Data processing method and device, equipment and storage medium

Abstract

The application relates to the technical field of information security, and discloses an application data processing method, device, equipment and storage medium, the method comprising the following steps: determining an application operation user according to a data storage instruction and obtaining a corresponding user key; obtaining access permission by decrypting a target encrypted storage space through the user key; obtaining to-be-stored application data and judging whether sensitive data exist in the data; and if the sensitive data exist, saving the to-be-stored application data to the encrypted storage space. Since the pre-allocated encrypted storage space is decrypted through the user key of the application operation user to obtain the access permission of the encrypted storage space, and then the to-be-stored application data is saved to the encrypted storage space when it is judged that the to-be-stored application data contains sensitive data, on one hand, the application data carrying the sensitive data can be prevented from being leaked, and on the other hand, other applications without the user key cannot access the encrypted storage space, so that the security of the application data is ensured.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an application data processing method, device, equipment and storage medium. Background Art

[0002] The current era of Industry 4.0, an era of information technology driving industrial transformation—the era of intelligence—is underway. The financial industry is undergoing a digital transformation, upgrading its existing business models through the adoption of next-generation information technologies (such as artificial intelligence, 5G, big data, cloud computing, and blockchain). With the in-depth utilization of this new generation of information technology, the accompanying information security risks will become increasingly prominent.

[0003] China has elevated information security to the forefront of its national security strategy. In particular, in 2019, the Cyberspace Administration of China, the Ministry of Public Security, the People's Bank of China, and other departments issued a series of information security regulatory requirements, including national standards for personal information protection, requirements for app privacy supervision, the 2.0 Information Security Protection Standard, and the financial app filing system. Regulatory agencies also issue penalties for inadequate implementation of these requirements. In recent years, numerous financial institutions have been subject to public notifications for information security-related issues.

[0004] In this regulatory context, employee oversight within financial institutions is particularly crucial. If employees arbitrarily store information and data from internal company apps, there's a risk that external apps or other malicious software could illegally access or misuse this data, potentially leaking sensitive corporate information or trade secrets. Therefore, preventing data from internal company apps from being stolen by external apps and ensuring corporate information security has become a pressing technical challenge.

[0005] The above content is only used to assist in understanding the technical solution of the present invention and does not constitute an admission that the above content is prior art. Summary of the Invention

[0006] The main purpose of the present invention is to provide an application data processing method, device, equipment and storage medium, aiming to solve the technical problem of how to prevent the application data of internal enterprise APPs from being stolen by other external APPs and ensure the security of enterprise information.

[0007] To achieve the above object, the present invention provides an application data processing method, which includes the following steps:

[0008] When a data storage instruction is detected, determining an application operating user according to the data storage instruction, and obtaining a user key corresponding to the application operating user;

[0009] decrypting the target encrypted storage space using the user key to obtain access rights to the target encrypted storage space;

[0010] Obtaining the application data to be stored corresponding to the data storage instruction, and determining whether there is sensitive data in the application data to be stored;

[0011] When the sensitive data exists in the application data to be stored, the application data to be stored is saved in the encrypted storage space.

[0012] Preferably, before the step of determining the application operating user according to the data storage instruction when the data storage instruction is detected and obtaining the user key corresponding to the application operating user, the method further includes:

[0013] When the application is installed, a storage space to be encrypted is allocated from the local storage space of the terminal where the application is located;

[0014] Acquire terminal information of the terminal, and generate a user key corresponding to the storage space to be encrypted according to the terminal information;

[0015] The storage space to be encrypted is encrypted according to the user key to obtain an encrypted storage space.

[0016] Preferably, the step of obtaining the terminal information of the terminal and generating a user key corresponding to the storage space to be encrypted according to the terminal information includes:

[0017] Obtaining terminal information of the terminal and reading hardware identification information contained in the terminal information;

[0018] Obtaining network location information and geographic location information of the terminal;

[0019] Correcting the geographic location information to obtain corrected target geographic location information;

[0020] A user key corresponding to the storage space to be encrypted is generated by a preset information digest algorithm according to the network location information, the target geographical location information, and the hardware identification information.

[0021] Preferably, the step of obtaining the application data to be stored corresponding to the data storage instruction and determining whether sensitive data exists in the application data to be stored includes:

[0022] Acquire application data to be stored corresponding to the data storage instruction, and determine whether the application data to be stored is image data;

[0023] When the application data to be stored is image data, optical character recognition (OCR) technology is used to perform feature recognition on the image data to obtain image features;

[0024] It is determined whether sensitive data exists in the application data to be stored by using a pre-built sensitive feature database and the image features.

