WO2024060411A1 - 一种数据共享系统、方法、装置、设备及介质 - Google Patents

一种数据共享系统、方法、装置、设备及介质 Download PDF

Info

Publication number
WO2024060411A1
WO2024060411A1 PCT/CN2022/137360 CN2022137360W WO2024060411A1 WO 2024060411 A1 WO2024060411 A1 WO 2024060411A1 CN 2022137360 W CN2022137360 W CN 2022137360W WO 2024060411 A1 WO2024060411 A1 WO 2024060411A1
Authority
WO
WIPO (PCT)
Prior art keywords
application
target
data
encryption key
belongs
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2022/137360
Other languages
English (en)
French (fr)
Inventor
邹奋
袁航
李定洲
周雍恺
王琪
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
China Unionpay Co Ltd
Original Assignee
China Unionpay Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by China Unionpay Co Ltd filed Critical China Unionpay Co Ltd
Priority to US19/112,335 priority Critical patent/US12561481B2/en
Publication of WO2024060411A1 publication Critical patent/WO2024060411A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6245—Protecting personal data, e.g. for financial or medical purposes
    • G06F21/6254—Protecting personal data, e.g. for financial or medical purposes by anonymising data, e.g. decorrelating personal data from the owner's identification
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0822—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using key encryption key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2141—Access rights, e.g. capability lists, access control lists, access tables, access matrices

