Data protection method, electronic device and storage medium

Abstract

The embodiments of the present application provide a data protection method, electronic device, and storage medium, which relate to the field of data security technology and can improve the security and privacy of data stored in a storage device shared by multiple users. The method includes: obtaining a root key through a first account and a first password; creating an encrypted home directory for the first account in the storage device, and setting the data in the encrypted home directory to be encrypted and decrypted based on the root key; obtaining a second account and a second password, and using the second account and the second password as authentication information for the encrypted home directory of the first account when the storage device is mounted on the current electronic device; when a user needs to access data in the encrypted home directory of the first account, if the storage device is mounted on the current electronic device, accessing or modifying the data based on the first account and the first password, and the second account and the second password; if the storage device is mounted on another electronic device, accessing or modifying the data based on the first account and the first password.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of data security, and in particular to a data protection method, electronic device, and storage medium. Background Art

[0002] As electronic devices become increasingly powerful, they generate an increasing amount of data, such as photos and videos captured by electronic devices with cameras, and multimedia data downloaded by electronic devices through installed applications. However, the storage space of these electronic devices is limited, so it is necessary to back up the data on these electronic devices to external storage devices.

[0003] When multiple users share the same external storage device, in order to protect the privacy of the users, the Server Message Block (Samba) protocol can be used to set access permissions on the electronic device to which the external storage device is mounted. For example, different home directories are created for different users in the external storage device, and accounts and passwords are set for each home directory. Only after the account and password are successfully authenticated can the account access or modify (for example, create, copy, cut, paste, and delete) the data in the home directory of the account. However, the account and password set on the electronic device are only valid when the external storage device is mounted on the electronic device. When the external storage device is mounted on other electronic devices, access permissions have not been set on the other electronic devices through the Samba protocol; as a result, one user can access or modify the data stored by other users on the external storage device. Therefore, the data stored on a storage device shared by multiple users in this data protection method has poor security. Summary of the Invention

[0004] Embodiments of the present application provide a data protection method, electronic device, and storage medium to solve the problem of poor security of data stored on a storage device shared by multiple users.

[0005] To achieve the above objectives, this application adopts the following technical solutions:

[0006] In a first aspect, an embodiment of the present application provides a data protection method, which is applied to a first device that supports an information service block service, the method comprising: the first device receives a first account and a root key sent by a second device, wherein the root key is obtained after the first account and a first password corresponding to the first account are successfully verified; when the encrypted home directory of the first account does not exist in the external storage device of the first device, the first device creates an encrypted home directory for the first account in the external storage device, wherein the data in the encrypted home directory of the first account is encrypted and decrypted based on the root key; the first device receives a second account and a second password corresponding to the second account sent by the second device, and sets the second account and the second password as the authentication information of the encrypted home directory of the first account when the external storage device is mounted on the first device.

[0007] In an embodiment of the present application, when a first device is connected to an external storage device and the encrypted home directory of the first account does not exist in the external storage device, the first device creates an encrypted home directory of the first account in the external storage device and sets the data in the encrypted home directory to be encrypted and decrypted based on the root key. Therefore, an encryption and decryption policy is set for the data in the encrypted home directory of the first account. In addition, the first device uses the second account and the second password as authentication information for the encrypted home directory and sets the access rights of the encrypted home directory of the first account to be obtained based on the authentication information. Therefore, an access control policy is also set for the encrypted home directory of the first account. The embodiment of the present application protects the data in the encrypted home directory through the access control policy of the encrypted home directory and the encryption and decryption policy of the data in the encrypted home directory. When the external storage device is mounted on another electronic device other than the first device, even if the access control policy for the encrypted home directory does not exist in the other electronic device, the security of the data in the encrypted home directory can still be ensured based on the pre-set encryption and decryption policy for the data in the encrypted home directory. This ensures that only by obtaining the root key can the data in the encrypted home directory of the first account be accessed or modified. The root key is obtained based on the first account and the first password. Therefore, it is ensured that users cannot arbitrarily access each other's data in the encrypted home directory.

[0008] In a possible implementation of the first aspect, after the first device creates an encrypted home directory for the first account in an external storage device, the method further includes: the first device generates a master key for the encrypted home directory of the first account, and sets the master key for the encrypted home directory of the first account in the system kernel of the first device; the first device encrypts and stores the master key for the encrypted home directory of the first account in the external storage device, wherein the root key is used to decrypt to obtain the encrypted master key stored in the external storage device, and the data in the encrypted home directory of the first account is encrypted and decrypted based on the master key.

[0009] In an embodiment of the present application, the first device can set the data in the encrypted main directory of the first account to be encrypted and decrypted based on the master key. The master key can derive multiple working keys, thereby ensuring that multiple files in the encrypted main directory are encrypted and stored in an external storage device based on different working keys. In order to improve the convenience of implementing the data protection method provided in the embodiment of the present application, the user does not need to remember the master key of the encrypted main directory of the first account. The master key can be encrypted and stored in an external storage device; when the user needs to access or modify the data in the encrypted main directory, the first device obtains the master key from the external storage device based on the root key, thereby obtaining the working keys for decrypting each file, which not only improves the convenience of implementation but also improves the security of the data.

[0010] In a possible implementation of the first aspect, the first device encrypts and stores the master key of the encrypted home directory of the first account in an external storage device, including: the first device creates a key file of the first account in the external storage device; the first device encrypts and stores the master key of the encrypted home directory of the first account in the key file of the first account.

[0011] In an embodiment of the present application, a first device may configure a key file, a key store, for a first account, and store information in the key file for the first account used to decrypt data, such as a master key for deriving a working key, and a second account and a second password for obtaining access to the first account's encrypted home directory. The first device may configure the encrypted data in the key file, the key store, to be decrypted based on a root key, i.e., the master key, the second account and the second password in the key file, may be obtained through decryption with the root key.

[0012] In a possible implementation manner of the first aspect, the root key is generated by a root key material, the root key material includes at least two sub-parts, and one of the sub-parts is a verification sub-part.

