制(允许临时访问第一实体的时间为每天8:00-18:00时间段)；数据量限制(允许通过临时访问从第一实体获取的数据量的最大值为10M)；数据量换算规则；以及数据共享规则。但是本领域技术人员应理解，该临时访问控制策略还可能包括的其他可能的访问规则。
下面参考图4来进一步描述第一实体和第二实体进行数据共享的过程。图4示出了根据本公开实施例的第一实体和第二实体进行数据共享的流程示意图。
首先，第一应用实体(AE1)和第二应用实体(AE2)分别向公共服务实体(CSE)进行注册，从而CSE可以为AE1和AE2创造资源，例如分别表示为<CSE/AE1>和<CSE/AE2>，该资源可以包括多个子资源并且可以存储AE1和AE2的各类型数据，例如各自的应用数据以及相关联的设备上传的数据。CSE在创建好上述资源之后，分别向AE1和AE2返回注册响应。
接着AE1向CSE发送数据获取请求(首次)，该数据获取请求包括存储目标数据的应用实体(AE2)的资源的标识以及共享操作指示信息。共享操作指示信息可以包括：AE1的资源的标识；或者，共享操作的标识；或者，共享操作的标识和AE1的资源的标识。
如果AE1确定不是首次与AE2的资源进行数据共享，且AE2的资源访问控制策略仍有效(如前面所述)，则数据获取请求中可以不用包括共享操作指示信息，并且CSE在收到数据获取请求之后，确定AE1满足AE2目前仍有效的、先前的资源访问控制策略，则直接向AE1返回目标数据。当然，AE1和CSE的这个预先操作是可选的。
CSE基于该数据获取请求而确定(隐式或显示地被指示)AE1希望与AE2进行数据共享(即访问CSE上的AE2的资源，并可以被AE2访问自身的资源)。在共享操作指示信息为AE1的资源的标识的情况下，CSE判断该AE1 不符合AE2的资源访问控制策略(例如，通过判断AE1的标识(根据AE1的资源的标识可以确定AE1的标识)是否包括在允许访问AE2的访问请求方的预设标识中，并且如果没有先前的共享过程，在当前资源访问控制策略中，AE1无法直接发出针对AE2的资源的访问请求，该判断结果为否)，因此CSE在CSE处设置AE1和AE2的资源访问控制策略，从而使得两者可以相互访问对方的资源，并在设置之前可选地可以向AE1返回数据获取失败响应以告知AE1当前无法直接获取目标数据而是需要CSE重新设置资源访问控制策略才可行；或者，在共享操作指示信息至少包括共享操作标识的情况下，CSE基于该共享操作标识而在CSE处设置AE1和AE2的资源访问控制策略，可以无需判断AE1是否满足AE2的资源访问控制策略，从而使得两者可以相互访问对方的所述资源。在这种情形下，可选地，CSE可以在设置AE1和AE2各自的资源访问控制策略之前确定发起数据获取请求的AE1和AE2是否是受信方，从而提高安全性。可选地，还可以根据AE1和AE2的受信级别而确定设置哪种安全级别的访问策略(例如，完全访问、临时访问)。
并且，在设置AE1和AE2的资源访问控制策略之前，CSE还可以先判断AE1和AE2的资源的数据类型是否相同，如果不相同，还应确定并在资源访问控制策略中创建或更新数据量换算规则。
此后，CSE可以获取注册到其处的AE2的资源下的目标数据并向AE1返回数据获取响应，该数据获取响应包括该目标数据。可选地，AE1可以基于该获取的目标数据而适应性地调整自身数据。
接着，CSE还可以向AE2发送通知请求，以通知AE2可以访问AE1的资源以与AE1进行数据共享。示例性地，该通知请求中可以包括AE1的资源访问控制策略。AE2在成功接收到该通知请求之后，可以向CSE返回通知响应。
并且，基于该数据获取响应，AE1可以确定其能够访问AE2的资源。在此之后，如果AE1再次想获取CSE上的AE2的资源处存储的相关数据，则可以向CSE发送数据获取请求，该数据获取请求中可以不再包括共享操作指示信息，而仅需包括AE2的资源的标识(即目标资源的标识)，因此在CSE处由于AE2的资源访问控制策略已经经过设置，并且此时接收的数据获取请求不再包括共享操作指示信息，因此CSE将基于设置后的资源访问控制策略来判断AE1是否满足AE2的资源访问控制策略(例如，AE1发起数据获取请 求的时间是否在AE2的资源临时访问控制策略中允许临时访问的时间段内)，并在判断满足后，向AE1返回数据获取响应。