[0025] Preferably, after the step of encrypting the storage space to be encrypted according to the user key to obtain the encrypted storage space, the method further comprises:

[0026] Periodically acquiring current performance parameters of the terminal, and performing a performance score on the terminal according to the current performance parameters to obtain a score value;

[0027] When the score value is lower than a preset threshold, the capacity of the encrypted storage space is expanded.

[0028] Preferably, the step of periodically acquiring the current performance parameters of the terminal and performing a performance score on the terminal according to the current performance parameters to obtain a score value includes:

[0029] Periodically obtaining current performance parameters of the terminal, and obtaining CPU occupancy information and memory occupancy information from the current performance parameters;

[0030] Obtaining a first weight set corresponding to the CPU occupancy information and a second weight set corresponding to the memory occupancy information;

[0031] A performance score is calculated for the terminal according to the CPU occupancy information, the first weight set, the memory occupancy information, and the second weight set to obtain a score value.

[0032] Preferably, when the score value is lower than a preset threshold, the step of expanding the capacity of the encrypted storage space includes:

[0033] When the score value is lower than a preset threshold, obtaining user operation records and resource occupancy information corresponding to the background application of the terminal;

[0034] Reading the last active time of the user corresponding to each background application from the user operation record;

[0035] Prioritize all background applications according to the user's final active time and the resource occupancy information;

[0036] Determine a target application according to the priority sorting result, and request the terminal to release hardware resources currently occupied by the target application;

[0037] When the hardware resources are released, the capacity of the encrypted storage space is expanded.

[0038] In addition, to achieve the above-mentioned object, the present invention further provides an application data processing device, the application data processing device comprising:

[0039] A key acquisition module is used to, when a data storage instruction is detected, determine the application operation user according to the data storage instruction and obtain a user key corresponding to the application operation user;

[0040] A space decryption module, configured to decrypt the target encrypted storage space using the user key to obtain access rights to the target encrypted storage space;

[0041] a data determination module, configured to obtain the application data to be stored corresponding to the data storage instruction, and determine whether there is sensitive data in the application data to be stored;

[0042] The data processing module is configured to save the application data to be stored into the encrypted storage space when the sensitive data exists in the application data to be stored.

[0043] In addition, to achieve the above-mentioned purpose, the present invention also proposes an application data processing device, which includes: a memory, a processor, and an application data processing program stored on the memory and executable on the processor, wherein the application data processing program is configured to implement the steps of the application data processing method described above.

[0044] In addition, to achieve the above-mentioned purpose, the present invention further proposes a storage medium, on which an application data processing program is stored. When the application data processing program is executed by a processor, the steps of the application data processing method described above are implemented.

[0045] When the present invention detects a data storage instruction, it determines the application operating user based on the data storage instruction and obtains the user key corresponding to the application operating user; decrypts the target encrypted storage space using the user key to obtain access rights to the target encrypted storage space; obtains the application data to be stored corresponding to the data storage instruction, and determines whether sensitive data exists in the application data to be stored; and if sensitive data exists, saves the application data to be stored to the encrypted storage space. Because the present invention decrypts the pre-allocated encrypted storage space using the user key of the application operating user to obtain access rights to the encrypted storage space, and then, if sensitive data exists in the application data to be stored, saves the application data to be stored to the encrypted storage space, it can ensure that application data carrying sensitive data is not leaked, and on the other hand, it prevents other applications that do not have the user key from accessing the encrypted storage space, thereby ensuring the security of the application data. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 It is a structural diagram of an application data processing device in a hardware operating environment involved in an embodiment of the present invention;

[0047] Figure 2 This is a flow chart of a first embodiment of a data processing method according to the present invention;

[0048] Figure 3 This is a flow chart of a second embodiment of a data processing method according to the present invention;

[0049] Figure 4 This is a flow chart of a third embodiment of a data processing method according to the present invention;

[0050] Figure 5 This is a structural block diagram of the first embodiment of the data processing device applied in the present invention.