[0013] Correspondingly, the first device receives the first account and root key sent by the second device, including: the first device receives the first account and the verification sub-part of the root key material sent by the second device, wherein the verification sub-part of the root key material is obtained after the first account and the first password corresponding to the first account are successfully verified.

[0014] In a possible implementation manner of the first aspect, the root key material further includes a local sub-part.

[0015] When the encrypted home directory of the first account does not exist in the external storage device of the first device, the method further includes: the first device generates a local sub-portion of the root key material and stores the local sub-portion of the root key material in the external storage device.

[0016] In a possible implementation manner of the first aspect, the root key material further includes an application sub-part stored in the first application of the second device.

[0017] In an embodiment of the present application, to improve data security, the root key material used to generate the root key can be divided into at least two sub-parts, one of which is a verification sub-part. This verification sub-part is obtained based on the first account and the first password, thereby achieving the effect of distinguishing different users based on the first account. Other sub-parts can also be provided, such as a local sub-part. This local sub-part can be stored in an external storage device. Therefore, even if the external storage device is mounted on another electronic device, the other electronic device can still obtain the local sub-part from the external storage device to decrypt and obtain the master key for the encrypted main directory. The other sub-part can also be an application sub-part. This application sub-part can be provided in the supporting application software during the development phase of the supporting application software, thereby ensuring that only the supporting application software can obtain the application sub-part and decrypt and obtain the master key for the encrypted main directory. Only after the first device obtains the pre-set sub-parts of the root key material can it generate a root key from the sub-parts of the root key material and decrypt the master key for the encrypted main directory based on the generated root key. By distributing the sub-parts of the root key material, the security of the data in the storage device and the privacy between users are improved.

[0018] In a possible implementation of the first aspect, the first device receiving the second account and the second password corresponding to the second account sent by the second device includes: the first device receiving the second account entered by the user on the second device and the second password corresponding to the second account sent by the second device; or the first device receiving the second account generated by the second device and the second password corresponding to the second account sent by the second device.

[0019] In a possible implementation of the first aspect, after the first device receives the second account and the second password corresponding to the second account sent by the second device, the method further includes: the first device encrypts the second account and the second password and stores them in an external storage device, wherein the second account and the second password are obtained by decryption based on the root key.

[0020] In an embodiment of the present application, if, when obtaining access rights to the encrypted home directory of the first account, it is set that the user enters the second account and the second password independently each time, then when setting the second account and the second password as the authentication information of the encrypted home directory, the second account and the second password are set by the user. In order to reduce the user's operations and improve the user experience, when obtaining access rights to the encrypted home directory of the first account, it can also be set that the user does not need to remember the second account and the second password, then the second account and the second password can be automatically generated by the supporting application software in the second device (such as the first application) or the first device; accordingly, the second password of the second account needs to be stored in an external storage device, for example, the second account and the second password are stored in a key file key store. When it is necessary to obtain the authentication information of the encrypted home directory of the first account, the root key is obtained through the first account and the first password, and the encrypted data in the key file is decrypted based on the root key to obtain the second account and the second password. Therefore, the user only needs to remember the first account and the first password. In addition, when the setting requires the user to enter the second account and second password independently, even if the user forgets the second account and second password, the root key can be obtained through the first account and first password, and the encrypted data in the key file key store can be decrypted based on the root key to obtain the second account and second password, thereby improving the convenience and flexibility of the implementation of the embodiment of the present application.

[0021] In a second aspect, an embodiment of the present application provides a data protection method, which is applied to a first device that supports an information service block service, the method comprising: the first device receives a first account and a root key sent by a second device, wherein the root key is obtained after the first account and the first password corresponding to the first account are successfully verified; when the encrypted home directory of the first account exists in the external storage device of the first device, if the first device has set authentication information for the encrypted home directory of the first account, the first device obtains the second account and the second password corresponding to the second account, and uses the second account and the second password as the authentication information of the encrypted home directory for authentication; after the second account and the second password are successfully authenticated, if the first device receives a data access request or a data modification request for the encrypted home directory of the first account sent by the second device, the first device responds to the received data access request or data modification request based on the root key; after the first device receives the exit information of the first account, the first device locks the encrypted home directory of the first account.

[0022] In a possible implementation of the second aspect, when the encrypted home directory of the first account exists in the external storage device of the first device, it also includes: the first device decrypts the master key of the encrypted home directory of the first account from the external storage device based on the root key; and the first device sets the master key of the encrypted home directory of the first account in the system kernel of the first device.

[0023] Correspondingly, the first device responds to the received data access request or data modification request based on the root key, including: the first device responds to the received data access request or data modification request based on the master key in the system kernel; the first device locks the encrypted main directory of the first account, including: the first device clears the master key in the system kernel.

[0024] In a possible implementation of the second aspect, the first device decrypts the master key of the encrypted home directory of the first account from the external storage device based on the root key, including: the first device parses the encrypted information in the key file stored in the external storage device through the root key to obtain the master key of the encrypted home directory of the first account.

[0025] In a possible implementation manner of the second aspect, the root key is generated by a root key material, the root key material includes at least two sub-parts, and one of the sub-parts is a verification sub-part.

[0026] Correspondingly, the first device receives the first account and root key sent by the second device, including: the first device receives the first account and the verification sub-part of the root key material sent by the second device, wherein the verification sub-part of the root key material is obtained after the first account and the first password corresponding to the first account are successfully verified.

[0027] In a possible implementation manner of the second aspect, the root key material further includes a local sub-part.

[0028] Before the first device responds to the received data access request or data modification request based on the root key, the method further includes: the first device obtaining a local sub-portion of the root key material from an external storage device.

[0029] In a possible implementation of the second aspect, before the first device responds to a received data access request or data modification request based on the root key, it also includes: the first device obtains an application sub-part of the root key material stored in the first application of the second device from the second device.

[0030] In a possible implementation of the second aspect, the first device obtains the second account and the second password corresponding to the second account, including: the first device receives the second account and the second password corresponding to the second account entered by the user on the second device and sent by the second device; or the first device decrypts the second account and the second password corresponding to the second account from an external storage device based on the root key.