通过参考图2A-4描述的数据共享方法，通过更新资源原有的资源访问控制策略，使得不同实体之间能够互相访问对方资源从而实现数据共享，并且还可以创建临时资源访问控制策略，从而可以进一步提高资源访问的安全性。此外，在更新或创建的资源访问控制策略中包括数据量限制、临时访问时间、数据共享规则以及可选的数据换算规则，从而可以提高数据共享的可靠性和安全性，并且可以使得两个实体相互从对方获取的资源的体积(数据量)相等。
上面参考图2A-4进行的描述均是针对不同实体注册到同一公共服务实体，从而通过该公共服务实体而在该不同实体之间进行相互的资源访问从而共享数据的场景，下面将针对不同实体注册到不同的公共服务实体，并通过不同的通信服务实体之间的交互来在该不同实体之间进行相互的资源访问从而共享数据的示例。
图5示出了在不同的实体注册到不同的通信服务实体的情况下的方法200的更多细节。
在这种情况下，第一实体与第一公共服务实体相关联(例如，注册到第一公共服务实体，第一公共服务实体在其处为第一实体创建资源以及原始的资源访问控制策略)，第二实体与第二公共服务实体相关联(例如，注册到第二公共服务实体，第二公共服务实体在其处为第二实体创建资源以及原始的资源访问控制策略)，并且第一公共服务实体与第二公共服务实体相互注册，从而第一公共服务实体与第二公共服务实体可以相互获取对方的数据并转发消息。
步骤S210可以具体包括以下各个子步骤。
在子步骤S2101中，由第一公共服务实体从第一实体接收数据获取请求。
数据获取请求的更多内容跟前面参考图2A-4描述的内容相同，因此这里不再重复描述。
在步骤S2102中，在第一公共服务实体基于数据获取请求中包括的第二实体的资源的标识确定第二实体未与其相关联但与所述第二公共服务实体相关联的情况下，将数据获取请求转发到第二公共服务实体。
由于第一实体和第二实体分别注册到第一公共服务实体和第二公共服务 实体，因此第一公共服务实体处并没有为第二实体创建的任何资源，因此无法协调第一实体和第二实体之间的数据共享，并且由于第一公共服务实体和第二公共服务实体之间相互注册，因此第一公共服务实体可知第二实体是注册到第二公共服务实体的，从而可以将该数据获取请求转发到第二公共服务实体。此外，如果第一公共服务实体确定第二实体未在第一公共服务实体处注册且未在第二公共服务实体处注册，则直接向第一实体返回获取失败响应。
同样的，步骤S220可以包括以下各个子步骤。
在步骤S2201中，由第二公共服务实体基于数据获取请求设置第二实体的资源访问控制策略，使得第一实体能够访问第二实体的资源。
例如，设置第二实体的资源访问控制策略可以包括更新该资源访问控制策略或者创建新的临时资源访问控制策略。具体的更新和创建的方式与前文已经进行了详细描述的方式相同，因此这里不再重复。
在步骤S2202中，由第二公共服务实体向第一公共服务实体返回数据获取响应，数据获取响应包括目标数据。
该目标数据是存储在第二公共服务实体处第二实体的资源下的，第二公共服务实体将存储在其处的目标数据取出，但是无法直接与第一实体通信，因此将目标数据包括在数据获取响应中返回给向其转发数据获取请求的第一公共服务实体。
在步骤S2203中，由第一公共服务实体设置第一实体的资源访问控制策略，使得第二实体能够访问第一实体的资源。
例如，第一公共服务实体可以将从第二公共服务实体接收到的上述数据获取响应理解为第二公共服务实体已经允许第一实体访问所请求的第二实体的资源，基于该理解第一公共服务实体可以设置第一实体的资源访问控制策略，使得第二实体也能够访问包括在先前的数据获取请求中的第一实体的资源的标识所指示的第一实体的资源。
此外，在步骤S230中，由第一公共服务实体向第一实体返回数据获取响应。
例如，第一公共服务实体最终向第一实体返回其所请求的目标数据，使得第一实体可以根据该目标数据来对自身数据进行适应性调整。