Definitions

  • the present application relates to the field of data sharing technology, and in particular, to a data sharing system, method, device, equipment and medium.
  • This application provides a data sharing system, method, device, equipment and medium, which are used to enable data sharing between multiple applications while ensuring the security of the data of each application.
  • this application provides a data sharing system, which includes:
  • the device to which the first application belongs is configured to determine the target access address corresponding to the target application identifier of the second application based on the pre-saved correspondence between the application identifier and the access address, and send a message sharing the second application to the target access address.
  • the device to which the target access address belongs is used to receive the sharing request, determine the target database corresponding to the target application ID according to the corresponding relationship between the saved application ID and the database; obtain the data saved in the target database; according to The corresponding relationship between the saved application identification and the encryption key is determined to determine the target encryption key corresponding to the target application identification; based on the target encryption key, the obtained data is decrypted; and the decrypted data is sent to the third A device to which an application belongs;
  • the target database is used to store data.
  • this application provides a data sharing method, which method is applied to the device to which the first application belongs.
  • the method includes:
  • this application provides a data sharing method, which method is applied to the device to which the target access address belongs.
  • the method includes:
  • the target database corresponding to the target application identifier determines the target database corresponding to the target application identifier; obtain the data saved in the target database;
  • the target encryption key corresponding to the target application identification determines the target encryption key corresponding to the target application identification; decrypt the obtained data based on the target encryption key; send the decrypted data to the The device to which the first application belongs.
  • this application provides a data sharing method, which method is applied to the device to which the second application belongs.
  • the method includes:
  • the confirmation instruction is sent to the management platform.
  • this application provides a data sharing method, the method is applied to the management platform, and the method includes:
  • the saved target application identification of the second application and the target access address corresponding to the target application identification information are sent. to the device to which the first application belongs.
  • this application provides a data sharing device, which includes:
  • the first determination module is configured to determine the target access address corresponding to the target application identifier of the second application based on the pre-saved correspondence between the application identifier and the access address, and send a message sharing the data of the second application to the target access address.
  • a sharing request the sharing request carries the target application identifier;
  • the first receiving module is configured to receive the decrypted data of the second application sent by the device to which the target access address belongs.
  • this application provides a data sharing device, which includes:
  • the second receiving module is configured to receive a sharing request sent by the device to which the first application belongs, where the sharing request carries the target application identifier;
  • the second determination module is used to determine the target database corresponding to the target application identifier according to the corresponding relationship between the saved application identifier and the database; and obtain the data saved in the target database;
  • An encryption and decryption module configured to determine the target encryption key corresponding to the target application ID based on the stored correspondence between the application ID and the encryption key; decrypt the acquired data based on the target encryption key; and convert the decrypted data into The data is sent to the device to which the first application belongs.
  • this application provides a data sharing device, which includes:
  • a display module used to display the application identifier of the first application carried in the application if an application sent by the management platform is received;
  • the first sending module is configured to send a confirmation instruction to the management platform upon receiving a confirmation instruction agreeing to share data with the first application.
  • this application provides a data sharing device, which includes:
  • a third receiving module configured to receive an application for sharing the data of the second application sent by the device to which the first application belongs, where the application carries the application identifier of the first application;
  • the second sending module is configured to send the application to the device to which the second application belongs; if a confirmation instruction sent by the device to which the second application belongs agrees with the sharing of data by the first application is received, the saved The target application identification of the second application and the target access address corresponding to the target application identification information are sent to the device to which the first application belongs.
  • the present application provides an electronic device, which includes a processor and a memory, wherein the memory stores program code, and when the program code is executed by the processor, the processor is caused to execute the above The steps of the method described in any one of the second aspect and the fifth aspect.
  • the present application provides a computer-readable storage medium, which includes program code.
  • the program code is used to cause the electronic device to execute the above second aspect. - The steps of the method according to any one of the fifth aspects.
  • the device to which the first application belongs can determine the target access address corresponding to the target application identifier of the second application based on the pre-saved correspondence between the application identifier and the access address, and send the shared second application to the target access address.
  • a sharing request for data the sharing request carries the target application identifier; the device to which the target access address belongs can receive the sharing request, and determine the target database corresponding to the target application identifier according to the correspondence between the saved application identifier and the database; obtain Data saved in the target database; determine the target encryption key corresponding to the target application ID based on the correspondence between the saved application ID and the encryption key; decrypt the obtained data based on the target encryption key; send the decrypted data to The device to which the first application belongs; based on this, the purpose of sharing data between multiple applications can be achieved while ensuring the security of the data of each application.
  • Figure 1 shows a schematic diagram of a data sharing system provided by some embodiments
  • Figure 2 shows a schematic diagram of the first data sharing process provided by some embodiments
  • Figure 3 shows a schematic diagram of the second data sharing process provided by some embodiments
  • Figure 4 shows a schematic diagram of the third data sharing process provided by some embodiments.
  • Figure 5 shows a schematic diagram of the fourth data sharing process provided by some embodiments.
  • Figure 6 shows a schematic diagram of the fifth data sharing process provided by some embodiments.
  • Figure 7 shows a schematic diagram of a writing data process provided by some embodiments.
  • Figure 8 shows a schematic diagram of a data reading process provided by some embodiments.
  • Figure 9 shows a schematic diagram of a data secure storage process provided by some embodiments.
  • Figure 10 is a schematic diagram of a data sharing scenario provided by some embodiments of the present application.
  • Figure 11 shows a schematic diagram of the sixth data sharing process provided by some embodiments.
  • Figure 12 shows a schematic diagram of a seventh data sharing process provided by some embodiments.
  • FIG13 is a schematic diagram showing an eighth data sharing process provided by some embodiments.
  • Figure 14 shows a schematic diagram of the ninth data sharing process provided by some embodiments.
  • Figure 15 shows a schematic diagram of the first data sharing device provided by some embodiments.
  • Figure 16 shows a schematic diagram of a second data sharing device provided by some embodiments.
  • Figure 17 shows a schematic diagram of a third data sharing device provided by some embodiments.
  • Figure 18 shows a schematic diagram of a fourth data sharing device provided by some embodiments.
  • FIG19 shows a schematic diagram of the structure of an electronic device provided in some embodiments.
  • this application provides a data sharing system, method, device, equipment and medium.
  • module means any known or later developed hardware, software, firmware, artificial intelligence, fuzzy logic or combination of hardware or/and software code capable of performing the functions associated with that element.
  • Figure 1 shows a schematic diagram of a data sharing system provided by some embodiments. As shown in Figure 1, the system includes:
  • the device 11 to which the first application belongs is configured to determine the target access address corresponding to the target application identification of the second application based on the pre-saved correspondence between the application identification and the access address, and send the shared second application to the target access address.
  • the device 12 to which the target access address belongs is used to receive the sharing request, determine the target database 13 corresponding to the target application ID according to the stored correspondence between the application ID and the database, and obtain the target database 13 stored in the target database 13 data; determine the target encryption key corresponding to the target application identification according to the corresponding relationship between the saved application identification and the encryption key; decrypt the obtained data based on the target encryption key; send the decrypted data to The device 11 to which the first application belongs;
  • the target database 13 is used to store data.
  • the data sharing system includes a device 11 to which the first application belongs, a device 12 to which the target access address belongs, and a target database 13.
  • the device to which the first application such as application B
  • it can determine the target application of the second application based on the correspondence between the pre-saved application identifier and the access address. Identify the corresponding target access address, and send a sharing request for sharing the data of the second application to the target access address.
  • the sharing request may carry the target application identifier of the second application.
  • the device 12 to which the target access address belongs (which may also be called a pre-encryption module) can receive the sharing request, and can determine the target database 13 corresponding to the target application ID of the second application based on the pre-saved correspondence between the application ID and the database. , and then obtain the data stored in the target database 13.
  • the data stored in the database corresponding to the application can be encrypted data based on the encryption key corresponding to the application, or That is to say, the data obtained from the target database 13 may be data encrypted based on the encryption key of the second application (such as application A).
  • the decrypted data can be sent to the first application (such as application B).
  • the device 12 to which the target access address belongs can save the correspondence between each application identification and the encryption key in advance.
  • the device 12 to which the target access address belongs can determine the target corresponding to the target application ID of the second application (such as application A) based on the saved correspondence between the application ID and the encryption key.
  • encryption key and decrypts the obtained data based on the target encryption key, and sends the decrypted data to the device 11 to which the first application belongs, so that multiple applications can be implemented while ensuring the security of the data of each application.
  • Data can be shared between applications.
  • a first application such as application B
  • the device 11 to which the first application wants to share data of a second application (such as application A)
  • the device 11 to which the first application such as application B
  • the device 11 to which the first application (such as application B) belongs can first contact the data sharing system.
  • the management platform in the application sends an application for sharing the data of the second application.
  • the application may carry the application identifier of the first application itself.
  • the management platform After receiving the application sent by the device to which the first application (such as application B) belongs, the management platform can send the application to the device to which the second application (such as application A) belongs.
  • the device to which the second application (such as application A) belongs can receive the application sent by the management platform.
  • the device to which the second application (such as application A) belongs
  • the device can display the application identification of the first application carried in the application.
  • the manager of the second application approves the application and agrees to the first application sharing the data of the second application, you can click the approval button, etc., and the device to which the second application belongs can receive the consent for the first application to share.
  • Confirmation instruction of data and can send the confirmation instruction to the management platform when receiving the confirmation instruction.
  • the management platform can receive the confirmation instruction sent by the device to which the second application belongs, and when receiving the confirmation instruction, can send the saved target application identification of the second application and the target access address corresponding to the target application identification to the device to which the first application belongs.
  • Device 11 if the target application identification of the second application includes primary identification information and secondary identification information, the management platform can send the secondary identification information to the device to which the first application (such as application B) belongs, and the device to which the first application belongs 11. Save the corresponding relationship between the secondary identification information of the second application and the target access address.
  • the primary identification information and secondary identification information of the second application will be introduced in subsequent embodiments and will not be described in detail here.
  • the device 11 to which the first application belongs can receive the target application identifier of the second application and the target access address corresponding to the target application identifier sent by the management platform, and can save the target application identifier and the target access address.
  • the corresponding relationship can be saved in the configuration file (database configuration file) of the device 11 to which the first application belongs, or the like.
  • Figure 2 shows a schematic diagram of the first data sharing process provided by some embodiments. The process includes the following steps:
  • S201 The device 11 to which the first application belongs sends an application to share the data of the second application to the management platform, and the application carries the application identification of the first application itself.
  • S202 The management platform receives the application, and sends the application to the device to which the second application belongs.
  • S203 The device to which the second application belongs receives the application and displays the application identification of the first application carried in the application. If it receives a confirmation instruction agreeing to share data with the first application, it sends the confirmation instruction to the management platform.
  • the management platform receives the confirmation instruction, and sends the saved target application identifier (such as secondary identifier information) of the second application and the target access address corresponding to the target application identifier to the device 11 to which the first application belongs.
  • the saved target application identifier such as secondary identifier information
  • the device 11 to which the first application belongs saves the correspondence between the target application identifier and the target access address.
  • the device 11 to which the first application belongs determines the target access address corresponding to the target application identifier of the second application based on the pre-saved correspondence between the application identifier and the access address, and sends a sharing request for sharing the data of the second application to the target access address.
  • the sharing request carries the target application identifier.
  • the device 12 to which the target access address belongs receives the sharing request, determines the target database 13 corresponding to the target application ID according to the saved application ID and the database; obtains the data saved in the target database 13; and encrypts the data according to the saved application ID.
  • the corresponding relationship between the keys is to determine the target encryption key corresponding to the target application identification; decrypt the acquired data based on the target encryption key; and send the decrypted data to the device 11 to which the first application belongs.
  • the first application can only read the data of the second application. Data cannot be written in the database of the second application, or the sensitive data involved in the second application needs to be desensitized before being sent to the first application, etc., so that while data can be shared between different applications, The security of the data of each application can also be increased.
  • the device 12 to which the target access address belongs After receiving the above-mentioned sharing request sent by the device 11 to which the first application belongs, the device 12 to which the target access address belongs determines the target application identification according to the corresponding relationship between the saved application identification and the database.
  • the type of the sharing request is a read data request or a write data request, and based on the type of the sharing request and the pre-saved permission of the first application to use the data of the second application, the determination can be made. Whether the sharing request complies with the corresponding usage rights.
  • the usage permission of the first application to the second application is that it can only read data but cannot write data
  • the type of shared data is a read data request
  • it will be judged that the sharing request meets the corresponding usage permission and then Subsequently, according to the corresponding relationship between the saved application identifier and the database, determine the target database 13 corresponding to the target application identifier; obtain the data stored in the target database 13; determine the corresponding target application identifier according to the corresponding relationship between the saved application identifier and the encryption key. the target encryption key; decrypting the obtained data based on the target encryption key; and sending the decrypted data to the device 11 to which the first application belongs.
  • the device 12 to which the target access address belongs can also perform data desensitization processing on the decrypted data, and send the decrypted data to the device 11 after the data desensitization processing.
  • the data is sent to the device 11 to which the first application belongs.
  • existing technology can be used to perform data desensitization processing on the data, which will not be described again here.
  • Figure 3 shows a schematic diagram of the second data sharing process provided by some embodiments. The process includes the following steps:
  • the device 11 to which the first application belongs determines the target access address corresponding to the target application identifier of the second application based on the pre-saved correspondence between the application identifier and the access address, and sends a sharing request for sharing the data of the second application to the target access address.
  • the sharing request carries the target application identifier.
  • the device 12 to which the target access address belongs receives the sharing request. If it is determined that the type of the sharing request is a read data request and the sharing request complies with the usage permissions, then the corresponding target application ID is determined based on the correspondence between the saved application ID and the database.
  • the target database 13 obtain the data stored in the target database 13; determine the target encryption key corresponding to the target application identification according to the corresponding relationship between the saved application identification and the encryption key; decrypt the obtained data based on the target encryption key .
  • the device 12 to which the target access address belongs performs data desensitization processing on the decrypted data, and sends the desensitized data to the device 11 to which the first application belongs. .
  • the device 12 to which the target access address belongs can also determine whether the target application identification carried in the sharing request belongs to the second application.
  • Secondary identification information if the target application identification carried in the sharing request is the secondary identification information of the second application, it can be considered that the data of a certain application needs to be shared with other applications at this time. In order to ensure the security of the data, the above embodiment can be continued. Determine whether the type of the sharing request is a read data request or a write data request. Based on the type of the sharing request and the pre-saved permissions for the first application to use the data of the second application, determine whether the sharing request meets the usage permissions. If If the usage rights are met, subsequent steps such as determining the target database corresponding to the target application identifier 13 will be performed based on the saved correspondence between the application identifier and the database.
  • Figure 4 shows a schematic diagram of a third data sharing process provided by some embodiments. The process includes the following steps:
  • the device 11 to which the first application belongs determines the target access address corresponding to the target application identifier of the second application based on the pre-saved correspondence between the application identifier and the access address, and sends a sharing request for sharing the data of the second application to the target access address.
  • the sharing request carries the target application identifier.
  • S402 The device 12 to which the target access address belongs receives the sharing request. If the target application identification of the second application includes primary identification information and secondary identification information, determine whether the target application identification carried in the sharing request is the secondary identification information of the second application. If yes, proceed to S403.
  • S403 If it is determined that the type of the sharing request is a read data request and the sharing request complies with the usage rights, determine the target database 13 corresponding to the target application ID according to the correspondence between the saved application ID and the database; obtain the target database 13 stored in the target database 13 data; determine the target encryption key corresponding to the target application ID according to the corresponding relationship between the saved application ID and the encryption key; decrypt the acquired data based on the target encryption key.
  • the device 12 to which the target access address belongs performs data desensitization processing on the decrypted data, and sends the desensitized data to the device 11 to which the first application belongs. .
  • the above data sharing system may also include: a management platform and a device to which the second application (such as application A) belongs.
  • the device to which the second application belongs can first send a data storage security protection request to the management platform.
  • the data storage security protection request can carry the name of the second application and the target access address of the second application.
  • the management platform may receive a data storage security protection request sent by the device to which the second application belongs, generate a target application identifier and a target encryption key corresponding to the name of the second application, and save the corresponding relationship between the target application identifier and the target encryption key.
  • the target application identification corresponding to the name of the second application generated by the management platform may include the primary identification information and the secondary identification information mentioned in the above embodiment. It can be understood that the primary identification information and the secondary identification information may correspond to the same A target encryption key.
  • the device 12 to which the target access address belongs may send a key acquisition request to the management platform to acquire the target encryption key corresponding to the second application.
  • the management platform may determine the target encryption key corresponding to the target application identifier of the second application based on the saved correspondence between the application identifier and the encryption key, and send the target encryption key to the device 12 to which the target access address belongs.
  • the device 12 to which the target access address belongs may receive the target encryption key and save the correspondence between the target encryption key and the target application identifier.
  • Figure 5 shows a schematic diagram of the fourth data sharing process provided by some embodiments. The process includes the following steps:
  • the device to which the second application (such as application A) belongs sends a data storage security protection request to the management platform.
  • the data storage security protection request carries the name of the second application and the target access address of the second application.
  • the management platform receives the data storage security protection request sent by the device to which the second application belongs, generates a target application identifier and a target encryption key corresponding to the name of the second application, and saves the corresponding relationship between the target application identifier and the target encryption key.
  • the device 12 to which the target access address belongs sends a key acquisition request to the management platform to obtain the target encryption key corresponding to the second application. After receiving the key acquisition request, the management platform determines the target encryption key corresponding to the target application ID of the second application based on the saved correspondence between the application ID and the encryption key, and sends the target encryption key to the target access address. device 12. The device 12 to which the target access address belongs receives the target encryption key and saves the corresponding relationship between the target encryption key and the target application identifier.
  • S504 The device to which the first application (such as application B) belongs sends an application to share the data of the second application to the management platform, and the application carries the application identifier of the first application itself.
  • the management platform receives the application and sends the application to the device to which the second application belongs.
  • the device to which the second application belongs receives the application and displays the application identification of the first application carried in the application. If it receives a confirmation instruction agreeing to share data with the first application, it sends the confirmation instruction to the management platform.
  • the management platform receives the confirmation instruction and sends the saved target application identification (such as secondary identification information) of the second application and the target access address corresponding to the target application identification to the device 11 to which the first application belongs.
  • the device 11 to which the first application belongs stores the corresponding relationship between the target application identifier and the target access address.
  • the device 11 to which the first application belongs determines the target access address corresponding to the target application identification of the second application based on the pre-saved correspondence between the application identification and the access address, and sends a sharing request for sharing the data of the second application to the target access address.
  • the request carries the target application identifier.
  • the device 12 to which the target access address belongs receives the sharing request, determines the target database 13 corresponding to the target application ID according to the saved application ID and the database; obtains the data saved in the target database 13; and encrypts the data according to the saved application ID.
  • the corresponding relationship between the keys is to determine the target encryption key corresponding to the target application identification; decrypt the acquired data based on the target encryption key; and send the decrypted data to the device 11 to which the first application belongs.
  • the encryption key stored in the management platform may be stored in the trusted execution environment (Trusted Execution Environment, TEE) of the management platform.
  • TEE trusted Execution Environment
  • the target encryption key saved in the management platform may be saved in the trusted execution environment (Trusted Execution Environment, TEE) of the management platform.
  • the encryption key stored in the device 12 to which the target access address belongs may also be stored in the TEE of the device 12 to which the target access address belongs.
  • the target encryption key of the second application may also be stored in the TEE of the device 12 to which the target access address belongs.
  • the management platform can also be based on the set TEE physical storage root key (for convenience of description, called the first TEE physical storage root key). key) to encrypt the encryption keys of each application and store them in its own TEE. That is to say, the encryption keys saved in the management platform can be encrypted based on the set first TEE physical storage root key. key.
  • the management platform sends the target encryption key to the device 12 to which the target access address belongs, if the target encryption key saved in the management platform is an encrypted key based on the set first TEE physical storage root key. key, the management platform can decrypt the target encryption key based on the set first TEE physical storage root key, and send the decrypted target encryption key to the device 12 to which the target access address belongs.
  • the management platform in order to increase the security of the target encryption key, when the management platform sends the target encryption key to the device 12 to which the target access address belongs, the management platform can encrypt the target encryption key based on a temporarily established secure channel. The key is sent to the device 12 to which the target access address belongs.
  • the management platform and the target access address in order to further increase the security of the target encryption key, the management platform and the target access address
  • the device 12 to which it belongs can negotiate a temporary secure channel key, and the management platform can encrypt the target encryption key based on the temporary secure channel key, and send the encrypted target encryption key to the temporarily established secure channel.
  • the device 12 to which the target access address belongs in order to increase the security of the target encryption key, when sending the target encryption key to the device 12 to which the target access address belongs based on the temporarily established secure channel.
  • the device 12 to which the target access address belongs When the device 12 to which the target access address belongs receives the target encryption key encrypted based on the temporary secure channel key, it can decrypt the target encryption key based on the corresponding temporary secure channel key to obtain the decrypted target encryption key. . In a possible implementation, the device 12 to which the target access address belongs can also encrypt the target encryption key based on the set second TEE physical storage root key, and then save the encrypted target encryption key.
  • Figure 6 shows a schematic diagram of the fifth data sharing process provided by some embodiments. The process includes the following steps:
  • the device to which the second application belongs sends a data storage security protection request to the management platform.
  • the data storage security protection request carries the name of the second application and the target access address of the second application.
  • the management platform receives the data storage security protection request sent by the device to which the second application belongs, generates a target application identifier and a target encryption key corresponding to the name of the second application, and generates the target application based on the set first TEE physical storage root key.
  • the target encryption key is encrypted, the encrypted target encryption key is stored in the Trusted Execution Environment (TEE) of the management platform, and the corresponding relationship between the target application identifier and the target encryption key is saved.
  • TEE Trusted Execution Environment
  • the target encryption key is generated and saved in the TEE, and the target encryption key is encrypted based on the first TEE physical storage root key before being saved, it can be ensured that the plaintext of the encryption key does not leave the TEE, and the security of the TEE can be guaranteed. .
  • the device 12 to which the target access address belongs sends a key acquisition request to the management platform to obtain the target encryption key corresponding to the second application.
  • the management platform receives the key acquisition request sent by the device 12 to which the target access address belongs, and determines the target encryption key corresponding to the target application ID of the second application based on the stored correspondence between the application ID and the encryption key.
  • the management platform decrypts the target encryption key based on the first TEE physical storage root key, and encrypts the target encryption key based on the temporary secure channel key negotiated with the device 12 to which the target access address belongs. Based on the temporarily established security channel, and sends the encrypted target encryption key to the device 12 to which the target access address belongs.
  • this application can not only generate and save the target encryption key in the TEE , the target encryption key is encrypted based on the first TEE physical storage root key and then saved, ensuring that the plaintext of the encryption key does not exit the TEE and ensuring the security of the TEE.
  • this application can also send the target encryption key to the device 12 to which the target access address belongs based on the secure channel, which can ensure the security of the target encryption key during the transmission process.
  • this application when this application sends the target encryption key based on the secure channel, it can also encrypt the target encryption key based on the temporary secure channel key before sending it, which can further ensure that the plaintext of the target encryption key is not leaked during the transmission process. This further ensures the security of the target encryption key during transmission.
  • the device 12 to which the target access address belongs receives the target encryption key encrypted based on the temporary secure channel key, decrypts the target encryption key based on the temporary secure channel key, and decrypts the target encryption key based on the set second TEE physical storage root.
  • the key encrypts the target encryption key, stores the encrypted target encryption key in the TEE of the device 12 to which the target access address belongs, and stores the corresponding relationship between the target encryption key and the target application identifier.
  • the device 12 to which the target access address belongs can save the target encryption key in the TEE, and encrypts the target encryption key based on the second TEE physical storage root key before saving it, it can be ensured that the plaintext of the encryption key does not leave the TEE. , which can ensure the safety of TEE.
  • the entire life cycle of the encryption key is carried out in the TEE and encrypted state.
  • the plaintext of the encryption key does not leave the TEE, which can ensure the security of the encryption key.
  • the management platform may send the target application identification to the third application.
  • the device to which the second application belongs can, for example, send the primary identification information in the target application identification to the device to which the second application belongs.
  • the device to which the second application belongs can send a write data request to the target access address.
  • the request carries the data to be written in the database and the target application identification (such as primary identification information) of the second application.
  • the device 12 to which the target access address belongs can receive the write data request, and determine the target encryption key corresponding to the target application ID based on the saved correspondence between the application ID and the encryption key. Based on the target encryption key, the data to be written to the database is The data in is encrypted, and the encrypted data is saved in the corresponding target database 13.
  • managers of the second application can also set corresponding encryption policies, such as fields that need to be encrypted, using Encryption algorithms, encryption rules, etc., where the encryption policy can be flexibly set according to needs.
  • This application does not specifically limit this.
  • the data storage security protection request sent by the device to which the second application belongs to the management platform can carry the encryption policy.
  • the device 12 to which the target access address belongs may send an encryption policy request to obtain the second application to the management platform, and the encryption policy request may carry the target application identifier corresponding to the second application.
  • the management platform can send the encryption policy to the device 12 to which the target access address belongs.
  • the device 12 to which the target access address belongs receives the encryption policy sent by the management platform and saves the corresponding relationship between the target application identifier and the encryption policy.
  • the device 12 to which the target access address belongs can determine the target encryption policy corresponding to the target application ID based on the saved correspondence relationship between the application ID and the encryption policy, and encrypt the data based on the target The key and target encryption policy to encrypt the data to be written to the database.
  • Figure 7 shows a schematic diagram of a data writing process provided by some embodiments.
  • the device to which the second application belongs accesses the address to the target.
  • the pre-encryption module in the figure sends a write data request, which carries the data to be written in the database and the target application identifier of the second application.
  • the device 12 (pre-encryption module) to which the target access address belongs includes an encryption and decryption module and an encryption proxy module.
  • the encryption and decryption module can be deployed in the TEE of the device 12 to which the target access address belongs.
  • the encryption key (target encryption key) is saved, and the corresponding data can be encrypted or decrypted in the TEE based on the target encryption key to ensure the security of the data and encryption key.
  • the encryption proxy module can intercept parsing write data requests, that is, Structured Query Language (SQL), where SQL language is a database query and programming language that can be used Access data, etc.
  • the encryption agent module may determine the target encryption policy corresponding to the target application ID of the second application based on the saved correspondence relationship between the application ID and the encryption policy.
  • the encryption agent module can determine the sub-data that needs to be encrypted in the data to be written to the database based on the target encryption policy, extract the sub-data that needs to be encrypted from the data to be written to the database, and add the sub-data to be written to the database.
  • the plain text data of the sub-data that needs to be encrypted in the data and the target application identification of the second application are sent to the encryption and decryption module.
  • the encryption and decryption module After the encryption and decryption module receives the sub-data that needs to be encrypted and the target application identifier, it can determine the target encryption key corresponding to the target application identifier based on the saved correspondence between the application identifier and the encryption key. In the TEE, based on the target encryption key , encrypt the sub-data that needs to be encrypted, and return the ciphertext data of the encrypted sub-data to the encryption agent module. The encryption agent module re-splices the encrypted sub-data into the data to be written into the database. That is to say, some of the sub-data in the data written into the database can be encrypted ciphertext data.
  • the encryption agent module can save the encrypted data based on the target encryption key and target encryption policy to in the corresponding target database 13.
  • the application of this application uses the database security storage service, it only needs to modify the database access address (target access address) in the database configuration file to point to the pre-encryption module (device 12 to which the target access address belongs), and then the existing database interface can be directly called through the target access address.