[0031] In a possible implementation of the second aspect, when an encrypted main directory of the first account exists in an external storage device of the first device, it also includes: in response to a received request to retrieve a second password corresponding to a second account, the first device decrypts the second account and the second password corresponding to the second account from the external storage device based on the root key, and sends the second account and the second password corresponding to the second account to the second device.

[0032] In a third aspect, an embodiment of the present application provides a data protection method, including: in response to a first account and a first password corresponding to the first account received through a second application, the third device sends the first account and the first password corresponding to the first account to a preset server; the third device receives a root key sent by the preset server after successfully verifying the first account and the first password; when there is an encrypted home directory of the first account in the external storage device of the third device and the third device has not set authentication information for the encrypted home directory of the first account, if the third device receives a data access request or a data modification request for the encrypted home directory of the first account, the third device responds to the received data access request or data modification request based on the root key; after the third device receives the exit information of the first account, the third device locks the encrypted home directory of the first account; wherein, before the third device receives the exit information of the first account, the third device does not allow other accounts other than the first account to log in to the second application of the third device.

[0033] In a possible implementation of the third aspect, when the encrypted home directory of the first account exists in the external storage device of the third device, it also includes: the third device decrypts the master key of the encrypted home directory of the first account from the external storage device based on the root key; and the third device sets the master key of the encrypted home directory of the first account in the system kernel of the third device.

[0034] Correspondingly, the third device responding to the received data access request or data modification request based on the root key includes: the third device responding to the received data access request or data modification request based on the master key in the system kernel.

[0035] The third device locking the encrypted home directory of the first account includes: the third device clearing the master key in the system kernel.

[0036] In a possible implementation of the third aspect, the third device decrypts the master key of the encrypted home directory of the first account from the external storage device based on the root key, including: the third device parses the encrypted information in the key file stored in the external storage device through the root key to obtain the master key of the encrypted home directory of the first account.

[0037] In a possible implementation manner of the third aspect, the root key is generated by a root key material, the root key material includes at least two sub-parts, and one of the sub-parts is a verification sub-part.

[0038] Correspondingly, the third device receives the root key sent by the preset server after the first account and the first password are successfully verified, including: the third device receives the verification sub-part of the root key material sent by the preset server after the first account and the first password are successfully verified.

[0039] In a possible implementation manner of the third aspect, the root key material further includes a local sub-part.

[0040] Before the third device responds to the received data access request or data modification request based on the root key, the method further includes: the third device obtaining a local sub-portion of the root key material from the external storage device.

[0041] In a possible implementation of the third aspect, before the third device responds to the received data access request or data modification request based on the root key, it also includes: the third device obtains an application sub-part of the root key material stored in the second application of the third device.

[0042] In a fourth aspect, an embodiment of the present application provides an electronic device, which may be referred to as a first device, and includes:

[0043] a root key receiving unit, configured to receive a first account and a root key sent by a second device, wherein the root key is obtained after the first account and a first password corresponding to the first account are successfully verified;

[0044] an encrypted home directory creating unit, configured to create an encrypted home directory for the first account in the external storage device of the first device when the encrypted home directory of the first account does not exist in the external storage device of the first device, wherein the data in the encrypted home directory of the first account is encrypted and decrypted based on the root key;

[0045] The authentication information setting unit is used to receive the second account and the second password corresponding to the second account sent by the second device, and set the second account and the second password as the authentication information of the encrypted home directory of the first account when the external storage device is mounted on the first device.

[0046] In a fifth aspect, an embodiment of the present application provides an electronic device, which may be referred to as a first device, and includes:

[0047] A root key receiving unit, configured to receive, on the first device, a first account and a root key sent by the second device, wherein the root key is obtained after the first account and a first password corresponding to the first account are successfully verified;

[0048] an authentication information acquisition unit configured to, when an encrypted home directory of a first account exists in an external storage device of the first device, acquire a second account and a second password corresponding to the second account if the first device has set authentication information for the encrypted home directory of the first account, and use the second account and the second password as authentication information for authentication of the encrypted home directory;

[0049] a data access or modification unit, configured to, after successful authentication of the second account and the second password, if the first device receives a data access request or a data modification request for the encrypted home directory of the first account from the second device, and to respond to the received data access request or data modification request based on the root key;

[0050] The data locking unit is configured to lock the encrypted home directory of the first account after the first device receives the logout information of the first account.

[0051] In a sixth aspect, an embodiment of the present application provides an electronic device, which may be referred to as a third device, and includes:

[0052] a first account receiving unit, configured to, in response to the first account and the first password corresponding to the first account received through the second application, cause the third device to send the first account and the first password corresponding to the first account to the preset server;

[0053] A root key receiving unit, configured to receive a root key sent by a preset server after successfully verifying the first account and the first password;

[0054] a data access or modification unit, configured to, when the encrypted home directory of the first account exists in an external storage device of the third device and the third device has not set authentication information for the encrypted home directory of the first account, respond to the received data access or data modification request based on the root key if the third device receives a data access request or data modification request for the encrypted home directory of the first account;

[0055] a data locking unit, configured to lock the encrypted home directory of the first account by the third device after the third device receives the logout information of the first account;

[0056] Before the third device receives the logout information of the first account, the third device does not allow other accounts except the first account to log in to the second application of the third device.

[0057] In the seventh aspect, an embodiment of the present application provides an electronic device, including a processor, the processor being used to run a computer program stored in a memory to implement any method of the first aspect and / or any method of the second aspect, or any method of the third aspect of the present application.

[0058] In an eighth aspect, a chip system is provided, comprising a processor coupled to a memory, wherein the processor executes a computer program stored in the memory to implement any method of the first aspect and / or any method of the second aspect, or any method of the third aspect of the present application.

[0059] In the ninth aspect, a computer-readable storage medium is provided, which stores a computer program. When the computer program is executed by one or more processors, it implements any method of the first aspect and / or any method of the second aspect, or any method of the third aspect of the present application.

[0060] In the tenth aspect, an embodiment of the present application provides a computer program product, which, when running on a device, enables the device to implement any method of the first aspect and / or any method of the second aspect, or any method of the third aspect of the present application.

