Data storage and transmission security method suitable for Android terminal

Abstract

The invention discloses a data storage and transmission security method suitable for an Android terminal. The method specifically comprises the following steps: creating an independent isolation space isolated from a main space on the Android terminal equipment, and deploying an enterprise application in the isolation space; implementing isolation protection on applications and data in the isolated space environment; encrypting and storing the data in the isolated space environment through the FBE by using a double-encryption key bound with the equipment screen locking password; performing application permission constraint and data access control on the isolation space; establishing an encrypted data transmission channel between the Android terminal and the security terminal; a data access auditing and monitoring mechanism is introduced, each access request for sensitive data is recorded, and a non-tampering log is generated. According to the invention, an omnibearing and deep defense data security access system is constructed, sensitive data stored on the Android mobile device by a user can be effectively protected, and security transmission of data between terminals can be realized.

Description

Technical Field

[0001] The present invention belongs to the technical field of Android system security protection, and in particular relates to a data storage and transmission security method suitable for Android terminals. Background Art

[0002] As the demand for mobile security terminals in multiple fields continues to grow, the demand for customized security terminals has become increasingly urgent. Currently, many customized terminals use the Android operating system. In response to the requirements for data security protection of Android mobile terminals, the enterprise-level security solutions currently disclosed by various manufacturers mainly include dual systems, multiple users, sandbox technology, and application layer virtualization.

[0003] However, dual systems and multiple users require deep customization of the mobile phone system, which is labor-intensive, has a long delivery cycle, and is costly, although it is relatively stable. Although sandbox technology has good protection effects, it is complex to operate and has a long response time. Due to its hook system, application layer virtualization has a large workload for adaptation and is less stable than dual systems and multiple users. Therefore, there is an urgent need for a secure isolation system and data security transmission technology that can reduce user response time, improve security isolation stability, and data transmission security while meeting security isolation requirements. Summary of the invention

[0004] The technical problem to be solved by the present invention is to provide a data storage and transmission security method suitable for Android terminals in view of the deficiencies of the above-mentioned prior art. Through fine-grained permission management, cross-profile data isolation, encrypted data channels, strict identity authentication and continuous access auditing, a comprehensive and in-depth defense data access security system is constructed. Even if an attacker breaks through a certain layer of defense, it is difficult to break through the multiple layers of protection to steal user sensitive data. Through the scheme proposed in the present invention, sensitive applications deployed by users on Android mobile devices can be effectively protected, and private data can be stored and transmitted securely.

[0005] In order to achieve the above technical objectives, the technical solution adopted by the present invention is: A data storage and transmission security method applicable to an Android terminal, specifically comprising the following steps: S1: Create an independent isolation space on the Android terminal device that is isolated from the main space and deploy enterprise applications in the isolation space; S2: Implement isolation protection for applications and data in the isolated space environment based on key authentication; S3: Encrypt and store data in the isolated space environment through FBE using a double encryption key bound to the device lock screen password; S4: Apply application permission constraints and data access control to the isolated space based on the device owner's permissions; S5: Use VPN+tun2socks technology to establish an encrypted data transmission channel between the Android terminal and the designated security terminal to achieve end-to-end encryption of sent and received data; S6: Introduce data access auditing and monitoring mechanisms to record every access request to sensitive data and generate tamper-proof logs.

[0006] To optimize the above technical solutions, the specific measures taken also include: The above-mentioned S3 uses FBE to encrypt each file in the isolated space environment separately. Each file has an independent encryption key. At the same time, the encryption and decryption process of different files adopts parallel processing.

[0007] The above FBE is encrypted using the AES-256-DKBC encryption algorithm, where AES is a symmetric encryption algorithm and DKBC is a hybrid encryption mode. This mode applies two AES keys to each data block for encryption, one as the encryption key in CBC mode and the other as the encryption key in CTR mode. The results of the two encryptions are mixed using XOR operations and byte-level cyclic shifts to generate the final encryption result.

[0008] The above-mentioned XOR operation and byte-level circular shift are used to mix the results of the two encryptions to generate the final encryption result, including: 1) Encrypt each plaintext data block using AES CBC mode and AES CTR mode, and generate intermediate results: C_CBC and C_CTR respectively; 2) Apply byte-by-byte XOR operation to C_CBC and C_CTR to get C_XOR, the formula is: ; 3) Circularly shift the bytes in C_XOR; 4) The cyclically shifted C_XOR is the final encryption result C_Final.