[0051] The purpose, features and advantages of the present invention will be further described with reference to the accompanying drawings and in conjunction with the embodiments. DETAILED DESCRIPTION

[0052] It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0053] Reference Figure 1 , Figure 1 This is a schematic diagram of the structure of an application data processing device in the hardware operating environment involved in an embodiment of the present invention.

[0054] like Figure 1 As shown, the application data processing device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the user interface 1003 may optionally include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a wireless fidelity (WIreless-FIdelity, WI-FI) interface). The memory 1005 may be a high-speed random access memory (Random Access Memory, RAM) memory, or a stable non-volatile memory (Non-Volatile Memory, NVM), such as a disk memory. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0055] Those skilled in the art will understand that Figure 1 The structure shown in the figure does not constitute a limitation to the application data processing device, and may include more or less components than shown in the figure, or combine certain components, or arrange the components differently.

[0056] like Figure 1 As shown, the memory 1005 as a storage medium may include an operating system, a data storage module, a network communication module, a user interface module and an application data processing program.

[0057] exist Figure 1 In the application data processing device shown, the network interface 1004 is mainly used for data communication with the network server; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in the application data processing device of the present invention can be set in the application data processing device, and the application data processing device calls the application data processing program stored in the memory 1005 through the processor 1001, and executes the application data processing method provided by the embodiment of the present invention.

[0058] The embodiment of the present invention provides an application data processing method, referring to Figure 2 , Figure 2 This is a flow chart of the first embodiment of the data processing method according to the present invention.

[0059] In this embodiment, the application data processing method includes the following steps:

[0060] Step S10: When a data storage instruction is detected, determining the application operating user according to the data storage instruction, and obtaining a user key corresponding to the application operating user;

[0061] It should be noted that the execution subject of the above method in this embodiment can be an application APP (hereinafter referred to as APP), or it can be a mobile terminal loaded with the application APP. The mobile terminal can be a computer device with data processing, network communication and program running functions, such as a mobile phone, tablet computer, laptop computer, etc.

[0062] It should be understood that the above-mentioned application operation user, that is, the operator who starts the current application, is defined in this embodiment as the user account currently logged into the APP. The data storage instruction is triggered by the user account by default. For example, when the user operates the mobile phone to take a screenshot of the application page of the APP and clicks the screenshot save button, the data storage instruction will be triggered.

[0063] It is understood that the user key can be the password information used to decrypt the encrypted storage space owned by the app. In this embodiment, before executing this step, the app will request the mobile terminal to automatically allocate an encrypted storage space for it. This encrypted storage space is isolated from other storage spaces on the mobile terminal, and only the app has the user key to decrypt this encrypted storage space. This user key can be generated by the app according to custom rules.

[0064] In a specific implementation, when the APP detects a data storage instruction, it can determine the application operation user according to the data storage instruction and obtain the user key corresponding to the application operation user.

[0065] Furthermore, considering that in actual applications, the same APP may have user accounts with different usage permissions that switch logins, for example, different departments or groups of employees in an enterprise may have inconsistent operating permissions for the same APP, and some external personnel cannot log in to certain APPs developed internally by the enterprise at all. Therefore, in this embodiment, the APP will verify the identity of each application operating user to prevent internal application data leakage in certain situations. Specifically, when the application startup instruction is detected, the APP can obtain the user account identifier and user account login information contained in the application startup instruction; then determine the application startup user (i.e., the application operating user) based on the user account identifier, and perform login verification on the application startup user based on the user account login information; when the login verification passes, it is determined whether the application startup user has the application operation permission based on the pre-built account permission table; when the user has the application operation permission, it is determined that the identity authentication has passed.

[0066] Of course, considering that existing APPs have an automatic login function for historical accounts, in some cases, the current operator of the APP may directly use a user account that has already logged in and has permission to use the APP, but in fact the current operator does not have permission to use the APP (for example, user B does not have permission to use the APP, but uses user A's mobile phone to log in and use the APP using user A's account). This situation will undoubtedly lead to the leakage of application data, such as the current operator stealing and sending internal application data by taking photos or screenshots. For such situations, this embodiment can also consider performing liveness detection on the current operator when the above-mentioned identity verification passes, such as face recognition, iris recognition, voiceprint recognition or fingerprint recognition to further improve the credibility and accuracy of the above-mentioned identity verification.