[0061] It can be understood that the beneficial effects of the fourth to tenth aspects mentioned above can be found in the relevant description of the first aspect mentioned above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Figure 1 A schematic diagram of an application scenario of the data protection method provided in an embodiment of the present application;

[0063] Figure 2 A schematic diagram of the hardware structure of an electronic device for executing the data protection method provided in an embodiment of the present application;

[0064] Figure 3 A flowchart of a data protection method provided in an embodiment of the present application;

[0065] Figure 4 A schematic diagram of a data encryption and decryption strategy provided in an embodiment of the present application;

[0066] Figure 5 A schematic diagram of data in an encrypted home directory of a first account stored in a storage device provided in an embodiment of the present application;

[0067] Figure 6 A timing diagram of a data protection method provided in an embodiment of the present application;

[0068] Figure 7 The embodiments of this application provide Figure 3 A schematic flow chart of a data protection method corresponding to the illustrated embodiment;

[0069] Figure 8 The embodiments of this application provide Figure 6 Another timing diagram corresponding to the data protection method shown;

[0070] Figure 9 A timing diagram of a method for retrieving a second account and a second password in the data protection method provided in an embodiment of the present application;

[0071] Figure 10 The embodiments of this application provide Figure 3 A schematic flow chart of a data protection method corresponding to the illustrated embodiment;

[0072] Figure 11 The embodiments of this application provide Figure 6 Another timing diagram corresponding to the data protection method shown;

[0073] Figure 12 A schematic block diagram of a functional architecture module of an electronic device for executing a data protection method provided in an embodiment of the present application;

[0074] Figure 13 A schematic block diagram of the functional architecture modules of another electronic device that performs the data protection method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0075] In the following description, specific details such as specific system structures and technologies are provided for illustration rather than limitation to facilitate a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details.

[0076] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, integers, steps, operations, elements and / or components, but does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or collections thereof.

[0077] It should also be understood that in the embodiments of this application, "one or more" refers to one, two, or more than two; "and / or" describes the relationship between associated objects, indicating that three relationships can exist; for example, A and / or B can mean: A exists alone, A and B exist simultaneously, and B exists alone, where A and B can be singular or plural. The character " / " generally indicates that the associated objects are in an "or" relationship.

[0078] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0079] References to "one embodiment" or "some embodiments" in this specification mean that a particular feature, structure, or characteristic described in conjunction with that embodiment is included in one or more embodiments of the present application. Thus, phrases such as "in one embodiment," "in some embodiments," "in other embodiments," and "in other embodiments" appearing in various places in this specification do not necessarily refer to the same embodiment, but rather mean "one or more but not all embodiments," unless otherwise specifically emphasized. The terms "including," "comprising," "having," and variations thereof all mean "including but not limited to," unless otherwise specifically emphasized.

[0080] The data protection method provided in the embodiment of the present application can be applied to electronic devices mounted with external storage devices. Figure 1 This is an application scenario of the data protection method provided in an embodiment of the present application. The storage device in this application scenario can be shared by multiple people. As an external storage device of an electronic device, the storage device can be mounted on a router for multiple people to share, or mounted on a computer for multiple people to share, or mounted on other electronic devices for multiple people to share.

[0081] Electronic devices that have deployed the Server Message Block (Samba) program (e.g. Figure 1 The router in the samba protocol can be used as a server to configure access control policies. Electronic devices such as mobile phones, computers, and tablets that can be used as clients of the samba protocol (for example, Figure 1 A preset application is installed on a mobile phone (in the router). This preset application is a supporting application software. The preset application controls the router to create home directories for different users on the external storage device, and sets a Samba account and password for each user's home directory as authentication information for the home directory. When a user needs to access data stored in their home directory, they can log in to the preset application, which serves as a Samba protocol client, using the pre-set Samba account and password for authentication. After successful authentication, the preset application can access the home directory on the router's external storage device to which they have permission, but cannot access the home directory on the external storage device to which they do not have permission.

[0082] However, when the external storage device is disconnected from the router and connected to other electronic devices (e.g. Figure 1After the computer is connected, since the Samba access control policy of the home directory previously created in the external storage device is configured on the router, the Samba access control policy of the home directory does not exist on other electronic devices, resulting in users being able to arbitrarily access or even modify the data in the home directory on the external storage device. Therefore, this data protection method has poor security.

[0083] Through the description and analysis of the above scenario, it can be understood that the access control policy of the main directory in the external storage device can only take effect on a specific electronic device, which is an electronic device configured with the access control policy of the main directory (for example, Figure 1 router in the .

[0084] To address the poor security of data in external storage devices described above, the present embodiment adds an encryption and decryption policy for data in the home directory based on the Samba access control policy to achieve the following technical effects:

[0085] When an external storage device is mounted on an electronic device configured with a home directory access control policy, the user obtains access rights to the home directory through the Samba access control policy and encryption and decryption permissions for the data in the home directory through the data encryption and decryption policy. Only after obtaining both access rights to the home directory and encryption and decryption permissions for the data in the home directory can the user access or modify the data in the home directory, which has been granted these dual permissions. This pre-set double-layer permission barrier prevents other users from accessing the data stored in the home directory of the external storage device.

[0086] When the external storage device is mounted on another electronic device, although the other electronic device does not have a Samba access control policy for the home directory, the data encryption and decryption policy for the home directory still exists. Therefore, the user can obtain encryption and decryption permissions for the data in the home directory through the data encryption and decryption policy. After the user obtains encryption and decryption permissions for the data in the home directory, the user can access or modify the data in the home directory for which encryption and decryption permissions have been granted. The data encryption and decryption policy for the data in the home directory makes the data stored by the user in the home directory of the external storage device inaccessible to other users.

[0087] The encryption and decryption strategies for data in the main directory may refer to the description of the subsequent embodiments.

[0088] For ease of description, the electronic device serving as the server of the Samba protocol can be recorded as the first device, and the electronic device serving as the client of the Samba protocol can be recorded as the second device. When the external storage device is disconnected from the first device and mounted on another electronic device, the other electronic device can be recorded as the third device.