  • the application (second application) accesses the database (target database 13) through the pre-encryption module first, and the pre-encryption module intercepts and parses SQL statements and matches encryption strategies, and encrypts the data (data to be written into the database) in the TEE, and then sends the encrypted data (ciphertext) to the target database 13 for corresponding processing and storage.
  • the data sharing method provided by this application is compatible with existing databases. Without changing the existing database client call interface and server database system, the database processing data can be changed from plain text to cipher text, realizing a dense database, even if it is Database privileged accounts or operation and maintenance personnel cannot access the plain text data of the application at the database level, which can conveniently and effectively ensure the security of calculation and storage of user privacy data.
  • the device to which the second application belongs can send a read data request to the target access address, and the read data request can carry the target application of the second application. logo.
  • the device 12 to which the target access address belongs receives the read data request and can determine the target database 13 corresponding to the target application ID according to the saved correspondence between the application ID and the database.
  • the device 12 to which the target access address belongs can then obtain the data saved in the target database 13, and determine the target encryption key corresponding to the target application ID based on the stored correspondence between the application ID and the encryption key. Based on the target encryption key, The obtained data is decrypted and the decrypted data is sent to the device to which the second application belongs.
  • the device 12 to which the target access address belongs can send an encryption policy request for obtaining the second application to the management platform, and the encryption policy request can carry the target application identifier corresponding to the second application. If the data storage security protection request sent by the device to which the second application belongs carries an encryption policy for the data, the management platform can send the encryption policy to the device 12 to which the target access address belongs. The device 12 to which the target access address belongs receives the encryption policy and saves the correspondence between the target application identifier and the encryption policy.
  • the device 12 to which the target access address belongs can determine the target encryption policy corresponding to the target application identifier based on the saved correspondence between the application identifier and the encryption policy, and decrypt the data obtained from the target database 13 based on the target encryption key and the target encryption policy, and send the decrypted data to the device to which the second application belongs.
  • Figure 8 shows a schematic diagram of a data reading process provided by some embodiments.
  • the device to which the second application belongs accesses the target address (called the application in the figure).
  • the pre-encryption module sends a read data request, where the read data request carries the target application identifier of the second application.
  • the device 12 (pre-encryption module) to which the target access address belongs includes an encryption and decryption module and an encryption proxy module, where the encryption proxy module can intercept parsing and reading data requests, that is, SQL.
  • the encryption agent module determines the target database 13 corresponding to the target application identifier based on the stored correspondence between the application identifier and the database; and obtains the data stored in the target database 13 .
  • the encryption agent module determines the target encryption policy corresponding to the target application ID of the second application based on the stored correspondence between the application ID and the encryption policy.
  • the encryption agent module can determine the encrypted sub-data in the data obtained from the target database 13 based on the target encryption policy, extract the encrypted sub-data from the data, and identify the encrypted sub-data with the target application of the second application. Sent to the encryption and decryption module.
  • the encryption and decryption module can determine the target encryption key corresponding to the target application identification based on the saved correspondence between the application identification and the encryption key. Based on the target encryption key, the encrypted sub-data can be The data is decrypted and the plaintext data of the decrypted sub-data is returned to the encryption agent module.
  • the encryption agent module re-splices the decrypted sub-data into the data obtained from the target database 13, and the encryption agent module can send the decrypted data to the device to which the second application belongs.
  • the device 12 to which the target access address belongs sends an encryption policy request to obtain the second application to the management platform.
  • the encryption policy request carries the target application identification corresponding to the second application. If the second application belongs to
  • the data storage security protection request sent by the device carries the encryption policy for the data.
  • the management platform sends the encryption policy to the device 12 to which the target access address belongs; the device 12 to which the target access address belongs receives the encryption policy and saves the target application identification and encryption policy.
  • the device 12 to which the target access address belongs After the corresponding relationship is established, if the device 12 to which the target access address belongs receives a sharing request sent by the device to which the first application belongs, the device 12 to which the target access address belongs can determine the target application identifier according to the saved correspondence relationship between the application identifier and the encryption policy. Corresponding target encryption policy; based on the target encryption key and the target encryption policy, decrypt the data obtained from the target database 13 and send the decrypted data to the device to which the first application belongs. The process of decrypting the data obtained from the target database 13 based on the target encryption key and the target encryption policy is the same as the above embodiment, and will not be described again here.
  • the device 12 to which the target access address belongs can be integrated into the device to which the second application belongs, or the device 12 to which the target access address belongs (pre-encryption module) Deployed into an encryption gateway cluster.
  • the device 12 (pre-encryption module) to which the target access address belongs can be integrated into the device to which the application belongs.
  • Figure 9 shows a schematic diagram of a data security storage process provided by some embodiments.
  • the target access can be The device 12 (pre-encryption module) to which the address belongs is deployed in the encryption gateway cluster.
  • the device to which each second application belongs can be deployed in the encryption gateway cluster.
  • the device 12 (pre-encryption module) to which the target access address belongs sends a write data request.
  • the data to be written in the database carried in the write data request is plaintext data.
  • the target access address belongs to The device 12 (pre-encryption module) can determine the target encryption key corresponding to the target application identification of the second application based on the saved correspondence between the application identification and the encryption key, and based on the target encryption key, perform the second application identification on the target encryption key.
  • the data to be written in the database of the application is encrypted, and the encrypted data (ciphertext) is saved in the target database 13 corresponding to the second application.
  • different applications can correspond to different databases, that is, each application can correspond to a dedicated database.
  • this application can encrypt the data of different second applications based on different encryption keys, so that automatic security isolation of data between applications can be achieved according to different applications, and the security of the data can be increased.
  • each device to which a second application belongs can send a data read request to the device 12 (pre-encryption module) to which the target access address deployed in the encryption gateway cluster belongs.
  • the device 12 (pre-encryption module) to which the target access address belongs can determine the target database 13 corresponding to the target application identifier of the second application based on the correspondence between the saved application identifier and the database; obtain the corresponding data of the second application stored in the target database 13.
  • the data obtained from the database is encrypted data, that is, ciphertext data;
  • the device 12 (pre-encryption module) to which the target access address belongs determines the target encryption key corresponding to the target application identifier of the second application based on the correspondence between the saved application identifier and the encryption key, decrypts the obtained data based on the target encryption key, and sends the decrypted data (plaintext) to the device to which the second application belongs.
  • the management platform can be deployed in a separate device, or in the device 11 to which the first application belongs or the device to which the second application belongs.
  • This application does not specifically limit this. It can be based on Flexible setting on demand.
  • Figure 10 is a schematic diagram of a data sharing scenario provided by some embodiments of the present application. As shown in Figure 10, the process may include: (1) a second application (application A) registration authorization process, (2) a target encryption key transmission process, (3) a second application writing or reading data process, (4) a first application (application B) applying to share the second application's data, (5) the first application sharing the second application's data, and other steps.
  • the registration and authorization process of the second application may include:
  • the device to which the second application belongs sends a data storage security protection request to the management platform, and the data storage security protection request carries the name of the second application and the target access address of the second application.
  • the management platform receives the data storage security protection request, generates a target application identifier and a target encryption key corresponding to the name of the second application, and saves the correspondence between the target application identifier and the target encryption key.
  • the generated target encryption key can be saved in the TEE of the management platform.
  • the target application identifier generated by the management platform includes primary identification information and secondary identification information, wherein the primary identification information is sent to the device to which the second application belongs, and the device to which the second application belongs saves the correspondence between the primary identification information and the target access address in its database configuration file, wherein the target access address can be the address of the pre-encryption module.
  • the target encryption key transmission process may include:
  • the device 12 (pre-encryption module) to which the target access address belongs sends a key acquisition request to the management platform to obtain the target encryption key corresponding to the second application.
  • the management platform receives the key acquisition request, determines the target encryption key corresponding to the target application ID of the second application based on the correspondence between the saved application ID and the encryption key, and sends the target encryption key to the target through the established secure encryption channel.
  • the device 12 to which the target access address belongs receives the target encryption key, saves the target encryption key in the TEE, and saves the corresponding relationship between the target encryption key and the target application identification of the second application.
  • the process of the second application writing data is: the device to which the second application belongs sends a write data request to the target access address, and the write data request carries the data to be written in the database and the target application identification of the second application (such as primary identification information).
  • the encryption agent module in the device 12 (pre-encryption module) to which the target access address belongs receives the write data request and recognizes that the target application identification carried in the write data request is the main identification information of the second application, then it can be considered that the write data request
  • the data input request is a compliance request for the second application to write data in the database corresponding to the second application itself.
  • the corresponding data writing process can be carried out based on the application's main logic (main Schema), that is, the data to be written can be
  • the data (plain text) in the database is sent to the encryption and decryption module in the device 12 (pre-encryption module) to which the target access address belongs.
  • the encryption and decryption module is configured in the TEE, and the encryption key is stored in the encryption and decryption module.
  • the encryption and decryption module determines the target encryption key corresponding to the target application ID based on the corresponding relationship between the saved application ID and the encryption key. Based on the target encryption key, it encrypts the data to be written into the database and converts the encrypted data (encrypted data) into the database.
  • text is sent to the encryption agent module, and the encryption agent module saves the encrypted data in the target database 13 corresponding to the second application.
  • the process of the second application reading data is as follows: the device to which the second application belongs sends a read data request to the target access address, and the read data request carries the target application identification (such as primary identification information) of the second application.
  • the encryption agent module in the device 12 (pre-encryption module) to which the target access address belongs receives the read data request and recognizes that the target application identification carried in the read data request is the main identification information of the second application, then it can be considered that the read data request
  • the data retrieval request is a compliance request for the second application to read the data in the database corresponding to the second application itself.
  • the corresponding data reading process can be carried out based on the application's main logic (main Schema), that is, it can be based on the saved application identifier.
  • the corresponding relationship with the database is to determine the target database 13 corresponding to the target application identifier; and obtain the data stored in the target database 13.
  • the encryption agent module sends the obtained data (ciphertext) to the encryption and decryption module.
  • the encryption and decryption module determines the target encryption key corresponding to the target application ID based on the saved correspondence between the application ID and the encryption key. Based on the target encryption key, The obtained data is decrypted, and the decrypted data is sent to the encryption agent module.
  • the encryption agent module sends the decrypted data to the device to which the second application belongs.
  • the process of the first application (Application B) applying to share the data of the second application may include:
  • the device to which the first application (Application B) belongs sends an application for sharing the data of the second application (Application A) to the management platform, and the application carries the application identifier of the first application.
  • the management platform receives the application and sends the application to the device to which the second application belongs.
  • the device to which the second application belongs receives the application and displays the application identification of the first application carried in the application. If it receives a confirmation instruction agreeing to the first application sharing data, it sends the confirmation instruction to the management platform.
  • the management platform receives the confirmation instruction and sends the saved secondary identification information in the target application identification of the second application and the target access address corresponding to the target application identification information to the device 11 to which the first application belongs.
  • the device 11 to which the first application belongs stores the corresponding relationship between the secondary identification information of the second application and the target access address.
  • the process of the first application sharing the data of the second application includes:
  • the device to which the first application (Application B) belongs determines the target access address corresponding to the target application identification (such as secondary identification information) of the second application based on the pre-saved correspondence between the application identification and the access address, and sends the shared first access address to the target access address.
  • a sharing request for application data The sharing request carries the target application identifier (such as secondary identification information).
  • the encryption proxy module in the terminal of the device 12 to which the target access address belongs determines whether the target application identification carried in the sharing request is the secondary identification information of the second application. If so, the corresponding shared data is processed based on the application secondary logic (secondary Schema). process, that is, it can be determined whether the type of the sharing request is a read data request or a write data request, if the sharing request is a read data request, and the pre-saved first application's permission to use the second application's data includes the first If the application can read the data of the second application, it is considered that the sharing request complies with the usage rights.
  • the application secondary logic secondary Schema
  • the target database 13 corresponding to the target application identification can be determined; the data saved in the target database 13 can be obtained.
  • the encryption agent module sends the data obtained from the target database 13 to the encryption and decryption module.
  • the encryption and decryption module determines the target encryption key corresponding to the target application ID based on the stored correspondence between the application ID and the encryption key. Decrypt the obtained data and send the decrypted data to the encryption agent module.
  • the encryption agent module sends the decrypted data to the device 11 to which the first application belongs.
  • FIG. 11 shows a schematic diagram of the sixth data sharing process provided by some embodiments.
  • the data sharing method includes the following steps:
  • S1101 Determine the target access address corresponding to the target application identifier of the second application based on the pre-saved correspondence between the application identifier and the access address, and send a sharing request for sharing the data of the second application to the target access address,
  • the sharing request carries the target application identifier.
  • S1102 Receive the decrypted data of the second application sent by the device to which the target access address belongs.
  • the device to which the first application belongs may be a PC, a mobile terminal, or other equipment, or may be a server or other equipment.
  • the method before determining the target access address corresponding to the target application identifier of the second application based on the pre-saved correspondence between the application identifier and the access address, the method further includes:
  • the target application identification of the second application and the target access address corresponding to the target application identification information sent by the management platform are received, the corresponding relationship between the target application identification and the target access address is saved.
  • FIG12 shows a seventh data sharing process schematic diagram provided by some embodiments, and the data sharing process includes the following steps:
  • S1201 Receive a sharing request sent by the device to which the first application belongs, where the sharing request carries the target application identifier.
  • S1202 Determine the target database corresponding to the target application identifier according to the corresponding relationship between the saved application identifier and the database; obtain the data stored in the target database.
  • S1203 Determine the target encryption key corresponding to the target application ID according to the corresponding relationship between the saved application ID and the encryption key; decrypt the obtained data based on the target encryption key; send the decrypted data to The device to which the first application belongs.
  • the device to which the target access address belongs can be a PC, a mobile terminal, or other equipment, or a server or other equipment.
  • the above methods after receiving the sharing request sent by the device to which the first application belongs, and before determining the target database corresponding to the target application identifier based on the saved correspondence relationship between the application identifier and the database, the above methods also include:
  • the method further includes :
  • the acquired data contains set sensitive data, perform data desensitization processing on the decrypted data;
  • the sending of the decrypted data to the device to which the first application belongs includes:
  • the method further includes :
  • target application identification of the second application includes primary identification information and secondary identification information, determine whether the target application identification carried in the sharing request is the secondary identification information of the second application, and if so, perform subsequent steps.
  • the method before receiving the sharing request sent by the device to which the first application belongs, the method further includes:
  • the corresponding relationship between the target encryption key and the target application identifier is saved.
  • the method after receiving the target encryption key corresponding to the second application sent by the management platform and before saving the corresponding relationship between the target encryption key and the target application identification, the method also includes:
  • the received target encryption key is a target encryption key encrypted based on the temporary secure channel key negotiated with the management platform
  • the target encryption key is decrypted based on the temporary secure channel key.
  • saving the target encryption key includes:
  • the target encryption key is encrypted based on the set second TEE physical storage root key, and the encrypted target encryption key is saved.
  • the method further includes:
  • the target encryption key corresponding to the target application identification is determined. Based on the target encryption key, the data to be written in the database is encrypted and the encrypted data is encrypted. The data is saved to the corresponding target database.
  • encrypting the data to be written in the database based on the target encryption key includes:
  • the target encryption strategy corresponding to the target application identification is determined; based on the target encryption key and the target encryption strategy, the data to be written in the database is encryption.
  • the method further includes:
  • the target encryption key corresponding to the target application identification is determined, the obtained data is decrypted based on the target encryption key, and the decrypted data is sent to the The device to which the second application belongs.
  • decrypting the obtained data based on the target encryption key includes:
  • the acquired data is decrypted based on the target encryption key and the target encryption policy.
  • FIG. 13 shows a schematic diagram of the eighth data sharing process provided by some embodiments.
  • the data sharing method includes the following steps:
  • the device to which the second application belongs may be a PC, a mobile terminal, or other equipment, or a server or other equipment.
  • the method further includes:
  • the method further includes:
  • the method further includes:
  • FIG. 14 shows a schematic diagram of the ninth data sharing process provided by some embodiments.
  • the data sharing process includes the following steps :
  • S1401 Receive an application for sharing data of the second application sent by the device to which the first application belongs, where the application carries the application identifier of the first application.
  • S1402 Send the application to the device to which the second application belongs.
  • the method before receiving an application for sharing data of the second application sent by the device to which the first application belongs, the method further includes:
  • Receive the data storage security protection request generate a target application identifier and a target encryption key corresponding to the name of the second application, and save the corresponding relationship between the target application identifier and the target encryption key;
  • the target encryption key corresponding to the target application identifier of the second application is determined, and the target encryption key is sent to the device to which the target access address belongs.
  • the method after determining the target encryption key corresponding to the target application identification of the second application and before sending the target encryption key to the device to which the target access address belongs, the method also includes:
  • the saved target encryption key is a key encrypted based on the set first TEE physical storage root key, decrypt the target encryption key based on the first TEE physical storage root key;
  • sending the target encryption key to the device to which the target access address belongs includes:
  • the target encryption key is sent to the device to which the target access address belongs.
  • sending the target encryption key to the device to which the target access address belongs based on the established secure channel includes:
  • the method further includes:
  • the encryption policy is sent to the device to which the target access address belongs, so that the The device to which the target access address belongs stores the corresponding relationship between the target application identifier and the encryption policy.
  • this application provides a data sharing device, which is applied to the device to which the first application belongs.
  • Figure 15 shows a schematic diagram of the first data sharing device provided by some embodiments.
  • the device includes:
  • the first determination module 151 is configured to determine the target access address corresponding to the target application identifier of the second application based on the pre-saved correspondence between the application identifier and the access address, and send data sharing the second application to the target access address.
  • a sharing request the sharing request carries the target application identifier;
  • the first receiving module 152 is configured to receive the decrypted data of the second application sent by the device to which the target access address belongs.
  • the first determination module 151 is also configured to send an application for sharing the data of the second application to the management platform, where the application carries the application identification of the first application; if After receiving the target application identification of the second application and the target access address corresponding to the target application identification information sent by the management platform, the corresponding relationship between the target application identification and the target access address is saved.
  • FIG. 16 shows a schematic diagram of the second data sharing device provided by some embodiments.
  • the device includes:
  • the second receiving module 161 is used to receive a sharing request sent by a device to which the first application belongs, wherein the sharing request carries the target application identifier;
  • the second determination module 162 is used to determine the target database corresponding to the target application identifier according to the corresponding relationship between the saved application identifier and the database; and obtain the data saved in the target database;
  • the encryption and decryption module 163 is configured to determine the target encryption key corresponding to the target application identification based on the stored correspondence between the application identification and the encryption key; decrypt the obtained data based on the target encryption key; and decrypt the decrypted data. The resulting data is sent to the device to which the first application belongs.
  • the second determination module 162 is also configured to determine whether the type of the sharing request is a read data request or a write data request, based on the type of the sharing request and all pre-saved data.
  • the usage rights of the first application to the data of the second application are determined to determine whether the sharing request complies with the usage rights. If so, the target application identification is subsequently determined based on the corresponding relationship between the saved application identification and the database. Corresponding steps for the target database.
  • the encryption and decryption module 163 is also used to perform data desensitization processing on the decrypted data if the acquired data contains set sensitive data; The resulting data is sent to the device to which the first application belongs.
  • the second determination module 162 is further configured to determine the target application identification carried in the sharing request if the target application identification of the second application includes primary identification information and secondary identification information. Whether it is the secondary identification information of the second application, if so, perform the subsequent step of determining whether the type of the sharing request is a read data request or a write data request.
  • the second receiving module 161 is also configured to send a key acquisition request to the management platform to obtain the target encryption key corresponding to the second application;
  • the target encryption key corresponding to the second application is stored, and the corresponding relationship between the target encryption key and the target application identifier is saved.
  • the second receiving module 161 is further used to decrypt the target encryption key based on the temporary secure channel key if the received target encryption key is a target encryption key encrypted based on the temporary secure channel key negotiated with the management platform.
  • the second receiving module 161 is specifically configured to encrypt the target encryption key based on the set second TEE physical storage root key, and save the encrypted target encryption key. .
  • the encryption and decryption module 163 is also configured to receive a write data request sent by the device to which the second application belongs, where the write data request carries the data to be written in the database and the The target application identification of the second application; according to the corresponding relationship between the saved application identification and the encryption key, determine the target encryption key corresponding to the target application identification, and based on the target encryption key, the to-be-written database Encrypt the data in the database and save the encrypted data to the corresponding target database.
  • the encryption and decryption module 163 is specifically configured to determine the target encryption policy corresponding to the target application ID based on the pre-saved correspondence between the application ID and the encryption policy; based on the target encryption key The key and the target encryption policy are used to encrypt the data to be written in the database.
  • the encryption and decryption module 163 is also configured to receive a read data request sent by the device to which the second application belongs, where the read data request carries the target application identification of the second application. ; According to the corresponding relationship between the saved application identification and the database, determine the target database corresponding to the target application identification; obtain the data saved in the target database; according to the corresponding relationship between the saved application identification and the encryption key, determine the target Apply the target encryption key corresponding to the identification, decrypt the acquired data based on the target encryption key, and send the decrypted data to the device to which the second application belongs.
  • the encryption and decryption module 163 is specifically configured to determine the target encryption policy corresponding to the target application ID based on the pre-saved correspondence between the application ID and the encryption policy; based on the target encryption key The key and the target encryption policy are used to decrypt the obtained data.
  • this application provides a data sharing device, which is applied to the device to which the second application belongs.
  • Figure 17 shows a schematic diagram of the third data sharing device provided by some embodiments.
  • the device includes:
  • the display module 171 is configured to display the application identification of the first application carried in the application upon receiving an application sent by the management platform;
  • the first sending module 172 is configured to send a confirmation instruction to the management platform if a confirmation instruction is received agreeing to share data with the first application.
  • the first sending module 172 is also configured to send a data storage security protection request to the management platform, where the data storage security protection request carries the name of the second application and the name of the second application. The target access address of the second application.
  • the first sending module 172 is also configured to send a write data request to the target access address, where the write data request carries the data to be written in the database and the The target application identifier of the second application.
  • the first sending module 172 is further configured to send a read data request to the target access address, where the read data request carries the target application identification of the second application; Receive decrypted data sent by the device to which the target access address belongs.
  • FIG. 18 shows a schematic diagram of the fourth data sharing device provided by some embodiments.
  • the device includes:
  • the third receiving module 181 is configured to receive an application for sharing the data of the second application sent by the device to which the first application belongs, where the application carries the application identifier of the first application;
  • the second sending module 182 is used to send the application to the device to which the second application belongs; if a confirmation instruction sent by the device to which the second application belongs agrees with the sharing of data by the first application is received, the application will be saved.
  • the target application identification of the second application and the target access address corresponding to the target application identification information are sent to the device to which the first application belongs.
  • the third receiving module 181 is also used to receive a data storage security protection request sent by the device to which the second application belongs, the data storage security protection request carrying the name of the second application and the target access address of the second application; receiving the data storage security protection request, generating a target application identifier and a target encryption key corresponding to the name of the second application, and saving the correspondence between the target application identifier and the target encryption key; if a key acquisition request for obtaining the target encryption key corresponding to the second application is received from the device to which the target access address belongs; determining the target encryption key corresponding to the target application identifier of the second application according to the saved correspondence between the application identifier and the encryption key, and sending the target encryption key to the device to which the target access address belongs.
  • the third receiving module 181 is also configured to, if the saved target encryption key is a key encrypted based on the set first TEE physical storage root key, based on the set The first TEE physical storage root key decrypts the target encryption key; and sends the decrypted target encryption key to the device to which the target access address belongs.
  • the third receiving module 181 is specifically configured to send the target encryption key to the device to which the target access address belongs based on the established secure channel.
  • the third receiving module 181 is specifically configured to encrypt the target encryption key based on a temporary secure channel key negotiated with the device to which the target access address belongs.
  • the secure channel is used to send the encrypted target encryption key to the device to which the target access address belongs.
  • the second sending module 182 is further configured to receive an encryption policy request for obtaining the second application sent by the device to which the target access address belongs, wherein the encryption policy request carries The target application identifier corresponding to the second application; if the data storage security protection request sent by the device to which the second application corresponding to the target application identifier belongs carries an encryption policy for data, send the encryption policy to the device.
  • the device to which the target access address belongs allows the device to which the target access address belongs to save the corresponding relationship between the target application identifier and the encryption policy.
  • Figure 19 shows a schematic structural diagram of an electronic device provided by some embodiments. As shown in Figure 19, it includes: a processor 191, a communication interface 192, and a memory. 193 and communication bus 194, wherein the processor 191, communication interface 192, and memory 193 complete communication with each other through the communication bus 194;
  • a computer program is stored in the memory 193.
  • the processor 191 is caused to perform the steps of any of the above data sharing methods.
  • the communication bus mentioned in the above-mentioned electronic equipment can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc.
  • PCI Peripheral Component Interconnect
  • EISA Extended Industry Standard Architecture
  • the communication bus can be divided into address bus, data bus, control bus, etc. For ease of presentation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.
  • the communication interface 192 is used for communication between the above-mentioned electronic device and other devices.
  • the memory may include random access memory (Random Access Memory, RAM) or non-volatile memory (Non-Volatile Memory, NVM), such as at least one disk memory.
  • RAM Random Access Memory
  • NVM Non-Volatile Memory
  • the memory may also be at least one storage device located remotely from the aforementioned processor.
  • the above-mentioned processor can be a general-purpose processor, including a central processing unit, a network processor (Network Processor, NP), etc.; it can also be a digital instruction processor (Digital Signal Processing, DSP), an application-specific integrated circuit, a field programmable gate array, or Other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.
  • NP Network Processor
  • DSP Digital Signal Processing
  • inventions of the present application provide a computer-readable storage medium.
  • the computer-readable storage medium stores a computer program that can be executed by an electronic device. When the program is run on the electronic device, , so that the electronic device implements the steps of any of the above data sharing methods when executed.
  • the above-mentioned computer-readable storage media can be any available media or data storage devices that can be accessed by the processor in the electronic device, including but not limited to magnetic memories such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc., and optical memories such as CDs. , DVD, BD, HVD, etc., as well as semiconductor memories such as ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid state drive (SSD), etc.
  • magnetic memories such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc.
  • optical memories such as CDs. , DVD, BD, HVD, etc.
  • semiconductor memories such as ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid state drive (SSD), etc.
  • the present application provides a computer program product, which includes: computer program code, when the computer program code runs on a computer, it enables the computer to execute the steps of any of the data sharing methods described above.
  • embodiments of the present application may be provided as methods, systems, or computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment that combines software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.
  • computer-usable storage media including, but not limited to, disk storage, CD-ROM, optical storage, etc.
  • These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device that implements the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.
  • These computer program instructions may also be loaded onto a computer or other programmable data processing device, causing a series of operating steps to be performed on the computer or other programmable device to produce computer-implemented processing, thereby executing on the computer or other programmable device.
  • Instructions provide steps for implementing the functions specified in a process or processes of a flowchart diagram and/or a block or blocks of a block diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • General Health & Medical Sciences (AREA)
  • Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • General Physics & Mathematics (AREA)
  • Bioethics (AREA)
  • Databases & Information Systems (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Medical Informatics (AREA)
  • Computing Systems (AREA)
  • Storage Device Security (AREA)
  • Signal Processing For Digital Recording And Reproducing (AREA)

