A method, apparatus, electronic and storage medium for using a key

Abstract

This application provides a method, apparatus, device, and storage medium for using a key, relating to the field of operating systems. The method includes: determining an original key based on a first password input by a user and a stored first key, and caching the original key in a preset security manner; when receiving an access instruction carrying an encrypted directory, determining whether the key feature value configured in the encrypted directory is equal to the key feature value corresponding to the original key; if the determination result is equal, performing encryption / decryption operations on the encrypted directory based on the configured key feature value. This approach solves the problem of storing the original key by storing the first key, caching the original key in a secure manner, and finally using the key feature value of the original key to handle tasks in the encryption / decryption process. The solution provided in this application employs security measures at every stage of key usage, ensuring both the security and usability of the original key.

Description

Technical Field

[0001] This application relates to the technical field of operating systems, and more specifically, to a method, apparatus, electronic and storage medium for using a key. Background Technology

[0002] Encryption operations for mobile operating systems include encrypting sensitive data in a directory or file using symmetric encryption algorithms. After encryption, sensitive data created by the user is automatically encrypted using a provided key before being stored on the disk. Similarly, data is automatically decrypted using a provided key before being read according to user-inputted read commands. This method ensures the security of sensitive data and prevents unauthorized access to it.

[0003] Since symmetric encryption algorithms use the same key for both encryption and decryption, key security is paramount. Therefore, the most important challenge is how to ensure key security while simultaneously increasing its usability. Summary of the Invention

[0004] The purpose of this application is to solve the problem of how to balance the security and usability of keys.

[0005] According to one aspect of the embodiments of this application, a method for using a key is provided, the method comprising:

[0006] The original key is determined based on the first password entered by the user and the first key stored, and the original key is cached in a preset security manner.

[0007] When an access command carrying an encrypted directory is received, it is determined whether the key feature value configured in the encrypted directory is equal to the key feature value corresponding to the original key.

[0008] When the results are equal, the encrypted directory is encrypted / decrypted according to the configured key feature value.

[0009] According to another aspect of the embodiments of this application, a key-using apparatus is provided, the apparatus comprising:

[0010] The determination module is used to determine the original key based on the first password entered by the user and the first key stored, and to cache the original key in a preset security manner.

[0011] The judgment module is used to determine whether the key feature value configured in the encrypted directory is equal to the key feature value corresponding to the original key when an access instruction carrying the encrypted directory is received.

[0012] The encryption / decryption module is used to encrypt / decrypt the encrypted directory based on the configured key feature value when the judgment result is equal.

[0013] According to another aspect of the embodiments of this application, an electronic device is provided, the electronic device comprising:

[0014] A memory, a processor, and a computer program stored in the memory, the processor executing the computer program to implement the steps of a method for using a key as shown in one aspect of an embodiment of this application.

[0015] According to another aspect of the embodiments of this application, a computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a processor, implements the steps of a key usage method shown in one aspect of the embodiments of this application.

[0016] According to one aspect of the present application, a computer program product is provided, which, when executed by a processor, represents the steps of a key usage method shown in one aspect of the present application.

[0017] The beneficial effects of the technical solutions provided in this application are:

[0018] This application provides a method for using a key.

[0019] The original key is determined based on the user-input first password (e.g., lock screen password) and the stored first key, rather than being directly stored. This approach solves the original key storage problem by storing the first key. After obtaining the original key, it is cached using a preset secure method, rather than caching it using an existing insecure method immediately after acquisition. When an access command for an encrypted directory is received, the configured key feature value is compared with the key feature value of the original key to determine if the encrypted directory uses the original key for encryption. Finally, if it is determined that the encrypted directory uses the original key, encryption / decryption operations are performed on the encrypted directory based on the configured key feature value, i.e., the tasks in the encryption / decryption process are handled using the key feature value of the original key. The solution provided in this application employs security measures at every stage of key usage, ensuring both the security and usability of the original key. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments of this application will be briefly introduced below.

[0021] Figure 1 A flowchart illustrating a method for using a key as provided in an embodiment of this application;

[0022] Figure 2 This is a schematic diagram of a key-using device provided in an embodiment of this application;

[0023] Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0024] The embodiments of this application are described below with reference to the accompanying drawings. It should be understood that the embodiments described below with reference to the accompanying drawings are exemplary descriptions for explaining the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions of the embodiments of this application.