为了更清楚地描述本公开，下面参考图6来进一步描述注册到不同公共服务平台的第一实体和第二实体进行数据共享的过程。图6示出了根据本公 开实施例的注册到不同公共服务平台的第一实体和第二实体进行数据共享的流程示意图。
首先，第一应用实体(AE1)和第二应用实体(AE2)分别向第一公共服务实体(CSE1)和第二公共服务实体(CSE2)进行注册，从而CSE1和CSE2分别可以为AE1和AE2创造资源，例如分别表示为<CSE1/AE1>和<CSE2/AE2>，该资源可以包括多个子资源并且可以存储AE1和AE2的各类型数据，例如各自的应用数据以及相关联的设备上传的数据。CSE1和CSE2分别在创建好上述资源之后，向AE1和AE2返回注册响应。
接着AE1向CSE1发送数据获取请求(首次)，该数据获取请求包括存储目标数据的应用实体(AE2)的资源的标识以及共享操作指示信息。共享操作指示信息可以包括：AE1的资源的标识；或者，共享操作的标识；或者，共享操作的标识和AE1的资源的标识。
CSE1基于该数据获取请求而确定(隐式或显示地被指示)AE1希望与AE2进行数据共享(即访问CSE上的AE2的资源，并可以被AE2访问自身的资源)，同时确定AE2未注册到CSE1但注册到CSE2，因此CSE1将数据获取请求转发到CSE2。
与前面图4所描述相类似，如果AE1确定不是首次与AE2的资源进行数据共享，且AE2的资源访问控制策略仍有效，则数据获取请求中可以不用包括共享操作指示信息，并且CSE2在收到经CS1转发的数据获取请求之后，确定AE1满足AE2目前仍有效的、先前的资源访问控制策略，则直接经由CSE1向AE1返回目标数据。当然，AE1和CSE1-CSE2的这个预先操作是可选的。
CSE2接收到数据获取请求(包括共享操作指示信息)之后，在共享操作指示信息为AE1的资源的标识的情况下，CSE2判断该AE1不符合AE2的资源访问控制策略，因此CSE2在CSE2处设置AE2的资源访问控制策略，从而使得AE1可以访问AE2的资源；或者，在共享操作指示信息包括至少共享操作标识的情况下，CSE2基于该共享操作标识而在CSE2处设置AE2的资源访问控制策略，无需判断AE1是否满足AE2的资源访问控制策略。在这种情形下，CSE2需要在设置AE2的资源访问控制策略之前确定发起数据获取请求的AE1是否是受信方，从而提高安全性。可选地，还可以根据AE1的受信级别而确定针对AE1设置哪种安全级别的访问策略(例如，完全访问、临时 访问)。
此后，CSE2可以获取注册到其处的AE2的资源下的目标数据并向CSE1返回数据获取响应。响应于接收到数据获取响应，CSE1可以确定CSE2已经允许AE1访问所请求的AE2的资源，因此CSE1也对AE1的资源访问控制策略进行设置(具体设置过程与前文相同)，以使AE2也能访问CSE1上的AE1的资源，从而实现数据共享。CSE1还可以向CSE2发出通知请求，以经由CSE2向AE2告知可以访问AE1的资源以与AE1进行数据共享。示例性地，该通知请求中可以包括AE1的资源访问控制策略。AE2在成功接收到该通知请求之后，可以向CSE2返回通知响应，并由CSE2转发回CSE1。可选地，CSE1在从CSE2接收到数据获取响应之后，同样的，也可以先判断AE2是否满足AE1当前的资源访问控制策略，并在判断出满足的情况下，直接向AE1返回数据，并经由CSE向AE2发送可以访问AE1的资源的通知，而不再进行后续过程，在判断出不满足的情况下，才继续设置CSE1处AE1的资源访问控制策略。
接着，CSE1将数据获取响应返回给AE1，该数据获取响应包括该目标数据。可选地，AE1可以基于该获取的目标数据而适应性地调整自身数据。