Abstract

本申请公开了一种数据共享系统、方法、装置、设备及介质，用于在保障每个应用的数据的安全的前提下，实现多个应用之间可以共享数据。本申请第一应用所属的设备根据预先保存的应用标识与访问地址的对应关系，确定第二应用的目标应用标识对应的目标访问地址，向目标访问地址发送共享第二应用的数据的共享请求，该共享请求中携带目标应用标识；目标访问地址所属的设备获取目标数据库中保存的数据；确定目标应用标识对应的目标加密密钥；基于目标加密密钥对获取的数据进行解密；将解密后的数据发送给第一应用所属的设备，从而在保障每个应用的数据的安全的前提下，实现多个应用之间可以共享数据。

Description

一种数据共享系统、方法、装置、设备及介质
相关申请的交叉引用
本申请要求在2022年09月19日提交中国专利局、申请号为202211147485.8、申请名称为“一种数据共享系统、方法、装置、设备及介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及数据共享技术领域，尤其涉及一种数据共享系统、方法、装置、设备及介质。
背景技术
传统数据保护主要侧重于在数据传输和写入存储介质时对其进行加密保护。当前针对应用的数据在计算状态(也即使用状态)下的安全保障能力不足，导致数据安全链条缺失最重要一环，因此，保障应用的数据在计算状态下的安全十分必要。
然而，即便可以保障每个应用在计算状态下的数据的安全，由于在实际应用场景中，通常存在多个应用之间需要共享数据的情况，在保障每个应用在计算状态下的数据的安全的前提下，如何实现多个应用之间可以共享数据，也是目前亟需解决的一个技术问题。
发明内容
本申请提供了一种数据共享系统、方法、装置、设备及介质，用于在保障每个应用的数据的安全的前提下，实现多个应用之间可以共享数据。
第一方面，本申请提供了一种数据共享系统，所述系统包括：
第一应用所属的设备，用于根据预先保存的应用标识与访问地址的对应关系，确定第二应用的目标应用标识对应的目标访问地址，向所述目标访问 地址发送共享所述第二应用的数据的共享请求，所述共享请求中携带所述目标应用标识；
所述目标访问地址所属的设备，用于接收所述共享请求，根据保存的应用标识与数据库的对应关系，确定所述目标应用标识对应的目标数据库；获取所述目标数据库中保存的数据；根据保存的应用标识与加密密钥的对应关系，确定所述目标应用标识对应的目标加密密钥；基于所述目标加密密钥，对获取的数据进行解密；将解密后的数据发送给所述第一应用所属的设备；
所述目标数据库，用于存储数据。
第二方面，本申请提供了一种数据共享方法，所述方法应用于第一应用所属的设备，所述方法包括：
根据预先保存的应用标识与访问地址的对应关系，确定第二应用的目标应用标识对应的目标访问地址，向所述目标访问地址发送共享所述第二应用的数据的共享请求，所述共享请求中携带所述目标应用标识；
接收所述目标访问地址所属的设备发送的解密后的所述第二应用的数据。
第三方面，本申请提供了一种数据共享方法，所述方法应用于目标访问地址所属的设备，所述方法包括：
接收第一应用所属的设备发送的共享请求，所述共享请求中携带所述目标应用标识；
根据保存的应用标识与数据库的对应关系，确定所述目标应用标识对应的目标数据库；获取所述目标数据库中保存的数据；
根据保存的应用标识与加密密钥的对应关系，确定所述目标应用标识对应的目标加密密钥；基于所述目标加密密钥，对获取的数据进行解密；将解密后的数据发送给所述第一应用所属的设备。
第四方面，本申请提供了一种数据共享方法，所述方法应用于第二应用所属的设备，所述方法包括：
若接收到管理平台发送的申请，展示所述申请中携带的第一应用的应用标识；
若接收到同意所述第一应用共享数据的确认指令，将所述确认指令发送给所述管理平台。
第五方面，本申请提供了一种数据共享方法，所述方法应用于管理平台，所述方法包括：
接收第一应用所属的设备发送的共享所述第二应用的数据的申请，所述申请中携带所述第一应用的应用标识；
将所述申请发送给所述第二应用所属的设备；
若接收到所述第二应用所属的设备发送的同意所述第一应用共享数据的确认指令，将保存的所述第二应用的目标应用标识及所述目标应用标识信息对应的目标访问地址发送给所述第一应用所属的设备。
第六方面，本申请提供了一种数据共享装置，所述装置包括：
第一确定模块，用于根据预先保存的应用标识与访问地址的对应关系，确定第二应用的目标应用标识对应的目标访问地址，向所述目标访问地址发送共享所述第二应用的数据的共享请求，所述共享请求中携带所述目标应用标识；
第一接收模块，用于接收所述目标访问地址所属的设备发送的解密后的所述第二应用的数据。
第七方面，本申请提供了一种数据共享装置，所述装置包括：
第二接收模块，用于接收第一应用所属的设备发送的共享请求，所述共享请求中携带所述目标应用标识；
第二确定模块，用于根据保存的应用标识与数据库的对应关系，确定所述目标应用标识对应的目标数据库；获取所述目标数据库中保存的数据；
加解密模块，用于根据保存的应用标识与加密密钥的对应关系，确定所述目标应用标识对应的目标加密密钥；基于所述目标加密密钥，对获取的数据进行解密；将解密后的数据发送给所述第一应用所属的设备。
第八方面，本申请提供了一种数据共享装置，所述装置包括：
展示模块，用于若接收到管理平台发送的申请，展示所述申请中携带的 第一应用的应用标识；
第一发送模块，用于若接收到同意所述第一应用共享数据的确认指令，将所述确认指令发送给所述管理平台。
第九方面，本申请提供了一种数据共享装置，所述装置包括：
第三接收模块，用于接收第一应用所属的设备发送的共享所述第二应用的数据的申请，所述申请中携带所述第一应用的应用标识；
第二发送模块，用于将所述申请发送给所述第二应用所属的设备；若接收到所述第二应用所属的设备发送的同意所述第一应用共享数据的确认指令，将保存的所述第二应用的目标应用标识及所述目标应用标识信息对应的目标访问地址发送给所述第一应用所属的设备。
第十方面，本申请提供了一种电子设备，其包括处理器和存储器，其中，所述存储器存储有程序代码，当所述程序代码被所述处理器执行时，使得所述处理器执行上述第二方面-第五方面任一项所述方法的步骤。
第十一方面，本申请提供了一种计算机可读存储介质，其包括程序代码，当所述存储介质在电子设备上运行时，所述程序代码用于使所述电子设备执行上述第二方面-第五方面任一项所述方法的步骤。
由于本申请实施例中，第一应用所属的设备可以根据预先保存的应用标识与访问地址的对应关系，确定第二应用的目标应用标识对应的目标访问地址，向目标访问地址发送共享第二应用的数据的共享请求，该共享请求中携带所述目标应用标识；目标访问地址所属的设备可以接收该共享请求，根据保存的应用标识与数据库的对应关系，确定目标应用标识对应的目标数据库；获取目标数据库中保存的数据；根据保存的应用标识与加密密钥的对应关系，确定目标应用标识对应的目标加密密钥；基于目标加密密钥对获取的数据进行解密；将解密后的数据发送给第一应用所属的设备；基于此，可以在保障每个应用的数据的安全的前提下，实现多个应用之间可以共享数据的目的。
附图说明
为了更清楚地说明本申请实施例或相关技术中的实施方式，下面将对实施例或相关技术描述中所需要使用的附图作一简单地介绍，显而易见地，下面描述中的附图是本申请的一些实施例，对于本领域普通技术人员来讲，还可以根据这些附图获得其他的附图。
图1示出了一些实施例提供的一种数据共享系统示意图；
图2示出了一些实施例提供的第一种数据共享过程示意图；
图3示出了一些实施例提供的第二种数据共享过程示意图；
图4示出了一些实施例提供的第三种数据共享过程示意图；
图5示出了一些实施例提供的第四种数据共享过程示意图；
图6示出了一些实施例提供的第五种数据共享过程示意图；
图7示出了一些实施例提供的一种写入数据过程示意图；
图8示出了一些实施例提供的一种读取数据过程示意图；
图9示出了一些实施例提供的一种数据安全存储过程示意图；
图10为本申请一些实施例提供的一种数据共享场景示意图；
图11示出了一些实施例提供的第六种数据共享过程示意图；
图12示出了一些实施例提供的第七种数据共享过程示意图；
图13示出了一些实施例提供的第八种数据共享过程示意图；
图14示出了一些实施例提供的第九种数据共享过程示意图；
图15示出了一些实施例提供的第一种数据共享装置示意图；
图16示出了一些实施例提供的第二种数据共享装置示意图；
图17示出了一些实施例提供的第三种数据共享装置示意图；
图18示出了一些实施例提供的第四种数据共享装置示意图；
图19示出了一些实施例提供的一种电子设备结构示意图。
具体实施方式
为了在保障每个应用的数据的安全的前提下，实现多个应用之间可以共 享数据，本申请提供了一种数据共享系统、方法、装置、设备及介质。
为使本申请的目的和实施方式更加清楚，下面将结合本申请示例性实施例中的附图，对本申请示例性实施方式进行清楚、完整地描述，显然，描述的示例性实施例仅是本申请一部分实施例，而不是全部的实施例。
需要说明的是，本申请中对于术语的简要说明，仅是为了方便理解接下来描述的实施方式，而不是意图限定本申请的实施方式。除非另有说明，这些术语应当按照其普通和通常的含义理解。
本申请中说明书和权利要求书及上述附图中的术语“第一”、“第二”、“第三”等是用于区别类似或同类的对象或实体，而不必然意味着限定特定的顺序或先后次序，除非另外注明。应该理解这样使用的用语在适当情况下可以互换。
术语“包括”和“具有”以及他们的任何变形，意图在于覆盖但不排他的包含，例如，包含了一系列组件的产品或设备不必限于清楚地列出的所有组件，而是可包括没有清楚地列出的或对于这些产品或设备固有的其它组件。
术语“模块”是指任何已知或后来开发的硬件、软件、固件、人工智能、模糊逻辑或硬件或/和软件代码的组合，能够执行与该元件相关的功能。
最后应说明的是：以上各实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述各实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分或者全部技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的范围。
图1示出了一些实施例提供的一种数据共享系统示意图，如图1所示，该系统包括：
第一应用所属的设备11，用于根据预先保存的应用标识与访问地址的对应关系，确定第二应用的目标应用标识对应的目标访问地址，向所述目标访问地址发送共享所述第二应用的数据的共享请求，所述共享请求中携带所述目标应用标识；
所述目标访问地址所属的设备12，用于接收所述共享请求，根据保存的应用标识与数据库的对应关系，确定所述目标应用标识对应的目标数据库13；获取所述目标数据库13中保存的数据；根据保存的应用标识与加密密钥的对应关系，确定所述目标应用标识对应的目标加密密钥；基于所述目标加密密钥，对获取的数据进行解密；将解密后的数据发送给所述第一应用所属的设备11；
所述目标数据库13，用于存储数据。
在一种可能的实施方式中，数据共享系统中包括第一应用所属的设备11、目标访问地址所属的设备12、目标数据库13。第一应用(如应用B)所属的设备在需要获取(共享)第二应用(如应用A)的数据时，可以根据预先保存的应用标识与访问地址的对应关系，确定第二应用的目标应用标识对应的目标访问地址，并向目标访问地址发送共享第二应用的数据的共享请求。可选的，共享请求中可以携带第二应用的目标应用标识。
目标访问地址所属的设备12(也可称为前置加密模块)可以接收该共享请求，并可以根据预先保存的应用标识与数据库的对应关系，确定第二应用的目标应用标识对应的目标数据库13，进而获得目标数据库13中保存的数据。在一种可能的实施方式中，为了保障每个应用的数据的安全，针对每个应用，该应用对应的数据库中保存的数据可以为基于该应用对应的加密密钥进行加密后的数据，也就是说，从目标数据库13中获取到数据可以为基于第二应用(如应用A)的加密密钥加密后的数据。为了实现不同应用之间的数据共享，可以将解密后的数据发送给第一应用(如应用B)，具体的，目标访问地址所属的设备12可以预先保存每个应用标识与加密密钥的对应关系，在从目标数据库13中获取到数据之后，目标访问地址所属的设备12可以根据保存的应用标识与加密密钥的对应关系，确定第二应用(如应用A)的目标应用标识对应的目标加密密钥，并基于该目标加密密钥对获取的数据进行解密，将解密后的数据发送给第一应用所属的设备11，从而在保障每个应用的数据的安全的前提下，可以实现多个应用之间可以共享数据。
在一种可能的实施方式中，第一应用(如应用B)如果想要共享第二应用(如应用A)的数据，第一应用(如应用B)所属的设备11可以先向数据共享系统中的管理平台发送共享第二应用的数据的申请，可选的，该申请中可以携带第一应用自身的应用标识。管理平台接收到第一应用(如应用B)所属的设备发送的该申请后，可以将该申请发送给第二应用(如应用A)所属的设备。第二应用(如应用A)所属的设备可以接收管理平台发送的该申请，为了使第二应用的管理人员等可以对是否允许第一应用共享数据进行审批，第二应用(如应用A)所属的设备可以展示该申请中携带的第一应用的应用标识。可选的，如果第二应用的管理人员等对该申请审批通过，同意第一应用共享第二应用的数据，可以点击审批通过按钮等，第二应用所属的设备可以接收到同意第一应用共享数据的确认指令，并可以在接收到该确认指令时，将该确认指令发送给管理平台。
管理平台可以接收第二应用所属的设备发送的确认指令，并可以在接收到确认指令时，将保存的第二应用的目标应用标识及目标应用标识对应的目标访问地址发送给第一应用所属的设备11。可选的，若第二应用的目标应用标识包括主标识信息和副标识信息，管理平台可以将其中的副标识信息发送给第一应用(如应用B)所属的设备，第一应用所属的设备11保存第二应用的副标识信息与目标访问地址的对应关系，关于第二应用的主标识信息和副标识信息在后续实施例中进行介绍，在此先不赘述。
在一种可能的实施方式中，第一应用所属的设备11可以接收管理平台发送的第二应用的目标应用标识及目标应用标识对应的目标访问地址，并可以保存该目标应用标识与目标访问地址的对应关系。示例性的，可以将该对应关系保存在第一应用所属的设备11的配置文件(数据库配置文件)中等。
为方便理解，下面通过一个具体实施例对本申请提供的数据共享过程进行说明。图2示出了一些实施例提供的第一种数据共享过程示意图，该过程包括以下步骤：
S201：第一应用所属的设备11向管理平台发送共享第二应用的数据的申 请，该申请中携带第一应用自身的应用标识。
S202：管理平台接收申请，并将该申请发送给第二应用所属的设备。
S203：第二应用所属的设备接收该申请并展示该申请中携带的第一应用的应用标识，若接收到同意第一应用共享数据的确认指令，将确认指令发送给管理平台。
S204：管理平台接收确认指令，将保存的第二应用的目标应用标识(如副标识信息)及目标应用标识对应的目标访问地址发送给第一应用所属的设备11。
S205：第一应用所属的设备11保存目标应用标识与目标访问地址的对应关系。
S206：第一应用所属的设备11根据预先保存的应用标识与访问地址的对应关系，确定第二应用的目标应用标识对应的目标访问地址，向目标访问地址发送共享第二应用的数据的共享请求，共享请求中携带该目标应用标识。
S207：目标访问地址所属的设备12接收共享请求，根据保存的应用标识与数据库的对应关系，确定目标应用标识对应的目标数据库13；获取目标数据库13中保存的数据；根据保存的应用标识与加密密钥的对应关系，确定目标应用标识对应的目标加密密钥；基于该目标加密密钥对获取的数据进行解密；将解密后的数据发送给第一应用所属的设备11。
在一种可能的实施方式中，考虑到第一应用在共享第二应用的数据时，通常需要为第一应用配置设定的使用权限，例如第一应用只能读取第二应用的数据，而并不能在第二应用的数据库中写入数据，或者第二应用涉及的敏感数据需要先进行数据脱敏处理再发送给第一应用等，从而在使得不同应用之间可以共享数据的同时，还可以增加各应用的数据的安全性，目标访问地址所属的设备12在接收第一应用所属的设备11发送的上述共享请求之后，在根据保存的应用标识与数据库的对应关系，确定目标应用标识对应的目标数据库13之前，还可以判断共享请求的类型为读取数据请求还是写入数据请求，并基于该共享请求的类型以及预先保存的第一应用对第二应用的数据的 使用权限，判断该共享请求是否符合相应的使用权限。例如，如果第一应用对第二应用的使用权限为只能读取数据而不能写入数据，则只有在共享数据的类型为读取数据请求时，判断该共享请求符合相应的使用权限，再进行后续根据保存的应用标识与数据库的对应关系，确定目标应用标识对应的目标数据库13；获取目标数据库13中保存的数据；根据保存的应用标识与加密密钥的对应关系，确定目标应用标识对应的目标加密密钥；基于目标加密密钥对获取的数据进行解密；将解密后的数据发送给第一应用所属的设备11的步骤。
在一种可能的实施方式中，考虑到如果从目标数据库13中获取到的数据包含设定的如身份证号等敏感数据时，为了增加数据的安全性，在基于目标加密密钥对获取的数据进行解密之后，将解密后的数据发送给第一应用所属的设备11之前，目标访问地址所属的设备12还可以对解密后的数据进行数据脱敏处理，并将经过数据脱敏处理后的数据发送给第一应用所属的设备11。其中，可以采用现有技术对数据进行数据脱敏处理，在此不再赘述。
为方便理解，下面通过一个具体实施例对本申请提供的数据共享过程进行说明。图3示出了一些实施例提供的第二种数据共享过程示意图，该过程包括以下步骤：
S301：第一应用所属的设备11根据预先保存的应用标识与访问地址的对应关系，确定第二应用的目标应用标识对应的目标访问地址，向目标访问地址发送共享第二应用的数据的共享请求，共享请求中携带该目标应用标识。
S302：目标访问地址所属的设备12接收共享请求，若判断该共享请求的类型为读取数据请求且该共享请求符合使用权限，则根据保存的应用标识与数据库的对应关系，确定目标应用标识对应的目标数据库13；获取目标数据库13中保存的数据；根据保存的应用标识与加密密钥的对应关系，确定目标应用标识对应的目标加密密钥；基于该目标加密密钥对获取的数据进行解密。
S303：若获取的数据包含设定的敏感数据，目标访问地址所属的设备12对解密后的数据进行数据脱敏处理，并将经过数据脱敏处理后的数据发送给 第一应用所属的设备11。
在一种可能的实施方式中，若第二应用的目标应用标识包括主标识信息和副标识信息，目标访问地址所属的设备12还可以判断共享请求中携带的目标应用标识是否为第二应用的副标识信息，若共享请求中携带的目标应用标识为第二应用的副标识信息，可以认为此时需要将某应用的数据共享给其他应用，为了保证数据的安全性，可以继而进行上述实施例中判断共享请求的类型为读取数据请求还是写入数据请求，基于该共享请求的类型以及预先保存的第一应用对第二应用的数据的使用权限，判断该共享请求是否符合使用权限，若符合使用权限，则再进行根据保存的应用标识与数据库的对应关系，确定目标应用标识对应的目标数据库13等后续步骤。
为方便理解，下面通过一个具体实施例对本申请提供的数据共享过程进行说明。图4示出了一些实施例提供的第三种数据共享过程示意图，该过程包括以下步骤：
S401：第一应用所属的设备11根据预先保存的应用标识与访问地址的对应关系，确定第二应用的目标应用标识对应的目标访问地址，向目标访问地址发送共享第二应用的数据的共享请求，共享请求中携带该目标应用标识。
S402：目标访问地址所属的设备12接收共享请求，若第二应用的目标应用标识包括主标识信息和副标识信息，判断该共享请求中携带的目标应用标识是否为第二应用的副标识信息，若是，则进行S403。
S403：若判断共享请求的类型为读取数据请求且该共享请求符合使用权限，则根据保存的应用标识与数据库的对应关系，确定目标应用标识对应的目标数据库13；获取目标数据库13中保存的数据；根据保存的应用标识与加密密钥的对应关系，确定目标应用标识对应的目标加密密钥；基于该目标加密密钥对获取的数据进行解密。
S404：若获取的数据包含设定的敏感数据，目标访问地址所属的设备12对解密后的数据进行数据脱敏处理，并将经过数据脱敏处理后的数据发送给第一应用所属的设备11。
实施例2：
考虑到传统数据保护主要侧重于在数据传输和写入存储介质时对其进行加密保护。当前针对应用的数据在计算状态(也即使用状态)下的安全保障能力不足，导致数据安全链条缺失最重要一环，因此，保障应用的数据在计算状态下的安全十分必要，然而目前尚没有很好的如何保障应用的数据在计算状态下的安全的技术方案。本申请实施例提供了一种可以保障应用的数据在计算状态下的安全性的技术方案，为方便理解，下面以保障上述实施例中的第二应用(如应用A)的数据的安全性为例进行举例说明。
在一种可能的实施方式中，上述数据共享系统中还可以包括：管理平台和第二应用(如应用A)所属的设备。为了保障数据的安全性，第二应用所属的设备可以先向管理平台发送一个数据存储安全保护请求，该数据存储安全保护请求中可以携带第二应用的名称及第二应用的目标访问地址。管理平台可以接收第二应用所属的设备发送的数据存储安全保护请求，并生成第二应用的名称对应的目标应用标识以及目标加密密钥，保存该目标应用标识与目标加密密钥的对应关系。可选的，管理平台生成的第二应用的名称对应的目标应用标识可以包括上述实施例中提及的主标识信息以及副标识信息，可以理解的，该主标识信息以及副标识信息可以对应同一个目标加密密钥。
在一种可能的实施方式中，目标访问地址所属的设备12可以向管理平台发送获取第二应用对应的目标加密密钥的获取密钥请求。管理平台接收到该获取密钥请求后，可以根据保存的应用标识与加密密钥的对应关系，确定第二应用的目标应用标识对应的目标加密密钥，将目标加密密钥发送给目标访问地址所属的设备12。目标访问地址所属的设备12可以接收该目标加密密钥，并保存该目标加密密钥与目标应用标识的对应关系。