[0025] Those skilled in the art will understand that, unless otherwise stated, the singular forms “a,” “an,” “the,” and “the” used herein may also include the plural forms. It should be further understood that the terms “comprising” and “including” as used in embodiments of this application mean that the corresponding feature can be implemented as the presented feature, information, data, step, operation, element, and / or component, but do not exclude implementation as other features, information, data, step, operation, element, component, and / or combinations thereof supported by the art. It should be understood that when we say that an element is “connected” or “coupled” to another element, the one element can be directly connected or coupled to the other element, or it can mean that the one element and the other element establish a connection relationship through an intermediate element. Furthermore, “connected” or “coupled” as used herein can include wireless connection or wireless coupling. The term “and / or” as used herein indicates at least one of the items defined by the term; for example, “A and / or B” indicates implementation as “A,” or implementation as “A,” or implementation as “A and B.”

[0026] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0027] This application provides a method for using a key, which can be implemented by a terminal device. The terminal device involved in this application is configured with at least one application; the terminal device is also configured with a display module, which is configured with a corresponding lock screen interface and lock screen password; the terminal device is also configured with a file system, which manages all files stored on the terminal device, and this file system is a kernel-level module. The at least one application accesses the corresponding files stored on the terminal device through the file system. The files stored in the terminal device may include: text files, such as Word documents, Excel documents, PPT documents, plain text files, etc., as well as image files, Flash animation files, video files, sound files, etc. The key usage method implemented through the terminal device ensures both the security and practicality of the key, achieving protection for the aforementioned types of sensitive files.

[0028] The technical solutions of this application and their effects are described below through several exemplary embodiments. It should be noted that the following embodiments can be referenced, borrowed from, or combined with each other. Identical terms, similar features, and similar implementation steps in different embodiments will not be repeated.

[0029] See Figure 1 This application provides a flowchart illustrating a method for using a key, including steps S110-S130, specifically:

[0030] S110, determine the original key based on the first password entered by the user and the stored first key, and cache the original key in a preset security manner;

[0031] The system may be an operating system installed on the terminal device referred to in the above embodiments.

[0032] The first password can be the power-on password for the terminal device's screen. This power-on password is not limited to numbers, patterns, fingerprints, etc., and can be customized by the user.

[0033] S120, when an access instruction carrying an encrypted directory is received, it is determined whether the key feature value configured in the encrypted directory is equal to the key feature value corresponding to the original key;

[0034] S130, when the judgment result is equal, the encrypted directory is encrypted / decrypted according to the configured key feature value.

[0035] This application provides a method for using a key. The method determines the original key based on a first password input by the user (e.g., a lock screen password) and a stored first key, rather than directly storing the original key. That is, it solves the storage problem of the original key by storing the first key. After obtaining the original key, it caches it using a preset secure method, rather than caching it using an existing insecure method after acquisition. When an access command for an encrypted directory is received, the configured key feature value is compared with the key feature value of the original key to determine whether the encrypted directory is encrypted using the original key. Finally, when it is determined that the encrypted directory is encrypted using the original key, encryption / decryption operations are performed on the encrypted directory based on the key feature value configured for the encrypted directory. That is, the task in the encryption / decryption process is handled using the key feature value of the original key. The solution provided in this application adopts security measures at every stage of key usage, ensuring both the security and usability of the original key.

[0036] This application embodiment also provides a possible implementation method in which a first key is stored during system initialization. System initialization can be the initialization during the first system startup or the initial initialization of the system's file system. During system initialization, a root process is created, which handles the storage of the first key. The process of the root process storing the first key includes: obtaining the original key randomly during system initialization; processing the first key using a preset algorithm to obtain a first key feature value; encrypting the original key based on the first key feature value to obtain the first key; and storing the first key.

[0037] Specifically, obtaining the original key in a random manner may include: generating a fixed-length random number using the system's random number generator and using it as the original key. This random number generator can be any application within the system or any hardware component on the terminal device.

[0038] The random number generator can generate data by collecting one or a set of noise data and then generating a fixed-length random number based on the noise data. Since noise is uncontrollable, the original key generated from the noise data is unpredictable and difficult to crack. The fixed length can be 256 bits or 128 bits. It should be noted that the value of this fixed length can be set according to actual needs, and this application does not impose any limitations.