并且，基于该数据获取响应，AE1可以确定其能够访问先前所请求的AE2的资源。在此之后，如果AE1再次想获取CSE2上的AE2的该资源处存储的相关数据，则可以向CSE1发送数据获取请求，并经由CSE1转发而发送到CSE2，该数据获取请求中可以不再包括共享操作指示信息，而仅需包括AE2的资源的标识(即目标资源的标识)，因此在CSE2处由于AE2的资源访问控制策略已经经过设置，并且此时接收的数据获取请求不再包括共享操作指示信息，因此CSE2将基于设置后的资源访问控制策略来判断AE1是否满足AE2的资源访问控制策略(例如，AE1发起数据获取请求的时间是否在AE2的资源临时访问控制策略中允许临时访问的时间段内)，并在判断满足后，经由CSE1向AE1返回数据获取响应。
通过参考图5-6描述的数据共享方法，通过更新资源原有的资源访问控制策略或创建新的临时资源访问控制策略，使得注册到不同的公共服务实体的不同实体之间也能够互相访问对方资源从而实现数据共享。
根据本公开的另一方面，还提供了一种数据共享装置。图7示出了根据本公开实施例的一种数据共享装置700的结构框图。
如图7所示，数据共享装置700包括接收模块701、设置模块702和发送模块703。
接收模块701被配置为从第一实体接收数据获取请求，其中所述数据获取请求包括存储目标数据的第二实体的资源的标识、以及共享操作指示信息。
设置模块702被配置为基于所述数据获取请求设置所述第一实体和所述第二实体各自的资源访问控制策略，以使得所述第一实体和所述第二实体能够访问对方的资源以实现数据共享。
发送模块703被配置为向第一实体发送数据获取响应，其中所述数据获取响应中包括所述目标数据。
可选地，该数据共享装置700还可以包括确定模块704，用于确定所述第一实体的资源的数据类型与所述第二实体的资源的数据类型是否相同，并且向设置模块发送确定结果，使得所述设置模块根据所述确定结果来设置所述第一实体和所述第二实体各自的资源访问控制策略。
上述各个模块的各功能的更多详细内容已在前面参考图2A-4进行了详细描述，因此这里可以省略。
此外，根据功能的不同划分或增减，该数据共享装置还可以包括更多或更少的模块，本公开对此不做限制。
此外，根据本公开的另一方面，还提供了一种数据共享系统。该数据共享系统包括：第一实体和第二实体；公共服务实体；以及第一设备和第二设备，其中，第一实体和第二实体以及第一设备和第二设备均注册到公共服务实体，并且第一实体和第二实体与第一设备和第二设备相关联。
作为具体的示例，该数据共享系统可以是用于制造业的数据共享系统。
图8示出了根据本公开实施例的一种数据共享系统800的示意图。
如图8所示，该数据共享系统包括：第一制造设备(D1)和第二制造设备(D2)；第一制造应用(MAE1)和第二制造应用(MAE2)，其中，第一制造应用(MAE1)与第一制造设备(D1)相关联，第二制造应用(MAE2)与第二制造设备(D2)相关联；以及物联网平台(P)。
物联网平台(P)被配置为：将第一制造设备上传的数据存储在第一制造应用的资源下，和第一制造应用的应用数据共同作为第一制造应用的产品数据，并将第二制造设备上传的数据存储在第二制造应用的资源下，和第二制造应用的应用数据共同作为第二制造应用的产品数据；从第一制造应用接收 数据获取请求，数据获取请求包括存储目标产品数据的第二制造应用的资源的标识以及产品数据共享操作指示信息；基于数据获取请求设置第一制造应用和第二制造应用各自的资源访问控制策略，以使得第一制造应用和第二制造应用能够访问对方的资源从而获取对方的产品数据；以及向第一制造应用发送数据获取响应，数据获取响应中包括目标资源的数据。
第一制造应用(MAE1)可以向物联网平台(P)发送上述数据获取请求。此外，第一制造应用(MAE1)在发送上述数据获取请求之前，确定无法通过其他方式获取第二制造应用(MAE2)的产品数据。例如，如果先前第一制造应用和第二制造应用进行过数据共享，且对应的资源访问控制策略仍然有效，则可以不在数据获取请求中包括共享操作指示信息，反之，如果未进行过数据共享，或者先前的资源访问控制策略已无效，则需要包括改共享操作指示信息。
所述第一制造应用可以根据所述第一制造应用的产品数据和从所述第二制造应用的资源获取的目标产品数据调整所述第一制造应用的产品数据，使得所述第一制造应用的产品数据和所述第二制造应用的产品数据兼容。例如，用于制造墙纸的厂家应用根据获取的从制造沙发的厂家应用的产品数据，来进行风格匹配。