[0067] Step S20: decrypting the target encrypted storage space using the user key to obtain access rights to the target encrypted storage space;

[0068] It should be understood that the target encrypted storage space is the storage space pre-allocated for the app. After obtaining the corresponding user key, the app can decrypt the target encrypted storage space based on the user key to obtain access rights to the target encrypted storage space, thereby enabling data to be read and written to the encrypted storage space.

[0069] Step S30: obtaining the application data to be stored corresponding to the data storage instruction, and determining whether there is sensitive data in the application data to be stored;

[0070] It should be noted that the sensitive data, i.e., the internal application data containing sensitive information that cannot be sent externally, includes, for example, APP screenshots, chat data, and commercial secrets involved in the application. In this embodiment, when such data is operated or generated by the user, the application will mark it accordingly, for example, each screenshot generated will be watermarked, or its image parameters will be modified when the screenshot is generated so that it has a special mark, so that when the APP detects the presence of sensitive data in the application data to be stored, it can store the application data to be stored or the sensitive data in the application data to be stored in the target storage space. Of course, for the application data to be stored that does not contain any sensitive data, the APP can directly store it in the non-encrypted storage space of the mobile terminal, thereby saving the capacity of the encrypted storage space.

[0071] Furthermore, considering that application data can be easily captured and sent out by the operator through screenshots, in this embodiment, the APP will obtain the application data to be stored corresponding to the data storage instruction, and determine whether the application data to be stored is image data; when the application data to be stored is image data, optical character recognition (OCR) technology is used to perform feature recognition on the image data to obtain image features; and a pre-built sensitive feature database and the image features are used to determine whether there is sensitive data in the application data to be stored.

[0072] It should be understood that optical character recognition (OCR) technology refers to the process by which an electronic device (such as a scanner or digital camera) examines characters printed on paper, determines their shape by detecting dark and light patterns, and then uses character recognition methods to translate the shape into computer text. This embodiment uses OCR technology to accurately identify image features in image data.

[0073] Furthermore, considering that the image processing process involved in image feature recognition is relatively complex, and the recognition object during recognition is also the entire image, it will occupy most of the CPU and GPU resources of the mobile terminal. As for image data, only a certain part of it carries sensitive data, it can be determined that it needs to be stored in the encrypted storage space. Therefore, when performing feature recognition on image data, this embodiment can also adopt the method of regional division and hierarchical recognition. Specifically, the APP can divide the image data into regions to obtain multiple image blocks, and then prioritize these image blocks according to the number of image features in the image blocks (which can be determined by the proportion of blank areas in the image); then, according to the priority sorting results, the image blocks are matched with sensitive features in turn. Once the match is successful, it can be determined that sensitive data exists in the image data. At this time, the operation of subsequent block images with relatively low priority can be stopped, which can not only ensure the accuracy of sensitive data recognition, but also improve recognition efficiency and reduce the consumption of various hardware resources of the mobile terminal.

[0074] Step S40: When the sensitive data exists in the application data to be stored, the application data to be stored is saved in the encrypted storage space.

[0075] In a specific implementation, when an APP detects that there is sensitive data in the application data to be stored, it can save the application data to be stored in an encrypted storage space to prevent malicious access by other APPs and avoid data leakage.

[0076] When this embodiment detects a data storage instruction, it determines the application operating user based on the data storage instruction and obtains the user key corresponding to the application operating user; decrypts the target encrypted storage space using the user key to obtain access rights to the target encrypted storage space; obtains the application data to be stored corresponding to the data storage instruction, and determines whether sensitive data is present in the application data to be stored; and if sensitive data is present, saves the application data to be stored to the encrypted storage space. Because this embodiment decrypts the pre-allocated encrypted storage space using the user key of the application operating user to obtain access rights to the encrypted storage space, and then, if sensitive data is present, saves the application data to be stored to the encrypted storage space, this ensures that application data carrying sensitive data is not leaked, while also preventing other applications that do not possess the user key from accessing the encrypted storage space, thereby ensuring the security of the application data.

[0077] refer to Figure 3 , Figure 3 This is a flow chart of a second embodiment of a data processing method according to the present invention.