[0009] The above encryption key is securely stored using the KeyStore mechanism and bound to the device lock screen password. When the device is locked, the data in the isolated space environment is automatically locked to prevent attackers from stealing data after obtaining the storage chip.

[0010] The above-mentioned FBE has an Android Direct Boot mode, which is used to start some system services and applications without completely decrypting the data partition after the device is restarted, so that the user can partially control the device while the device is encrypted.

[0011] The above-mentioned S4 sets a permission table for applications in the isolated space to restrict application permissions in the isolated space based on the device owner's permissions. By default, applications can only access the minimum permissions required. At the same time, within the isolated space, applications are isolated from each other, and an application cannot access the data of another application without authorization.

[0012] The above-mentioned S4 adopts the following data access control method: an identity authentication mechanism is deployed at both ends of data transmission, the mobile device proves its identity through a hardware-bound key, and the terminal device uses a preset digital certificate for authentication. The terminal device can only establish a data channel after the two-way verification is passed.

[0013] The above-mentioned S5 specifically includes: S501: Encapsulate the network request in the isolated space in an encrypted VPN tunnel through VPN, so that it cannot be parsed by unauthorized users during transmission on the public network; S502: Deploy tun2socks client and server at both ends of the VPN tunnel, convert all network requests in the isolated space into socks5 proxy requests and then transmit them through the VPN tunnel, so as to perform fine-grained control and screening of network traffic while utilizing the encryption and authentication mechanism of the socks5 protocol, thereby improving data transmission security; S503: Add a layer of encryption / decryption logic to the system network stack to intercept all network requests sent from the isolated space and force them to be encrypted before sending; intercept all network responses received by the isolated space and force them to be decrypted before delivering to the application; S504: Further ensure the security of network transmission through device authentication and interface control. Only when the device in the isolated space passes the strong authentication can it establish a VPN connection with the designated data terminal. The authentication process includes verifying the identity of the device and verifying the integrity of the device to prevent the device from being rooted or implanted with malicious software. It also limits the isolated space to communicate with the designated data terminal only through the designated network interface, eliminating access by other unauthorized devices and interfaces.

[0014] The aforementioned S6 continuously records and audits all sensitive data access requests, helping administrators detect suspicious behavior in a timely manner through tamper-proof security logs.

[0015] The present invention has the following beneficial effects: The present invention firstly creates an independent isolation space isolated from the main space on the terminal device based on the Work Profile function of Android and deploys applications in the space; secondly, the isolation space hard disk is encrypted through a file-based encryption mechanism to prevent data from being read by unauthorized users; then an isolation domain security control system is used to strictly control the application permissions and data access of the isolation space; then an encrypted data transmission channel is established between the Android terminal and the designated security terminal through VPN+tun2socks technology; finally, a data access audit and monitoring mechanism is introduced to record each access request to the data in the isolation space and generate a tamper-proof log. Compared with the prior art, the present invention constructs an all-round, in-depth defense data security access system, which can effectively protect the sensitive data stored by users on Android mobile devices and realize the secure transmission of data between terminals. The present invention can reduce the user response time, improve the stability of security isolation and data transmission security while meeting the security isolation requirements, and meet the requirements of data security protection of mobile terminals of the existing Android system.

[0016] The present invention constructs a comprehensive set of secure transmission mechanisms through a series of technologies such as VPN, tun2socks, mandatory encryption, device authentication and interface control. This mechanism can not only prevent data from being stolen and tampered with during transmission, but also prevent unauthorized devices and interfaces from illegally accessing data, and fully guarantee the security of data transmission in the isolated space, which can provide solid protection for the mobile data security of enterprises and organizations, allowing them to safely handle various sensitive services on mobile devices.

[0017] Based on Android Work Profile, the present invention implements a set of fine-grained permission management and access control mechanisms to comprehensively prevent the risk of data being stolen by malicious applications or unauthorized users. Through strict permission control, access to specified apps and specified file browsers within the isolated space requires permission, which effectively prevents data from being stolen. At the same time, core applications are reinforced twice. In addition to the system's runtime permissions, explicit user authorization is required to access specific directories, and sensitive files will always be hidden from them.

[0018] The present invention uses XOR operation and byte-level circular shift to mix the results of two encryptions to generate the final encryption result. Compared with the traditional encryption mode, this encryption mode has multiple advantages: Hybrid encryption mode (DKBC): This is the core innovation of the scheme. The DKBC mode combines the advantages of the two encryption modes of AES-CBC and AES-CTR, while introducing an additional mixing step, which greatly enhances the encryption strength.

