(19)
(11)EP 2 942 899 B1

(12)EUROPEAN PATENT SPECIFICATION

(45)Mention of the grant of the patent:
20.01.2021 Bulletin 2021/03

(21)Application number: 14771033.9

(22)Date of filing:  21.03.2014
(51)International Patent Classification (IPC): 
H04L 9/00(2006.01)
H04L 29/08(2006.01)
H04L 29/06(2006.01)
(86)International application number:
PCT/CN2014/073886
(87)International publication number:
WO 2014/146609 (25.09.2014 Gazette  2014/39)

(54)

INFORMATION PROCESSING METHOD, TRUST SERVER AND CLOUD SERVER

INFORMATIONSVERARBEITUNGSVERFAHREN, SICHERER SERVER UND CLOUD-SERVER

PROCÉDÉ DE TRAITEMENT D'INFORMATIONS, SERVEUR DE CONFIANCE ET SERVEUR EN NUAGE


(84)Designated Contracting States:
AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

(30)Priority: 21.03.2013 CN 201310092589

(43)Date of publication of application:
11.11.2015 Bulletin 2015/46

(73)Proprietor: Huawei Device Co., Ltd.
Dongguan, Guangdong 523808 (CN)

(72)Inventors:
  • WANG, Chan
    Shenzhen Guangdong 518129 (CN)
  • WU, Huangwei
    Shenzhen Guangdong 518129 (CN)

(74)Representative: Pfenning, Meinig & Partner mbB 
Patent- und Rechtsanwälte Theresienhöhe 11a
80339 München
80339 München (DE)


(56)References cited: : 
CN-A- 102 655 508
US-A1- 2002 035 605
US-A1- 2012 131 075
US-A1- 2001 036 224
US-A1- 2008 263 645
US-A1- 2012 297 184
  
      
    Note: Within nine months from the publication of the mention of the grant of the European patent, any person may give notice to the European Patent Office of opposition to the European patent granted. Notice of opposition shall be filed in a written reasoned statement. It shall not be deemed to have been filed until the opposition fee has been paid. (Art. 99(1) European Patent Convention).


    Description

    TECHNICAL FIELD



    [0001] The present invention relates to the field of network communications technologies, and in particular, to an information processing method, a trusted server, and a cloud server.

    BACKGROUND



    [0002] Cloud computing is a technology in which dynamically scalable and virtualized resources are provided over the internet. By using cloud computing, a network can be conveniently accessed, and storage and management of massive data can be implemented by configuring a large number of storage devices. In cloud computing, a great number of users need to be involved, and to protect security of user data, a user generally encrypts user data to be uploaded to a cloud server.

    [0003] However, when uploading encrypted user data to the cloud server, the user also uploads summary information of the user data at the same time, where the summary information is a brief summary of user data, and is information that describes the user data in a concise form by extracting key information from the user data; and the summary information may include a name, a phone number, an e-mail address, information that interests the user, and so on. Due to openness of the summary information, a third party may obtain, from the cloud server, summary information of a user in which the third party is interested. As a result, personal privacy information of the user is leaked, and security performance of a cloud computing system is reduced.

    [0004] US 2012131075A1 discloses a scheme for storage of private information on a cloud computing platform without contravention of territorial privacy laws. A method of anonymising a database of personal data is described whereby data identifiers are assigned to data items and deviation identifiers are assigned to deviations for selected data items derived from reference records. Such information can then be uploaded to a cloud based storage platform. A translation table maps the data items, data identifiers and deviation identifiers to the original data entries. This translation table is stored locally and separate to the anonymised information uploaded to the cloud. It further describes a method of decoding the database anonymised according to the above method.

    [0005] US 2001/036224 A1 discloses a mediation server which receives raw location positioning data from the wireless communications network and sends standardized location positioning data with encrypted unique identifiers to a profiling server. The profiling server tracks and profiles current and historical location positioning data, compiling databases of anonymous user profiles to permit targeting of personalized and relevant data.

    SUMMARY



    [0006] Embodiments of the present invention provide an information processing method, a trusted server, and a cloud server according to the independent claims, so as to solve a problem that security performance is low because user privacy information is prone to be leaked on a cloud server. Further embodiments are defined by the dependent claims.

    [0007] In the embodiments provided by the present invention, a trusted server acquires user data of a user terminal, extracts summary information of the user data, where the summary information includes privacy information and non-privacy information of a user, generates a UID for the privacy information, and transmits the non-privacy information and the UID to a cloud server, and the cloud server saves a correspondence between the non-privacy information and the UID. Because a trusted server is introduced in the embodiments provided by the present invention, after the summary information of the user is processed by the trusted server, the cloud server no longer saves complete summary information formed by the privacy information and the non-privacy information, but saves only the non-privacy information in the summary information and the UID of the privacy information in the summary information, so that a third party cannot acquire the privacy information of the user from the cloud server, thereby improving security performance of a cloud computing system.

    BRIEF DESCRIPTION OF DRAWINGS



    [0008] To describe the technical solutions in the embodiments of the present invention or in the prior art more clearly, the following briefly introduces the accompanying drawings required for describing the embodiments or the prior art. Apparently, a person of ordinary skill in the art may still derive other drawings from these accompanying drawings without creative efforts.

    FIG. 1 is a flowchart of an embodiment of an information processing method;

    FIG. 2 is a flowchart of another embodiment of an information processing method;

    FIG. 3 is a flowchart of another embodiment of an information processing method;

    FIG. 4 is a flowchart of another embodiment of an information processing method;

    FIG. 5 is a block diagram of an embodiment of a trusted server according to the present invention;

    FIG. 6 is a block diagram of another embodiment of a trusted server according to the present invention;

    FIG. 7 is a block diagram of another embodiment of a trusted server according to the present invention;

    FIG. 8 is a block diagram of another embodiment of a trusted server according to the present invention;

    FIG. 9 is a block diagram of another embodiment of a trusted server according to the present invention;

    FIG. 10 is a block diagram of an embodiment of a cloud server according to the present invention;

    FIG. 11 is a block diagram of another embodiment of a cloud server according to the present invention; and

    FIG. 12 is a block diagram of another embodiment of a cloud server according to the present invention.


    DESCRIPTION OF EMBODIMENTS



    [0009] The following embodiments of the present invention provide an information processing method, a trusted server, and a cloud server.

    [0010] To make a person skilled in the art understand the technical solutions in the embodiments of the present invention better, and make the foregoing objectives, features, and advantages of the embodiments of the present invention clearer, the following further describes the technical solutions in the embodiments of the present invention with reference to the accompanying drawings.

    [0011] Referring to FIG. 1, FIG. 1 is a flowchart of an embodiment of an information processing method according to the present invention. The embodiment describes an information processing process in cloud computing from a perspective of a trusted server.

    [0012] Step 101: A trusted server acquires user data of a user terminal.

    [0013] In this embodiment of the present invention, the trusted server may be specifically a server in a trust center. The trust center is deployed between a cloud server and a terminal, and may issue certificates in advance to the cloud server, the user terminal, and a third party terminal that perform information interaction by using the trusted server, so as to implement identity authentication between the cloud server, the user terminal, and the third party terminal, that is, the trust center may have a certificate authority (CA) center. In addition, the trust center may further deliver a key to the user terminal, that is, the trust center may have a key distribution center (KDC).

    [0014] In the embodiment, the trusted server may receive the user data directly uploaded by the user terminal. Alternatively, the trusted server may also receive a notification message sent by the user terminal, and then send, to the cloud server according to the notification message, a data request message that is used to request for encrypted user data, where the notification message is used to notify the trusted server that the encrypted user data has been uploaded to the cloud server by the user terminal, and the encrypted user data is data obtained by the user terminal after encrypting the user data according to a encryption key delivered by the trusted server; and the trusted server receives the encrypted user data that is returned by the cloud server according to the data request message, and decrypts the encrypted user data by using the encryption key, to obtain decrypted user data.

    [0015] Step 102: The trusted server extracts summary information of the user data, where the summary information includes privacy information and non-privacy information of a user.

    [0016] In this embodiment of the present invention, the summary information refers to a brief summary of user data, and is information that describes the user data in a concise form by extracting key information from the user data. The summary information may include two parts, namely, privacy information and non-privacy information, where the privacy information refers to some personal sensitive information with a confidential property, and the non-privacy information may include information that interests the user, and the like. For example, for medical data of the user, privacy information of the medical data may include a name, a phone number, a home address, an E-Mail, account information of the user, and the like; and the non-privacy information of the medical data may include information of a hospital that the user visits, medicine information, family medical history information, and the like.

    [0017] In this embodiment of the present invention, a crawler technology or an automatic abstracting technology in the prior art may be used to extract the summary information from the user data, and details are not described herein again.

    [0018] Step 103: The trusted server generates a UID for the privacy information.

    [0019] In this embodiment, each user may have a user identity representing identity, and each user may have multiple copies of user data. In order to distinguish privacy information in summary information of each piece of user data, the trusted server generates a unique identifier (UID) for each piece of privacy information. The UID may be a sequence number generated by the trusted server in sequence, or may be a sequence number generated by the trusted server by using a preset function to perform calculation on the data. That is, each piece of privacy information corresponds to a unique sequence number.