为方便理解，下面通过一个具体实施例对本申请提供的数据共享过程进行说明。图5示出了一些实施例提供的第四种数据共享过程示意图，该过程包括以下步骤：
S501：第二应用(如应用A)所属的设备向管理平台发送一个数据存储 安全保护请求，该数据存储安全保护请求中携带第二应用的名称及第二应用的目标访问地址。
S502：管理平台接收第二应用所属的设备发送的数据存储安全保护请求，生成第二应用的名称对应的目标应用标识以及目标加密密钥，保存该目标应用标识与目标加密密钥的对应关系。
S503：目标访问地址所属的设备12向管理平台发送获取第二应用对应的目标加密密钥的获取密钥请求。管理平台接收到该获取密钥请求后，根据保存的应用标识与加密密钥的对应关系，确定第二应用的目标应用标识对应的目标加密密钥，将目标加密密钥发送给目标访问地址所属的设备12。目标访问地址所属的设备12接收该目标加密密钥，并保存该目标加密密钥与目标应用标识的对应关系。
S504：第一应用(如应用B)所属的设备向管理平台发送共享第二应用的数据的申请，该申请中携带第一应用自身的应用标识。
S505：管理平台接收申请，并将该申请发送给第二应用所属的设备。第二应用所属的设备接收该申请并展示该申请中携带的第一应用的应用标识，若接收到同意第一应用共享数据的确认指令，将确认指令发送给管理平台。管理平台接收确认指令，将保存的第二应用的目标应用标识(如副标识信息)及目标应用标识对应的目标访问地址发送给第一应用所属的设备11。
S506：第一应用所属的设备11保存目标应用标识与目标访问地址的对应关系。第一应用所属的设备11根据预先保存的应用标识与访问地址的对应关系，确定第二应用的目标应用标识对应的目标访问地址，向目标访问地址发送共享第二应用的数据的共享请求，共享请求中携带该目标应用标识。
S507：目标访问地址所属的设备12接收共享请求，根据保存的应用标识与数据库的对应关系，确定目标应用标识对应的目标数据库13；获取目标数据库13中保存的数据；根据保存的应用标识与加密密钥的对应关系，确定目标应用标识对应的目标加密密钥；基于该目标加密密钥对获取的数据进行解密；将解密后的数据发送给第一应用所属的设备11。
在一种可能的实施方式中，为了提高加密密钥的安全性，管理平台中保存的加密密钥可以是保存在管理平台的可信执行环境(Trusted Execution Environment，TEE)中的。以第二应用的目标加密密钥为例，管理平台中保存的目标加密密钥可以是保存在管理平台的可信执行环境(Trusted Execution Environment，TEE)中的。另外，目标访问地址所属的设备12中保存的加密密钥也可以是保存在目标访问地址所属的设备12的TEE中的。以第二应用的目标加密密钥为例，目标加密密钥也可以是保存在目标访问地址所属的设备12的TEE中的。
在一种可能的实施方式中，为了进一步提高对保存的加密密钥的安全性，管理平台还可以基于设定的TEE物理存储根密钥(为方便描述，称为第一TEE物理存储根密钥)将各应用的加密密钥进行加密后，在保存在自身的TEE中，也就是说，管理平台中保存的加密密钥可以为基于设定的第一TEE物理存储根密钥加密后的密钥。可选的，管理平台在将目标加密密钥发送给目标访问地址所属的设备12时，如果管理平台中保存的目标加密密钥为基于设定的第一TEE物理存储根密钥加密后的密钥，管理平台可以基于设定的第一TEE物理存储根密钥对目标加密密钥进行解密，将解密后的目标加密密钥，发送给目标访问地址所属的设备12。
在一种可能的实施方式中，为了增加目标加密密钥的安全性，管理平台在将目标加密密钥发送给目标访问地址所属的设备12时，可以基于临时建立的安全通道，将目标加密密钥发送给目标访问地址所属的设备12。在一种可能的实施方式中，在基于临时建立的安全通道，将目标加密密钥发送给目标访问地址所属的设备12时，为了进一步增加目标加密密钥的安全性，管理平台与目标访问地址所属的设备12可以协商一个临时安全通道密钥，管理平台可以基于该临时安全通道密钥，对目标加密密钥进行加密，并基于临时建立的安全通道，将加密后的目标加密密钥发送给目标访问地址所属的设备12。目标访问地址所属的设备12接收到基于临时安全通道密钥加密后的目标加密密钥时，可以基于相应的临时安全通道密钥，对目标加密密钥进行解密，得 到解密后的目标加密密钥。在一种可能的实施方式中，目标访问地址所属的设备12还可以基于设定的第二TEE物理存储根密钥对目标加密密钥进行加密，然后保存加密后的目标加密密钥。
为方便理解，下面通过一个具体实施例对本申请提供的数据共享过程进行说明。图6示出了一些实施例提供的第五种数据共享过程示意图，该过程包括以下步骤：
S601：第二应用所属的设备向管理平台发送数据存储安全保护请求，该数据存储安全保护请求中携带第二应用的名称及第二应用的目标访问地址。
S602：管理平台接收第二应用所属的设备发送的数据存储安全保护请求，生成第二应用的名称对应的目标应用标识以及目标加密密钥，基于设定的第一TEE物理存储根密钥对该目标加密密钥进行加密，将加密后的目标加密密钥保存在管理平台的可信执行环境(TEE)中，并保存目标应用标识与目标加密密钥的对应关系。
由于是在TEE中生成保存目标加密密钥，且基于第一TEE物理存储根密钥对目标加密密钥进行加密后在保存，可以保证加密密钥的明文不出TEE，可以保证TEE的安全性。
S603：目标访问地址所属的设备12向管理平台发送获取第二应用对应的目标加密密钥的获取密钥请求。管理平台接收目标访问地址所属的设备12发送的获取密钥请求，根据保存的应用标识与加密密钥的对应关系，确定第二应用的目标应用标识对应的目标加密密钥。管理平台基于第一TEE物理存储根密钥对目标加密密钥进行解密，并基于与目标访问地址所属的设备12协商的临时安全通道密钥，对目标加密密钥进行加密，基于临时建立的安全通道，将加密后的目标加密密钥发送给目标访问地址所属的设备12。
相较于相关技术中将加密密钥的明文出现在加密机外的应用内存中，而且加密密钥传输过程中的安全性无法保证而言，本申请不仅可以在TEE中生成保存目标加密密钥，基于第一TEE物理存储根密钥对目标加密密钥进行加密后在保存，保证加密密钥的明文不出TEE，保证TEE的安全性。另外，本 申请还可以基于安全通道将目标加密密钥发送给目标访问地址所属的设备12，可以保障目标加密密钥在传输过程中的安全性。另外，本申请基于安全通道发送该目标加密密钥时，还可以基于临时安全通道密钥对目标加密密钥加密后再发送，可以进一步保障目标加密密钥的明文在传输过程中不被泄露，进一步保障目标加密密钥在传输过程中的安全性。
S604：目标访问地址所属的设备12接收基于临时安全通道密钥加密后的目标加密密钥，基于临时安全通道密钥，对目标加密密钥进行解密，并基于设定的第二TEE物理存储根密钥对目标加密密钥进行加密，将加密后的目标加密密钥保存在目标访问地址所属的设备12的TEE中，并保存目标加密密钥与目标应用标识的对应关系。
由于目标访问地址所属的设备12可以将目标加密密钥保存在TEE中，且基于第二TEE物理存储根密钥对目标加密密钥进行加密后在保存，可以保证加密密钥的明文不出TEE，可以保证TEE的安全性。
本申请实施例中加密密钥从生成、传输、存储等全生命周期均在TEE及加密状态下进行，加密密钥的明文不出TEE，可以保证加密密钥的安全性。
在一种可能的实施方式中，管理平台在接收到第二应用所属的设备发送的数据存储安全保护请求，生成第二应用的名称对应的目标应用标识之后，可以将该目标应用标识发送给第二应用所属的设备，示例性的，可以将目标应用标识中的主标识信息发送给第二应用所属的设备。
在一种可能的实施方式中，在第二应用需要将数据写入对应的数据库(目标数据库13)中时，第二应用所属的设备可以向目标访问地址发送写入数据请求，该写入数据请求中携带待写入数据库中的数据以及第二应用的目标应用标识(如主标识信息)。目标访问地址所属的设备12可以接收该写入数据请求，并根据保存的应用标识与加密密钥的对应关系，确定目标应用标识对应的目标加密密钥，基于目标加密密钥，对待写入数据库中的数据进行加密，将加密后的数据保存到对应的目标数据库13中。
在一种可能的实施方式中，为了实现对待写入数据库中的数据的精细加 密，增加加密的灵活性，第二应用的管理人员等还可以设置相应的加密策略，例如需要加密的字段、采用的加密算法、加密规则等，其中加密策略可以根据需求灵活设置，本申请对此不作具体限定，第二应用所属的设备向管理平台发送的数据存储安全保护请求中可以携带该加密策略。可选的，目标访问地址所属的设备12可以向管理平台发送获取第二应用的加密策略请求，该加密策略请求中可以携带第二应用对应的目标应用标识。若数据存储安全保护请求中携带对数据的加密策略，管理平台可以将该加密策略发送给目标访问地址所属的设备12。目标访问地址所属的设备12接收管理平台发送的加密策略，保存目标应用标识与加密策略的对应关系。若接收到第二应用所属的设备发送的写入数据请求，目标访问地址所属的设备12可以根据保存的应用标识与加密策略的对应关系，确定目标应用标识对应的目标加密策略，并基于目标加密密钥以及目标加密策略，对待写入数据库中的数据进行加密。
示例性的，图7示出了一些实施例提供的一种写入数据过程示意图，如图7所示，第二应用所属的设备(为方面描述，图中称为应用程序)向目标访问地址(图中称为前置加密模块)发送写入数据请求，该写入数据请求中携带待写入数据库中的数据以及第二应用的目标应用标识。
可选的，目标访问地址所属的设备12(前置加密模块)中包括加解密模块和加密代理模块，其中，加解密模块可以部署在目标访问地址所属的设备12的TEE中，加解密模块中保存有加密密钥(目标加密密钥)，后续可以在TEE中基于目标加密密钥对相应的数据进行加密或解密，保证数据及加密密钥的安全性。
在一种可能的实施方式中，加密代理模块可以拦截解析写入数据请求，即结构化查询语言(Structured Query Language，SQL)，其中，SQL语言是一种数据库查询和程序设计语言，可以用于存取数据等。加密代理模块可以根据保存的应用标识与加密策略的对应关系，确定第二应用的目标应用标识对应的目标加密策略。加密代理模块可以基于该目标加密策略，确定待写入数据库的数据中需要进行加密的子数据，可以将需要进行加密的子数据从待写 入数据库的数据中提取出来，将待写入数据库的数据中需要加密的子数据的明文数据和第二应用的目标应用标识发送给加解密模块。加解密模块接收到需要加密的子数据以及目标应用标识后，可以根据保存的应用标识与加密密钥的对应关系，确定目标应用标识对应的目标加密密钥，在TEE中，基于目标加密密钥，对需要加密的子数据进行加密，并将加密后的子数据的密文数据返回给加密代理模块。加密代理模块将加密后的子数据重新拼接到待写入数据库的数据中，也就是说写入数据库中的数据中可以有其中一部分子数据是加密后的密文数据，当然也可以是将写入数据库中的数据中全部的子数据均进行加密，可以根据需求灵活设置，本申请对此不做具体限定，加密代理模块可以将基于目标加密密钥以及目标加密策略，加密后的数据保存到对应的目标数据库13中。
本申请应用(如第二应用)在使用数据库安全存储服务时，只需要将数据库配置文件中的数据库访问地址(目标访问地址)修改为指向前置加密模块(目标访问地址所属的设备12)，然后就可以通过该目标访问地址直接调用现有数据库接口即可，应用(第二应用)对数据库(目标数据库13)的访问先经过前置加密模块，前置加密模块通过拦截、解析SQL语句以及匹配加密策略，并在TEE中对数据(待写入数据库中的数据)进行加密，然后将加密后的数据(密文)发送至目标数据库13进行相应处理和存储。相较于相关技术中将明文发送至数据库进行相应处理而只将处理结果进行加密保存在数据库中而言，由于本申请是将加密后的数据发送至数据库进行相应处理，因此即使是数据库特权账户或运维人员等也无法在数据库层面接触到应用的明文数据，从而可以更有效保障用户隐私数据的计算和存储的安全性。
另外，本申请提供的数据共享方法对现有数据库兼容，无需改变现有数据库客户端调用接口和服务端数据库系统，即可将数据库处理数据由明文变为密文，实现密态数据库，即使是数据库特权账户或运维人员等也无法在数据库层面接触到应用的明文数据，可以方便有效地保障用户隐私数据的计算和存储的安全性。
在一种可能的实施方式中，当第二应用需要读取数据时，第二应用所属的设备可以向目标访问地址发送读取数据请求，该读取数据请求中可以携带第二应用的目标应用标识。目标访问地址所属的设备12接收该读取数据请求，并可以根据保存的应用标识与数据库的对应关系，确定目标应用标识对应的目标数据库13。目标访问地址所属的设备12可以继而获取目标数据库13中保存的数据，并根据保存的应用标识与加密密钥的对应关系，确定目标应用标识对应的目标加密密钥，基于目标加密密钥，对获取的数据进行解密，将解密后的数据发送给第二应用所属的设备。
在一种可能的实施方式中，与上述实施例相同，目标访问地址所属的设备12可以向管理平台发送获取第二应用的加密策略请求，该加密策略请求中可以携带第二应用对应的目标应用标识。若第二应用所属的设备发送的数据存储安全保护请求中携带对数据的加密策略，管理平台可以将该加密策略发送给目标访问地址所属的设备12。目标访问地址所属的设备12接收加密策略，保存目标应用标识与加密策略的对应关系。后续如果接收到第二应用所属的设备发送的上述读取数据请求，目标访问地址所属的设备12可以根据保存的应用标识与加密策略的对应关系，确定目标应用标识对应的目标加密策略，基于目标加密密钥以及目标加密策略，对从目标数据库13中获取的数据进行解密，将解密后的数据发送给第二应用所属的设备。
示例性的，图8示出了一些实施例提供的一种读取数据过程示意图，如图8所示，第二应用所属的设备(图中称为应用程序)向目标访问地址(图中称为前置加密模块)发送读取数据请求，该读取数据请求中携带第二应用的目标应用标识。可选的，目标访问地址所属的设备12(前置加密模块)中包括加解密模块和加密代理模块，其中，加密代理模块可以拦截解析读取数据请求，即SQL。
加密代理模块根据保存的应用标识与数据库的对应关系，确定目标应用标识对应的目标数据库13；获取目标数据库13中保存的数据。加密代理模块根据保存的应用标识与加密策略的对应关系，确定第二应用的目标应用标识 对应的目标加密策略。加密代理模块可以基于该目标加密策略，确定从目标数据库13中获取的数据中加密的子数据，可以将加密的子数据从数据中提取出来，将加密的子数据和第二应用的目标应用标识发送给加解密模块。加解密模块接收到加密的子数据以及目标应用标识后，可以根据保存的应用标识与加密密钥的对应关系，确定目标应用标识对应的目标加密密钥，基于目标加密密钥，对加密的子数据进行解密，并将解密后的子数据的明文数据返回给加密代理模块。加密代理模块将解密后的子数据重新拼接到从目标数据库13获取的数据中，加密代理模块可以将解密后的数据发送给第二应用所属的设备。
同样的，与上述实施例相同，目标访问地址所属的设备12向管理平台发送获取第二应用的加密策略请求，该加密策略请求中携带第二应用对应的目标应用标识，若第二应用所属的设备发送的数据存储安全保护请求中携带对数据的加密策略，管理平台将加密策略发送给目标访问地址所属的设备12；目标访问地址所属的设备12接收该加密策略，保存目标应用标识与加密策略的对应关系之后，若目标访问地址所属的设备12接收到第一应用所属的设备发送的共享请求，目标访问地址所属的设备12可以根据保存的应用标识与加密策略的对应关系，确定目标应用标识对应的目标加密策略；基于目标加密密钥以及目标加密策略，对从目标数据库13获取的数据进行解密，将解密后的数据发送给第一应用所属的设备。其中，基于目标加密密钥以及目标加密策略，对从目标数据库13获取的数据进行解密的过程与上述实施例相同，在此不再赘述。
在一种可能的实施方式中，可以将目标访问地址所属的设备12(前置加密模块)集成到第二应用所属的设备中，也可以将目标访问地址所属的设备12(前置加密模块)部署到加密网关集群中。示例性的，当只针对一个应用进行安全存储服务时，可以将目标访问地址所属的设备12(前置加密模块)集成到该应用所属的设备中。参阅图9，图9示出了一些实施例提供的一种数据安全存储过程示意图，当有多个应用均需要进行数据存储安全保护服务(又 可称为安全存储服务)时，可以将目标访问地址所属的设备12(前置加密模块)部署到加密网关集群中，也就是说第二应用的数量为多个时，针对每个第二应用所属的设备，均可以向部署在加密网关集群中的目标访问地址所属的设备12(前置加密模块)发送写入数据请求，该写入数据请求中携带的待写入数据库中的数据为明文数据，针对每个第二应用，目标访问地址所属的设备12(前置加密模块)可以根据保存的应用标识与加密密钥的对应关系，确定该第二应用的目标应用标识对应的目标加密密钥，基于该目标加密密钥，对该第二应用的待写入数据库中的数据进行加密，将加密后的数据(密文)保存到该第二应用对应的目标数据库13中。在一种可能的实施方式中，不同的应用可以对应不同的数据库，即每个应用可以分别对应一个专属的数据库。
由于针对不同的第二应用，本申请可以基于不同的加密密钥对不同的第二应用的数据进行加密，从而可以根据应用的不同做到应用间数据的自动安全隔离，增加数据的安全性。
另外，每个第二应用所属的设备均可以向部署在加密网关集群中的目标访问地址所属的设备12(前置加密模块)发送读取数据请求，针对每个第二应用，目标访问地址所属的设备12(前置加密模块)可以根据保存的应用标识与数据库的对应关系，确定该第二应用的目标应用标识对应的目标数据库13；获取该目标数据库13中保存的该第二应用相应的数据，可以理解的，从数据库中获取到的数据为加密后的数据，即密文数据；目标访问地址所属的设备12(前置加密模块)根据保存的应用标识与加密密钥的对应关系，确定该第二应用的目标应用标识对应的目标加密密钥，基于该目标加密密钥，对获取的数据进行解密，将解密后的数据(明文)发送给该第二应用所属的设备。
在一种可能的实施方式中，管理平台可以部署在一个单独的设备中，也可以部署在第一应用所属的设备11或者第二应用所属的设备中，本申请对此不作具体限定，可以根据需求灵活设置。
为方便理解，下面通过一个具体实施例对本申请提供的数据共享过程进 行举例说明。图10为本申请一些实施例提供的一种数据共享场景示意图，如图10所示，该过程可以包括：(1)第二应用(应用A)注册授权过程、(2)目标加密密钥传输过程、(3)第二应用写入或读取数据过程、(4)第一应用(应用B)申请共享第二应用的数据、(5)第一应用共享第二应用的数据等步骤。
其中：(1)第二应用(应用A)注册授权过程可以包括：
第二应用所属的设备向管理平台发送数据存储安全保护请求，该数据存储安全保护请求中携带第二应用的名称及第二应用的目标访问地址。管理平台接收数据存储安全保护请求，生成第二应用的名称对应的目标应用标识以及目标加密密钥，并保存目标应用标识与目标加密密钥的对应关系。可选的，可以将生成的目标加密密钥保存在管理平台的TEE中。可选的，管理平台生成的目标应用标识包括主标识信息和副标识信息，其中将主标识信息发送给第二应用所属的设备，第二应用所属的设备在其数据库配置文件中保存该主标识信息与目标访问地址的对应关系，其中，目标访问地址可以为前置加密模块的地址。
(2)目标加密密钥传输过程可以包括：
目标访问地址所属的设备12(前置加密模块)向管理平台发送获取第二应用对应的目标加密密钥的获取密钥请求。管理平台接收获取密钥请求，根据保存的应用标识与加密密钥的对应关系，确定第二应用的目标应用标识对应的目标加密密钥，将目标加密密钥通过建立的安全加密通道发送给目标访问地址所属的设备12。目标访问地址所属的设备12接收目标加密密钥，将目标加密密钥保存在TEE中，并保存目标加密密钥与第二应用的目标应用标识的对应关系。
(3)第二应用写入或读取数据的过程如下：
其中第二应用写入数据的过程为：第二应用所属的设备向目标访问地址发送写入数据请求，写入数据请求中携带待写入数据库中的数据以及第二应用的目标应用标识(如主标识信息)。目标访问地址所属的设备12(前置加密 模块)中的加密代理模块接收写入数据请求，识别到写入数据请求中携带的目标应用标识为第二应用的主标识信息，则可以认为该写入数据请求为第二应用想在第二应用自身对应的数据库中写入数据的合规请求，可以基于应用主逻辑(主Schema)来进行相应的写入数据的过程，即可以将待写入数据库中的数据(明文)发送给目标访问地址所属的设备12(前置加密模块)中的加解密模块，该加解密模块配置在TEE中，加密密钥保存在该加解密模块中。加解密模块根据保存的应用标识与加密密钥的对应关系，确定目标应用标识对应的目标加密密钥，基于目标加密密钥，对待写入数据库中的数据进行加密，将加密后的数据(密文)发送给加密代理模块，加密代理模块将加密后的数据保存在第二应用对应的目标数据库13中。
第二应用读取数据的过程为：第二应用所属的设备向目标访问地址发送读取数据请求，读取数据请求中携带第二应用的目标应用标识(如主标识信息)。目标访问地址所属的设备12(前置加密模块)中的加密代理模块接收读取数据请求，识别到读取数据请求中携带的目标应用标识为第二应用的主标识信息，则可以认为该读取数据请求为第二应用想读取第二应用自身对应的数据库中数据的合规请求，可以基于应用主逻辑(主Schema)来进行相应的读取数据的过程，即可以根据保存的应用标识与数据库的对应关系，确定目标应用标识对应的目标数据库13；获取目标数据库13中保存的数据。加密代理模块将获取的数据(密文)发送给加解密模块，加解密模块根据保存的应用标识与加密密钥的对应关系，确定目标应用标识对应的目标加密密钥，基于目标加密密钥，对获取的数据进行解密，将解密后的数据发送给加密代理模块，加密代理模块将解密后的数据发送给第二应用所属的设备。
(4)第一应用(应用B)申请共享第二应用的数据的过程可以包括：