[0019] Dual AES key application: Use two independent AES keys to encrypt each data block, one for CBC mode and the other for CTR mode. This increases the key space and improves security.

[0020] Innovative application of XOR operation: By performing XOR operation on the CBC and CTR encryption results, the original data is effectively obfuscated and the complexity of the ciphertext is increased.

[0021] Byte-level circular shift: This is a unique innovation. By performing byte-level circular shift on the XOR result, the data arrangement is further disrupted, enhancing the unpredictability of the ciphertext.

[0022] Combination with FBE combines this innovative encryption mode with file-level encryption (FBE) to achieve independent encryption of each file, further improving the security of the overall system.

[0023] This mode not only combines the advantages of CBC and CTR modes, but also solves the problems existing in multiple traditional encryption modes, such as the "initialization vector (IV)" problem in CBC mode and the repeated key stream problem in CTR mode, by introducing a hybrid method of XOR and byte cyclic shift. This makes the encryption process not only efficient, but also highly secure and resistant to attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 This is a flow chart of the data storage and transmission method applicable to Android terminals of the present invention; Figure 2 This is a functional architecture diagram of the user terminal of the present invention; Figure 3 It is a schematic diagram of the isolation space components of the present invention; Figure 4 Flow chart of configuring work data for the terminal of the present invention. DETAILED DESCRIPTION

[0025] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0026] Although the steps in the present invention are arranged with numbers, they are not used to limit the order of the steps. Unless the order of the steps is clearly stated or the execution of a certain step requires other steps as a basis, the relative order of the steps can be adjusted. It is understood that the term "and / or" used in this article involves and covers any and all possible combinations of one or more of the associated listed items.

[0027] The present invention is a data storage and transmission security method suitable for Android terminals, such as Figure 1 As shown, the steps are: S1: Based on the Android Work Profile function, an independent isolation space is created on the device, which is isolated from the main space and enterprise applications are deployed in the isolation space; S2: Implement strict isolation protection for applications and data in the isolated space environment; S3: Encrypts the isolated space hard disk through a file-based encryption mechanism to prevent data from being stolen; S4: Strictly control application permissions and data access in isolated spaces; S5: Establish an encrypted data transmission channel between the Android terminal and the designated security terminal through VPN+tun2socks technology; S6: Implement two-way authentication and security auditing for external data transmission: Introduce data access auditing and monitoring mechanisms to record every access request to sensitive data and generate tamper-proof logs.

[0028] The present invention constructs an all-round, in-depth defense data access security system. Even if an attacker breaks through a certain layer of defense, it is difficult to break through the multiple layers of protection to steal sensitive data. Through this effective solution, users can safely process the most sensitive data on mobile devices without worrying about the risk of data leakage.

[0029] like Figure 2 As shown in the figure, the device has three functional designs based on the isolation space: isolation of the isolation space, VPN encryption, and access auditing and monitoring.

[0030] Isolation space isolation implements encrypted storage of data files, application permission management, and cross-profile access control; The VPN encrypted channel realizes secure transmission between the device and the designated terminal by mandatory encryption and decryption of data and strong device identity authentication; The access auditing and monitoring function records access requests and generates tamper-proof audit logs, allowing administrators to promptly detect suspicious data access behaviors and take countermeasures.

[0031] In the embodiment, S1 creates an isolated space and deploys applications in the isolated space. The present invention creates an independent isolated space on the device based on Android WorkProfile, which is isolated from the main (personal) space, thereby separating work applications and data from user personal applications and data.

[0032] In the embodiment, S2 implements strict key-authentication-based protection for applications and data in the isolated space. All data in the isolated space, such as application data, files, etc., are stored in an independent space, which is completely isolated from the main space (completely isolated from other data on the device).

[0033] In the embodiment, S3 uses FBE (File-Based Encryption) to encrypt and store the data in the isolated space. The data in the isolated space is encrypted using a dual-mode encryption key and bound to the device lock screen password.