    [0020] Step 104: The trusted server transmits the non-privacy information and the UID to a cloud server, so that the cloud server saves a correspondence between the non-privacy information and the UID.

    [0021] In this embodiment, the trusted server transmits, to the cloud server, the non-privacy information in the summary information and the UID generated for the privacy information. Because the cloud server merely saves the non-privacy information of the user, a third party cannot obtain the privacy information of the user from the cloud server.

    [0022] It can be seen from the foregoing embodiment that, after summary information of a user is processed by a trusted server, a cloud server no longer saves complete summary information formed by privacy information and non-privacy information, but saves only the non-privacy information in the summary information and a UID of the privacy information in the summary information, so that a third party cannot acquire the privacy information of the user from the cloud server, thereby improving security performance of a cloud computing system.

    [0023] Referring to FIG. 2, FIG. 2 is a flowchart of another embodiment of an information processing method according to the present invention. The embodiment describes an information processing process in cloud computing from a perspective of a cloud server.

    [0024] Step 201: A cloud server receives non-privacy information and a UID of a user that are transmitted by a trusted server, where the non-privacy information is information included in summary information that is extracted by the trusted server from acquired user data, the summary information further includes privacy information of the user, and the UID is a UID that is generated for the privacy information by the trusted server.

    [0025] In this embodiment of the present invention, the cloud server may be specifically a server that is set in a cloud computing system, the server has a function of storing massive user data, and a user terminal may access the cloud server via a network. From the embodiment described from the perspective of the trusted server in FIG. 1, it can be seen that, after acquiring the user data of the user terminal, the trusted server extracts the summary information of the user data, where the summary information includes the privacy information and the non-privacy information of the user; and after generating the UID for the privacy information, the trusted server transmits the non-privacy information and the UID to the cloud server. Therefore, the cloud server may obtain only the non-privacy information of the user, so that a third party cannot obtain the privacy information of the user from the cloud server.

    [0026] Step 202: The cloud server saves a correspondence between the non-privacy information and the UID.

    [0027] It can be seen from the foregoing embodiment that, after summary information of a user is processed by a trusted server, a cloud server saves only non-privacy information in the summary information, so that a third party cannot acquire privacy information of the user from the cloud server, thereby improving security performance of a cloud computing system.

    [0028] Referring to FIG. 3, FIG. 3 is a flowchart of another embodiment of an information processing method according to the present invention. In this embodiment, a detailed information processing process is described by using interaction between a user terminal, a trusted server, a cloud server, and a third party terminal.

    [0029] Step 301: A user terminal sends a key request message to a trusted server.

    [0030] In this embodiment of the present invention, the trusted server may be specifically a server in a trust center. The trust center is deployed between a cloud server and a terminal, and may issue certificates in advance to the cloud server, the user terminal, and a third party terminal that perform information interaction by using the trusted server, so as to implement identity authentication between the cloud server, the user terminal, and the third party terminal, that is, the trust center may have a CA. In addition, the trust center may further deliver a key to the user terminal, that is, the trust center may have a KDC.

    [0031] In order to protect privacy of user data, the user terminal may send the key request message including a user identity to the trusted server before uploading the user data to the cloud server, where the key request message is used to request the trusted server to allocate a encryption key.

    [0032] Step 302: The trusted server returns a encryption key to the user terminal according to the key request message, and saves a correspondence between a user identity and the encryption key.

    [0033] Step 303: The user terminal encrypts, by using the encryption key, user data to be uploaded to a cloud server, to obtain encrypted user data.

    [0034] The cloud server is a device used for implementing mass storage of the user data. In order to ensure security of the user data saved on the cloud server, in this embodiment, the user terminal may encrypt the user data, and save the encrypted user data on the cloud server. Because it is difficult for a third party terminal to obtain the encryption key, the third party terminal cannot access the user data at will.

    [0035] Step 304: The user terminal uploads the encrypted user data to the cloud server.

    [0036] When the user terminal uploads the encrypted user data to the cloud server, the user identity is carried at the same time.

    [0037] Step 305: The cloud server saves a correspondence between the user identity and the encrypted user data.

    [0038] Step 306: The user terminal sends, to the trusted server, a notification message indicating that the encrypted user data has been uploaded to the cloud server.

    [0039] Step 307: The trusted server sends, to the cloud server, a data request message that is used to request for the encrypted user data.

    [0040] The trusted server carries the user identity in the sent data request message.

    [0041] Step 308: The cloud server searches for the saved correspondence between the user identity and the encrypted user data according to the user identity, acquires encrypted user data corresponding to the user identity, and sends the acquired encrypted user data to the trusted server.

    [0042] Step 309: The trusted server obtains, according to the user identity, the encryption key corresponding to the user identity, and decrypts, by using the encryption key, the encrypted user data that is received, to obtain the user data.

    [0043] Step 310: The trusted server performs summary information processing on the user data, extracts summary information from the user data, removes privacy information from the summary information, and generates a UID for the privacy information.

    [0044] Step 311: The trusted server saves a correspondence between the privacy information and the UID.

    [0045] Step 312: The trusted server uploads non-privacy information and the UID generated for the privacy information to the cloud server.

    [0046] Step 313: On a basis of the correspondence, between the user identity and the encrypted user data, saved in step 305 described above, the cloud server further saves a correspondence between the user identity, the non-privacy information, and the UID.

    [0047] Step 314: A third party terminal sends requirement information to the cloud server.

    [0048] The requirement information is information that is set by the third party terminal when the third party terminal wants to acquire, from the cloud server, information of a user that meets a specific condition. For example, if a travel company wants to acquire, from the cloud server, information of users who travel more than three times every year, and to push travel information to these users, "travelling more than three times" is a type of requirement information.

    [0049] Step 315: The cloud server matches the requirement information to saved non-privacy information, to obtain a UID corresponding to non-privacy information that matches the requirement information.

    [0050] The cloud server saves the correspondence between non-privacy information and the UID, and the cloud server may match the requirement information to saved non-privacy information one by one, to obtain non-privacy information that matches the requirement information, and then, the cloud server obtains, according to the correspondence, a UID corresponding to matched non-privacy information.

    [0051] Step 316: The cloud server sends the obtained UID to the third party terminal.

    [0052] Step 317: The third party terminal sends push information and the UID to the trusted server.

    [0053] Step 318: The trusted server acquires privacy information corresponding to the UID sent by the third party terminal, and obtains user address information from the privacy information.

    [0054] Because the trusted server saves the correspondence between the privacy information and the UID, after receiving the UID sent by the third party terminal, the trusted server may obtain, according to the correspondence, the privacy information corresponding to the UID, where the privacy information may usually include the user address information.

    [0055] Step 319: The trusted server sends the push information to the user terminal according to the obtained address information.

    [0056] Optionally, in the foregoing embodiment shown in FIG. 3, the user terminal may also upload the encrypted user data to the trusted server, so that the trusted server does not need to obtain the encrypted user data from the cloud server, which is not limited in the embodiment of the present invention.

    [0057] It can be seen from the foregoing embodiment that, after summary information of a user is processed by a trusted server, a cloud server no longer saves complete summary information formed by privacy information and non-privacy information, but saves only the non-privacy information in the summary information and a UID of the privacy information in the summary information, so that a third party cannot acquire the privacy information of the user from the cloud server, thereby improving security performance of a cloud computing system.

    [0058] Referring to FIG. 4, FIG. 4 is a flowchart of another embodiment of an information processing method according to the present invention. In this embodiment, a detailed information processing process is described by using interaction between a user terminal, a trusted server, a cloud server, and a third party terminal.

    [0059] Step 401: A user terminal and a trusted server performs key agreement, to obtain a encryption key.

    [0060] One difference between this embodiment and that shown in FIG. 3 lies in that, in this embodiment, the user terminal obtains the encryption key by performing key agreement with the trusted server rather than directly receives a encryption key delivered by the trusted server.

    [0061] Step 402: The user terminal sends user data to the trusted server.

    [0062] Step 403: The trusted server encrypts the user data by using the encryption key obtained by the agreement, to obtain encrypted user data.

    [0063] Step 404: The trusted server performs summary information processing on the user data, extracts summary information from the user data, removes privacy information from the summary information, and generates a UID for the privacy information.

    [0064] It should be noted that, the foregoing step 404 may also be executed before step 403, which is not limited in the embodiment.

    [0065] Step 405: The trusted server saves a correspondence between the privacy information and the UID.

    [0066] Step 406: The trusted server uploads, to a cloud server, a user identity, the encrypted user data, non-privacy information, and the UID generated for the privacy information.

    [0067] It should be noted that, the trusted server may upload the user identity, the encrypted user data, the non-privacy information, and the UID to the cloud server at the same time, or may upload the non-privacy information and the UID to the cloud server first, and then upload the user identity and the encrypted user data to the cloud server, which is not limited in the embodiment of the present invention.