虽然上述以制造业中的数据共享系统为例进行了描述，但是其中设置资源访问控制策略的具体细节和方式仍与前文参考图2A-4描述的内容相同，因此这里也可以省略。
根据本公开的又一方面，还提供了一种服务器。
图9示出了根据本公开实施例的服务器900。服务器900可以包括处理器901和存储器902。处理器901和存储器902可以通过总线903相连。
处理器901可以根据存储在存储器902中的程序执行各种动作和处理。在存储器中的程序被执行时，可以使得处理器执行根据本公开的实施例中的数据共享方法的各步骤。
具体地，处理器901可以是一种集成电路芯片，具有信号的处理能力。上述处理器可以是通用处理器、数字信号处理器(DSP)、专用集成电路(ASIC)、现成可编程门阵列(FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等，可以是X99架构或ARM架构的。
存储器902可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。非易失性存储器可以是只读存储器(ROM)、可编程只读存储器(PROM)、可擦除可编程只读存储器(EPROM)、电可擦除可编程只读存储器(EEPROM)或闪存。易失性存储器可以是随机存储存储器(RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存储存储器(SRAM)、动态随机存储存储器(DRAM)、同步动态随机存储存储器(SDRAM)、双倍数据速率同步动态随机存储存储器DDRSDRAM)、增强型同步动态随机存储存储器(ESDRAM)、同步连接动态随机存储存储器(SLDRAM)和直接内存总线随机存储存储器(DR RAM)。应注意，本公开描述的方法的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
根据本公开的又一方面，还公开了一种计算机存储介质，其上存储有计算机程序，该计算机程序在被处理器执行时用于实现根据本公开实施例的数据共享方法。
虽然已经针对本公开的各种具体示例实施例详细描述了本公开，但是每个示例通过解释而不是限制本公开来提供。本领域技术人员在得到对上述内容的理解后，可以容易地做出这样的实施例的变更、变化和等同物。因此，本发明并不排除包括将对本领域普通技术人员显而易见的对本公开的这样的修改、变化和/或添加。例如，作为一个实施例的一部分图示或描述的特征可以与另一实施例一起使用，以产生又一实施例。因此，意图是本公开覆盖这样的变更、变化和等同物。
具体地，尽管本公开的附图出于图示和讨论的目的分别描述了以特定顺序执行的步骤，但是本公开的方法不限于特定图示的顺序或布置。在不偏离本公开的范围的情况下，上述方法的各个步骤可以以各种方式省略、重新布置、组合和/或调整。
本领域技术人员可以理解，本申请的各方面可以通过若干具有可专利性的种类或情况进行说明和描述，包括任何新的和有用的工序、机器、产品或物质的组合，或对他们的任何新的和有用的改进。相应地，本申请的各个方面可以完全由硬件执行、可以完全由软件(包括固件、常驻软件、微码等)执行、也可以由硬件和软件组合执行。以上硬件或软件均可被称为“数据块”、“模块”、“引擎”、“单元”、“组件”或“系统”。此外，本申请的各方面可能 表现为位于一个或多个计算机可读介质中的计算机产品，该产品包括计算机可读程序编码。
以上是对本公开的说明，而不应被认为是对其的限制。尽管描述了本公开的若干示例性实施例，但本领域技术人员将容易地理解，在不背离本公开的新颖教学和优点的前提下可以对示例性实施例进行许多修改。因此，所有这些修改都意图包含在权利要求书所限定的本公开范围内。应当理解，上面是对本公开的说明，而不应被认为是限于所公开的特定实施例，并且对所公开的实施例以及其他实施例的修改意图包含在所附权利要求书的范围内。本公开由权利要求书及其等效物限定。