[0039] In one possible implementation, the first password is processed by a preset algorithm to obtain the first password feature value, which can be: the first password is processed by a one-way hash algorithm to obtain the first password feature value.

[0040] Specifically, by processing the first password using a one-way hash algorithm, a fixed-length data segment is obtained. This fixed-length data segment can be used as the first password feature value, or data at a fixed position within this fixed-length data segment can be extracted as the first password feature value.

[0041] Taking the MD5 algorithm as an example of a one-way hash algorithm, the first password is processed by the MD5 algorithm to obtain a fixed-length numerical value, which is then used as the feature value of the first password. It should be noted that the MD5 algorithm is only used as an example to illustrate the embodiments of this application and should not be construed as limiting the scope of protection of the embodiments of this application. Therefore, the one-way hash algorithm can also be other algorithms.

[0042] In one possible implementation, encrypting the original key based on the first cryptographic feature value to obtain the first key may include: using the first cryptographic feature value as the key of a symmetric encryption algorithm, encrypting the original key using the symmetric encryption algorithm, and determining the encrypted result as the first key.

[0043] In one possible implementation, storing the first key may include storing it in a designated area of ​​the system. This designated area may include a disk built into the system or an external storage device.

[0044] In one possible implementation, after obtaining the original key, the process may further include: obtaining a directory to be encrypted, wherein the directory to be encrypted is empty; processing the original key using a preset algorithm to obtain a key feature value corresponding to the original key; and processing the directory to be encrypted based on the key feature value to obtain an encrypted directory.

[0045] Specifically, after obtaining the original key, it is processed using a one-way hash algorithm to obtain fixed-length data. All or part of this fixed-length data is then used as the key feature value corresponding to the original key. The directory to be encrypted can be determined based on a user-preset directory, a configuration file, etc. Therefore, the user-set directory to be encrypted or the directory to be encrypted can be obtained from the configuration file. This directory to be encrypted has various types of file attributes, which can include: encryption status and encryption feature value. The encryption status includes at least two values: "encrypting" and "public," where "encrypting" indicates that the file is encrypted, and "public" indicates that the file is not encrypted. The corresponding encryption feature value represents the feature value of the key used for encryption. Processing the directory to be encrypted based on the key feature value can specifically include: setting the encryption status of the directory to be encrypted to "encrypting," setting the encryption feature value of the directory to be encrypted to the key feature value corresponding to the original key, and determining the directory with the set file attributes as the encrypted directory.

[0046] In one possible implementation, determining the original key based on the first password input by the user and the stored first key includes: obtaining the first key; processing the first password using a preset algorithm to obtain a first password feature value; and decrypting the first key based on the first password feature value to obtain the original key.

[0047] Specifically, after the system starts up, it receives the first password input by the user, processes the first password according to the one-way hash algorithm to obtain the first password feature value, uses the first password feature value as the key of the symmetric encryption algorithm, and decrypts the first key to obtain the original key.

[0048] For example, after system startup, the kernel starts the root process. The root process acquires any noise, processes it, and obtains the original key K1. The root process applies the MD5 algorithm to K1 and uses the result as the feature value H1 of K1. At this point, the system has not performed any encryption / decryption operations. To prevent K1 from being stored directly in plaintext, it can be stored by receiving the user's input lock screen password. The system has a default lock screen password, which the user can use after the system's first startup and can change later; alternatively, the user can set a custom lock screen password after the system's first startup. After confirming that a lock screen password has been set in the system, the root process acquires the original key. After receiving the user's input lock screen password, the root process processes the lock screen password using a one-way hash algorithm to obtain the corresponding feature value H2. The root process uses H2 as the key for a symmetric encryption algorithm to process K1, obtaining a new key K1'. The root process stores K1 in the kernel's protected area and K1' in the key string configured by the root process.