    [0068] The cloud server is a device used for implementing mass storage of the user data. In order to ensure security of the user data saved on the cloud server, in this embodiment, the user terminal may directly send the user data to the trusted server, and the trusted server encrypts the user data and then uploads encrypted user data to the cloud server for storage; or the user terminal may encrypt the user data and then send encrypted user data to the trusted server, and the trusted server uploads the encrypted user data to the cloud server for storage. Because it is difficult for the third party terminal to obtain the encryption key, the third party terminal cannot access the user data from the cloud server at will.

    [0069] Step 407: The cloud server saves the user identity, the encrypted user data, and a correspondence between the non-privacy information and the UID.

    [0070] Step 408: A third party terminal sends requirement information to the cloud server.

    [0071] Step 409: The cloud server matches the requirement information to saved non-privacy information, to obtain a UID corresponding to non-privacy information that matches the requirement information.

    [0072] Step 410: The cloud server sends the obtained UID to the third party terminal.

    [0073] Step 411: The third party terminal sends push information and the UID to the trusted server.

    [0074] Step 412: The trusted server acquires privacy information corresponding to the UID sent by the third party terminal, and obtains user address information from the privacy information.

    [0075] Step 413: The trusted server sends the push information to the user terminal according to the obtained address information.

    [0076] When this embodiment is applied, the third party terminal may be various types of terminals, for example, a terminal of a medical institution, that push advertising information to the user terminal. The third party terminal may access the cloud server; however, because the cloud server saves the non-privacy information and the UID of the privacy information, the third party terminal cannot acquire the privacy information of the user terminal from the cloud server, but can only send the UID and the push information to the trusted server according to the UID, which is returned by the cloud server, of the privacy information. The trusted server obtains the privacy information corresponding to the UID, and then obtains the user address information, so that the trusted server pushes the push information to the user terminal.

    [0077] Optionally, in the foregoing embodiment shown in FIG. 4, the user terminal may also send, to the trusted server, the encrypted user data that is encrypted by using the encryption key in step 402, and the trusted server may decrypt the encrypted user data by using the encryption key, perform summary processing on the obtained user data, and then send the non-privacy information and the UID of the privacy information that are obtained by summary processing, and the encrypted user data sent by the user terminal to the cloud server; therefore, the trusted server does not need to encrypt the user data, and the encrypted user data is forwarded to the cloud server by the trusted server. Alternatively, the user terminal may also directly transmit the encrypted user data to the cloud server, and the trusted server does not need to forward the encrypted user data. The user terminal may send the user data or the encrypted user data to the trusted server, and the trusted server performs summary processing on the user data, and then uploads the non-privacy information and the UID of the privacy information that are obtained by summary processing to the cloud server, which is not limited in the embodiment of the present invention.

    [0078] It can be seen from the foregoing embodiment that, after summary information of a user is processed by a trusted server, a cloud server no longer saves complete summary information formed by privacy information and non-privacy information, but saves only the non-privacy information in the summary information and a UID of the privacy information in the summary information, so that a third party cannot acquire the privacy information of the user from the cloud server, thereby improving security performance of a cloud computing system.

    [0079] Corresponding to the embodiments of information processing methods of the present invention, the present invention further provides embodiments of a trusted server and a cloud server.

    [0080] Referring to FIG. 5, FIG. 5 is a block diagram of an embodiment of a trusted server according to the present invention.

    [0081] The trusted server includes: an acquiring unit 510, an extracting unit 520, a generating unit 530, and a transmitting unit 540.

    [0082] The acquiring unit 510 is configured to acquire user data of a user terminal.

    [0083] The extracting unit 520 is configured to extract summary information of the user data acquired by the acquiring unit 510, where the summary information includes privacy information and non-privacy information of a user.

    [0084] The generating unit 530 is configured to generate a unique identifier UID for the privacy information in the summary information extracted by the extracting unit 520.

    [0085] The transmitting unit 540 is configured to transmit, to a cloud server, the non-privacy information in the summary information extracted by the extracting unit 520 and the UID generated by the generating unit 530, so that the cloud server saves a correspondence between the non-privacy information and the UID.

    [0086] In this embodiment of the present invention, the trusted server may be specifically a server in a trust center. The trust center is deployed between a cloud server and a terminal, and may issue certificates in advance to the cloud server, the user terminal, and a third party terminal that perform information interaction by using the trusted server, so as to implement identity authentication between the cloud server, the user terminal, and the third party terminal, that is, the trust center may have a certificate authority center. In addition, the trust center may further deliver a key to the user terminal, that is, the trust center may have a key distribution center.

    [0087] Referring to FIG. 6, FIG. 6 is a block diagram of another embodiment of a trusted server according to the present invention.

    [0088] The trusted server includes: a first receiving unit 610, a delivering unit 620, an acquiring unit 630, an extracting unit 640, a generating unit 650, a saving unit 660, and a transmitting unit 670.

    [0089] The first receiving unit 610 is configured to receive a key request message sent by a user terminal.

    [0090] The delivering unit 620, configured to deliver a encryption key to the user terminal according to the key request message received by the first receiving unit 610, so that the user terminal encrypts user data according to the encryption key and then transmits encrypted user data to a cloud server.

    [0091] The acquiring unit 630 is configured to acquire the user data of the user terminal. Specifically, the acquiring unit 630 may include (not shown in FIG. 6): a notification message receiving sub-unit, configured to receive a notification message sent by the user terminal, where the notification message is used to notify the trusted server that the encrypted user data has been uploaded to the cloud server by the user terminal, and the encrypted user data is data obtained by the user terminal after encrypting the user data according to the encryption key delivered by the trusted server; a data request sending sub-unit, configured to send, to the cloud server according to the notification message received by the notification message receiving sub-unit, a data request message that is used to request for the encrypted user data; an encrypted data receiving sub-unit, configured to receive the encrypted user data that is returned by the cloud server according to the data request message sent by the request message sending sub-unit; and an encrypted data decrypting sub-unit, configured to decrypt, by using the encryption key, the encrypted user data received by the encrypted data receiving sub-unit, to obtain decrypted user data.

    [0092] The extracting unit 640 is configured to extract summary information of the user data acquired by the acquiring unit 630, where the summary information includes privacy information and non-privacy information of a user.

    [0093] The generating unit 650 is configured to generate a unique identifier UID for the privacy information in the summary information extracted by the extracting unit 640.

    [0094] The saving unit 660 is configured to save a correspondence between the privacy information in the summary information extracted by the extracting unit 640 and the UID generated by the generating unit 650.

    [0095] The transmitting unit 670 is configured to transmit, to the cloud server, the non-privacy information in the summary information extracted by the extracting unit 640 and the UID generated by the generating unit 650, so that the cloud server saves a correspondence between the non-privacy information and the UID.

    [0096] Referring to FIG. 7, FIG. 7 is a block diagram of another embodiment of a trusted server according to the present invention.

    [0097] The trusted server includes: an acquiring unit 710, an encrypting unit 720, a transmitting unit 730, an extracting unit 740, a generating unit 750, and a saving unit 760.

    [0098] The acquiring unit 710 is configured to acquire user data of a user terminal. Specifically, the acquiring unit 710 may include (not shown in FIG. 7): a user data receiving sub-unit, configured to receive the user data, which is uploaded by the user terminal, of the user terminal.

    [0099] The encrypting unit 720 is configured to encrypt, by using a encryption key agreed with the user terminal, the user data acquired by the acquiring unit 710.

    [0100] The transmitting unit 730 is configured to transmit, to a cloud server, encrypted user data that is output by the encrypting unit 720.

    [0101] The extracting unit 740 is configured to extract summary information of the user data acquired by the acquiring unit 710, where the summary information includes privacy information and non-privacy information of a user.

    [0102] The generating unit 750 is configured to generate a unique identifier UID for the privacy information in the summary information extracted by the extracting unit 740.

    [0103] The transmitting unit 730 is further configured to transmit, to the cloud server, the non-privacy information in the summary information extracted by the extracting unit 740 and the UID generated by the generating unit 750, so that the cloud server saves a correspondence between the non-privacy information and the UID.

    [0104] The saving unit 760 is configured to save a correspondence between the privacy information in the summary information extracted by the extracting unit 740 and the UID generated by the generating unit 750.

    [0105] Referring to FIG. 8, FIG. 8 is a block diagram of another embodiment of a trusted server according to the present invention.

    [0106] The trusted server includes: an acquiring unit 810, an extracting unit 820, a generating unit 830, a saving unit 840, a transmitting unit 850, a second receiving unit 860, an obtaining unit 870, and a sending unit 880.

    [0107] The acquiring unit 810 is configured to acquire user data of a user terminal.

    [0108] The extracting unit 820 is configured to extract summary information of the user data acquired by the acquiring unit 810, where the summary information includes privacy information and non-privacy information of a user.

    [0109] The generating unit 830 is configured to generate a unique identifier UID for the privacy information in the summary information extracted by the extracting unit 820.