第一应用(应用B)所属的设备向管理平台发送共享第二应用(应用A)的数据的申请，该申请中携带第一应用的应用标识。管理平台接收该申请，并将申请发送给第二应用所属的设备。第二应用所属的设备接收申请并展示申请中携带的第一应用的应用标识，若接收到同意第一应用共享数据的确认 指令，将确认指令发送给管理平台。管理平台接收确认指令，将保存的第二应用的目标应用标识中的副标识信息及目标应用标识信息对应的目标访问地址发送给第一应用所属的设备11。第一应用所属的设备11保存第二应用的副标识信息与目标访问地址的对应关系。
(5)第一应用共享第二应用的数据的过程包括：
第一应用(应用B)所属的设备根据预先保存的应用标识与访问地址的对应关系，确定第二应用的目标应用标识(如副标识信息)对应的目标访问地址，向目标访问地址发送共享第二应用的数据的共享请求，该共享请求中携带目标应用标识(如副标识信息)。
目标访问地址所属的设备12终端中的加密代理模块判断共享请求中携带的目标应用标识是否为第二应用的副标识信息，若是，则基于应用副逻辑(副Schema)来进行相应的共享数据的过程，即可以判断共享请求的类型为读取数据请求还是写入数据请求，如果该共享请求为读取数据请求，且预先保存的第一应用对第二应用的数据的使用权限中包括第一应用可以读取第二应用的数据，则认为该共享请求符合使用权限，可以根据保存的应用标识与数据库的对应关系，确定目标应用标识对应的目标数据库13；获取目标数据库13中保存的数据。加密代理模块将从目标数据库13中获取的数据发送给加解密模块，加解密模块根据保存的应用标识与加密密钥的对应关系，确定目标应用标识对应的目标加密密钥，基于目标加密密钥对获取的数据进行解密，将解密后的数据发送给加密代理模块。加密代理模块将解密后的数据发送给第一应用所属的设备11。
实施例3：
基于相同的技术构思，本申请提供了一种数据共享方法，该数据共享方法应用于第一应用所属的设备，图11示出了一些实施例提供的第六种数据共享过程示意图，该数据共享过程包括以下步骤：
S1101：根据预先保存的应用标识与访问地址的对应关系，确定第二应用的目标应用标识对应的目标访问地址，向所述目标访问地址发送共享所述第 二应用的数据的共享请求，所述共享请求中携带所述目标应用标识。
S1102：接收所述目标访问地址所属的设备发送的解密后的所述第二应用的数据。
第一应用所属的设备可以为PC、移动终端等设备，也可以是服务器等设备。
在一种可能的实施方式中，所述根据预先保存的应用标识与访问地址的对应关系，确定第二应用的目标应用标识对应的目标访问地址之前，所述方法还包括：
向管理平台发送共享所述第二应用的数据的申请，所述申请中携带所述第一应用的应用标识；
若接收到所述管理平台发送的所述第二应用的目标应用标识及所述目标应用标识信息对应的目标访问地址，保存所述目标应用标识与所述目标访问地址的对应关系。
基于相同的技术构思，本申请提供了一种数据共享方法，该数据共享方法应用于目标访问地址所属的设备，图12示出了一些实施例提供的第七种数据共享过程示意图，该数据共享过程包括以下步骤：
S1201：接收第一应用所属的设备发送的共享请求，所述共享请求中携带所述目标应用标识。
S1202：根据保存的应用标识与数据库的对应关系，确定所述目标应用标识对应的目标数据库；获取所述目标数据库中保存的数据。
S1203：根据保存的应用标识与加密密钥的对应关系，确定所述目标应用标识对应的目标加密密钥；基于所述目标加密密钥，对获取的数据进行解密；将解密后的数据发送给所述第一应用所属的设备。
目标访问地址所属的设备可以为PC、移动终端等设备，也可以是服务器等设备。
在一种可能的实施方式中，所述接收第一应用所属的设备发送的共享请求之后，所述根据保存的应用标识与数据库的对应关系，确定所述目标应用 标识对应的目标数据库之前，所述方法还包括：
判断所述共享请求的类型为读取数据请求还是写入数据请求，基于所述共享请求的类型以及预先保存的所述第一应用对所述第二应用的数据的使用权限，判断所述共享请求是否符合所述使用权限，若是，则进行后续根据保存的应用标识与数据库的对应关系，确定所述目标应用标识对应的目标数据库的步骤。
在一种可能的实施方式中，所述基于所述目标加密密钥对获取的数据进行解密之后，所述将解密后的数据发送给所述第一应用所属的设备之前，所述方法还包括：
若获取的数据包含设定的敏感数据，则对所述解密后的数据进行数据脱敏处理；
所述将解密后的数据发送给所述第一应用所属的设备，包括：
将经过数据脱敏处理后的数据发送给所述第一应用所属的设备。
在一种可能的实施方式中，所述接收第一应用所属的设备发送的共享请求之后，所述判断所述共享请求的类型为读取数据请求还是写入数据请求之前，所述方法还包括：
若所述第二应用的目标应用标识包括主标识信息和副标识信息，判断所述共享请求中携带的目标应用标识是否为所述第二应用的副标识信息，若是，则进行后续步骤。
在一种可能的实施方式中，所述接收第一应用所属的设备发送的共享请求之前，所述方法还包括：
向管理平台发送获取所述第二应用对应的目标加密密钥的获取密钥请求；
若接收到所述管理平台发送的所述第二应用对应的目标加密密钥，保存所述目标加密密钥与所述目标应用标识的对应关系。
在一种可能的实施方式中，接收到所述管理平台发送的所述第二应用对应的目标加密密钥之后，所述保存所述目标加密密钥与所述目标应用标识的对应关系之前，所述方法还包括：
若接收到的目标加密密钥为基于与所述管理平台协商的临时安全通道密钥加密后的目标加密密钥，基于所述临时安全通道密钥，对所述目标加密密钥进行解密。
在一种可能的实施方式中，保存所述目标加密密钥包括：
基于设定的第二TEE物理存储根密钥对所述目标加密密钥进行加密，保存加密后的目标加密密钥。
在一种可能的实施方式中，所述方法还包括：
接收第二应用所属的设备发送的写入数据请求，所述写入数据请求中携带待写入数据库中的数据以及所述第二应用的目标应用标识；
根据保存的应用标识与加密密钥的对应关系，确定所述目标应用标识对应的目标加密密钥，基于所述目标加密密钥，对所述待写入数据库中的数据进行加密，将加密后的数据保存到对应的目标数据库中。
在一种可能的实施方式中，所述基于所述目标加密密钥，对所述待写入数据库中的数据进行加密，包括：
根据预先保存的应用标识与加密策略的对应关系，确定所述目标应用标识对应的目标加密策略；基于所述目标加密密钥以及所述目标加密策略，对所述待写入数据库中的数据进行加密。
在一种可能的实施方式中，所述方法还包括：
接收第二应用所属的设备发送的读取数据请求，所述读取数据请求中携带所述第二应用的目标应用标识；
根据保存的应用标识与数据库的对应关系，确定所述目标应用标识对应的目标数据库；获取所述目标数据库中保存的数据；
根据保存的应用标识与加密密钥的对应关系，确定所述目标应用标识对应的目标加密密钥，基于所述目标加密密钥，对获取的数据进行解密，将解密后的数据发送给所述第二应用所属的设备。
在一种可能的实施方式中，所述基于所述目标加密密钥，对获取的数据进行解密，包括：
根据预先保存的应用标识与加密策略的对应关系，确定所述目标应用标识对应的目标加密策略；
基于所述目标加密密钥以及所述目标加密策略，对获取的所述数据进行解密。
基于相同的技术构思，本申请提供了一种数据共享方法，该数据共享方法应用于第二应用所属的设备，图13示出了一些实施例提供的第八种数据共享过程示意图，该数据共享过程包括以下步骤：
S1301：若接收到管理平台发送的申请，展示所述申请中携带的第一应用的应用标识。
S1302：若接收到同意所述第一应用共享数据的确认指令，将所述确认指令发送给所述管理平台。
第二应用所属的设备可以为PC、移动终端等设备，也可以是服务器等设备。
在一种可能的实施方式中，所述方法还包括：
向所述管理平台发送数据存储安全保护请求，所述数据存储安全保护请求中携带所述第二应用的名称及所述第二应用的目标访问地址。
在一种可能的实施方式中，所述方法还包括：
向所述目标访问地址发送写入数据请求，所述写入数据请求中携带待写入数据库中的数据以及所述第二应用的目标应用标识。
在一种可能的实施方式中，所述方法还包括：
向所述目标访问地址发送读取数据请求，所述读取数据请求中携带所述第二应用的目标应用标识；
接收所述目标访问地址所属的设备发送的解密后的数据。
基于相同的技术构思，本申请提供了一种数据共享方法，该数据共享方法应用于管理平台，图14示出了一些实施例提供的第九种数据共享过程示意图，该数据共享过程包括以下步骤：
S1401：接收第一应用所属的设备发送的共享所述第二应用的数据的申请， 所述申请中携带所述第一应用的应用标识。
S1402：将所述申请发送给所述第二应用所属的设备。
S1403：若接收到所述第二应用所属的设备发送的同意所述第一应用共享数据的确认指令，将保存的所述第二应用的目标应用标识及所述目标应用标识信息对应的目标访问地址发送给所述第一应用所属的设备。
在一种可能的实施方式中，所述接收第一应用所属的设备发送的共享所述第二应用的数据的申请之前，所述方法还包括：
接收所述第二应用所属的设备发送的数据存储安全保护请求，所述数据存储安全保护请求中携带所述第二应用的名称及所述第二应用的目标访问地址；
接收所述数据存储安全保护请求，生成所述第二应用的名称对应的目标应用标识以及目标加密密钥，并保存所述目标应用标识与所述目标加密密钥的对应关系；
若接收到所述目标访问地址所属的设备发送的获取所述第二应用对应的目标加密密钥的获取密钥请求；
根据保存的应用标识与加密密钥的对应关系，确定所述第二应用的目标应用标识对应的目标加密密钥，将所述目标加密密钥发送给所述目标访问地址所属的设备。
在一种可能的实施方式中，所述确定所述第二应用的目标应用标识对应的目标加密密钥之后，所述将所述目标加密密钥发送给所述目标访问地址所属的设备之前，所述方法还包括：
若保存的所述目标加密密钥为基于设定的第一TEE物理存储根密钥加密后的密钥，基于所述第一TEE物理存储根密钥对所述目标加密密钥解密；
将所述目标加密密钥发送给所述目标访问地址所属的设备，包括：
将解密后的目标加密密钥，发送给所述目标访问地址所属的设备。
在一种可能的实施方式中，所述将所述目标加密密钥发送给所述目标访问地址所属的设备，包括：
基于建立的安全通道，将所述目标加密密钥发送给所述目标访问地址所属的设备。
在一种可能的实施方式中，所述基于建立的安全通道，将所述目标加密密钥发送给所述目标访问地址所属的设备，包括：
基于与所述目标访问地址所属的设备协商的临时安全通道密钥，对所述目标加密密钥进行加密，基于所述安全通道，将加密后的目标加密密钥发送给所述目标访问地址所属的设备。
在一种可能的实施方式中，所述方法还包括：
接收所述目标访问地址所属的设备发送的获取所述第二应用的加密策略请求，其中所述加密策略请求中携带所述第二应用对应的目标应用标识；
若所述目标应用标识对应的第二应用所属的设备发送的所述数据存储安全保护请求中携带对数据的加密策略，将所述加密策略发送给所述目标访问地址所属的设备，使所述目标访问地址所属的设备保存所述目标应用标识与所述加密策略的对应关系。
实施例4：
基于相同的技术构思，本申请提供了一种数据共享装置，应用于第一应用所属的设备，图15示出了一些实施例提供的第一种数据共享装置示意图，该装置包括：
第一确定模块151，用于根据预先保存的应用标识与访问地址的对应关系，确定第二应用的目标应用标识对应的目标访问地址，向所述目标访问地址发送共享所述第二应用的数据的共享请求，所述共享请求中携带所述目标应用标识；
第一接收模块152，用于接收所述目标访问地址所属的设备发送的解密后的所述第二应用的数据。
在一种可能的实施方式中，所述第一确定模块151，还用于向管理平台发送共享所述第二应用的数据的申请，所述申请中携带所述第一应用的应用标识；若接收到所述管理平台发送的所述第二应用的目标应用标识及所述目标 应用标识信息对应的目标访问地址，保存所述目标应用标识与所述目标访问地址的对应关系。
基于相同的技术构思，本申请提供了一种数据共享装置，应用于目标访问地址所属的设备，图16示出了一些实施例提供的第二种数据共享装置示意图，该装置包括：
第二接收模块161，用于接收第一应用所属的设备发送的共享请求，所述共享请求中携带所述目标应用标识；
第二确定模块162，用于根据保存的应用标识与数据库的对应关系，确定所述目标应用标识对应的目标数据库；获取所述目标数据库中保存的数据；
加解密模块163，用于根据保存的应用标识与加密密钥的对应关系，确定所述目标应用标识对应的目标加密密钥；基于所述目标加密密钥，对获取的数据进行解密；将解密后的数据发送给所述第一应用所属的设备。
在一种可能的实施方式中，所述第二确定模块162，还用于判断所述共享请求的类型为读取数据请求还是写入数据请求，基于所述共享请求的类型以及预先保存的所述第一应用对所述第二应用的数据的使用权限，判断所述共享请求是否符合所述使用权限，若是，则进行后续根据保存的应用标识与数据库的对应关系，确定所述目标应用标识对应的目标数据库的步骤。
在一种可能的实施方式中，所述加解密模块163，还用于若获取的数据包含设定的敏感数据，则对所述解密后的数据进行数据脱敏处理；将经过数据脱敏处理后的数据发送给所述第一应用所属的设备。
在一种可能的实施方式中，所述第二确定模块162，还用于若所述第二应用的目标应用标识包括主标识信息和副标识信息，判断所述共享请求中携带的目标应用标识是否为所述第二应用的副标识信息，若是，则进行后续判断所述共享请求的类型为读取数据请求还是写入数据请求的步骤。
在一种可能的实施方式中，所述第二接收模块161，还用于向管理平台发送获取所述第二应用对应的目标加密密钥的获取密钥请求；若接收到所述管理平台发送的所述第二应用对应的目标加密密钥，保存所述目标加密密钥与 所述目标应用标识的对应关系。
在一种可能的实施方式中，所述第二接收模块161，还用于若接收到的目标加密密钥为基于与所述管理平台协商的临时安全通道密钥加密后的目标加密密钥，基于所述临时安全通道密钥，对所述目标加密密钥进行解密。
在一种可能的实施方式中，所述第二接收模块161，具体用于基于设定的第二TEE物理存储根密钥对所述目标加密密钥进行加密，保存加密后的目标加密密钥。
在一种可能的实施方式中，所述加解密模块163，还用于接收第二应用所属的设备发送的写入数据请求，所述写入数据请求中携带待写入数据库中的数据以及所述第二应用的目标应用标识；根据保存的应用标识与加密密钥的对应关系，确定所述目标应用标识对应的目标加密密钥，基于所述目标加密密钥，对所述待写入数据库中的数据进行加密，将加密后的数据保存到对应的目标数据库中。
在一种可能的实施方式中，所述加解密模块163，具体用于根据预先保存的应用标识与加密策略的对应关系，确定所述目标应用标识对应的目标加密策略；基于所述目标加密密钥以及所述目标加密策略，对所述待写入数据库中的数据进行加密。
在一种可能的实施方式中，所述加解密模块163，还用于接收第二应用所属的设备发送的读取数据请求，所述读取数据请求中携带所述第二应用的目标应用标识；根据保存的应用标识与数据库的对应关系，确定所述目标应用标识对应的目标数据库；获取所述目标数据库中保存的数据；根据保存的应用标识与加密密钥的对应关系，确定所述目标应用标识对应的目标加密密钥，基于所述目标加密密钥，对获取的数据进行解密，将解密后的数据发送给所述第二应用所属的设备。
在一种可能的实施方式中，所述加解密模块163，具体用于根据预先保存的应用标识与加密策略的对应关系，确定所述目标应用标识对应的目标加密策略；基于所述目标加密密钥以及所述目标加密策略，对获取的所述数据进 行解密。
基于相同的技术构思，本申请提供了一种数据共享装置，应用于第二应用所属的设备，图17示出了一些实施例提供的第三种数据共享装置示意图，该装置包括：
展示模块171，用于若接收到管理平台发送的申请，展示所述申请中携带的第一应用的应用标识；
第一发送模块172，用于若接收到同意所述第一应用共享数据的确认指令，将所述确认指令发送给所述管理平台。
在一种可能的实施方式中，所述第一发送模块172，还用于向所述管理平台发送数据存储安全保护请求，所述数据存储安全保护请求中携带所述第二应用的名称及所述第二应用的目标访问地址。
在一种可能的实施方式中，所述第一发送模块172，还用于向所述目标访问地址发送写入数据请求，所述写入数据请求中携带待写入数据库中的数据以及所述第二应用的目标应用标识。
在一种可能的实施方式中，所述第一发送模块172，还用于向所述目标访问地址发送读取数据请求，所述读取数据请求中携带所述第二应用的目标应用标识；接收所述目标访问地址所属的设备发送的解密后的数据。
基于相同的技术构思，本申请提供了一种数据共享装置，应用于管理平台，图18示出了一些实施例提供的第四种数据共享装置示意图，该装置包括：
第三接收模块181，用于接收第一应用所属的设备发送的共享所述第二应用的数据的申请，所述申请中携带所述第一应用的应用标识；
第二发送模块182，用于将所述申请发送给所述第二应用所属的设备；若接收到所述第二应用所属的设备发送的同意所述第一应用共享数据的确认指令，将保存的所述第二应用的目标应用标识及所述目标应用标识信息对应的目标访问地址发送给所述第一应用所属的设备。
在一种可能的实施方式中，所述第三接收模块181，还用于接收所述第二应用所属的设备发送的数据存储安全保护请求，所述数据存储安全保护请求 中携带所述第二应用的名称及所述第二应用的目标访问地址；接收所述数据存储安全保护请求，生成所述第二应用的名称对应的目标应用标识以及目标加密密钥，并保存所述目标应用标识与所述目标加密密钥的对应关系；若接收到所述目标访问地址所属的设备发送的获取所述第二应用对应的目标加密密钥的获取密钥请求；根据保存的应用标识与加密密钥的对应关系，确定所述第二应用的目标应用标识对应的目标加密密钥，将所述目标加密密钥发送给所述目标访问地址所属的设备。
在一种可能的实施方式中，所述第三接收模块181，还用于若保存的所述目标加密密钥为基于设定的第一TEE物理存储根密钥加密后的密钥，基于所述第一TEE物理存储根密钥对所述目标加密密钥解密；将解密后的目标加密密钥，发送给所述目标访问地址所属的设备。
在一种可能的实施方式中，所述第三接收模块181，具体用于基于建立的安全通道，将所述目标加密密钥发送给所述目标访问地址所属的设备。
在一种可能的实施方式中，所述第三接收模块181，具体用于基于与所述目标访问地址所属的设备协商的临时安全通道密钥，对所述目标加密密钥进行加密，基于所述安全通道，将加密后的目标加密密钥发送给所述目标访问地址所属的设备。
在一种可能的实施方式中，所述第二发送模块182，还用于接收所述目标访问地址所属的设备发送的获取所述第二应用的加密策略请求，其中所述加密策略请求中携带所述第二应用对应的目标应用标识；若所述目标应用标识对应的第二应用所属的设备发送的所述数据存储安全保护请求中携带对数据的加密策略，将所述加密策略发送给所述目标访问地址所属的设备，使所述目标访问地址所属的设备保存所述目标应用标识与所述加密策略的对应关系。
基于相同的技术构思，本申请还提供了一种电子设备，图19示出了一些实施例提供的一种电子设备结构示意图，如图19所示，包括：处理器191、通信接口192、存储器193和通信总线194，其中，处理器191，通信接口192，存储器193通过通信总线194完成相互间的通信；
在一种可能的实施方式中，所述存储器193中存储有计算机程序，当所述程序被所述处理器191执行时，使得所述处理器191执行上述任意一种数据共享方法的步骤。
由于上述电子设备解决问题的原理与数据共享方法相似，因此上述电子设备的实施可以参见方法的实施，重复之处不再赘述。
上述电子设备提到的通信总线可以是外设部件互连标准(Peripheral Component Interconnect，PCI)总线或扩展工业标准结构(Extended Industry Standard Architecture，EISA)总线等。该通信总线可以分为地址总线、数据总线、控制总线等。为便于表示，图中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
通信接口192用于上述电子设备与其他设备之间的通信。
存储器可以包括随机存取存储器(Random Access Memory，RAM)，也可以包括非易失性存储器(Non-Volatile Memory，NVM)，例如至少一个磁盘存储器。可选地，存储器还可以是至少一个位于远离前述处理器的存储装置。
上述处理器可以是通用处理器，包括中央处理器、网络处理器(Network Processor，NP)等；还可以是数字指令处理器(Digital Signal Processing，DSP)、专用集成电路、现场可编程门陈列或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。
基于相同的技术构思，本申请实施例提供了一种计算机可读存储介质，所述计算机可读存储介质内存储有可由电子设备执行的计算机程序，当所述程序在所述电子设备上运行时，使得所述电子设备执行时实现上述任意一种数据共享方法的步骤。
上述计算机可读存储介质可以是电子设备中的处理器能够存取的任何可用介质或数据存储设备，包括但不限于磁性存储器如软盘、硬盘、磁带、磁光盘(MO)等、光学存储器如CD、DVD、BD、HVD等、以及半导体存储器如ROM、EPROM、EEPROM、非易失性存储器(NAND FLASH)、固态硬盘(SSD)等。
基于相同的技术构思，在上述各实施例的基础上，本申请提供了一种计算机程序产品，所述计算机程序产品包括：计算机程序代码，当所述计算机程序代码在计算机上运行时，使得计算机执行如上述任一所述数据共享方法的步骤。
本领域内的技术人员应明白，本申请的实施例可提供为方法、系统、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的精神和范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (44)