[0049] This application provides a method for using a key. During system initialization, an original key is obtained in a non-replicable, random manner, making it difficult to crack and thus ensuring its security. The original key is then encrypted using a user-inputted custom password to obtain a key that can be stored in any area of ​​the system. Without the user-inputted custom password, the original key cannot be obtained from the stored key. Therefore, to address the issue of storing the original key, a technique of storing the encrypted key is employed. After obtaining the directory to be encrypted, the encryption status of the directory is configured as "encrypting," and the encryption feature value is set to the corresponding key feature value of the original key. This uses the key feature value of the original key to mark the encrypted directory, ensuring the security of the original key. After configuring the key feature value, the system encrypts / decrypts the directory based on the configured key feature value.

[0050] This application embodiment also provides a possible implementation method for caching the original key in a preset security manner, including: caching the original key in the protected area of ​​the system and caching the key feature value corresponding to the original key in the public area of ​​the system.

[0051] Specifically, during system initialization, a root process is created. This root process belongs to the kernel layer and is used to handle kernel-level transactions. The root process caches the original key in the system's protected area and the key signature corresponding to the original key in the system's public area. When the encrypted directory is used as the encrypted directory for a specific application, the root process can act as the parent process, creating a child process corresponding to that application and providing the child process with the key signature corresponding to the original key for use when sending access commands to the file system.

[0052] In S130, the encryption / decryption operation of the encrypted directory is performed according to the configured key feature value, including: obtaining the original key from the protected area according to the configured key feature value; and performing encryption / decryption operation on the encrypted directory according to the original key.

[0053] Specifically, the system's root process first determines whether the key feature value configured for the encrypted directory is equal to the key feature value stored in the public area. If they are equal, the root process performs encryption / decryption operations on the encrypted directory based on the configured key feature value.

[0054] The root process performs encryption / decryption operations on the encrypted directory based on the configured key characteristic value. This can be achieved by the system's root process determining the corresponding operation based on the type of access instruction.

[0055] Specifically, when the access command is a read command, the ciphertext data corresponding to the encrypted directory is read; the system kernel uses the original key as the key for the decryption algorithm to decrypt the ciphertext data corresponding to the encrypted directory to obtain the target plaintext data.

[0056] When encrypting an encrypted directory, not only are the files themselves encrypted, but their paths are also encrypted. Therefore, when retrieving ciphertext data, the kernel's root process decrypts the path information at each level of the encrypted directory sequentially until the file corresponding to the encrypted directory is located. The retrieved file is then decrypted.

[0057] Following the example above, the encrypted directory could be: . / user / ... The files stored in this directory would look like this:

[0058] Path 1: . / user / info1.jpg;

[0059] Path 2: . / user / app2 / info2.txt;

[0060] Path 3: . / user / app3 / info3.txt;

[0061] Path 4: . / user / app4 / client / info4.txt;

[0062] It should be noted that app2-app4 are unique identifiers for any application installed on the terminal device.

[0063] The aforementioned info1-info4 are all encrypted by the root process according to K1, and the path information corresponding to info1-info4 is also encrypted by the root process according to K1. For example, if a user wants to access info2.txt, the access command could carry the information of: encrypted directory . / user / … and info2.txt. Since the file paths at any level in . / user / … are hidden, decryption is required to obtain the files stored at each level. Therefore, after receiving the encrypted directory, the kernel decrypts . / user / … level by level. Based on K1, the first-level directory of . / user / … is decrypted to obtain the files or folders under the first-level directory.

[0064] Path 1: . / user / info1.jpg;

[0065] Path 2: . / user / app2 / …;

[0066] Path 3: . / user / app3 / …;

[0067] Path 4: . / user / app4 / …;

[0068] After comparing the files corresponding to path 1 and path 3, it was found that they were not the same files. Then, the files from path 2 to path 4, which were unknown according to K1, were decrypted to obtain the corresponding files or folders.

[0069] Path 2: . / user / app2 / info2.txt;

[0070] Path 3: . / user / app3 / info3.txt;

[0071] Path 4: . / user / app4 / client / …;

[0072] After comparing the file corresponding to path 2, it was found that the file corresponding to path 2 was the target file. The file was then obtained and info2.txt was decrypted.

[0073] or,

[0074] Specifically, when the access command is a write command, the plaintext data carried in the write command is obtained; the system kernel uses the original key as the key for the encryption algorithm to encrypt the plaintext data to obtain the target ciphertext data.