    [0110] The saving unit 840 is configured to save a correspondence between the privacy information in the summary information extracted by the extracting unit 820 and the UID generated by the generating unit 830.

    [0111] The transmitting unit 850 is configured to transmit, to a cloud server, the non-privacy information in the summary information extracted by the extracting unit 820 and the UID generated by the generating unit 830, so that the cloud server saves a correspondence between the non-privacy information and the UID.

    [0112] The second receiving unit 860 is configured to receive push information and a UID that are sent by a third party terminal, where the UID is a UID that is obtained and sent to the third party terminal by the cloud server after receiving requirement information sent by the third party terminal, and that is corresponding to non-privacy information matching the requirement information.

    [0113] The obtaining unit 870 is configured to obtain, from the correspondence, which is saved by the saving unit 840, between the privacy information and the UID, privacy information corresponding to the UID received by the second receiving unit 860.

    [0114] The sending unit 880 is configured to send the push information according to user address information included in the privacy information acquired by the obtaining unit 870.

    [0115] Referring to FIG. 9, FIG. 9 is a block diagram of another embodiment of a trusted server according to the present invention.

    [0116] The trusted server includes: a bus 910, a processor 920, a network interface 930, and a memory 940.

    [0117] The processor 920 is configured to acquire user data of a user terminal by using the network interface 930, extract summary information of the user data, where the summary information includes privacy information and non-privacy information of a user, generate a unique identifier UID for the privacy information, and transmit the non-privacy information and the UID to a cloud server by using the network interface 930, so that the cloud server saves a correspondence between the non-privacy information and the UID.

    [0118] The memory 940 is configured to save a correspondence between the privacy information and the UID.

    [0119] Optionally, the processor 920 may be further configured to receive, by using the network interface 930, push information and a UID that are sent by a third party terminal, where the UID is a UID that is obtained and sent to the third party terminal by the cloud server after receiving requirement information sent by the third party terminal, and that is corresponding to non-privacy information matching the requirement information; obtain privacy information corresponding to the UID; and send the push information to the user by using the network interface 930 according to user address information included in the privacy information.

    [0120] Referring to FIG. 10, FIG. 10 is a block diagram of an embodiment of a cloud server according to the present invention.

    [0121] The cloud server includes: a first receiving unit 1010 and a saving unit 1020.

    [0122] The first receiving unit 1010 is configured to receive non-privacy information and a UID of a user that are transmitted by a trusted server, where the non-privacy information is information included in summary information that is extracted by the trusted server from acquired user data, the summary information further includes privacy information of the user, and the UID is a UID that is generated for the privacy information by the trusted server.

    [0123] The saving unit 1020 is configured to save a correspondence between the non-privacy information and the UID that are received by the first receiving unit 1010.

    [0124] Referring to FIG. 11, FIG. 11 is a block diagram of another embodiment of a cloud server according to the present invention.

    [0125] The cloud server includes: a first receiving unit 1110, a saving unit 1120, a second receiving unit 1130, a matching unit 1140, and a sending unit 1150.

    [0126] The first receiving unit 1110 is configured to receive non-privacy information and a UID of a user that are transmitted by a trusted server, where the non-privacy information is information included in summary information that is extracted by the trusted server from acquired user data, the summary information further includes privacy information of the user, and the UID is a UID that is generated for the privacy information by the trusted server.

    [0127] The saving unit 1120 is configured to save a correspondence between the non-privacy information and the UID that are received by the first receiving unit 1110.

    [0128] The second receiving unit 1130 is configured to receive requirement information sent by a third party terminal.

    [0129] The matching unit 1140 is configured to match the non-privacy information saved by the saving unit 1120 to the requirement information received by the second receiving unit 1130, to obtain a UID corresponding to non-privacy information that matches the requirement information.

    [0130] The sending unit 1150 is configured to send, to the third party terminal, the UID that is corresponding to the non-privacy information and obtained by the matching unit 1140, so that, after the third party terminal sends the UID and push information to the trusted server, the trusted server sends the push information according to user address information included in privacy information corresponding to the UID.

    [0131] Referring to FIG. 12, FIG. 12 is a block diagram of another embodiment of a cloud server according to the present invention.

    [0132] The cloud server includes: a bus 1210, a processor 1220, a network interface 1230, and a memory 1240, where the processor 1220, the network interface 1230, and the memory 1240 are connected by using the bus 1210.

    [0133] The processor 1220 is configured to receive, by using the network interface 1230, non-privacy information and a UID of a user that are transmitted by a trusted server, where the non-privacy information is information included in summary information that is extracted by the trusted server from acquired user data, the summary information further includes privacy information of the user, and the UID is a UID that is generated for the privacy information by the trusted server; and save a correspondence between the non-privacy information and the UID to the memory 1240.

    [0134] Optionally, the processor 1220 may be further configured to receive, by using the network interface 1230, requirement information sent by a third party terminal, match the non-privacy information saved by the memory 1240 to the requirement information, to obtain a UID corresponding to non-privacy information that matches the requirement information, and send the obtained UID corresponding to the non-privacy information to the third party terminal by using the network interface 1230, so that, after the third party terminal sends the UID and push information to the trusted server, the trusted server sends the push information according to user address information included in privacy information corresponding to the UID.

    [0135] It can be seen from the foregoing embodiment that, a trusted server acquires user data of a user terminal, extracts summary information of the user data, where the summary information includes privacy information and non-privacy information of a user, generates a UID for the privacy information, and transmits the non-privacy information and the UID to a cloud server, and the cloud server saves a correspondence between the non-privacy information and the UID. Because a trusted server is introduced in the embodiments of the present invention, after the summary information of the user is processed by the trusted server, the cloud server no longer saves complete summary information formed by the privacy information and the non-privacy information, but saves only the non-privacy information in the summary information and the UID of the privacy information in the summary information, so that a third party cannot acquire the privacy information of the user from the cloud server, thereby improving security performance of a cloud computing system.

    [0136] A person skilled in the art may clearly understand that the technique in the embodiments of the present invention may be implemented through software and a necessary general hardware platform. Based on such an understanding, the technical solutions of the present invention essentially or the part contributing to the prior art may be implemented in a form of a software product. The computer software product is stored in a storage medium, such as a ROM/RAM, a hard disk, or an optical disc, and includes several instructions for instructing a computer device (which may be a personal computer, a server, or a network device) to perform the methods described in the embodiments or some parts of the embodiments of the present invention.

    [0137] The embodiments in this specification are all described in a progressive manner, for same or similar parts in the embodiments, reference may be made to these embodiments, and each embodiment focuses on a difference from other embodiments. Especially, a system embodiment is basically similar to a method embodiment, and therefore is described briefly; for related parts, reference may be made to partial descriptions in the method embodiment.

    [0138] The foregoing descriptions are implementation manners of the present invention, but are not intended to limit the protection scope of the present invention.


    Claims

    1. An information processing method executed by a trusted server, wherein the method comprises:

    receiving a key request message sent by a user terminal; and

    delivering an encryption key to the user terminal according to the key request message, so that the user terminal transmits encrypted user data to a cloud server after encrypting user data according to the encryption key;

    acquiring (101) user data of a user terminal, wherein the acquiring user data of a user terminal is specifically:

    receiving a notification message sent by the user terminal, wherein the notification message is used to notify that encrypted user data has been uploaded to the cloud server by the user terminal, and the encrypted user data is data obtained by the user terminal after encrypting the user data according to a delivered encryption key;

    sending, to the cloud server according to the notification message, a data request message that is used to request for the encrypted user data;

    receiving the encrypted user data that is returned by the cloud server according to the data request message; and

    decrypting the encrypted user data by using the encryption key, to obtain decrypted user data; and

    the method further comprises:

    extracting (102) summary information of the user data, wherein the summary information comprises privacy information and non-privacy information of a user, and wherein the summary information refers to a summary of the user data, the privacy information refers to personal sensitive information with a confidential property, and the non-privacy information includes information that interests the user;

    generating (103) a unique identifier UID for the privacy information; and

    transmitting (104) the non-privacy information and the UID to the cloud server, so that the cloud server saves a correspondence between the non-privacy information and the UID.


     
    2. The method according to claim 1, wherein after the extracting summary information of the user data, the method further comprises: saving a correspondence between the privacy information and the UID.
     
    3. The method according to claim 1 or 2, wherein the acquiring user data of a user terminal is specifically: receiving the user data, which is uploaded by the user terminal, of the user terminal; and the method further comprises:

    encrypting the user data by using a encryption key agreed with the user terminal; and

    transmitting the encrypted user data to the cloud server.


     
    4. The method according to claim 2, wherein the method further comprises:

    receiving push information and a second UID that are sent by a third party terminal, wherein the second UID is a UID that is obtained and sent to the third party terminal by the cloud server after receiving requirement information sent by the third party terminal, and that is corresponding to non-privacy information matching the requirement information, wherein the requirement information is information set by the third party terminal when the third party terminal wants to acquire, from the cloud server, information of a user that meets a specific condition;

    obtaining privacy information corresponding to the second UID; and

    sending the push information according to user address information comprised in the privacy information.