Claims (19)

  1. 一种数据共享方法，包括：
    从第一实体接收数据获取请求，其中所述数据获取请求包括存储目标数据的第二实体的资源的标识、以及共享操作指示信息；以及
    基于所述数据获取请求设置所述第一实体和所述第二实体各自的资源访问控制策略，以使得所述第一实体和所述第二实体能够访问对方的资源以实现数据共享；以及
    向第一实体发送数据获取响应，其中所述数据获取响应中包括所述目标数据。
  2. 根据权利要求1所述的数据共享方法，其中，共享操作指示信息包括：所述第一实体的资源的标识，
    其中，基于所述数据获取请求设置所述第一实体和所述第二实体各自的资源访问控制策略，包括:
    基于所述第一实体的资源的标识和/或共享操作的标识以及所述第二实体的资源的标识确定所述第一实体期望与所述第二实体进行数据共享；以及
    确定所述第一实体是否满足所述第二实体的资源访问控制策略，并且基于所述确定设置所述第一实体和所述第二实体各自的资源访问控制策略。
  3. 根据权利要求1所述的数据共享方法，其中，共享操作指示信息包括：共享操作的标识；或者，共享操作的标识和所述第一实体的资源的标识，
    其中，基于所述数据获取请求设置所述第一实体和所述第二实体各自的资源访问控制策略，包括:
    基于至少所述共享操作的标识确定所述第一实体期望与所述第二实体进行数据共享，并设置所述第一实体和所述第二实体各自的资源访问控制策略。
  4. 根据权利要求2或3所述的数据共享方法，其中，设置所述第一实体和所述第二实体各自的资源访问控制策略包括：
    更新所述第一实体的资源访问控制策略，更新所述第二实体的资源访问控制策略；或者
    创建所述第一实体的临时访问控制策略，创建第二实体的临时访问控制策略；或者
    更新第一实体的资源访问控制策略，创建第二实体的资源临时访问控制策略；或者
    更新第二实体的资源访问控制策略，创建第一实体的临时访问控制策略。
  5. 根据权利要求4所述的数据共享方法，其中，
    更新第一实体的资源访问控制策略包括：使资源访问控制策略中的访问方标识包括所述第一实体和所述第二实体的标识，所述访问方标识指示允许访问第一实体的资源的实体的标识；以及
    更新第二实体的资源访问控制策略包括：使资源访问控制策略中的访问方标识包括所述第一实体和所述第二实体的标识，所述访问方标识指示允许访问第二实体的资源的实体的标识。
  6. 权利要求4所述的数据共享方法，其中，
    所述创建第一实体的临时访问控制策略包括：创建临时访问方标识，并在其中包括所述第二实体的标识，所述临时访问方标识指示允许临时访问第一实体的资源的实体的标识；以及
    所述创建第二实体的临时访问控制策略包括：创建临时访问方标识，并在其中包括所述第一实体的标识，所述临时访问方标识指示允许临时访问第二实体的资源的实体的标识。
  7. 根据权利要求5或6所述的数据共享方法，其中，更新第一实体或第二实体的资源访问控制策略还包括：添加数据量限制，指示允许从所述第一实体的资源或所述第二实体的资源获取的数据量上限阈值；或者
    其中，创建第一实体或第二实体的资源访问控制策略还包括：创建数据量限制，指示允许从所述第一实体的资源或第二实体的资源通过临时访问获取的数据量上限阈值，
    其中，在从所述第一实体的资源或第二实体的资源通过临时访问获取的 数据量达到数据量上限阈值时，禁止继续从所述第一实体的资源或第二实体的资源获取数据。
  8. 根据权利要求7所述的数据共享方法，其中，创建所述第一实体或所述第二实体的临时访问控制策略还包括：
    创建临时访问时间限制，指示允许临时访问所述第一实体的资源或所述第二实体的资源的时间。
  9. 根据权利要求7所述的数据共享方法，还包括：确定所述第一实体的资源的数据类型与所述第二实体的资源的数据类型是否相同，
    其中，在确定两者的类型相同的情况下，更新资源访问控制策略或者创建临时访问控制策略还包括：
    添加数据共享规则，以限定双方各自从对方获取的该相同类型数据的数据量上限阈值需相等。
  10. 根据权利要求7-9任一项所述的数据共享方法，还包括：确定所述第一实体的资源的数据类型与所述第二实体的资源的数据类型是否相同，
    其中，在确定两者的类型不同的情况下，更新资源访问控制策略或者创建临时访问控制策略还包括：
    添加数据共享规则，以限定双方各自从对方获取的不同类型数据的数据量上限阈值需相等；以及
    添加数据量换算规则，用于对从资源获取的数据量进行换算。
  11. 根据权利要求10所述的数据共享方法，其中，每个实体的资源下的数据具有内容价值属性，内容价值属性的值与该实体的资源下的数据对于该实体的有用性正相关且预先定义，
    其中，所述数据量换算规则包括：使从资源获取的数据的数据量分别与该数据的内容价值属性的值相乘得到换算后的数据量，并且其中，