[0078] Based on the first embodiment above, in this embodiment, before step S10, the following steps are further included:

[0079] Step S01: when the application is installed, a storage space to be encrypted is allocated from the local storage space of the terminal where the application is located;

[0080] It should be noted that in order to ensure that application data is not stolen or leaked privately by corporate employees, this implementation also needs to divide a dedicated sensitive data storage area for different applications before the above step S10, that is, an encrypted storage space. In actual applications, only APPs with user keys can access this storage space. At the same time, even the APP's application operating user cannot directly send the application data stored therein without authorization. For example, an unauthorized user A takes a screenshot of page B corresponding to the current page of the APP through a screenshot. When the APP detects the storage instruction of page screenshot B, it recognizes that page screenshot B contains sensitive information. At this time, the page screenshot B will be directly stored in the encrypted storage space. If user A wants to send page screenshot B from the encrypted storage space to user C at this time, since it is not authorized, the sending behavior will be prohibited by the APP, thereby curbing the leakage of application data from the source.

[0081] In a specific implementation, when the APP is installed, it can send a space allocation request to the (mobile) terminal where it is located, so that when the terminal receives the request, it can allocate a storage space to be encrypted from the local storage space to the APP.

[0082] Step S02: obtaining terminal information of the terminal, and generating a user key corresponding to the storage space to be encrypted according to the terminal information;

[0083] It should be noted that the terminal information includes but is not limited to the hardware information of the mobile terminal (such as the International Mobile Equipment Identity code IMEI, the Mobile Equipment Identity code MEID, the Integrated Circuit Card Identity code ICCID, i.e., the SIM card number, etc.) and / or location information (which may include network location information and geographic location information).

[0084] In a specific implementation, the APP can obtain the terminal information of the terminal and then generate the corresponding user key based on the terminal information. For example, it can obtain the terminal's IMEI and then use the information digest algorithm to calculate the hash value of the IMEI, and use the hash value as the user key.

[0085] Furthermore, in order to increase the security and uniqueness of user keys, and taking into account that the usage scenarios of internal enterprise APPs are basically fixed on work terminals (computers at workstations) and private terminals (employee mobile phones), in this embodiment, user keys can be generated based on the hardware identification information (such as IMEI, MEID, wireless LAN address, ICCID, etc.) and location information of each terminal. For example, for work terminals, such terminals are usually not allowed to be taken out of the company, and their network location (IP address) and actual geographical location (actual address, longitude and latitude, etc.) are generally fixed or change within a small range within the company. Therefore, when generating keys, the above two parameters (network location and actual geographical location) can be considered as one of the basic parameters for generating user keys. Of course, the basic parameters can also include unique characters such as the user's account ID, employee ID, and the above-mentioned hardware identification information. When generating user keys, they can be obtained by combining the basic parameters (the combination method is not specifically limited) and then encrypting them using an encryption algorithm or an existing key generation algorithm. In this embodiment

[0086] In a specific implementation, the APP can obtain the terminal information of the terminal and read the hardware identification information contained in the terminal information; then obtain the network location information and geographic location information of the terminal; then correct the geographic location information to obtain the corrected target geographic location information; finally, based on the network location information, the target geographic location information and the hardware identification information, generate the user key corresponding to the storage space to be encrypted through a preset information summary algorithm.

[0087] Step S03: Encrypt the storage space to be encrypted according to the user key to obtain an encrypted storage space.

[0088] In a specific implementation, the APP can encrypt the storage space to be encrypted according to the generated user key, obtain the encrypted storage space, and have the right to use the encrypted storage space.

[0089] When an application is installed, this embodiment allocates a storage space to be encrypted from the local storage space of the terminal. Terminal information is obtained and a corresponding user key is generated based on the terminal information. The encrypted storage space is then encrypted using the user key to obtain an encrypted storage space. This provides a secure and reliable storage environment for application data, effectively preventing the leakage of sensitive application data. Furthermore, this embodiment ensures the uniqueness and security of the generated user key, effectively preventing malware from cracking the user key through reverse engineering.

[0090] refer to Figure 4 , Figure 4 FIG. 1 is a flow chart of a third embodiment of a data processing method according to the present invention.

[0091] Based on the above embodiments, in this embodiment, after step S03, the method further includes:

[0092] Step S04: periodically obtaining current performance parameters of the terminal, and performing a performance score on the terminal according to the current performance parameters to obtain a score value;

[0093] It should be noted that, in order to ensure smooth operation of the APP during the above-mentioned application data processing, this embodiment will monitor the performance parameters of the terminal and then dynamically adjust the capacity of the encrypted storage space according to the performance parameters.