     
    5. An information processing method executed by a cloud server, wherein the method comprises:

    receiving (307) a data request message that is used to request for encrypted user data;

    sending (308) the encrypted user data according to the data request message;

    receiving (312) non-privacy information and a unique identifier, UID, of a user that are transmitted by a trusted server, wherein the non-privacy information is information comprised in summary information that is extracted by the trusted server from the encrypted user data, the summary information further comprises privacy information of the user, and the UID is a UID that is generated for the privacy information by the trusted server, and wherein the summary information refers to a summary of the user data, the privacy information refers to personal sensitive information with a confidential property, and the non-privacy information includes information that interests the user; and

    saving (313) a correspondence between the non-privacy information and the UID.


     
    6. The method according to claim 5, wherein the method further comprises:

    receiving (314) requirement information sent by a third party terminal, wherein the requirement information is information set by the third party terminal when the third party terminal wants to acquire, from the cloud server, information of a user that meets a specific condition;

    matching (315) the saved non-privacy information to the requirement information, to obtain a UID corresponding to non-privacy information that matches the requirement information; and

    sending (316) the obtained UID corresponding to the non-privacy information to the third party terminal, so that, after the third party terminal sends the UID and push information to the trusted server, the trusted server sends the push information according to user address information comprised in privacy information corresponding to the UID.


     
    7. A trusted server, wherein the trusted server comprises:

    an acquiring unit (510), configured to acquire user data of a user terminal;

    an extracting unit (520), configured to extract summary information of the user data acquired by the acquiring unit, wherein the summary information comprises privacy information and non-privacy information of a user, and wherein the summary information refers to a summary of the user data, the privacy information refers to personal sensitive information with a confidential property, and the non-privacy information includes information that interests the user;

    a generating unit (530), configured to generate a unique identifier UID for the privacy information in the summary information extracted by the extracting unit; and

    a transmitting unit (540), configured to transmit, to a cloud server, the non-privacy information in the summary information extracted by the extracting unit and the UID generated by the generating unit, so that the cloud server saves a correspondence between the non-privacy information and the UID;

    wherein the acquiring unit comprises:

    a notification message receiving sub-unit, configured to receive a notification message sent by the user terminal, wherein the notification message is used to notify that encrypted user data has been uploaded to the cloud server by the user terminal, and the encrypted user data is data obtained by the user terminal after encrypting the user data according to a delivered encryption key;

    a data request sending sub-unit, configured to send, to the cloud server according to the notification message received by the notification message receiving sub-unit, a data request message that is used to request for the encrypted user data;

    an encrypted data receiving sub-unit, configured to receive the encrypted user data that is returned by the cloud server according to the data request message sent by the request message sending sub-unit; and

    an encrypted data decrypting sub-unit, configured to decrypt, by using the encryption key, the encrypted user data received by the encrypted data receiving sub-unit, to obtain decrypted user data; and

    wherein the trusted server further comprises:

    a first receiving unit (610), configured to receive a key request message sent by the user terminal; and

    a delivering unit (620), configured to deliver the encryption key to the user terminal according to the key request message received by the first receiving unit, so that the user terminal transmits the encrypted user data to the cloud server after encrypting the user data according to the encryption key.


     
    8. The trusted server according to claim 7, wherein the trusted server further comprises:
    a saving unit, configured to save a correspondence between the privacy information in the summary information extracted by the extracting unit and the UID generated by the generating unit.
     
    9. The trusted server according to claim 7 or 8, wherein the acquiring unit comprises:

    a user data receiving sub-unit, configured to receive the user data, which is uploaded by the user terminal, of the user terminal; and

    the trusted server further comprises:

    an encrypting unit (720), configured to encrypt, by using a encryption key agreed with the user terminal, the user data received by the user data receiving sub-unit, wherein

    the transmitting unit is further configured to transmit, to the cloud server, encrypted user data that is output by the encrypting unit.


     
    10. The trusted server according to claim 8, wherein the trusted server further comprises:

    a second receiving unit (860), configured to receive push information and a second UID that are sent by a third party terminal, wherein the second UID is a UID that is obtained and sent to the third party terminal by the cloud server after receiving requirement information sent by the third party terminal, and that is corresponding to non-privacy information matching the requirement information, wherein the requirement information is information set by the third party terminal when the third party terminal wants to acquire, from the cloud server, information of a user that meets a specific condition;

    an obtaining unit (870), configured to obtain privacy information corresponding to the second UID received by the second receiving unit; and

    a sending unit (880), configured to send the push information according to user address information comprised in the privacy information acquired by the obtaining unit.


     
    11. A cloud server, wherein the cloud server comprises:

    a first receiving unit (1010), configured to receive a data request message that is used to request for encrypted user data, and receive non-privacy information and a unique identifier, UID, of a user that are transmitted by a trusted server, wherein the non-privacy information is information comprised in summary information that is extracted by the trusted server from the encrypted user data, the summary information further comprises privacy information of the user, and the UID is a UID that is generated for the privacy information by the trusted server, and wherein the summary information refers to a summary of the user data, the privacy information refers to personal sensitive information with a confidential property, and the non-privacy information include information that interests the user;

    a sending unit (1150), configured to send the encrypted user data according to the data request message; and

    a saving unit (1020), configured to save a correspondence between the non-privacy information and the UID that are received by the first receiving unit.


     
    12. The cloud server according to claim 11, wherein the cloud server further comprises:

    a second receiving unit (1130), configured to receive requirement information sent by a third party terminal, wherein the requirement information is information set by the third party terminal when the third party terminal wants to acquire, from the cloud server, information of a user that meets a specific condition;

    a matching unit (1140), configured to match the non-privacy information saved by the saving unit to the requirement information received by the second receiving unit, to obtain a UID corresponding to non-privacy information that matches the requirement information; and

    the sending unit (1150) is further configured to send the UID that is corresponding to the non-privacy information and obtained by the matching unit to the third party terminal.


     


    Ansprüche

    1. Informationsverarbeitungsverfahren, das von einem vertrauenswürdigen Server ausgeführt wird, wobei das Verfahren umfasst:

    Empfangen einer Schlüsselanforderungsnachricht, die von einem Benutzerendgerät gesendet wurde; und

    Liefern eines Verschlüsselungsschlüssels an das Benutzerendgerät gemäß der Schlüsselanforderungsnachricht, so dass das Benutzerendgerät verschlüsselte Benutzerdaten an einen Cloud-Server überträgt, nachdem es die Benutzerdaten gemäß dem Verschlüsselungsschlüssel verschlüsselt hat;

    Erfassen (101) von Benutzerdaten eines Benutzerendgerätes, wobei das Erfassen von Benutzerdaten eines Benutzerendgerätes insbesondere beinhaltet:

    Empfangen einer durch das Benutzerendgerät gesendeten Benachrichtigungsnachricht, wobei die Benachrichtigungsnachricht verwendet wird, um mitzuteilen, dass verschlüsselte Benutzerdaten durch das Benutzerendgerät auf den Cloud-Server hochgeladen wurden, und es sich bei den verschlüsselten Benutzerdaten um Daten handelt, die durch das Benutzerendgerät nach Verschlüsselung der Benutzerdaten gemäß einem gelieferten Verschlüsselungsschlüssel erhalten wurden;

    Senden einer Datenanforderungsnachricht, an den Cloud-Server gemäß der Benachrichtigungsnachricht, die zum Anfordern der verschlüsselten Benutzerdaten verwendet wird;

    Empfangen der verschlüsselten Benutzerdaten, die durch den Cloud-Server gemäß der Datenanforderungsnachricht zurückgegeben werden; und

    Entschlüsseln der verschlüsselten Benutzerdaten unter Verwendung des Verschlüsselungsschlüssels, um entschlüsselte Benutzerdaten zu erhalten; und

    wobei das Verfahren ferner umfasst:

    Extrahieren (102) von zusammenfassenden Informationen der Benutzerdaten, wobei die zusammenfassenden Informationen vertrauliche Informationen und nicht vertrauliche Informationen eines Benutzers umfassen, und wobei die zusammenfassenden Informationen sich auf eine Zusammenfassung der Benutzerdaten beziehen, die vertraulichen Informationen sich auf persönliche sensible Informationen mit einer vertraulichen Eigenschaft beziehen und die nicht vertraulichen Informationen Informationen beinhalten, die den Benutzer interessieren;

    Erzeugen (103) einer eindeutigen Kennung UID ("Unique Identifier") für die vertraulichen Informationen; und

    Übertragen (104) der nicht vertraulichen Informationen und der UID an den Cloud-Server, so dass der Cloud-Server eine Übereinstimmung zwischen den nicht vertraulichen Informationen und der UID speichert.


     
    2. Verfahren gemäß Anspruch 1, wobei das Verfahren nach dem Extrahieren der zusammenfassenden Informationen der Benutzerdaten ferner umfasst: Speichern einer Übereinstimmung zwischen den vertraulichen Informationen und der UID.
     