[0075] For example, when the access command is sent from app5, the file to be stored is info5.xls. After the kernel's root process receives the access command, it first creates a first-level directory . / user / app5 / ... in . / user / ...; it encrypts info5.xls according to K1 and stores the encrypted info5.xls in this directory. Then, it encrypts . / user / app5 / ... and . / user / app5 / info5.xls respectively using K1 and stores the encrypted results in a table associated with . / user / .... It should be noted that app5 can be any application in the system.

[0076] Before app5 sends access commands to the file system, the corresponding child process needs to be started by root-process. Specifically, after the system receives the start command from app5, root-process creates a child process corresponding to app5 and configures a keychain with the same information as the keychain configured on root-process.

[0077] Therefore, any application process can only obtain the key characteristics of the original key, but cannot directly access the original key.

[0078] This application also provides a possible implementation method, which further includes:

[0079] When a user inputs a modification instruction carrying a second password, the second password is processed by a preset algorithm to obtain the second password feature value corresponding to the second password; the original key is encrypted according to the second password feature value to obtain the second key; and the first key is updated to the second key.

[0080] Specifically, when a user inputs a modification instruction carrying a second password, the second password is processed according to a one-way hash algorithm to obtain the second password feature value corresponding to the second password; the second password feature value is used as the key of a symmetric encryption algorithm to encrypt the original key to obtain the second key; the first key is deleted, and the second key is stored in the corresponding designated area.

[0081] Following the example above, after the root-process receives the user's input lock screen password, it processes the new lock screen password using a one-way hash algorithm to obtain the feature value H3 corresponding to the new lock screen password; the root-process uses H3 as the key K1 for a symmetric encryption algorithm to obtain a new key K1”; the root-process stores K1” in the key string configured for the root-process.

[0082] This application provides a method for using a key that, when a user-defined password is at risk and needs to be replaced, can update the stored first key based on the new lock screen key without replacing the original key or decrypting and reencrypting each file in the encrypted directory. Therefore, this method is highly efficient for redeploying custom keys.

[0083] This application also provides a possible implementation method, which includes:

[0084] When a copy request is received from another system, the stored first key is sent to the other system so that the other system can perform encryption / decryption operations based on the first key. The current custom password of the other system is the same as the current custom password of the system.

[0085] Specifically, when the system receives a copy request for the key to the encrypted directory from another system, it sends the stored first key to the other system so that the other system can perform encryption / decryption operations based on the first key. The encryption / decryption process performed by other systems is the same as that performed by this system, and will not be described in detail here for simplicity. The current custom password of the other system is the same as the current custom password of this system; for example, the first password of the other system is the same as the first password of this system, which can all be customized by the user.

[0086] It should be noted that when the first key is updated to the second key, the second key is passed to other systems.

[0087] This application provides a method for using a key. When the current system malfunctions, in order to ensure timely access to the files required by the application, it is necessary to migrate the files in the encrypted directory of the current system to a new platform. This solution ensures that the new platform and the current platform have the same custom password and encryption / decryption mechanism. Only the first key stored in the specified location needs to be moved. There is no need to move the original key. On the new platform, the files in the encrypted directory can also be encrypted / decrypted based on the copied key.

[0088] See Figure 2 This application also provides a key usage device 200, which may include: a determining module 210, a judging module 220, and an encryption / decryption module 230, wherein...

[0089] The determination module 210 is used to determine the original key based on the first password entered by the user and the stored first key, and to cache the original key in a preset security manner.

[0090] The judgment module 220 is used to determine whether the key feature value configured in the encrypted directory is equal to the key feature value corresponding to the original key when an access instruction carrying the encrypted directory is received.

[0091] The encryption / decryption module 230 is used to perform encryption / decryption operations on the encrypted directory according to the configured key feature value when the judgment result is equal.

[0092] In one possible implementation, the device further includes: an initialization module 240, wherein,

[0093] The initialization module 240 is used to obtain the original key in a random manner during the initialization; process the first password through a preset algorithm to obtain the first password feature value; encrypt the original key according to the first password feature value to obtain the first key; and store the first key.

[0094] In one possible implementation, after obtaining the original key, the initialization module 240 is further configured to: obtain the directory to be encrypted, wherein the directory to be encrypted is empty; process the original key through a preset algorithm to obtain the key feature value corresponding to the original key; and process the directory to be encrypted based on the key feature value to obtain the encrypted directory.