    在换算后的数据量超过数据量上限阈值的情况下，禁止继续从资源获取数据。
  12. 根据权利要求1所述的数据共享方法，其中，所述第一实体与第一公共服务实体相关联，所述第二实体与第二公共服务实体相关联，并且所述第一公共服务实体与所述第二公共服务实体相互注册，
    其中，从第一实体接收数据获取请求，包括：
    由所述第一公共服务实体从第一实体接收所述数据获取请求；以及
    在所述第一公共服务实体基于所述数据获取请求中包括的第二实体的资源的标识确定所述第二实体未与其相关联但与所述第二公共服务实体相关联的情况下，将所述数据获取请求转发到所述第二公共服务实体。
  13. 根据权利要求12所述的数据共享方法，其中，基于所述数据获取请求设置所述第一实体和所述第二实体各自的资源访问控制策略，包括：
    由所述第二公共服务实体基于所述数据获取请求设置所述第二实体的资源访问控制策略，使得第一实体能够访问其资源；
    由所述第二公共服务实体向所述第一公共服务实体返回数据获取响应，所述数据获取响应包括所述目标资源的数据；
    由所述第一公共服务实体基于所述数据获取响应设置所述第一实体的资源访问控制策略，使得第二实体能够访问其资源；以及
    由所述第一公共服务实体向第一实体返回所述数据获取响应。
  14. 一种数据共享装置，包括：
    接收模块，被配置为从第一实体接收数据获取请求，其中所述数据获取请求包括存储目标数据的第二实体的资源的标识、以及共享操作指示信息；
    设置模块，被配置为基于所述数据获取请求设置所述第一实体和所述第二实体各自的资源访问控制策略，以使得所述第一实体和所述第二实体能够访问对方的资源以实现数据共享；以及
    发送模块，被配置为向第一实体发送数据获取响应，其中所述数据获取响应中包括所述目标数据。
  15. 根据权利要求14所述的数据共享装置，还包括：
    确定模块，被配置为确定所述第一实体的资源的数据类型与所述第二实体的资源的数据类型是否相同，并且向设置模块发送确定结果，使得所述设 置模块还根据所述确定结果来设置所述第一实体和所述第二实体各自的资源访问控制策略。
  16. 一种数据共享系统，包括：
    第一制造设备和第二制造设备；
    第一制造应用和第二制造应用，其中，第一制造应用与第一制造设备相关联，第二制造应用与第二制造设备相关联；以及
    物联网平台，被配置为：
    将第一制造设备上传的数据存储在第一制造应用的资源下，和第一制造应用的应用数据共同作为第一制造应用的产品数据，并将第二制造设备上传的数据存储在第二制造应用的资源下，和第二制造应用的应用数据共同作为第二制造应用的产品数据；
    接收由所述第一制造应用发送的数据获取请求，所述数据获取请求包括存储目标产品数据的第二制造应用的资源的标识以及产品数据共享操作指示信息；
    基于所述数据获取请求设置所述第一制造应用和所述第二制造应用各自的资源访问控制策略，以使得所述第一制造应用和所述第二制造应用能够访问对方的资源从而获取对方的产品数据；以及
    向第一制造应用发送数据获取响应，所述数据获取响应中包括所述目标产品数据。
  17. 根据权利要求16所述的数据共享系统，其中，所述第一制造应用被配置为：
    根据所述第一制造应用的产品数据和从所述第二制造应用的资源获取的目标产品数据调整所述第一制造应用的产品数据，使得所述第一制造应用的产品数据和所述第二制造应用的产品数据兼容。
  18. 一种服务器，包括：
    处理器；以及
    存储器，其上存储有程序，所述程序在被所述处理器执行时使得所述处理器如权利要求1-13任一项所述的数据共享方法的各步骤。
  19. 一种计算机存储介质，包括计算机程序，所述计算机程序在被所述处理器执行时实现如权利要求1-13任一项所述的数据共享方法。
PCT/CN2022/072684 2021-01-22 2022-01-19 数据共享方法、装置、系统、服务器和计算机存储介质 WO2022156694A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US18/272,876 US20240305641A1 (en) 2021-01-22 2022-01-19 Data sharing method, apparatus and system, and server and computer storage medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110088792.2 2021-01-22
CN202110088792.2A CN114826629A (zh) 2021-01-22 2021-01-22 数据共享方法、装置、系统、服务器和计算机存储介质