    3. Verfahren gemäß Anspruch 1 oder 2, wobei das Erfassen von Benutzerdaten eines Benutzerendgerätes insbesondere beinhaltet: Empfangen der Benutzerdaten, die durch das Benutzerendgerät hochgeladen werden, des Benutzerendgeräts; und wobei das Verfahren ferner umfasst:

    Verschlüsseln der Benutzerdaten unter Verwendung eines mit dem Benutzerendgerät vereinbarten Verschlüsselungsschlüssels; und

    Übertragen der verschlüsselten Benutzerdaten an den Cloud-Server.


     
    4. Verfahren gemäß Anspruch 2, wobei das Verfahren ferner umfasst:

    Empfangen von Push-Informationen und einer zweiten UID, die von einem Drittanbieter-Endgerät gesendet werden, wobei die zweite UID eine UID ist, die durch den Cloud-Server nach dem Empfang von Anforderungsinformationen, die durch das Drittanbieter-Endgerät gesendet wurden, erhalten und an das Drittanbieter-Endgerät gesendet wird, und die nicht vertraulichen Informationen entspricht, die mit den Anforderungsinformationen übereinstimmen, wobei die Anforderungsinformationen Informationen sind, die durch das Drittanbieter-Endgerät gesetzt werden, wenn das Drittanbieter-Endgerät vom Cloud-Server Informationen eines Benutzers, die eine bestimmte Bedingung erfüllen, erhalten will;

    Erhalten von vertraulichen Informationen, die der zweiten UID entsprechen; und Senden der Push-Informationen gemäß den in den vertraulichen Informationen enthaltenen Benutzeradressinformationen.


     
    5. Informationsverarbeitungsverfahren, das durch einen Cloud-Server ausgeführt wird, wobei das Verfahren umfasst:

    Empfangen (307) einer Datenanforderungsnachricht, die dazu verwendet wird, verschlüsselte Benutzerdaten anzufordern;

    Senden (308) der verschlüsselten Benutzerdaten gemäß der Datenanforderungsnachricht;

    Empfangen (312) von nicht vertraulichen Informationen und einer eindeutigen Kennung, UID, eines Benutzers, die durch einen vertrauenswürdigen Server übertragen werden, wobei die nicht vertraulichen Informationen Informationen sind, die in zusammenfassenden Informationen enthalten sind, die durch den vertrauenswürdigen Server aus den verschlüsselten Benutzerdaten extrahiert werden, wobei die zusammenfassenden Informationen ferner vertrauliche Informationen des Benutzers umfassen, und die UID eine UID ist, die für die vertraulichen Informationen durch den vertrauenswürdigen Server erzeugt wird, und wobei die zusammenfassenden Informationen sich auf eine Zusammenfassung der Benutzerdaten beziehen, die vertraulichen Informationen sich auf persönliche sensible Informationen mit einer vertraulichen Eigenschaft beziehen und die nicht vertraulichen Informationen Informationen beinhalten, die den Benutzer interessieren; und

    Speichern (313) einer Übereinstimmung zwischen den nicht vertraulichen Informationen und der UID.


     
    6. Verfahren gemäß Anspruch 5, wobei das Verfahren ferner umfasst:

    Empfangen (314) von Anforderungsinformationen, die durch ein Drittanbieter-Endgerät gesendet werden, wobei die Anforderungsinformationen Informationen sind, die durch das Drittanbieter-Endgerät gesetzt werden, wenn das Drittanbieter-Endgerät vom Cloud-Server Informationen eines Benutzers, die eine bestimmte Bedingung erfüllen, erhalten will;

    Abgleichen (315) der gespeicherten nicht vertraulichen Informationen mit den Anforderungsinformationen, um eine UID zu erhalten, die den nicht vertraulichen Informationen entspricht und mit den Anforderungsinformationen übereinstimmt; und

    Senden (316) der erhaltenen UID, die den nicht vertraulichen Informationen entspricht, an das Drittanbieter-Endgerät, so dass, nachdem das Drittanbieter-Endgerät die UID und die Push-Informationen an den vertrauenswürdigen Server gesendet hat, der vertrauenswürdige Server die Push-Informationen gemäß den Benutzeradressinformationen sendet, die in den vertraulichen Informationen enthalten sind, die der UID entsprechen.


     
    7. Vertrauenswürdiger Server, wobei der vertrauenswürdige Server umfasst:

    eine Erfassungseinheit (510), die dafür ausgelegt ist, Benutzerdaten eines Benutzergerätes zu erfassen;

    eine Extraktionseinheit (520), die dafür ausgelegt ist, zusammenfassende Informationen der Benutzerdaten, die durch die Erfassungseinheit erfasst wurden, zu extrahieren, wobei die zusammenfassenden Informationen vertrauliche Informationen und nicht vertrauliche Informationen eines Benutzers umfassen, und wobei die zusammenfassenden Informationen sich auf eine Zusammenfassung der Benutzerdaten beziehen, die vertraulichen Informationen sich auf persönliche sensible Informationen mit einer vertraulichen Eigenschaft beziehen und die nicht vertraulichen Informationen Informationen beinhalten, die den Benutzer interessieren;

    eine Erzeugungseinheit (530), die dafür ausgelegt ist, eine eindeutige Kennung UID für die vertraulichen Informationen in den von der Extraktionseinheit extrahierten zusammenfassenden Informationen zu erzeugen; und

    eine Übertragungseinheit (540), die dafür ausgelegt ist, die nicht vertraulichen Informationen in den von der Extraktionseinheit extrahierten zusammenfassenden Informationen und die von der Erzeugungseinheit erzeugte UID an einen Cloud-Server zu übertragen, so dass der Cloud-Server eine Übereinstimmung zwischen den nicht vertraulichen Informationen und der UID speichert;

    wobei die Erfassungseinheit umfasst:

    eine Untereinheit zum Empfangen von Benachrichtigungsnachrichten, die dafür ausgelegt ist, eine durch das Benutzerendgerät gesendete Benachrichtigungsnachricht zu empfangen, wobei die Benachrichtigungsnachricht verwendet wird, um mitzuteilen, dass verschlüsselte Benutzerdaten durch das Benutzerendgerät auf den Cloud-Server hochgeladen wurden, und es sich bei den verschlüsselten Benutzerdaten um Daten handelt, die durch das Benutzerendgerät nach Verschlüsselung der Benutzerdaten gemäß einem gelieferten Verschlüsselungsschlüssel erhalten wurden;

    eine Untereinheit zum Senden einer Datenanforderung, die dafür ausgelegt ist, gemäß der Benachrichtigungsnachricht, die durch die Untereinheit zum Empfangen von Benachrichtigungsnachrichten empfangen wird, eine Datenanforderungsnachricht, die zum Anfordern der verschlüsselten Benutzerdaten verwendet wird, an den Cloud-Server zu senden;

    eine Untereinheit zum Empfangen verschlüsselter Daten, die dafür ausgelegt ist, die verschlüsselten Benutzerdaten zu empfangen, die durch den Cloud-Server gemäß der Datenanforderungsnachricht, die durch die Untereinheit zum Senden von Anforderungsnachrichten gesendet wurde, zurückgegeben werden; und

    eine Untereinheit zum Entschlüsseln verschlüsselter Daten, die dafür ausgelegt ist, unter Verwendung des Verschlüsselungsschlüssels die verschlüsselten Benutzerdaten zu entschlüsseln, die durch die Untereinheit zum Empfangen verschlüsselter Daten empfangen werden, um entschlüsselte Benutzerdaten zu erhalten; und

    wobei der vertrauenswürdige Server ferner umfasst:

    eine erste Empfangseinheit (610), die dafür ausgelegt ist, eine Schlüsselanforderungsnachricht, die durch ein Benutzerendgerät gesendet wurde, zu empfangen; und

    eine Liefereinheit (620), die dafür ausgelegt ist, einen Verschlüsselungsschlüssel an das Benutzerendgerät gemäß der Schlüsselanforderungsnachricht, die durch die erste Empfangseinheit empfangen wurde, zu liefern, so dass das Benutzerendgerät die verschlüsselten Benutzerdaten an den Cloud-Server überträgt, nachdem es die Benutzerdaten gemäß dem Verschlüsselungsschlüssel verschlüsselt hat.


     
    8. Vertrauenswürdiger Server gemäß Anspruch 7, wobei der vertrauenswürdige Server ferner umfasst:
    eine Speichereinheit, die dafür ausgelegt ist, eine Übereinstimmung zwischen den vertraulichen Informationen in den zusammenfassenden Informationen, die durch die Extraktionseinheit extrahiert wurden, und der durch die Erzeugungseinheit erzeugten UID zu speichern.
     