[0034] Use FBE to encrypt and store data in the isolated space. Each file uses an independent encryption key. The key is securely stored using the KeyStore mechanism and bound to the device lock screen password. When the device is locked, the isolated space data is automatically locked, effectively preventing attackers from stealing data after obtaining the storage chip. The specific contents include: (1) File encryption This solution is based on FBE to encrypt and store application data and files in the isolated space. The working principle of FBE is to encrypt each file separately. Each file has an independent encryption key. Even if the key of a single file is cracked, the security of other files will not be affected. At the same time, the encryption and decryption process of different files adopts parallel processing to improve the performance of FBE. This solution uses the AES-256-DKBC encryption algorithm, where AES is a symmetric encryption algorithm and DKBC is a hybrid encryption mode designed specifically for this solution. This mode uses two AES keys to encrypt each data block, one as the encryption key of the CBC mode and the other as the encryption key of the CTR mode. At the same time, this mode does not simply rely on the traditional encryption mode, but innovatively uses XOR operations and byte-level circular shifts to mix the encryption results: 1) Each plaintext data block is encrypted using AES CBC mode and AES CTR mode to generate two intermediate results: C_CBC and C_CTR.

[0035] 2) Apply a byte-by-byte XOR operation to these two results to get C_XOR: .

[0036] 3) Circularly shift the bytes in C_XOR. For example, shift the i-th byte to the right by i bits (circularly shift, the excess part returns to the left).

[0037] 4) The final result C_Final will be the shifted C_XOR.

[0038] Compared with the traditional encryption mode, this encryption mode has several innovations: Hybrid encryption mode (DKBC): This is the core innovation of the scheme. The DKBC mode combines the advantages of the two encryption modes of AES-CBC and AES-CTR, while introducing an additional mixing step, which greatly enhances the encryption strength.

[0039] Dual AES key application: Use two independent AES keys to encrypt each data block, one for CBC mode and the other for CTR mode. This increases the key space and improves security.

[0040] Innovative application of XOR operation: By performing XOR operation on the CBC and CTR encryption results, the original data is effectively obfuscated and the complexity of the ciphertext is increased.

[0041] Byte-level circular shift: This is a unique innovation. By performing byte-level circular shift on the XOR result, the data arrangement is further disrupted, enhancing the unpredictability of the ciphertext.

[0042] Combination with FBE combines this innovative encryption mode with file-level encryption (FBE) to achieve independent encryption of each file, further improving the security of the overall system.

[0043] This mode not only combines the advantages of CBC and CTR modes, but also solves the problems existing in multiple traditional encryption modes, such as the "initialization vector (IV)" problem in CBC mode and the repeated key stream problem in CTR mode, by introducing a hybrid method of XOR and byte cyclic shift. This makes the encryption process not only efficient, but also highly secure and resistant to attacks.

[0044] (2) Data key The data in the isolated space is encrypted with a dual-mode encryption key, which is securely stored by Android's KeyStore mechanism and bound to the device lock screen password. This means that even if an attacker obtains the device's storage chip, the data in the isolated space cannot be decrypted without the device lock screen password. When the device is locked, the data in the isolated space will be automatically locked. Only after the user unlocks the device and passes the authentication of the isolated space can the work data be accessed. This mechanism takes into account both convenience and security.

[0045] (3) Direct Boot mode FBE supports Android's Direct Boot mode, which allows some system services and applications to be started after the device is restarted without completely decrypting the data partition, allowing users to partially control the device while the device is encrypted.

[0046] In the embodiment, S4 obtains the device owner authority (Device Owner) and uses it to implement strict control over the application permissions and data access of the isolated space. Corresponding permissions must be obtained when accessing the specified app and specified file browser within the isolated space. Data exchange access between the Android host and the isolated space is not supported. It only supports data transmission to the specified terminal device via an encrypted network via a network cable. The terminal uses key authentication to prevent attackers from stealing data by capturing packets.

[0047] The device owner's permissions are used to manage and control the access to the isolated space. The data interaction between the isolated space and the personal space is prohibited. The isolated space data is only allowed to circulate internally. The specific contents include: (1) Application permission constraints Applications in the isolated space are subject to strict permission constraints. The present invention sets a permission table for isolated space applications. By default, applications can only access the minimum permissions required. For example, document editing applications can apply for access to storage permissions, but are not allowed to access sensitive permissions such as location or camera. At the same time, within the isolated space, applications are isolated from each other, and applications cannot access the data of another application before obtaining authorization. The solution of the present invention adopts secondary reinforcement, prohibition of screenshots, prohibition of application installation, prohibition of taking photos and other restrictions for core applications such as file browsers. In addition to the system's operating permissions, users are required to explicitly authorize to access specific directories, and sensitive files will always be hidden from them.