[0095] In one possible implementation, the determining module 210, in determining the original key based on the first password input by the user and the stored first key, is specifically used for: obtaining the first key; processing the first password through a preset algorithm to obtain a first password feature value; and decrypting the first key based on the first password feature value to obtain the original key.

[0096] In one possible implementation, the determining module 210 caches the original key in a preset secure manner, specifically for:

[0097] The original key is cached in the protected area of ​​the system, and the key feature value corresponding to the original key is cached in the public area of ​​the system.

[0098] Specifically, the encryption / decryption module 230, in the process of encrypting / decrypting the encrypted directory according to the configured key feature value, is used to: obtain the original key from the protected area according to the configured key feature value; and perform encryption / decryption operations on the encrypted directory according to the original key.

[0099] In one possible implementation, the encryption / decryption module 230, in performing encryption / decryption operations on the encrypted directory based on the original key, is specifically used for:

[0100] When the access command is a read command, read the ciphertext data corresponding to the encrypted directory;

[0101] The system kernel uses the original key as the key for the decryption algorithm to decrypt the ciphertext data corresponding to the encrypted directory, thereby obtaining the target plaintext data.

[0102] or,

[0103] When the access command is a write command, retrieve the plaintext data carried in the write command;

[0104] The system kernel uses the original key as the key for the encryption algorithm to encrypt the plaintext data, thus obtaining the target ciphertext data.

[0105] In one possible implementation, the device 200 further includes an update module 250, which is used for:

[0106] When a user inputs a modification instruction carrying a second password, the second password is processed by a preset algorithm to obtain the second password feature value corresponding to the second password; the original key is encrypted according to the second password feature value to obtain the second key; and the first key is updated to the second key.

[0107] In one possible implementation, the device 200 further includes a transceiver module 260, which is used for:

[0108] When a copy request is received from another system, the stored first key is sent to the other system so that the other system can perform encryption / decryption operations based on the first key. The current custom password of the other system is the same as the current custom password of the system.

[0109] The key-using device of this embodiment can execute the steps of the key-using method shown in the foregoing embodiments of this application. The implementation principle is similar and will not be repeated here.

[0110] This application provides an electronic device, including a memory, a processor, and a computer program stored in the memory. The processor executes the computer program to implement a method for using a key. Compared with the prior art, this method achieves the following: security measures are taken at each stage of using the key, ensuring both the security and usability of the original key.

[0111] See Figure 3 This application also provides a specific example of an electronic device. Figure 3 The illustrated electronic device 3000 includes a processor 3001 and a memory 3003. The processor 3001 and the memory 3003 are connected, for example, via a bus 3002. Optionally, the electronic device 3000 may further include a transceiver 3004, which can be used for data interaction between the electronic device and other electronic devices, such as sending and / or receiving data. It should be noted that in practical applications, the transceiver 3004 is not limited to one type, and the structure of the electronic device 3000 does not constitute a limitation on the embodiments of this application.

[0112] Processor 3001 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 3001 may also be a combination that implements computational functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0113] Bus 3002 may include a pathway for transmitting information between the aforementioned components. Bus 3002 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. Bus 3002 can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 3 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0114] The memory 3003 may be ROM (Read Only Memory) or other types of static storage devices capable of storing static information and instructions, RAM (Random Access Memory) or other types of dynamic storage devices capable of storing information and instructions, or EEPROM (Electrically Erasable Programmable Read Only Memory), CD-ROM (Compact Disc Read Only Memory) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media, other magnetic storage devices, or any other medium capable of carrying or storing computer programs and capable of being read by a computer, without limitation herein.

[0115] The memory 3003 is used to store computer programs that execute the embodiments of this application, and the execution is controlled by the processor 3001. The processor 3001 is used to execute the computer programs stored in the memory 3003 to implement the steps shown in the foregoing method embodiments.

[0116] Electronic devices include, but are not limited to, computers, mobile phones, and other mobile terminals.

[0117] This application provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it can implement the steps and corresponding content of the aforementioned method embodiments.

[0118] This application also provides a computer program product, including a computer program that, when executed by a processor, can implement the steps and corresponding content of the aforementioned method embodiments.