  1. 一种数据共享系统，所述系统包括：
    第一应用所属的设备，用于根据预先保存的应用标识与访问地址的对应关系，确定第二应用的目标应用标识对应的目标访问地址，向所述目标访问地址发送共享所述第二应用的数据的共享请求，所述共享请求中携带所述目标应用标识；
    所述目标访问地址所属的设备，用于接收所述共享请求，根据保存的应用标识与数据库的对应关系，确定所述目标应用标识对应的目标数据库；获取所述目标数据库中保存的数据；根据保存的应用标识与加密密钥的对应关系，确定所述目标应用标识对应的目标加密密钥；基于所述目标加密密钥，对获取的数据进行解密；将解密后的数据发送给所述第一应用所属的设备；
    所述目标数据库，用于存储数据。
  2. 根据权利要求1所述的系统，所述系统还包括：管理平台和第二应用所属的设备；
    所述第一应用所属的设备，还用于向所述管理平台发送共享所述第二应用的数据的申请，所述申请中携带所述第一应用的应用标识；
    所述管理平台，用于接收所述申请，并将所述申请发送给所述第二应用所属的设备；
    所述第二应用所属的设备，用于接收所述申请并展示所述申请中携带的所述第一应用的应用标识，若接收到同意所述第一应用共享数据的确认指令，将所述确认指令发送给所述管理平台；
    所述管理平台，还用于接收所述确认指令，将保存的所述第二应用的目标应用标识及所述目标应用标识信息对应的目标访问地址发送给所述第一应用所属的设备；
    所述第一应用所属的设备，还用于保存所述目标应用标识与所述目标访问地址的对应关系。
  3. 根据权利要求1所述的系统，所述目标访问地址所属的设备，还用于判断所述共享请求的类型为读取数据请求还是写入数据请求，基于所述共享请求的类型以及预先保存的所述第一应用对所述第二应用的数据的使用权限，判断所述共享请求是否符合所述使用权限，若是，则进行根据保存的应用标识与数据库的对应关系，确定所述目标应用标识对应的目标数据库的步骤。
  4. 根据权利要求1-3任一所述的系统，所述目标访问地址所属的设备，还用于若获取的数据包含设定的敏感数据，则对所述解密后的数据进行数据脱敏处理，并将经过数据脱敏处理后的数据发送给所述第一应用所属的设备。
  5. 根据权利要求3所述的系统，所述目标访问地址所属的设备，还用于若所述第二应用的目标应用标识包括主标识信息和副标识信息，判断所述共享请求中携带的目标应用标识是否为所述第二应用的副标识信息，若是，则进行判断所述共享请求的类型为读取数据请求还是写入数据请求，基于所述共享请求的类型以及预先保存的所述第一应用对所述第二应用的数据的使用权限，判断所述共享请求是否符合所述使用权限的步骤。
  6. 根据权利要求1所述的系统，所述系统还包括：管理平台和第二应用所属的设备；
    所述第二应用所属的设备，用于向所述管理平台发送数据存储安全保护请求，所述数据存储安全保护请求中携带所述第二应用的名称及所述第二应用的目标访问地址；
    所述管理平台，还用于接收所述数据存储安全保护请求，生成所述第二应用的名称对应的目标应用标识以及目标加密密钥，并保存所述目标应用标识与所述目标加密密钥的对应关系；
    所述目标访问地址所属的设备，还用于向所述管理平台发送获取所述第二应用对应的目标加密密钥的获取密钥请求；
    所述管理平台，用于接收所述获取密钥请求，根据保存的应用标识与加密密钥的对应关系，确定所述第二应用的目标应用标识对应的目标加密密钥，将所述目标加密密钥发送给所述目标访问地址所属的设备；
    所述目标访问地址所属的设备，还用于接收所述目标加密密钥，并保存所述目标加密密钥与所述目标应用标识的对应关系。
  7. 根据权利要求6所述的系统，其中，所述管理平台中保存的所述目标加密密钥是保存在所述管理平台的可信执行环境TEE中的；和/或，
    所述目标访问地址所属的设备中保存的所述目标加密密钥是保存在所述目标访问地址所属的设备的TEE中的。
  8. 根据权利要求6-7任一所述的系统，所述管理平台，还用于若保存的所述目标加密密钥为基于设定的第一TEE物理存储根密钥加密后的密钥，基于所述第一TEE物理存储根密钥对所述目标加密密钥解密，将解密后的目标加密密钥，发送给所述目标访问地址所属的设备。
  9. 根据权利要求6-7任一所述的系统，其中，所述管理平台，具体用于基于建立的安全通道，将所述目标加密密钥发送给所述目标访问地址所属的设备。
  10. 根据权利要求9所述的系统，其中，所述管理平台，具体用于基于与所述目标访问地址所属的设备协商的临时安全通道密钥，对所述目标加密密钥进行加密，基于所述安全通道，将加密后的目标加密密钥发送给所述目标访问地址所属的设备；
    所述目标访问地址所属的设备，还用于接收基于与所述管理平台协商的所述临时安全通道密钥加密后的目标加密密钥，基于所述临时安全通道密钥，对所述目标加密密钥进行解密。
  11. 根据权利要求6或7或10所述的系统，所述目标访问地址所属的设备，还用于基于设定的第二TEE物理存储根密钥对所述目标加密密钥进行加密，保存加密后的目标加密密钥。
  12. 根据权利要求6所述的系统，所述第二应用所属的设备，还用于向所述目标访问地址发送写入数据请求，所述写入数据请求中携带待写入数据库中的数据以及所述第二应用的目标应用标识；
    所述目标访问地址所属的设备，还用于接收所述写入数据请求，根据保 存的应用标识与加密密钥的对应关系，确定所述目标应用标识对应的目标加密密钥，基于所述目标加密密钥，对所述待写入数据库中的数据进行加密，将加密后的数据保存到对应的目标数据库中。
  13. 根据权利要求12所述的系统，所述目标访问地址所属的设备，还用于向所述管理平台发送获取所述第二应用的加密策略请求，所述加密策略请求中携带所述第二应用对应的目标应用标识；
    所述管理平台，还用于接收所述加密策略请求，若所述目标应用标识对应的第二应用所属的设备发送的所述数据存储安全保护请求中，携带对数据的加密策略，将所述加密策略发送给所述目标访问地址所属的设备；
    所述目标访问地址所属的设备，还用于接收所述加密策略，保存所述目标应用标识与所述加密策略的对应关系；若接收到所述写入数据请求，则根据保存的应用标识与加密策略的对应关系，确定所述目标应用标识对应的目标加密策略；基于所述目标加密密钥以及所述目标加密策略，对所述待写入数据库中的数据进行加密。
  14. 根据权利要求6所述的系统，第二应用所属的设备，还用于向所述目标访问地址发送读取数据请求，所述读取数据请求中携带所述第二应用的目标应用标识；
    所述目标访问地址所属的设备，还用于接收所述读取数据请求，根据保存的应用标识与数据库的对应关系，确定所述目标应用标识对应的目标数据库；获取所述目标数据库中保存的数据；根据保存的应用标识与加密密钥的对应关系，确定所述目标应用标识对应的目标加密密钥，基于所述目标加密密钥，对获取的数据进行解密，将解密后的数据发送给所述第二应用所属的设备。
  15. 根据权利要求14所述的系统，所述目标访问地址所属的设备，还用于向所述管理平台发送获取所述第二应用的加密策略请求，所述加密策略请求中携带所述第二应用对应的目标应用标识；
    所述管理平台，还用于接收所述加密策略请求，若所述目标应用标识对 应的第二应用所属的设备发送的所述数据存储安全保护请求中，携带对数据的加密策略，将所述加密策略发送给所述目标访问地址所属的设备；
    所述目标访问地址所属的设备，还用于接收所述加密策略，保存所述目标应用标识与所述加密策略的对应关系；若接收到所述读取数据请求，根据保存的应用标识与加密策略的对应关系，确定所述目标应用标识对应的目标加密策略；基于所述目标加密密钥以及所述目标加密策略，对获取的所述数据进行解密。
  16. 一种数据共享方法，所述方法应用于第一应用所属的设备，所述方法包括：
    根据预先保存的应用标识与访问地址的对应关系，确定第二应用的目标应用标识对应的目标访问地址，向所述目标访问地址发送共享所述第二应用的数据的共享请求，所述共享请求中携带所述目标应用标识；
    接收所述目标访问地址所属的设备发送的解密后的所述第二应用的数据。
  17. 根据权利要求16所述的方法，所述根据预先保存的应用标识与访问地址的对应关系，确定第二应用的目标应用标识对应的目标访问地址之前，所述方法还包括：
    向管理平台发送共享所述第二应用的数据的申请，所述申请中携带所述第一应用的应用标识；
    若接收到所述管理平台发送的所述第二应用的目标应用标识及所述目标应用标识信息对应的目标访问地址，保存所述目标应用标识与所述目标访问地址的对应关系。
  18. 一种数据共享方法，所述方法应用于目标访问地址所属的设备，所述方法包括：
    接收第一应用所属的设备发送的共享请求，所述共享请求中携带所述目标应用标识；
    根据保存的应用标识与数据库的对应关系，确定所述目标应用标识对应的目标数据库；获取所述目标数据库中保存的数据；
    根据保存的应用标识与加密密钥的对应关系，确定所述目标应用标识对应的目标加密密钥；基于所述目标加密密钥，对获取的数据进行解密；将解密后的数据发送给所述第一应用所属的设备。
  19. 根据权利要求18所述的方法，所述接收第一应用所属的设备发送的共享请求之后，所述根据保存的应用标识与数据库的对应关系，确定所述目标应用标识对应的目标数据库之前，所述方法还包括：
    判断所述共享请求的类型为读取数据请求还是写入数据请求，基于所述共享请求的类型以及预先保存的所述第一应用对所述第二应用的数据的使用权限，判断所述共享请求是否符合所述使用权限，若是，则进行后续根据保存的应用标识与数据库的对应关系，确定所述目标应用标识对应的目标数据库的步骤。
  20. 根据权利要求18或19所述的方法，所述基于所述目标加密密钥对获取的数据进行解密之后，所述将解密后的数据发送给所述第一应用所属的设备之前，所述方法还包括：
    若获取的数据包含设定的敏感数据，则对所述解密后的数据进行数据脱敏处理；
    所述将解密后的数据发送给所述第一应用所属的设备，包括：
    将经过数据脱敏处理后的数据发送给所述第一应用所属的设备。
  21. 根据权利要求19所述的方法，所述接收第一应用所属的设备发送的共享请求之后，所述判断所述共享请求的类型为读取数据请求还是写入数据请求之前，所述方法还包括：
    若所述第二应用的目标应用标识包括主标识信息和副标识信息，判断所述共享请求中携带的目标应用标识是否为所述第二应用的副标识信息，若是，则进行后续步骤。
  22. 根据权利要求18所述的方法，所述接收第一应用所属的设备发送的共享请求之前，所述方法还包括：
    向管理平台发送获取所述第二应用对应的目标加密密钥的获取密钥请求；
    若接收到所述管理平台发送的所述第二应用对应的目标加密密钥，保存所述目标加密密钥与所述目标应用标识的对应关系。
  23. 根据权利要求22所述的方法，接收到所述管理平台发送的所述第二应用对应的目标加密密钥之后，所述保存所述目标加密密钥与所述目标应用标识的对应关系之前，所述方法还包括：
    若接收到的目标加密密钥为基于与所述管理平台协商的临时安全通道密钥加密后的目标加密密钥，基于所述临时安全通道密钥，对所述目标加密密钥进行解密。
  24. 根据权利要求22或23所述的方法，其中，保存所述目标加密密钥包括：
    基于设定的第二TEE物理存储根密钥对所述目标加密密钥进行加密，保存加密后的目标加密密钥。
  25. 根据权利要求22所述的方法，所述方法还包括：
    接收第二应用所属的设备发送的写入数据请求，所述写入数据请求中携带待写入数据库中的数据以及所述第二应用的目标应用标识；
    根据保存的应用标识与加密密钥的对应关系，确定所述目标应用标识对应的目标加密密钥，基于所述目标加密密钥，对所述待写入数据库中的数据进行加密，将加密后的数据保存到对应的目标数据库中。
  26. 根据权利要求25所述的方法，其中，所述基于所述目标加密密钥，对所述待写入数据库中的数据进行加密，包括：
    根据预先保存的应用标识与加密策略的对应关系，确定所述目标应用标识对应的目标加密策略；基于所述目标加密密钥以及所述目标加密策略，对所述待写入数据库中的数据进行加密。
  27. 根据权利要求22所述的方法，所述方法还包括：
    接收第二应用所属的设备发送的读取数据请求，所述读取数据请求中携带所述第二应用的目标应用标识；
    根据保存的应用标识与数据库的对应关系，确定所述目标应用标识对应 的目标数据库；获取所述目标数据库中保存的数据；
    根据保存的应用标识与加密密钥的对应关系，确定所述目标应用标识对应的目标加密密钥，基于所述目标加密密钥，对获取的数据进行解密，将解密后的数据发送给所述第二应用所属的设备。
  28. 根据权利要求27所述的方法，其中，所述基于所述目标加密密钥，对获取的数据进行解密，包括：
    根据预先保存的应用标识与加密策略的对应关系，确定所述目标应用标识对应的目标加密策略；
    基于所述目标加密密钥以及所述目标加密策略，对获取的所述数据进行解密。
  29. 一种数据共享方法，所述方法应用于第二应用所属的设备，所述方法包括：
    若接收到管理平台发送的申请，展示所述申请中携带的第一应用的应用标识；
    若接收到同意所述第一应用共享数据的确认指令，将所述确认指令发送给所述管理平台。
  30. 根据权利要求29所述的方法，所述方法还包括：
    向所述管理平台发送数据存储安全保护请求，所述数据存储安全保护请求中携带所述第二应用的名称及所述第二应用的目标访问地址。
  31. 根据权利要求30所述的方法，所述方法还包括：
    向所述目标访问地址发送写入数据请求，所述写入数据请求中携带待写入数据库中的数据以及所述第二应用的目标应用标识。
  32. 根据权利要求30所述的方法，所述方法还包括：
    向所述目标访问地址发送读取数据请求，所述读取数据请求中携带所述第二应用的目标应用标识；
    接收所述目标访问地址所属的设备发送的解密后的数据。
  33. 一种数据共享方法，所述方法应用于管理平台，所述方法包括：
    接收第一应用所属的设备发送的共享所述第二应用的数据的申请，所述申请中携带所述第一应用的应用标识；
    将所述申请发送给所述第二应用所属的设备；
    若接收到所述第二应用所属的设备发送的同意所述第一应用共享数据的确认指令，将保存的所述第二应用的目标应用标识及所述目标应用标识信息对应的目标访问地址发送给所述第一应用所属的设备。
  34. 根据权利要求33所述的方法，所述接收第一应用所属的设备发送的共享所述第二应用的数据的申请之前，所述方法还包括：
    接收所述第二应用所属的设备发送的数据存储安全保护请求，所述数据存储安全保护请求中携带所述第二应用的名称及所述第二应用的目标访问地址；
    接收所述数据存储安全保护请求，生成所述第二应用的名称对应的目标应用标识以及目标加密密钥，并保存所述目标应用标识与所述目标加密密钥的对应关系；
    若接收到所述目标访问地址所属的设备发送的获取所述第二应用对应的目标加密密钥的获取密钥请求；
    根据保存的应用标识与加密密钥的对应关系，确定所述第二应用的目标应用标识对应的目标加密密钥，将所述目标加密密钥发送给所述目标访问地址所属的设备。
  35. 根据权利要求34所述的方法，所述确定所述第二应用的目标应用标识对应的目标加密密钥之后，所述将所述目标加密密钥发送给所述目标访问地址所属的设备之前，所述方法还包括：
    若保存的所述目标加密密钥为基于设定的第一TEE物理存储根密钥加密后的密钥，基于所述第一TEE物理存储根密钥对所述目标加密密钥解密；
    将所述目标加密密钥发送给所述目标访问地址所属的设备，包括：
    将解密后的目标加密密钥，发送给所述目标访问地址所属的设备。
  36. 根据权利要求34或35所述的方法，其中，所述将所述目标加密密 钥发送给所述目标访问地址所属的设备，包括：
    基于建立的安全通道，将所述目标加密密钥发送给所述目标访问地址所属的设备。
  37. 根据权利要求36所述的方法，其中，所述基于建立的安全通道，将所述目标加密密钥发送给所述目标访问地址所属的设备，包括：
    基于与所述目标访问地址所属的设备协商的临时安全通道密钥，对所述目标加密密钥进行加密，基于所述安全通道，将加密后的目标加密密钥发送给所述目标访问地址所属的设备。
  38. 根据权利要求34所述的方法，所述方法还包括：
    接收所述目标访问地址所属的设备发送的获取所述第二应用的加密策略请求，其中所述加密策略请求中携带所述第二应用对应的目标应用标识；
    若所述目标应用标识对应的第二应用所属的设备发送的所述数据存储安全保护请求中携带对数据的加密策略，将所述加密策略发送给所述目标访问地址所属的设备，使所述目标访问地址所属的设备保存所述目标应用标识与所述加密策略的对应关系。
  39. 一种数据共享装置，所述装置包括：
    第一确定模块，用于根据预先保存的应用标识与访问地址的对应关系，确定第二应用的目标应用标识对应的目标访问地址，向所述目标访问地址发送共享所述第二应用的数据的共享请求，所述共享请求中携带所述目标应用标识；
    第一接收模块，用于接收所述目标访问地址所属的设备发送的解密后的所述第二应用的数据。
  40. 一种数据共享装置，所述装置包括：
    第二接收模块，用于接收第一应用所属的设备发送的共享请求，所述共享请求中携带所述目标应用标识；
    第二确定模块，用于根据保存的应用标识与数据库的对应关系，确定所述目标应用标识对应的目标数据库；获取所述目标数据库中保存的数据；
    加解密模块，用于根据保存的应用标识与加密密钥的对应关系，确定所述目标应用标识对应的目标加密密钥；基于所述目标加密密钥，对获取的数据进行解密；将解密后的数据发送给所述第一应用所属的设备。
  41. 一种数据共享装置，所述装置包括：
    展示模块，用于若接收到管理平台发送的申请，展示所述申请中携带的第一应用的应用标识；
    第一发送模块，用于若接收到同意所述第一应用共享数据的确认指令，将所述确认指令发送给所述管理平台。
  42. 一种数据共享装置，所述装置包括：
    第三接收模块，用于接收第一应用所属的设备发送的共享所述第二应用的数据的申请，所述申请中携带所述第一应用的应用标识；
    第二发送模块，用于将所述申请发送给所述第二应用所属的设备；若接收到所述第二应用所属的设备发送的同意所述第一应用共享数据的确认指令，将保存的所述第二应用的目标应用标识及所述目标应用标识信息对应的目标访问地址发送给所述第一应用所属的设备。
  43. 一种电子设备，其包括处理器和存储器，其中，所述存储器存储有程序代码，当所述程序代码被所述处理器执行时，使得所述处理器执行权利要求16至38任一项所述方法的步骤。
  44. 一种计算机可读存储介质，其包括程序代码，当所述存储介质在电子设备上运行时，所述程序代码用于使所述电子设备执行权利要求16至38任一项所述方法的步骤。
PCT/CN2022/137360 2022-09-19 2022-12-07 一种数据共享系统、方法、装置、设备及介质 Ceased WO2024060411A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US19/112,335 US12561481B2 (en) 2022-09-19 2022-12-07 Data sharing system, method and apparatus, and device and medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202211147485.8 2022-09-19
CN202211147485.8A CN115580440A (zh) 2022-09-19 2022-09-19 一种数据共享系统、方法、装置、设备及介质