[0089] The present application provides a data protection method that can be applied to electronic devices that can mount external storage devices. The electronic devices can be: mobile phones, tablet computers, wearable devices, in-vehicle devices, smart speakers, smart screens, augmented reality (AR) / virtual reality (VR) devices, laptop computers, routers, ultra-mobile personal computers (UMPCs), netbooks, personal digital assistants (PDAs), and other electronic devices. The present application does not limit the specific types of electronic devices.

[0090] Figure 2 The electronic device 200 may include a processor 210, an external storage device interface 220, an internal memory 221, a universal serial bus (USB) interface 230, a charging management module 240, a power management module 241, a battery 242, an antenna 1, an antenna 2, a mobile communication module 250, a wireless communication module 260, an audio module 270, a speaker 270A, a receiver 270B, a microphone 270C, an earphone interface 270D, a sensor module 280, a button 290, a motor 291, an indicator 292, a camera 293, a display 294, and a subscriber identification module (SIM) card interface 295. The sensor module 280 may include a pressure sensor 280A, a gyroscope sensor 280B, an air pressure sensor 280C, a magnetic sensor 280D, an acceleration sensor 280E, a distance sensor 280F, a proximity light sensor 280G, a fingerprint sensor 280H, a temperature sensor 280J, a touch sensor 280K, an ambient light sensor 280L, a bone conduction sensor 280M, etc.

[0091] When the electronic device is a mobile phone, it may include all or part of the components described above.

[0092] When the electronic device is a router, it may include the processor 210 described above, the external storage device interface 220, the internal memory 221, the universal serial bus (USB) interface 230, the charging management module 240, the power management module 241, the battery 242, the antenna 2, the wireless communication module 260, the button 290, and the indicator 292.

[0093] When the electronic device is a computer, it may include the processor 210 described above, the external storage device interface 220, the internal memory 221, the universal serial bus (USB) interface 230, the charging management module 240, the power management module 241, the battery 242, the antenna 2, the wireless communication module 260, the audio module 270, the speaker 270A, the receiver 270B, the microphone 270C, the headphone jack 270D, the sensor module 280, the button 290, the motor 291, the indicator 292, the camera 293, and the display screen 294. The sensor module 280 may include a fingerprint sensor 280H, a touch sensor 280K, an ambient light sensor 280L, etc.

[0094] It should be understood that the structures illustrated in the embodiments of the present application do not constitute a specific limitation on the electronic device 200. In other embodiments of the present application, the electronic device 200 may include more or fewer components than shown, or may combine or separate certain components, or arrange the components differently. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0095] The processor 210 may include one or more processing units, for example: the processor 210 may include an application processor (AP), a modem processor, a graphics processing unit (GPU), an image signal processor (ISP), a controller, a memory, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU), etc. Among them, different processing units can be independent devices or integrated into one or more processors. For example, the processor 210 is used to execute the data protection method in the embodiment of the present application, for example, the following steps 301 to 303 and / or steps 701 to 704, or steps 1001 to 1004.

[0096] The controller may be the nerve center and command center of the electronic device 200. The controller may generate an operation control signal according to the instruction operation code and the timing signal to complete the control of fetching and executing instructions.

[0097] Processor 210 may also include a memory for storing instructions and data. In some embodiments, the memory in processor 210 is a cache memory. This memory can store instructions or data that have just been used or are being recycled by processor 210. If processor 210 needs to use the same instruction or data again, it can directly retrieve it from the memory. This avoids duplicate accesses, reduces processor 210 latency, and thus improves system efficiency.

[0098] In some embodiments, the processor 210 may include one or more interfaces. The interfaces may include an inter-integrated circuit (I2C) interface, an inter-integrated circuit sound (I2S) interface, a pulse code modulation (PCM) interface, a universal asynchronous receiver / transmitter (UART) interface, a mobile industry processor interface (MIPI), a general-purpose input / output (GPIO) interface, a subscriber identity module (SIM) interface, and / or a universal serial bus (USB) interface.

[0099] The I2C interface is a bidirectional synchronous serial bus that includes a serial data line (SDA) and a serial clock line (SCL). In some embodiments, the processor 210 may include multiple I2C bus lines. The processor 210 may be coupled to the touch sensor 280K, charger, flash, camera 293, etc. via different I2C bus interfaces. For example, the processor 210 may be coupled to the touch sensor 280K via the I2C interface, enabling communication between the processor 210 and the touch sensor 280K via the I2C bus interface, thereby implementing the touch function of the electronic device 200.

[0100] The I2S interface can be used for audio communication. In some embodiments, the processor 210 can include multiple I2S buses. The processor 210 can be coupled to the audio module 270 via the I2S bus to enable communication between the processor 210 and the audio module 270. In some embodiments, the audio module 270 can transmit audio signals to the wireless communication module 260 via the I2S interface, enabling the function of answering calls through a Bluetooth headset.

[0101] The PCM interface can also be used for audio communication, sampling, quantizing and encoding analog signals. In some embodiments, the audio module 270 and the wireless communication module 260 can be coupled via a PCM bus interface.

[0102] In some embodiments, the audio module 270 can also transmit audio signals to the wireless communication module 260 through the PCM interface to implement the function of answering calls through a Bluetooth headset. Both the I2S interface and the PCM interface can be used for audio communication.

[0103] The UART interface is a universal serial data bus used for asynchronous communication. This bus can be a bidirectional communication bus. It converts the data to be transmitted between serial communication and parallel communication.

[0104] In some embodiments, a UART interface is typically used to connect the processor 210 to the wireless communication module 260. For example, the processor 210 communicates with the Bluetooth module in the wireless communication module 260 via the UART interface to implement Bluetooth functionality. In some embodiments, the audio module 270 can transmit audio signals to the wireless communication module 260 via the UART interface, enabling the playback of music via Bluetooth headphones.

[0105] The MIPI interface can be used to connect the processor 210 to peripheral devices such as the display screen 294 and the camera 293. MIPI interfaces include the camera serial interface (CSI) and the display serial interface (DSI). In some embodiments, the processor 210 and the camera 293 communicate via the CSI interface to implement the camera function of the electronic device 200. The processor 210 and the display screen 294 communicate via the DSI interface to implement the display function of the electronic device 200.