    9. Vertrauenswürdiger Server gemäß Anspruch 7 oder 8, wobei die Erfassungseinheit umfasst:

    eine Untereinheit zum Empfangen von Benutzerdaten, die dafür ausgelegt ist, die Benutzerdaten des Benutzerendgeräts zu empfangen, die durch das Benutzerendgerät hochgeladen werden; und

    wobei der vertrauenswürdige Server ferner umfasst:

    eine Verschlüsselungseinheit (720), die dafür ausgelegt ist, unter Verwendung eines mit dem Benutzerendgerät vereinbarten Verschlüsselungsschlüssels die Benutzerdaten, die von der Untereinheit zum Empfangen von Benutzerdaten empfangen werden, zu verschlüsseln, wobei

    die Übertragungseinheit ferner dafür ausgelegt ist, verschlüsselte Benutzerdaten, die von der Verschlüsselungseinheit ausgegeben werden, an den Cloud-Server zu übertragen.


     
    10. Vertrauenswürdiger Server gemäß Anspruch 8, wobei der vertrauenswürdige Server ferner umfasst:

    eine zweite Empfangseinheit (860), die dafür ausgelegt ist, Push-Informationen und eine zweite UID, die durch ein Drittanbieter-Endgerät gesendet werden, zu empfangen, wobei die zweite UID eine UID ist, die durch den Cloud-Server nach dem Empfang von Anforderungsinformationen, die durch das Drittanbieter-Endgerät gesendet wurden, erhalten und an das Drittanbieter-Endgerät gesendet wird, und die nicht vertraulichen Informationen entspricht, die mit den Anforderungsinformationen übereinstimmen, wobei die Anforderungsinformationen Informationen sind, die durch das Drittanbieter-Endgerät gesetzt werden, wenn das Drittanbieter-Endgerät vom Cloud-Server Informationen eines Benutzers, die eine bestimmte Bedingung erfüllen, erhalten will;

    eine Beschaffungseinheit (870), die dafür ausgelegt ist, vertrauliche Informationen zu beschaffen, die der zweiten UID entsprechen, welche von der zweiten Empfangseinheit empfangen wurde; und

    eine Sendeeinheit (880), die dafür ausgelegt ist, die Push-Informationen gemäß den Benutzeradressinformationen, die in den vertraulichen Informationen, die durch die Beschaffungseinheit gewonnen wurden, enthalten sind, zu senden.


     
    11. Cloud-Server, wobei der Cloud-Server umfasst:

    eine erste Empfangseinheit (1010), die dafür ausgelegt ist, eine Datenanforderungsnachricht zu empfangen, die verwendet wird, um verschlüsselte Benutzerdaten anzufordern, und nicht vertrauliche Informationen und eine eindeutige Kennung, UID, eines Benutzers zu empfangen, die durch einen vertrauenswürdigen Server übertragen werden, wobei die nicht vertraulichen Informationen Informationen sind, die in zusammenfassenden Informationen enthalten sind, die durch den vertrauenswürdigen Server aus den verschlüsselten Benutzerdaten extrahiert werden, wobei die zusammenfassenden Informationen ferner vertrauliche Informationen des Benutzers umfassen, und die UID eine UID ist, die für die vertraulichen Informationen durch den vertrauenswürdigen Server erzeugt wird, und wobei die zusammenfassenden Informationen sich auf eine Zusammenfassung der Benutzerdaten beziehen, die vertraulichen Informationen sich auf persönliche sensible Informationen mit einer vertraulichen Eigenschaft beziehen und die nicht vertraulichen Informationen Informationen beinhalten, die den Benutzer interessieren;

    eine Sendeeinheit (1150), die dafür ausgelegt ist, die verschlüsselten Benutzerdaten gemäß der Datenanforderungsnachricht zu senden; und

    eine Speichereinheit (1020), die dafür ausgelegt ist, eine Übereinstimmung zwischen den nicht vertraulichen Informationen und der UID, die von der ersten Empfangseinheit empfangen werden, zu speichern.


     
    12. Cloud-Server gemäß Anspruch 11, wobei der Cloud-Server ferner umfasst:

    eine zweite Empfangseinheit (1130), die dafür ausgelegt ist, Anforderungsinformationen, die durch ein Drittanbieter-Endgerät gesendet werden, zu empfangen, wobei die Anforderungsinformationen Informationen sind, die durch das Drittanbieter-Endgerät gesetzt werden, wenn das Drittanbieter-Endgerät vom Cloud-Server Informationen eines Benutzers, die eine bestimmte Bedingung erfüllen, erhalten will;

    eine Abgleicheinheit (1140), die dafür ausgelegt ist, die durch die Speichereinheit gespeicherten nicht vertraulichen Informationen mit den durch die zweite Empfangseinheit empfangenen Anforderungsinformationen abzugleichen, um eine UID zu erhalten, die den nicht vertraulichen Informationen entspricht und mit den Anforderungsinformationen übereinstimmt; und

    die Sendeeinheit (1150) ferner dafür ausgelegt ist, die UID, die den nicht vertraulichen Informationen entspricht und von der Abgleicheinheit erhalten wurde, an das Drittanbieter-Endgerät zu senden.


     


    Revendications

    1. Procédé de traitement d'informations, exécuté par un serveur de confiance, dans lequel le procédé comprend :

    la réception d'un message de demande de clef envoyé par un terminal d'utilisateur ; et la livraison d'une clef de chiffrement au terminal d'utilisateur selon le message de demande de clef, pour que le terminal d'utilisateur transmette des données d'utilisateur chiffrées à un serveur en nuage après le chiffrement de données d'utilisateur selon la clef de chiffrement ;

    l'acquisition (101) de données d'utilisateur d'un terminal d'utilisateur, dans lequel l'acquisition de données d'utilisateur d'un terminal d'utilisateur est spécifiquement :

    la réception d'un message de notification envoyé par le terminal d'utilisateur, dans lequel le message de notification est utilisé pour notifier que des données d'utilisateur chiffrées ont été téléchargées sur le serveur en nuage par le terminal d'utilisateur, et les données d'utilisateur chiffrées sont des données obtenues par le terminal d'utilisateur après le chiffrement des données d'utilisateur selon une clef de chiffrement livrée ;

    l'envoi, au serveur en nuage, selon le message de notification, d'un message de demande de données, qui est utilisé pour demander les données d'utilisateur chiffrées ;

    la réception des données d'utilisateur chiffrées qui sont renvoyées par le serveur en nuage selon le message de demande de données ; et

    le déchiffrement des données d'utilisateur chiffrées en utilisant la clef de chiffrement, pour obtenir des données d'utilisateur déchiffrées ; et

    le procédé comprend en outre :

    l'extraction (102) d'informations de résumé des données d'utilisateur, dans lequel les informations de résumé comprennent des informations de confidentialité et des informations de non-confidentialité d'un utilisateur, et dans lequel les informations de résumé font référence à un résumé des données d'utilisateur, les informations de confidentialité font référence à des informations sensibles personnelles avec une propriété confidentielle, et les informations de non-confidentialité incluent des informations qui intéressent l'utilisateur ;

    la génération (103) d'un identifiant unique UID pour les informations de confidentialité ; et

    la transmission (104) des informations de non-confidentialité et l'UID au serveur en nuage, pour que le serveur en nuage sauvegarde une correspondance entre les informations de non-confidentialité et l'UID.


     
    2. Procédé selon la revendication 1, dans lequel, après l'extraction d'informations de résumé des données d'utilisateur, le procédé comprend en outre : la sauvegarde d'une correspondance entre les informations de confidentialité et l'UID.
     
    3. Procédé selon la revendication 1 ou 2, dans lequel l'acquisition de données d'utilisateur d'un terminal d'utilisateur est spécifiquement : la réception des données d'utilisateur, qui sont téléchargées par le terminal d'utilisateur, du terminal d'utilisateur ; et
    le procédé comprend en outre :

    le chiffrement des données d'utilisateur en utilisant une clef de chiffrement convenue avec le terminal d'utilisateur ; et

    la transmission des données d'utilisateur chiffrées au serveur en nuage.


     
    4. Procédé selon la revendication 2, dans lequel le procédé comprend en outre :

    la réception d'informations de pousser et d'un second UID qui sont envoyés par un terminal de tiers, dans lequel le second UID est un UID qui est obtenu et envoyé au terminal de tiers par le serveur en nuage après la réception d'informations d'exigence envoyées par le terminal de tiers, et qui correspond à des informations de non-confidentialité assorties aux informations d'exigence, dans lequel les informations d'exigence sont des informations définies par le terminal de tiers lorsque le terminal de tiers veut acquérir, à partir du serveur en nuage, des informations d'un utilisateur qui satisfait à une condition spécifique ;

    l'obtention d'informations de confidentialité correspondant au second UID ; et

    l'envoi des informations de pousser selon des informations d'adresse d'utilisateur comprises dans les informations de confidentialité.