Publications (1)

Publication Number Publication Date
WO2024060411A1 true WO2024060411A1 (zh) 2024-03-28

Family

ID=84580757

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/137360 Ceased WO2024060411A1 (zh) 2022-09-19 2022-12-07 一种数据共享系统、方法、装置、设备及介质

Country Status (4)

Country Link
US (1) US12561481B2 (zh)
CN (1) CN115580440A (zh)
TW (1) TWI824904B (zh)
WO (1) WO2024060411A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN120530601A (zh) * 2023-12-20 2025-08-22 京东方科技集团股份有限公司 数据共享的方法、电子设备及存储介质

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108933838A (zh) * 2018-08-08 2018-12-04 网易（杭州）网络有限公司 应用数据处理方法及装置
US20200119921A1 (en) * 2015-02-13 2020-04-16 Yoti Holding Limited Digital Identity System
CN111459899A (zh) * 2020-03-27 2020-07-28 中国平安人寿保险股份有限公司 日志共享方法、装置及终端设备
CN113704210A (zh) * 2021-09-03 2021-11-26 维沃移动通信有限公司 数据共享方法和电子设备
CN114553586A (zh) * 2022-03-04 2022-05-27 中国建设银行股份有限公司 数据获取方法、装置、设备、介质及程序产品
CN114710274A (zh) * 2022-03-28 2022-07-05 恒安嘉新（北京）科技股份公司 数据调用方法、装置、电子设备及存储介质

Family Cites Families (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP4039923B2 (ja) 2002-09-20 2008-01-30 富士通株式会社 ソフトウェア実行管理装置、ソフトウェア実行管理方法、およびソフトウェア実行管理プログラム
BRPI0812392A2 (pt) 2007-06-12 2015-07-21 Facebook Inc Sistema e métodos de acessamento e de compartilhamento de dados de perfis de usuários entre sítio da web de rede social e servidor de aplicativos de terceiros
EP2101276A1 (en) * 2008-03-10 2009-09-16 Aceinc Pty. Limited Data access and user identity verification
CN104836715B (zh) * 2014-02-08 2018-08-03 国际商业机器公司 在移动设备上运行的多个应用之间共享数据的方法和装置
SE539602C2 (en) 2014-10-09 2017-10-17 Kelisec Ab Generating a symmetric encryption key
US10038674B2 (en) * 2014-10-17 2018-07-31 Sap Se Secure mobile data sharing
JP6393953B2 (ja) 2015-01-13 2018-10-03 富士フイルム株式会社 銀微粒子分散物、インク組成物、銀電極、及び薄膜トランジスタ
US10073975B2 (en) * 2016-08-11 2018-09-11 International Business Machines Corporation Application integrity verification in multi-tier architectures
JP7205057B2 (ja) * 2017-12-28 2023-01-17 トヨタ自動車株式会社 情報システム、情報処理装置、情報処理方法およびプログラム
US11556667B2 (en) * 2019-08-23 2023-01-17 Sympatic, Inc. Facilitating processing of a query on shareable data in a temporary vault
CN112860445B (zh) * 2019-11-27 2023-06-20 华为技术有限公司 一种快应用与原生应用间数据共享的方法及终端

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20200119921A1 (en) * 2015-02-13 2020-04-16 Yoti Holding Limited Digital Identity System
CN108933838A (zh) * 2018-08-08 2018-12-04 网易（杭州）网络有限公司 应用数据处理方法及装置
CN111459899A (zh) * 2020-03-27 2020-07-28 中国平安人寿保险股份有限公司 日志共享方法、装置及终端设备
CN113704210A (zh) * 2021-09-03 2021-11-26 维沃移动通信有限公司 数据共享方法和电子设备
CN114553586A (zh) * 2022-03-04 2022-05-27 中国建设银行股份有限公司 数据获取方法、装置、设备、介质及程序产品
CN114710274A (zh) * 2022-03-28 2022-07-05 恒安嘉新（北京）科技股份公司 数据调用方法、装置、电子设备及存储介质

Also Published As

Publication number Publication date
TWI824904B (zh) 2023-12-01
US20260004003A1 (en) 2026-01-01
CN115580440A (zh) 2023-01-06
US12561481B2 (en) 2026-02-24
TW202415032A (zh) 2024-04-01

Similar Documents

Publication Publication Date Title
CN111917540B (zh) 一种数据加解密方法、装置、移动终端和存储介质
EP3987712B1 (en) Cryptographic key orchestration between trusted containers in a multi-node cluster
WO2022247385A1 (zh) 一种基于区块链的数据处理方法及区块链节点装置
WO2020206953A1 (zh) 一种数据处理方法及系统
WO2020187008A1 (zh) 服务调用控制方法、服务调用方法、装置及终端
US20140282833A1 (en) Methods, Systems and Machine-Readable Media For Providing Security Services
US10887085B2 (en) System and method for controlling usage of cryptographic keys
EP2943878B1 (en) Clipboard management
US12210658B2 (en) Executing entity-specific cryptographic code in a cryptographic
EP3962021A1 (en) Service processing methods, apparatuses, devices and systems
US20230222230A1 (en) Key distribution system in a secure enclave
US20140281499A1 (en) Method and system for enabling communications between unrelated applications
CN114428784A (zh) 数据存取方法、装置、计算机设备及存储介质
WO2021208906A1 (zh) 数据传输、处理、授权
CN110598429A (zh) 数据加密存储和读取的方法、终端设备及存储介质
WO2020073712A1 (zh) 一种移动终端中共享安全应用的方法及移动终端
US20120166793A1 (en) Apparatus and method for sharing and using comment on content in distributed network system
WO2024221905A1 (zh) 区块链中账户数据的隐私保护方法及装置
TWI824904B (zh) 一種資料共用系統、方法、裝置、設備及介質
CN114020705A (zh) 一种文件处理方法、装置和存储介质
US20200322158A1 (en) Method and apparatus for determining trust status of tpm, and storage medium
US20230076420A1 (en) Multi-platform key recovery for trusted code
CN110457959B (zh) 一种基于Trust应用的信息传输方法及装置
CN116847359B (zh) 一种多接入边缘计算mec通信保护方法、装置、及介质
WO2025153866A1 (zh) 全密态数据库系统、数据处理方法、安全控制装置及设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22959411

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 11202501235U

Country of ref document: SG

WWP Wipo information: published in national office

Ref document number: 11202501235U

Country of ref document: SG

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 22959411

Country of ref document: EP

Kind code of ref document: A1