[0106] The GPIO interface can be configured through software. The GPIO interface can be configured as a control signal or a data signal. In some embodiments, the GPIO interface can be used to connect the processor 210 to the camera 293, the display 294, the wireless communication module 260, the audio module 270, the sensor module 280, etc. The GPIO interface can also be configured as an I2C interface, an I2S interface, a UART interface, a MIPI interface, etc.

[0107] USB interface 230 is an interface that complies with USB standards and specifications, and may be a Mini USB interface, a Micro USB interface, a USB Type-C interface, or the like. USB interface 230 can be used to connect a charger to charge electronic device 200, or to transfer data between electronic device 200 and peripheral devices. It can also be used to connect headphones to play audio. This interface can also be used to connect other electronic devices, such as AR devices.

[0108] It is understood that the interface connection relationship between the modules illustrated in the embodiment of the present application is merely an illustrative illustration and does not constitute a structural limitation on the electronic device 200. In other embodiments of the present application, the electronic device 200 may also adopt a different interface connection method from the above embodiment, or a combination of multiple interface connection methods.

[0109] The charging management module 240 is configured to receive charging input from a charger. The charger can be either a wireless charger or a wired charger. In some wired charging embodiments, the charging management module 240 can receive charging input from the wired charger via the USB interface 230. In some wireless charging embodiments, the charging management module 240 can receive wireless charging input via the wireless charging coil of the electronic device 200. While charging the battery 242, the charging management module 240 can also provide power to the electronic device via the power management module 241.

[0110] The power management module 241 is used to connect the battery 242, the charging management module 240, and the processor 210. The power management module 241 receives input from the battery 242 and / or the charging management module 240 and provides power to the processor 210, the internal memory 221, the external storage device 220, the display 294, the camera 293, and the wireless communication module 260. The power management module 241 can also be used to monitor parameters such as battery capacity, battery cycle count, and battery health status (leakage, impedance), etc.

[0111] In some other embodiments, the power management module 241 may also be provided in the processor 210. In some other embodiments, the power management module 241 and the charging management module 240 may also be provided in the same device.

[0112] The wireless communication function of the electronic device 200 can be implemented through the antenna 1, the antenna 2, the mobile communication module 250, the wireless communication module 260, the modem processor and the baseband processor.

[0113] Antenna 1 and Antenna 2 are used to transmit and receive electromagnetic wave signals. Each antenna in electronic device 200 can be used to cover a single or multiple communication frequency bands. Different antennas can also be reused to improve antenna utilization. For example, antenna 1 can be reused as a diversity antenna for a wireless local area network. In other embodiments, the antennas can be used in conjunction with a tuning switch.

[0114] The mobile communication module 250 can provide wireless communication solutions, including 2G / 3G / 4G / 5G, for the electronic device 200. The mobile communication module 250 may include at least one filter, a switch, a power amplifier, a low-noise amplifier (LNA), and the like. The mobile communication module 250 can receive electromagnetic waves from the antenna 1, filter and amplify the received electromagnetic waves, and transmit them to the modem processor for demodulation. The mobile communication module 250 can also amplify the signals modulated by the modem processor and convert them into electromagnetic waves for radiation via the antenna 1.

[0115] In some embodiments, at least some functional modules of the mobile communication module 250 may be provided in the processor 210. In some embodiments, at least some functional modules of the mobile communication module 250 and at least some functional modules of the processor 210 may be provided in the same device.

[0116] The modem processor may include a modulator and a demodulator. The modulator is used to modulate the low-frequency baseband signal to be transmitted into a medium-high frequency signal. The demodulator is used to demodulate the received electromagnetic wave signal into a low-frequency baseband signal. The demodulator then transmits the demodulated low-frequency baseband signal to the baseband processor for processing. After being processed by the baseband processor, the low-frequency baseband signal is passed to the application processor. The application processor outputs a sound signal through an audio device (not limited to the speaker 270A, the receiver 270B, etc.) or displays an image or video through the display screen 294. In some embodiments, the modem processor may be an independent device. In other embodiments, the modem processor may be independent of the processor 210 and be set in the same device as the mobile communication module 250 or other functional modules.

[0117] The wireless communication module 260 can provide wireless communication solutions including wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) networks), Bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), infrared (IR), etc., which are applied to the electronic device 200. The wireless communication module 260 can be one or more devices integrating at least one communication processing module. The wireless communication module 260 receives electromagnetic waves via the antenna 2, frequency modulates and filters the electromagnetic wave signals, and sends the processed signals to the processor 210. The wireless communication module 260 can also receive the signal to be sent from the processor 210, frequency modulate it, amplify it, and convert it into electromagnetic waves for radiation through the antenna 2.

[0118] In some embodiments, antenna 1 of electronic device 200 is coupled to mobile communication module 250, and antenna 2 is coupled to wireless communication module 260, so that electronic device 200 can communicate with a network and other devices via wireless communication technology. Wireless communication technology may include global system for mobile communications (GSM), general packet radio service (GPRS), code division multiple access (CDMA), wideband code division multiple access (WCDMA), time-division code division multiple access (TD-SCDMA), long term evolution (LTE), BT, GNSS, WLAN, NFC, FM, and / or IR technology, etc. GNSS may include the global positioning system (GPS), the global navigation satellite system (GLONASS), the Beidou navigation satellite system (BDS), the quasi-zenith satellite system (QZSS) and / or the satellite based augmentation system (SBAS).

[0119] Electronic device 200 implements display functionality through a GPU, display screen 294, and an application processor. A GPU is a microprocessor for image processing that connects display screen 294 and the application processor. The GPU is used to perform mathematical and geometric calculations for graphics rendering. Processor 210 may include one or more GPUs that execute program instructions to generate or modify display information.

[0120] Display screen 294 is used to display images, videos, etc. Display screen 294 includes a display panel. The display panel can be a liquid crystal display (LCD), an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode (AMOLED), a flexible light-emitting diode (FLED), a MiniLED, a MicroLED, a Micro-oLed, or a quantum dot light-emitting diode (QLED). In some embodiments, electronic device 200 may include one or N display screens 294, where N is a positive integer greater than one.