[0094] Specifically, the app can periodically obtain the current performance parameters of the terminal, and then perform a performance score on the terminal based on the current performance parameters to obtain a score value. Specifically, the performance score can be scored based on the parameter values ​​corresponding to different performance parameters, and then a weighted sum of the scores is obtained to obtain a score value.

[0095] Furthermore, considering that the smoothness of application runtime is strongly related to the CPU and memory of the terminal, in this embodiment, the APP can periodically obtain the current performance parameters of the terminal, obtain CPU occupancy information and memory occupancy information from the current performance parameters; then obtain a first weight set corresponding to the CPU occupancy information and a second weight set corresponding to the memory occupancy information; and then calculate a performance score for the terminal based on the CPU occupancy information, the first weight set, the memory occupancy information, and the second weight set to obtain a score value.

[0096] The first weight set may be a set of weight coefficients corresponding to different CPU performance parameters, such as a set of weight coefficients corresponding to parameters such as CPU occupancy, CPU speed, and CPU temperature. Correspondingly, the second weight set may be a set of weight coefficients corresponding to different memory performance parameters, such as a set of weight coefficients corresponding to parameters such as remaining memory and memory occupancy.

[0097] Step S05: When the score value is lower than a preset threshold, the capacity of the encrypted storage space is expanded.

[0098] In actual application, when the APP detects that the score value is higher than the preset threshold, the capacity of the encrypted storage space will be released to reduce the capacity occupancy of the encrypted storage space; when the score value is detected to be lower than the preset threshold, the capacity of the encrypted storage space will be expanded to increase the capacity of the encrypted storage space.

[0099] Specifically, when the score value is lower than a preset threshold, the APP can obtain the user operation records and resource occupancy information corresponding to the background applications of the terminal; read the user's final active time corresponding to each background application from the user operation record; prioritize all background applications according to the user's final active time and the resource occupancy information; determine the target application according to the priority sorting result, and request the terminal to release the hardware resources currently occupied by the target application; when the hardware resources are released, expand the capacity of the encrypted storage space.

[0100] It should be noted that the user operation record refers to the user's most recent operation information and the last operation time (i.e., the user's last active time) for the background application, and the resource usage information refers to the hardware resources currently occupied by the background application, such as CPU, GPU, and memory. For example, the background application with the longest time interval between the last active time and the current time may be released first, or the background application with a relatively long time interval but a large hardware resource usage may be released first.

[0101] Furthermore, to ensure that the APP can use the encrypted storage space normally, in this embodiment, the APP can also dynamically adjust the storage space by monitoring the capacity of the encrypted storage space, that is, when the utilization rate of the encrypted storage space is lower than 50%, the capacity of the encrypted storage space is released to the mobile terminal; when the utilization rate of the encrypted storage space is above 60%, the capacity of the mobile terminal is divided into the encrypted storage space; when the overall capacity utilization rate of the mobile terminal is higher than 80% (including encrypted storage space and non-encrypted storage space), the startup, use and installation of other APPs and new APPs are restricted.

[0102] This embodiment periodically obtains the current performance parameters of the terminal and scores the terminal based on the current performance parameters to obtain a score value; when the score value is lower than a preset threshold, the capacity of the encrypted storage space is expanded; when the score value is higher than the preset threshold, the capacity of the encrypted storage space is released. The capacity of the encrypted storage space can be dynamically adjusted to ensure the smooth operation of the APP in real time.

[0103] In addition, an embodiment of the present invention further provides a storage medium on which an application data processing program is stored. When the application data processing program is executed by a processor, the steps of the application data processing method described above are implemented.

[0104] Reference Figure 5 , Figure 5 This is a structural block diagram of the first embodiment of the data processing device applied in the present invention.

[0105] like Figure 5 As shown, the application data processing device proposed in the embodiment of the present invention includes:

[0106] The key acquisition module 501 is configured to, upon detecting a data storage instruction, determine an application operation user according to the data storage instruction and obtain a user key corresponding to the application operation user;

[0107] A space decryption module 502 is configured to decrypt the target encrypted storage space using the user key to obtain access rights to the target encrypted storage space;

[0108] The data determination module 503 is configured to obtain the application data to be stored corresponding to the data storage instruction and determine whether there is sensitive data in the application data to be stored;

[0109] The data processing module 504 is configured to save the application data to be stored into the encrypted storage space when the sensitive data exists in the application data to be stored.