[0048] (2) Data transmission channel authentication mechanism The present invention transmits data with a designated terminal device through a wired network. The transmission process is based on a VPN encrypted tunnel, which effectively prevents data from being intercepted or eavesdropped during the transmission process. A strict identity authentication mechanism is deployed at both ends of data transmission. The mobile device proves its identity through a hardware-bound key (such as a key in TEE), and the terminal device uses a preset digital certificate for authentication. The terminal device can establish a data channel only after the two-way verification is passed.

[0049] In the embodiment, S5 creates an isolated space initialization step to force the specification of a VPN application, thereby forming an isolated space network closed loop. All network requests within the isolated space are encapsulated in an encrypted tunnel, making it impossible to eavesdrop and decrypt when transmitted on the public network. At the same time, tun2socks client and server are deployed at both ends of the VPN tunnel to convert TCP / UDP traffic into socks5 proxy traffic transmission, thereby achieving end-to-end encryption of sending and receiving data.

[0050] Through device authentication and interface control, network transmission security is further guaranteed. The device in the isolated space can establish a VPN connection with the designated data terminal only after passing strong authentication, and the isolated space is limited to communicating with the designated data terminal only through a specific network interface, including: S501: Encapsulate the network request inside the isolated space in an encrypted tunnel through VPN, so that it cannot be parsed by unauthorized users during transmission on the public network.

[0051] S502: Deploy tun2socks client and server at both ends of the VPN tunnel, convert all network requests in the isolated space into socks5 proxy requests and then transmit them through the VPN tunnel. This mode can not only utilize the encryption and authentication mechanism of the socks5 protocol, but also perform fine-grained control and screening of network traffic, further improving data transmission security.

[0052] S503: Add a layer of encryption / decryption logic to the system network stack to intercept all network requests issued in the isolated space and force them to be encrypted before sending; intercept all network responses received in the isolated space and force them to be decrypted before delivering them to the application.

[0053] S504: The security of network transmission is further guaranteed through strict device authentication and interface control. Only when the device in the isolation space passes the strong authentication can a VPN connection be established with the designated data terminal. The authentication process includes verifying the identity of the device and verifying the integrity of the device to prevent the device from being ROOT or implanted with malicious software. In addition, the present invention also limits the isolation space to communicate with the designated data terminal only through a specific network interface (such as WIFI, USB network sharing, etc.), eliminating access by other unauthorized devices and interfaces.

[0054] Figure 4 Flowchart for configuring work profiles for terminals. The specific process includes the following steps: first, the administrator creates a work profile configuration on the console; second, the terminal creates a work profile on the device through the Android Management API; third, the system creates an independent application and data storage space for the work profile; then, the system generates an independent user ID and encryption key for the work profile; then, the administrator deploys and manages enterprise applications to the work profile; finally, the user uses the application in the work profile to process work data, thereby isolating the user's personal application from the work profile.

[0055] In the embodiment, S6 transmits data with the designated terminal device through a wired network. The transmission process is based on a VPN encrypted tunnel. At the same time, a strict identity authentication mechanism is deployed at both ends of the data transmission, and access requests to sensitive data are recorded in detail, including access users, initiating applications, access time, access content, etc., to form a tamper-proof security log.

[0056] The present invention provides a secure and controllable external data transmission channel. The isolated space communicates with the designated terminal through a wired network and an encrypted VPN tunnel, and implements strict identity authentication at both ends. At the same time, the system continuously records and audits all sensitive data access requests, and helps administrators detect suspicious behavior in a timely manner through an unalterable security log.

[0057] like Figure 3 As shown, the isolated space consists of encrypted tunnels, permissions and access control, enterprise data, encrypted storage, etc., which realizes the isolation of personal data and enterprise data, strict control of application permissions, and encrypted upload and storage of user data.

[0058] It will be apparent to those skilled in the art that the invention is not limited to the details of the exemplary embodiments described above and that the invention can be implemented in other specific forms without departing from the spirit or essential features of the invention. Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description, and it is intended that all variations falling within the meaning and scope of the equivalent elements of the claims be included in the invention. Any reference numeral in a claim should not be considered as limiting the claim to which it relates.

[0059] In addition, it should be understood that although the present specification is described according to implementation modes, not every implementation mode contains only one independent technical solution. This description of the specification is only for the sake of clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each embodiment may also be appropriately combined to form other implementation modes that can be understood by those skilled in the art.