Publications (1)

Publication Number Publication Date
WO2022156694A1 true WO2022156694A1 (zh) 2022-07-28

Family

ID=82525323

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/072684 WO2022156694A1 (zh) 2021-01-22 2022-01-19 数据共享方法、装置、系统、服务器和计算机存储介质

Country Status (3)

Country Link
US (1) US20240305641A1 (zh)
CN (1) CN114826629A (zh)
WO (1) WO2022156694A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2024080406A1 (ko) * 2022-10-13 2024-04-18 한국전자기술연구원 데이터 플랫폼 미가동시에도 손실 없이 데이터를 저장하고 제공하는 방법

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102959922A (zh) * 2010-06-25 2013-03-06 瑞典爱立信有限公司 用于授权临时访问电子内容的方法、服务器和系统
CN108141446A (zh) * 2015-08-28 2018-06-08 康维达无线有限责任公司 服务层动态授权
WO2019067817A1 (en) * 2017-09-29 2019-04-04 Convida Wireless, Llc ENHANCED RESOURCE SHARING USING A RESERVATION
CN110691061A (zh) * 2018-07-06 2020-01-14 电信科学技术研究院有限公司 一种资源访问控制方法及装置
CN111490966A (zh) * 2019-01-28 2020-08-04 电信科学技术研究院有限公司 一种访问控制策略的处理方法、装置及计算机可读存储介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102959922A (zh) * 2010-06-25 2013-03-06 瑞典爱立信有限公司 用于授权临时访问电子内容的方法、服务器和系统
CN108141446A (zh) * 2015-08-28 2018-06-08 康维达无线有限责任公司 服务层动态授权
WO2019067817A1 (en) * 2017-09-29 2019-04-04 Convida Wireless, Llc ENHANCED RESOURCE SHARING USING A RESERVATION
CN110691061A (zh) * 2018-07-06 2020-01-14 电信科学技术研究院有限公司 一种资源访问控制方法及装置
CN111490966A (zh) * 2019-01-28 2020-08-04 电信科学技术研究院有限公司 一种访问控制策略的处理方法、装置及计算机可读存储介质

Also Published As

Publication number Publication date
US20240305641A1 (en) 2024-09-12
CN114826629A (zh) 2022-07-29

Similar Documents

Publication Publication Date Title
CN111914269B (zh) 一种区块链和云存储环境下的数据安全共享方法和系统
US10735428B2 (en) Data access and ownership management
WO2020140679A1 (zh) 接口对接方法、装置、计算机设备和存储介质
US9319412B2 (en) Method for establishing resource access authorization in M2M communication
WO2020168692A1 (zh) 海量数据共享方法、开放共享平台及电子设备
TWI223949B (en) Resource authorization
US9319413B2 (en) Method for establishing resource access authorization in M2M communication
US10554406B1 (en) Authorized data sharing using smart contracts
EP3843353B1 (en) Access control policy configuration method, device and storage medium
US11240031B2 (en) System and method for delegating authority through coupled devices
US11829502B2 (en) Data sharing via distributed ledgers
JP2015501021A (ja) ＯＡｕｔｈフレームワーク
WO2017076165A1 (zh) 一种访问控制方法和访问令牌颁发方法、设备
CN110222518A (zh) 基于区块链的可信权能访问控制方法
CN112738100B (zh) 数据访问的鉴权方法、装置、鉴权设备和鉴权系统
WO2016141783A1 (zh) 访问控制、策略获取、属性获取方法及相关装置
WO2022156694A1 (zh) 数据共享方法、装置、系统、服务器和计算机存储介质
WO2020007132A1 (zh) 一种资源访问控制方法及装置
WO2017157176A1 (zh) 一种资源分发方法及装置
WO2022116575A1 (zh) 业务平台的访问权限获取方法和业务平台的访问控制方法
US9537893B2 (en) Abstract evaluation of access control policies for efficient evaluation of constraints
CN116566704A (zh) 安全访问控制方法、系统、车控设备、车辆及介质
US11991171B2 (en) Communication method for device, device and storage medium
CN106656936A (zh) 一种访问控制方法和设备
WO2017076129A1 (zh) 角色颁发方法、访问控制方法及相关设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22742173

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 18272876

Country of ref document: US

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 02.11.2023)

122 Ep: pct application non-entry in european phase

Ref document number: 22742173

Country of ref document: EP

Kind code of ref document: A1