[0110] When this embodiment detects a data storage instruction, it determines the application operating user based on the data storage instruction and obtains the user key corresponding to the application operating user; decrypts the target encrypted storage space using the user key to obtain access rights to the target encrypted storage space; obtains the application data to be stored corresponding to the data storage instruction, and determines whether sensitive data is present in the application data to be stored; and if sensitive data is present, saves the application data to be stored to the encrypted storage space. Because this embodiment decrypts the pre-allocated encrypted storage space using the user key of the application operating user to obtain access rights to the encrypted storage space, and then, if sensitive data is present, saves the application data to be stored to the encrypted storage space, this ensures that application data carrying sensitive data is not leaked, while also preventing other applications that do not possess the user key from accessing the encrypted storage space, thereby ensuring the security of the application data.

[0111] Based on the above-mentioned first embodiment of the application data processing device of the present invention, a second embodiment of the application data processing device of the present invention is proposed.

[0112] In this embodiment, the application data processing device also includes a space allocation module, which is used to divide a storage space to be encrypted from the local storage space of the terminal where the application is located when the application is installed; obtain the terminal information of the terminal, and generate a user key corresponding to the storage space to be encrypted based on the terminal information; encrypt the storage space to be encrypted based on the user key to obtain an encrypted storage space.

[0113] Furthermore, the space allocation module is also used to obtain the terminal information of the terminal and read the hardware identification information contained in the terminal information; obtain the network location information and geographic location information of the terminal; correct the geographic location information to obtain the corrected target geographic location information; and generate the user key corresponding to the storage space to be encrypted through a preset information summary algorithm based on the network location information, the target geographic location information and the hardware identification information.

[0114] Furthermore, the data judgment module 503 is also used to obtain the application data to be stored corresponding to the data storage instruction, and to determine whether the application data to be stored is image data; when the application data to be stored is image data, optical character recognition (OCR) technology is used to perform feature recognition on the image data to obtain image features; and whether sensitive data exists in the application data to be stored is determined by using a pre-built sensitive feature database and the image features.

[0115] Furthermore, the application data processing device also includes a space monitoring module, which is used to periodically obtain the current performance parameters of the terminal, and perform a performance score on the terminal based on the current performance parameters to obtain a score value; when the score value is lower than a preset threshold, the capacity of the encrypted storage space is expanded.

[0116] Furthermore, the space monitoring module is also used to periodically obtain the current performance parameters of the terminal, obtain CPU occupancy information and memory occupancy information from the current performance parameters; obtain a first weight set corresponding to the CPU occupancy information and a second weight set corresponding to the memory occupancy information; calculate a performance score for the terminal based on the CPU occupancy information, the first weight set, the memory occupancy information and the second weight set to obtain a score value.

[0117] Furthermore, the space monitoring module is also used to obtain the user operation records and resource occupancy information corresponding to the background applications of the terminal when the score value is lower than a preset threshold; read the user's final active time corresponding to each background application from the user operation record; prioritize all background applications according to the user's final active time and the resource occupancy information; determine the target application according to the priority ranking result, and request the terminal to release the hardware resources currently occupied by the target application; when the hardware resources are released, expand the capacity of the encrypted storage space.

[0118] Other embodiments or specific implementations of the data processing device of the present invention can refer to the above-mentioned method embodiments and will not be described in detail here.

[0119] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or system comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or system. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or system comprising the element.

[0120] The serial numbers of the above embodiments of the present invention are for description only and do not represent the advantages or disadvantages of the embodiments.

[0121] Through the description of the above embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better embodiment. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as read-only memory / random access memory, magnetic disk, optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present invention.

[0122] The above are only preferred embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention description and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A method for processing application data, characterized in that: The application data processing method includes: When a data storage instruction is detected, determining an application operating user according to the data storage instruction, and obtaining a user key corresponding to the application operating user; decrypting the target encrypted storage space using the user key to obtain access rights to the target encrypted storage space; Obtaining the application data to be stored corresponding to the data storage instruction, and determining whether there is sensitive data in the application data to be stored, wherein the sensitive data is marked when it is operated or generated by the user; When the sensitive data exists in the application data to be stored, saving the application data to be stored in the encrypted storage space; Before the step of determining the application operating user according to the data storage instruction when the data storage instruction is detected and obtaining the user key corresponding to the application operating user, the method further includes: When the application is installed, a storage space to be encrypted is allocated from the local storage space of the terminal where the application is located; Acquire terminal information of the terminal, and generate a user key corresponding to the storage space to be encrypted based on the terminal information, wherein the terminal information includes hardware information and location information; Encrypting the storage space to be encrypted according to the user key to obtain an encrypted storage space; The step of obtaining the terminal information of the terminal and generating a user key corresponding to the storage space to be encrypted according to the terminal information includes: Obtaining terminal information of the terminal and reading hardware identification information contained in the terminal information; Obtaining network location information and geographic location information of the terminal; Correcting the geographic location information to obtain corrected target geographic location information; A user key corresponding to the storage space to be encrypted is generated by a preset information digest algorithm according to the network location information, the target geographical location information, and the hardware identification information.