[0121] The electronic device 200 can implement a shooting function through an ISP, a camera 293, a video codec, a GPU, a display screen 294, and an application processor.

[0122] The ISP processes data fed back by camera 293. For example, when taking a photo, the shutter is opened, and light is transmitted through the lens to the camera's photosensitive element. The light signal is converted into an electrical signal, which is then passed to the ISP for processing and transformed into a visible image. The ISP can also perform algorithmic optimization for image noise, brightness, and skin tone. The ISP can also optimize parameters such as exposure and color temperature of the captured scene. In some embodiments, the ISP can be located within camera 293.

[0123] The camera 293 is used to capture still images or videos. The object generates an optical image through the lens and projects it onto the photosensitive element. The photosensitive element can be a charge coupled device (CCD) or a complementary metal-oxide-semiconductor (CMOS) phototransistor. The photosensitive element converts the light signal into an electrical signal, and then passes the electrical signal to the ISP for conversion into a digital image signal. The ISP outputs the digital image signal to the DSP for processing. The DSP converts the digital image signal into an image signal in a standard RGB, YUV or other format. In some embodiments, the electronic device 200 may include 1 or N cameras 293, where N is a positive integer greater than 1.

[0124] The digital signal processor is used to process digital signals. In addition to processing digital image signals, it can also process other digital signals. For example, when the electronic device 200 selects a frequency point, the digital signal processor is used to perform Fourier transform on the frequency point energy.

[0125] Video codecs are used to compress or decompress digital video. Electronic device 200 may support one or more video codecs. This allows electronic device 200 to play or record videos in various encoding formats, such as Moving Picture Experts Group (MPEG) 1, MPEG2, MPEG3, and MPEG4.

[0126] The NPU is a neural network (NN) computing processor that rapidly processes input information and can continuously self-learn by drawing on the structure of biological neural networks, such as the transmission patterns between neurons in the human brain. The NPU can be used to implement applications such as intelligent cognition in electronic device 200.

[0127] The external storage device interface 220 can be used to connect an external storage device, such as a Micro SD card or a mobile hard drive, to expand the storage capacity of the electronic device 200. The external storage device communicates with the processor 210 via the external storage device interface 220 to implement data storage functions. For example, files such as music and videos can be stored in the external storage device.

[0128] The internal memory 221 can be used to store computer executable program code, which includes instructions. The processor 210 executes various functional applications and data processing of the electronic device 200 by running the instructions stored in the internal memory 221. The internal memory 221 may include a program storage area and a data storage area. Among them, the program storage area can store an operating system and an application required for at least one function (such as a sound playback function, an image playback function, etc.). The data storage area can store data created during the use of the electronic device 200 (such as audio data, a phone book, etc.).

[0129] In addition, the internal memory 221 may include a high-speed random access memory and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, a universal flash storage (UFS), etc.

[0130] The electronic device 200 can implement audio functions such as music playback and recording through the audio module 270, the speaker 270A, the receiver 270B, the microphone 270C, the headphone jack 270D, and the application processor.

[0131] The audio module 270 is used to convert digital audio signals into analog audio signals for output, and is also used to convert analog audio input into digital audio signals. The audio module 270 can also be used to encode and decode audio signals. In some embodiments, the audio module 270 can be provided in the processor 210, or some functional modules of the audio module 270 can be provided in the processor 210.

[0132] The speaker 270A, also called a "speaker", is used to convert audio electrical signals into sound signals. The electronic device 200 can listen to music or listen to hands-free calls through the speaker 270A.

[0133] The receiver 270B, also called a "handset", is used to convert audio electrical signals into sound signals. When the electronic device 200 receives a call or a voice message, the user can place the receiver 270B close to the ear to hear the voice.

[0134] The microphone 270C, also known as a "microphone" or "microphone", is used to convert sound signals into electrical signals. When making a call or sending a voice message, the user can speak by putting their mouth close to the microphone 270C to input the sound signal into the microphone 270C. The electronic device 200 can be provided with at least one microphone 270C. In other embodiments, the electronic device 200 can be provided with two microphones 270C, which can not only collect sound signals but also realize noise reduction function. In other embodiments, the electronic device 200 can also be provided with three, four or more microphones 270C to collect sound signals, reduce noise, identify the source of sound, realize directional recording function, etc.

[0135] The headphone jack 270D is used to connect a wired headphone and can be a USB interface 230 or a 3.5mm open mobile terminal platform (OMTP) standard interface or a cellular telecommunications industry association of the USA (CTIA) standard interface.

[0136] The pressure sensor 280A is used to sense pressure signals and convert them into electrical signals. In some embodiments, the pressure sensor 280A can be set on the display screen 294. There are many types of pressure sensors 280A, such as resistive pressure sensors, inductive pressure sensors, capacitive pressure sensors, etc. A capacitive pressure sensor can be a device including at least two parallel plates with conductive material. When force acts on the pressure sensor 280A, the capacitance between the electrodes changes. The electronic device 200 determines the intensity of the pressure based on the change in capacitance. When a touch operation is applied to the display screen 294, the electronic device 200 detects the intensity of the touch operation based on the pressure sensor 280A. The electronic device 200 can also calculate the position of the touch based on the detection signal of the pressure sensor 280A.

[0137] The gyroscope sensor 280B can be used to determine the motion posture of the electronic device 200. In some embodiments, the angular velocity of the electronic device 200 around three axes (i.e., x, y, and z axes) can be determined by the gyroscope sensor 280B. The gyroscope sensor 280B can be used for anti-shake shooting. For example, when the shutter is pressed, the gyroscope sensor 280B detects the angle of the electronic device 200 shaking, calculates the distance that the lens module needs to compensate based on the angle, and allows the lens to offset the shaking of the electronic device 200 through reverse movement to achieve anti-shake. The gyroscope sensor 280B can also be used for navigation and somatosensory game scenes.

[0138] The air pressure sensor 280C is used to measure air pressure. In some embodiments, the electronic device 200 calculates the altitude using the air pressure value measured by the air pressure sensor 280C to assist in positioning and navigation.

