A data protection method, comprising the steps of: establishing (101, 201), by a data owner, a proxy relationship with a data sharer, and generating a proxy relation f AB according to a private key of the data owner sk A and a public key of the data sharer pk B; sending, by the data owner, proxy relationship information and the proxy relation f AB to a data distribution system, wherein the proxy relationship information comprises information about the proxy relationship established between the data owner and the data sharer; updating (500, 501), by the data distribution system, a proxy relationship table of the data owner according to the proxy relationship information, and establishing a mapping relationship between the proxy relation f AB and the data sharer, wherein the proxy relationship table is used to record information about a data sharer establishing a proxy relationship with the data owner; generating, (102, 203) by the data owner, a secret value m of shared data, and encrypting the shared data by using the secret value m; encrypting (103, 203), by the data owner and by using a public key of the data owner pk A, the secret value m to obtain an upper-layer key; sending (104, 204), by the data owner, the shared data encrypted by the secret value m and the upper-layer key to the data distribution system; after receiving the encrypted shared data and the upper-layer key, searching (105, 502), by the data distribution system, the proxy relationship table and confirming the proxy relationship between the data owner and the data sharer, and when the data distribution system confirms that the proxy relationship is established between the data owner and the data sharer, obtaining, by the data distribution system, the proxy relation f AB corresponding to the data sharer; updating, by the data distribution system, the upper-layer key by obtaining a proxy change value according to the proxy relation f AB to obtain an updated upper-layer key; sending (106, 503), by the data distribution system, the encrypted shared data and the updated upper-layer key to the data sharer; decrypting (107,601), by the data sharer and according to a private key of the data sharer sk B, the updated upper-layer key to obtain the secret value m; and decrypting (108, 602), by the data sharer, the encrypted shared data according to the secret value m to obtain the shared data. establishing (101, 201), by a data owner, a proxy relationship with a data sharer, and generating a proxy relation f AB according to a private key of the data owner sk A and a public key of the data sharer pk B; sending, by the data owner, proxy relationship information and the proxy relation f AB to a data distribution system, wherein the proxy relationship information comprises information about the proxy relationship established between the data owner and the data sharer; updating (500, 501), by the data distribution system, a proxy relationship table of the data owner according to the proxy relationship information, and establishing a mapping relationship between the proxy relation f AB and the data sharer, wherein the proxy relationship table is used to record information about a data sharer establishing a proxy relationship with the data owner; generating, (102, 203) by the data owner, a secret value m of shared data, and encrypting the shared data by using the secret value m; encrypting (103, 203), by the data owner and by using a public key of the data owner pk A, the secret value m to obtain an upper-layer key; sending (104, 204), by the data owner, the shared data encrypted by the secret value m and the upper-layer key to the data distribution system; after receiving the encrypted shared data and the upper-layer key, searching (105, 502), by the data distribution system, the proxy relationship table and confirming the proxy relationship between the data owner and the data sharer, and when the data distribution system confirms that the proxy relationship is established between the data owner and the data sharer, obtaining, by the data distribution system, the proxy relation f AB corresponding to the data sharer; updating, by the data distribution system, the upper-layer key by obtaining a proxy change value according to the proxy relation f AB to obtain an updated upper-layer key; sending (106, 503), by the data distribution system, the encrypted shared data and the updated upper-layer key to the data sharer; decrypting (107,601), by the data sharer and according to a private key of the data sharer sk B, the updated upper-layer key to obtain the secret value m; and decrypting (108, 602), by the data sharer, the encrypted shared data according to the secret value m to obtain the shared data.