2. The application data processing method according to claim 1, wherein: The step of obtaining the application data to be stored corresponding to the data storage instruction and determining whether sensitive data exists in the application data to be stored includes: Acquire application data to be stored corresponding to the data storage instruction, and determine whether the application data to be stored is image data; When the application data to be stored is image data, optical character recognition (OCR) technology is used to perform feature recognition on the image data to obtain image features; It is determined whether sensitive data exists in the application data to be stored by using a pre-built sensitive feature database and the image features.

3. The application data processing method according to claim 1 or 2, wherein: After the step of encrypting the storage space to be encrypted according to the user key to obtain the encrypted storage space, the method further includes: Periodically acquiring current performance parameters of the terminal, and performing a performance score on the terminal according to the current performance parameters to obtain a score value; When the score value is lower than a preset threshold, the capacity of the encrypted storage space is expanded.

4. The application data processing method according to claim 3, wherein: The step of periodically acquiring the current performance parameters of the terminal and performing a performance score on the terminal according to the current performance parameters to obtain a score value includes: Periodically obtaining current performance parameters of the terminal, and obtaining CPU occupancy information and memory occupancy information from the current performance parameters; Obtaining a first weight set corresponding to the CPU occupancy information and a second weight set corresponding to the memory occupancy information; A performance score is calculated for the terminal according to the CPU occupancy information, the first weight set, the memory occupancy information, and the second weight set to obtain a score value.

5. The application data processing method according to claim 3, wherein: The step of expanding the capacity of the encrypted storage space when the score value is lower than a preset threshold comprises: When the score value is lower than a preset threshold, obtaining user operation records and resource occupancy information corresponding to the background application of the terminal; Reading the last active time of the user corresponding to each background application from the user operation record; Prioritize all background applications according to the user's final active time and the resource occupancy information; Determine a target application according to the priority sorting result, and request the terminal to release hardware resources currently occupied by the target application; When the hardware resources are released, the capacity of the encrypted storage space is expanded.

6. An application data processing device, characterized in that: The application data processing device includes: A key acquisition module is used to, when a data storage instruction is detected, determine the application operation user according to the data storage instruction and obtain a user key corresponding to the application operation user; A space decryption module, configured to decrypt the target encrypted storage space using the user key to obtain access rights to the target encrypted storage space; a data determination module, configured to obtain the application data to be stored corresponding to the data storage instruction, and determine whether there is sensitive data in the application data to be stored, wherein the sensitive data is marked when it is operated or generated by the user; a data processing module, configured to save the application data to be stored into the encrypted storage space when the sensitive data exists in the application data to be stored; The key acquisition module is further configured to, upon completion of application installation, allocate a storage space to be encrypted from the local storage space of the terminal where the application is located; obtain terminal information of the terminal, and generate a user key corresponding to the storage space to be encrypted based on the terminal information, wherein the terminal information includes hardware information and location information; and encrypt the storage space to be encrypted based on the user key to obtain an encrypted storage space. The key acquisition module is further used to obtain the terminal information of the terminal and read the hardware identification information contained in the terminal information; obtain the network location information and geographic location information of the terminal; correct the geographic location information to obtain the corrected target geographic location information; and generate the user key corresponding to the storage space to be encrypted through a preset information summary algorithm based on the network location information, the target geographic location information and the hardware identification information.

7. An application data processing device, characterized in that: The device includes: a memory, a processor, and an application data processing program stored in the memory and executable on the processor, wherein the application data processing program is configured to implement the steps of the application data processing method according to any one of claims 1 to 5.

8. A storage medium, characterized in that: The storage medium stores an application data processing program, which, when executed by a processor, implements the steps of the application data processing method according to any one of claims 1 to 5.

Images