[0119] It should be understood that although arrows indicate various operation steps in the flowcharts of this application's embodiments, the order in which these steps are implemented is not limited to the order indicated by the arrows. Unless explicitly stated herein, in some implementation scenarios of this application's embodiments, the implementation steps in each flowchart can be executed in other orders as required. Furthermore, some or all steps in each flowchart, based on the actual implementation scenario, may include multiple sub-steps or multiple stages. Some or all of these sub-steps or stages can be executed at the same time, and each sub-step or stage can also be executed at different times. In scenarios where execution times differ, the execution order of these sub-steps or stages can be flexibly configured according to requirements, and this application's embodiments do not limit this.

[0120] The above description is only an optional implementation method for some implementation scenarios of this application. It should be noted that for those skilled in the art, other similar implementation methods based on the technical concept of this application without departing from the technical concept of this application also fall within the protection scope of the embodiments of this application.

Claims

1. A method for using a key, characterized in that, include: The original key is determined based on the first password entered by the user and the first key stored in the database. The original key is cached in the kernel protected area of ​​the system, and the key feature value corresponding to the original key is cached in the public area of ​​the system; the key feature value is all or part of a fixed-length data, and the fixed-length data is obtained by processing the original key through a one-way hash algorithm. When an access instruction carrying an encrypted directory is received, it is determined whether the key feature value configured in the encrypted directory is equal to the key feature value corresponding to the original key; When the determination result is equal, the original key is obtained from the protected area according to the configured key feature value; The encrypted directory is encrypted / decrypted using the original key.

2. The method according to claim 1, characterized in that, The process of storing the first key includes: During initial initialization, the original key is obtained randomly. The first password is processed by a preset algorithm to obtain the first password feature value; The original key is encrypted based on the first cryptographic feature value to obtain the first key; Store the first key.

3. The method according to claim 2, characterized in that, After obtaining the original key, the following is also included: Obtain the directory to be encrypted, wherein the directory to be encrypted is empty; The original key is processed by the preset algorithm to obtain the key feature value corresponding to the original key; The directory to be encrypted is processed based on the key feature value to obtain the encrypted directory.

4. The method according to claim 1, characterized in that, The step of determining the original key based on the first password entered by the user and the stored first key includes: Obtain the first key; The first password is processed by a preset algorithm to obtain the first password feature value; The first key is decrypted based on the first cryptographic feature value to obtain the original key.

5. The method according to claim 4, characterized in that, The encryption / decryption operation of the encrypted directory based on the original key includes: When the access instruction is a read instruction, the encrypted data corresponding to the encrypted directory is read; The kernel of the system uses the original key as the key for the decryption algorithm to decrypt the ciphertext data corresponding to the encrypted directory, thereby obtaining the target plaintext data; or, When the access instruction is a write instruction, the plaintext data carried in the write instruction is obtained; The kernel of the system uses the original key as the key for the encryption algorithm to encrypt the plaintext data to obtain the target ciphertext data.

6. The method according to claim 1, characterized in that, The method further includes: When a user inputs a modification instruction carrying a second password, the second password is processed by a preset algorithm to obtain the second password feature value corresponding to the second password; The original key is encrypted based on the second cryptographic feature value to obtain the second key; Update the first key to the second key.

7. The method according to claim 1, characterized in that, The method further includes: When a copy request is received from another system, the stored first key is sent to that other system so that the other system can perform encryption / decryption operations based on the first key. The current custom password of the other system is the same as the current custom password of the system.

8. A device for using a key, characterized in that, include: The determination module is used to determine the original key based on the first password entered by the user and the first key stored in the database. The original key is cached in the kernel protected area of ​​the system, and the key feature value corresponding to the original key is cached in the public area of ​​the system; the key feature value is all or part of a fixed-length data, and the fixed-length data is obtained by processing the original key through a one-way hash algorithm. The judgment module is used to determine whether the key feature value configured in the encrypted directory is equal to the key feature value corresponding to the original key when an access instruction carrying the encrypted directory is received. An encryption / decryption module is used to obtain the original key from the protected area according to the configured key feature value when the judgment result is equal; The encrypted directory is encrypted / decrypted using the original key.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory, characterized in that, The processor executes the computer program to implement the steps of a method for using a key as described in any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of a method for using a key as described in any one of claims 1-7.

11. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of a method for using a key as described in any one of claims 1-7.

Images