     
    5. Procédé de traitement d'informations exécuté par un serveur en nuage, dans lequel le procédé comprend :

    la réception (307) d'un message de demande de données qui est utilisé pour demander des données d'utilisateur chiffrées ;

    l'envoi (308) des données d'utilisateur chiffrées selon le message de demande de données ;

    la réception (312) d'informations de non-confidentialité et d'un identifiant unique, UID, d'un utilisateur qui sont transmis par un serveur de confiance, dans lequel les informations de non-confidentialité sont des informations comprises dans des informations de résumé qui sont extraites par le serveur de confiance à partir des données d'utilisateur chiffrées, les informations de résumé comprennent en outre des informations de confidentialité de l'utilisateur, et l'UID est un UID qui est généré pour les informations de confidentialité par le serveur de confiance, et dans lequel les informations de résumé font référence à un résumé des données d'utilisateur, les informations de confidentialité font référence à des informations sensibles personnelles avec un propriété confidentielle, et les informations de non-confidentialité incluent des informations qui intéressent l'utilisateur ; et

    la sauvegarde (313) d'une correspondance entre les informations de non-confidentialité et l'UID.


     
    6. Procédé selon la revendication 5, dans lequel le procédé comprend en outre :

    la réception (314) d'informations d'exigence envoyées par un terminal de tiers, dans lequel les informations d'exigence sont des informations définies par le terminal de tiers lorsque le terminal de tiers veut acquérir, à partir du serveur en nuage, des informations d'un utilisateur qui satisfait à une condition spécifique ;

    l'assortiment (315) des informations de non-confidentialité sauvegardées aux informations d'exigence, pour obtenir un UID correspondant à des informations de non-confidentialité qui sont assorties aux informations d'exigence ; et

    l'envoi (316) de l'UID obtenu correspondant aux informations de non-confidentialité au terminal de tiers, pour que, après que le terminal de tiers envoie l'UID et les informations de pousser au serveur de confiance, le serveur de confiance envoie les informations de pousser selon des informations d'adresse d'utilisateur comprises dans des informations de confidentialité correspondant à l'UID.


     
    7. Serveur de confiance, dans lequel le serveur de confiance comprend :

    une unité d'acquisition (510), configurée pour acquérir des données d'utilisateur d'un terminal d'utilisateur ;

    une unité d'extraction (520), configurée pour extraire des informations de résumé des données d'utilisateur acquises par l'unité d'acquisition, dans lequel les informations de résumé comprennent des informations de confidentialité et des informations de non-confidentialité d'un utilisateur, et dans lequel les informations de résumé font référence à un résumé des données d'utilisateur, les informations de confidentialité font référence à des informations sensibles personnelles avec une propriété confidentielle, et les informations de non-confidentialité incluent des informations qui intéressent l'utilisateur ;

    une unité de génération (530), configurée pour générer un identifiant unique UID pour les informations de confidentialité dans les informations de résumé extraites par l'unité d'extraction ; et

    une unité de transmission (540), configurée pour transmettre, à un serveur en nuage, les informations de non-confidentialité dans les informations de résumé extraites par l'unité d'extraction et l'UID généré par l'unité de génération, pour que le serveur en nuage sauvegarde une correspondance entre les informations de non-confidentialité et l'UID ;

    dans lequel l'unité d'acquisition comprend :

    une sous-unité de réception de message de notification, configurée pour recevoir un message de notification envoyé par le terminal d'utilisateur, dans lequel le message de notification est utilisé pour notifier que des données d'utilisateur chiffrées ont été téléchargées sur le serveur en nuage par le terminal d'utilisateur, et les données d'utilisateur chiffrées sont des données obtenues par le terminal d'utilisateur après le chiffrement des données d'utilisateur selon une clef de chiffrement livrée ;

    une sous-unité d'envoi de demande de données, configurée pour envoyer, au serveur en nuage, selon le message de notification reçu par la sous-unité de réception de message de notification, un message de demande de données qui est utilisé pour demander les données d'utilisateur chiffrées ;

    une sous-unité de réception de données chiffrées, configurée pour recevoir les données d'utilisateur chiffrées qui sont renvoyées par le serveur en nuage selon le message de demande de données envoyé par la sous-unité d'envoi de message de demande ; et une sous-unité de déchiffrement de données chiffrées, configurée pour déchiffrer, en utilisant la clef de chiffrement, les données d'utilisateur chiffrées reçues par la sous-unité de réception de données chiffrées, pour obtenir des données d'utilisateur déchiffrées ; et

    dans lequel le serveur de confiance comprend en outre :

    une première unité de réception (610), configurée pour recevoir un message de demande de clef envoyé par le terminal d'utilisateur ; et

    une unité de livraison (620), configurée pour livrer la clef de chiffrement au terminal d'utilisateur selon le message de demande de clef reçu par la première unité de réception, pour que le terminal d'utilisateur transmette les données d'utilisateur chiffrées au serveur en nuage après le chiffrement des données d'utilisateur selon la clef de chiffrement.


     
    8. Serveur de confiance selon la revendication 7, dans lequel le serveur de confiance comprend en outre :
    une unité de sauvegarde, configurée pour sauvegarder une correspondance entre les informations de confidentialité dans les informations de résumé extraites par l'unité d'extraction et l'UID généré par l'unité de génération.
     
    9. Serveur de confiance selon la revendication 7 ou 8, dans lequel l'unité d'acquisition comprend :

    une sous-unité de réception de données d'utilisateur, configurée pour recevoir les données d'utilisateur, qui sont téléchargées par le terminal d'utilisateur, du terminal d'utilisateur ; et

    le serveur de confiance comprend en outre :
    une unité de chiffrement (720), configurée pour chiffrer, en utilisant une clef de chiffrement convenue avec le terminal d'utilisateur, les données d'utilisateur reçues par la sous-unité de réception de données d'utilisateur, dans lequel l'unité de transmission est en outre configurée pour transmettre, au serveur en nuage, des données d'utilisateur chiffrées qui sont produites en sortie par l'unité de chiffrement.


     
    10. Serveur de confiance selon la revendication 8, dans lequel le serveur de confiance comprend en outre :

    une seconde unité de réception (860), configurée pour recevoir des informations de pousser et un second UID qui sont envoyés par un terminal de tiers, dans lequel le second UID est un UID qui est obtenu et envoyé au terminal de tiers par le serveur en nuage après la réception d'informations d'exigence envoyées par le terminal de tiers, et qui correspond à des informations de non-confidentialité assorties aux informations d'exigence, dans lequel les informations d'exigence sont des informations définies par le terminal de tiers lorsque le terminal de tiers veut acquérir, à partir du serveur en nuage, des informations d'un utilisateur qui satisfait à une condition spécifique ;

    une unité d'obtention (870), configurée pour obtenir des informations de confidentialité correspondant au second UID reçu par la seconde unité de réception ; et

    une unité d'envoi (880), configurée pour envoyer les informations de pousser selon des informations d'adresse d'utilisateur comprises dans les informations de confidentialité acquises par l'unité d'obtention.


     
    11. Serveur en nuage, dans lequel le serveur en nuage comprend :

    une première unité de réception (1010), configurée pour recevoir un message de demande de données qui est utilisé pour demander des données d'utilisateur chiffrées, et recevoir des informations de non-confidentialité et un identifiant unique, UID, d'un utilisateur qui sont transmis par un serveur de confiance, dans lequel les informations de non-confidentialité sont des informations comprises dans des informations de résumé qui sont extraites par le serveur de confiance à partir des données d'utilisateur chiffrées, les informations de résumé comprennent en outre des informations de confidentialité de l'utilisateur, et l'UID est un UID qui est généré pour les informations de confidentialité par le serveur de confiance, et dans lequel les informations de résumé font référence à un résumé des données d'utilisateur, les informations de confidentialité font référence à des informations sensibles personnelles avec une propriété confidentielle, et les informations de non-confidentialité incluent des informations qui intéressent l'utilisateur ;

    une unité d'envoi (1150), configurée pour envoyer les données d'utilisateur chiffrées selon le message de demande de données ; et

    une unité de sauvegarde (1020), configurée pour sauvegarder une correspondance entre les informations de non-confidentialité et l'UID qui sont reçus par la première unité de réception.


     
    12. Serveur en nuage selon la revendication 11, dans lequel le serveur en nuage comprend en outre :

    une seconde unité de réception (1130), configurée pour recevoir des informations d'exigence envoyées par un terminal de tiers, dans lequel les informations d'exigence sont des informations définies par le terminal de tiers lorsque le terminal de tiers veut acquérir, à partir du serveur en nuage, des informations d'un utilisateur qui satisfait à une condition spécifique ;

    une unité d'assortiment (1140), configurée pour assortir les informations de non-confidentialité sauvegardées par l'unité de sauvegarde aux informations d'exigence reçues par la seconde unité de réception, pour obtenir un UID correspondant à des informations de non-confidentialité qui sont assorties aux informations d'exigence ; et l'unité d'envoi (1150) est en outre configurée pour envoyer l'UID, qui correspond aux informations de non-confidentialité et est obtenu par l'unité d'assortiment, au terminal de tiers.


     




    Drawing


























    Cited references

    REFERENCES CITED IN THE DESCRIPTION



    This list of references cited by the applicant is for the reader's convenience only. It does not form part of the European patent document. Even though great care has been taken in compiling the references, errors or omissions cannot be excluded and the EPO disclaims all liability in this regard.

    Patent documents cited in the description