Claims

1. A data storage and transmission security method suitable for Android terminals, characterized in that: The specific steps include: S1: Create an independent isolation space on the Android terminal device that is isolated from the main space and deploy enterprise applications in the isolation space; S2: Implement isolation protection for applications and data in the isolated space environment based on key authentication; S3: Encrypt and store data in the isolated space environment through FBE using a double encryption key bound to the device lock screen password; S4: Apply application permission constraints and data access control to the isolated space based on the device owner's permissions; S5: Use VPN+tun2socks technology to establish an encrypted data transmission channel between the Android terminal and the designated security terminal to achieve end-to-end encryption of sent and received data; S6: Introduce data access auditing and monitoring mechanisms to record every access request to sensitive data and generate tamper-proof logs.

2. According to claim 1, a data storage and transmission security method suitable for Android terminals is characterized in that: The S3 uses FBE to encrypt each file in the isolated space environment separately. Each file has an independent encryption key. At the same time, the encryption and decryption process of different files adopts a parallel processing method.

3. According to claim 1, a data storage and transmission security method suitable for Android terminals is characterized in that: The FBE is encrypted using the AES-256-DKBC encryption algorithm, where AES is a symmetric encryption algorithm and DKBC is a hybrid encryption mode that applies two AES keys to encrypt each data block, one as the encryption key in CBC mode and the other as the encryption key in CTR mode. The results of the two encryptions are mixed using an XOR operation and byte-level cyclic shift to generate the final encryption result.

4. A data storage and transmission security method suitable for Android terminals according to claim 3, characterized in that: The XOR operation and the byte-level circular shift are used to mix the two encryption results to generate the final encryption result, including: 1) Encrypt each plaintext data block using AES CBC mode and AES CTR mode, and generate intermediate results: C_CBC and C_CTR respectively; 2) Apply byte-by-byte XOR operation to C_CBC and C_CTR to get C_XOR, the formula is: ； 3) Circularly shift the bytes in C_XOR; 4) The cyclically shifted C_XOR is the final encryption result C_Final.

5. A data storage and transmission security method suitable for Android terminals according to claim 1, characterized in that: The encryption key is securely stored using the KeyStore mechanism and bound to the device lock screen password. When the device is locked, the data in the isolated space environment is automatically locked to prevent attackers from stealing data after obtaining the storage chip.

6. The data storage and transmission security method applicable to Android terminals according to claim 1, characterized in that: The FBE is provided with Android's Direct Boot mode, which is used to start some system services and applications without completely decrypting the data partition after the device is restarted, so that the user can partially control the device while the device is encrypted.

7. A data storage and transmission security method suitable for Android terminals according to claim 1, characterized in that: The S4 sets a permission table for applications in the isolated space to restrict application permissions in the isolated space based on the device owner's permissions. By default, applications can only access the minimum permissions required. At the same time, within the isolated space, applications are isolated from each other and cannot access the data of another application without authorization.

8. A data storage and transmission security method suitable for Android terminals according to claim 1, characterized in that: The S4 adopts the following data access control method: an identity authentication mechanism is deployed at both ends of data transmission, the mobile device proves its identity through a hardware-bound key, and the terminal device uses a preset digital certificate for authentication. The terminal device can establish a data channel only after the two-way verification is passed.

9. A data storage and transmission security method suitable for Android terminals according to claim 1, characterized in that: The S5 specifically includes: S501: Encapsulate the network request in the isolated space in an encrypted VPN tunnel through VPN, so that it cannot be parsed by unauthorized users during transmission on the public network; S502: Deploy tun2socks client and server at both ends of the VPN tunnel, convert all network requests in the isolated space into socks5 proxy requests and then transmit them through the VPN tunnel, so as to perform fine-grained control and screening of network traffic while utilizing the encryption and authentication mechanism of the socks5 protocol, thereby improving data transmission security; S503: Add a layer of encryption / decryption logic to the system network stack to intercept all network requests sent from the isolated space and force them to be encrypted before sending; intercept all network responses received by the isolated space and force them to be decrypted before delivering to the application; S504: Further ensure the security of network transmission through device authentication and interface control. Only when the device in the isolated space passes the strong authentication can it establish a VPN connection with the designated data terminal. The authentication process includes verifying the identity of the device and verifying the integrity of the device to prevent the device from being rooted or implanted with malicious software. It also limits the isolated space to communicate with the designated data terminal only through the designated network interface, eliminating access by other unauthorized devices and interfaces.

10. A data storage and transmission security method suitable for Android terminals according to claim 1, characterized in that: The S6 continuously records and audits all sensitive data access requests, helping administrators to detect suspicious behavior in a timely manner through an unalterable security log.

Images