[0139] The magnetic sensor 280D includes a Hall sensor. The electronic device 200 can use the magnetic sensor 280D to detect the opening and closing of the flip case. In some embodiments, when the electronic device 200 is a flip phone, the electronic device 200 can detect the opening and closing of the flip cover based on the magnetic sensor 280D. Based on the detected opening and closing status of the case or flip cover, features such as automatic unlocking of the flip cover can be configured.

[0140] Accelerometer 280E can detect the magnitude of acceleration of electronic device 200 in all directions (generally three axes). When electronic device 200 is stationary, it can detect the magnitude and direction of gravity. It can also be used to identify the electronic device's posture, enabling applications such as switching between landscape and portrait modes and pedometers.

[0141] The distance sensor 280F is used to measure distance. The electronic device 200 can measure distance using infrared or laser. In some embodiments, when shooting a scene, the electronic device 200 can use the distance sensor 280F to measure distance to achieve fast focusing.

[0142] The proximity light sensor 280G may include, for example, a light emitting diode (LED) and a light detector, such as a photodiode. The light emitting diode may be an infrared light emitting diode. The electronic device 200 emits infrared light outward through the light emitting diode. The electronic device 200 uses a photodiode to detect infrared reflected light from nearby objects. When sufficient reflected light is detected, it can be determined that there is an object near the electronic device 200. When insufficient reflected light is detected, the electronic device 200 can determine that there is no object near the electronic device 200. The electronic device 200 can use the proximity light sensor 280G to detect that the user is holding the electronic device 200 close to the ear to talk, so as to automatically turn off the screen to save power. The proximity light sensor 280G can also be used in leather case mode and pocket mode to automatically unlock and lock the screen.

[0143] Ambient light sensor 280L is used to sense ambient light brightness. Electronic device 200 can adaptively adjust the brightness of display screen 294 based on the perceived ambient light brightness. Ambient light sensor 280L can also be used to automatically adjust white balance when taking photos. Ambient light sensor 280L can also work with proximity light sensor 280G to detect whether electronic device 200 is in a pocket to prevent accidental touches.

[0144] The fingerprint sensor 280H is used to collect fingerprints. The electronic device 200 can use the collected fingerprint characteristics to implement fingerprint unlocking, access application locks, fingerprint photography, fingerprint answering calls, etc.

[0145] The temperature sensor 280J is used to detect temperature. In some embodiments, the electronic device 200 uses the temperature detected by the temperature sensor 280J to execute a temperature processing strategy. For example, when the temperature reported by the temperature sensor 280J exceeds a threshold, the electronic device 200 reduces the performance of the processor located near the temperature sensor 280J to reduce power consumption and implement thermal protection. In other embodiments, when the temperature is lower than another threshold, the electronic device 200 heats the battery 242 to prevent the electronic device 200 from shutting down abnormally due to low temperature. In other embodiments, when the temperature is lower than another threshold, the electronic device 200 boosts the output voltage of the battery 242 to prevent abnormal shutdown due to low temperature.

[0146] The touch sensor 280K is also called a "touch panel." The touch sensor 280K can be disposed on the display screen 294. The touch sensor 280K and the display screen 294 form a touch screen, also called a "touch screen." The touch sensor 280K is used to detect touch operations applied thereto or in the vicinity thereof. The touch sensor can transmit the detected touch operations to the application processor to determine the type of touch event. Visual output related to the touch operations can be provided via the display screen 294. In other embodiments, the touch sensor 280K can also be disposed on the surface of the electronic device 200, at a location different from that of the display screen 294.

[0147] Bone conduction sensor 280M can acquire vibration signals. In some embodiments, bone conduction sensor 280M can acquire vibration signals from vibrating bones in the human body. Bone conduction sensor 280M can also contact the human pulse to receive blood pressure signals.

[0148] In some embodiments, the bone conduction sensor 280M can also be installed in headphones, forming a bone conduction headset. The audio module 270 can parse the vibration signal of the vocal bone obtained by the bone conduction sensor 280M to extract the voice signal, thus implementing the voice function. The application processor can parse the heart rate information based on the blood pressure signal obtained by the bone conduction sensor 280M, thus implementing the heart rate detection function.

[0149] The buttons 290 include a power button, a volume button, and the like. The buttons 290 may be mechanical buttons or touch buttons. The electronic device 200 may receive key inputs and generate key signal inputs related to user settings and function control of the electronic device 200.

[0150] Motor 291 can generate vibration prompts. Motor 291 can be used for incoming call vibration prompts, and can also be used for touch vibration feedback. For example, touch operations acting on different applications (such as taking pictures, audio playback, etc.) can correspond to different vibration feedback effects. For touch operations acting on different areas of the display screen 294, motor 291 can also correspond to different vibration feedback effects. Different application scenarios (for example: time reminders, receiving messages, alarm clocks, games, etc.) can also correspond to different vibration feedback effects. The touch vibration feedback effect can also support customization.

[0151] The indicator 292 may be an indicator light, which may be used to indicate the charging status, power level change, messages, missed calls, notifications, etc.

[0152] The SIM card interface 295 is used to connect a SIM card. The SIM card can be connected to and separated from the electronic device 200 by inserting it into or removing it from the SIM card interface 295. The electronic device 200 can support 1 or N SIM card interfaces, where N is a positive integer greater than 1. The SIM card interface 295 can support Nano SIM cards, Micro SIM cards, SIM cards, etc. Multiple cards can be inserted into the same SIM card interface 295 at the same time. The types of the multiple cards can be the same or different. The SIM card interface 295 can also be compatible with different types of SIM cards. The SIM card interface 295 can also be compatible with external memory cards. The electronic device 200 interacts with the network through the SIM card to implement functions such as calls and data communications. In some embodiments, the electronic device 200 uses an eSIM, i.e., an embedded SIM card. The eSIM card can be embedded in the electronic device 200 and cannot be separated from the electronic device 200.

[0153] It should be noted that, if the electronic device is a server, the server includes a processor and a communication interface.

[0154] The embodiments of the present application do not specifically limit the specific structure of the execution subject of a data protection method, as long as it can communicate according to a data protection method of an embodiment of the present application by running a program that records the code of the data protection method of an embodiment of the present application. For example, the execution subject of a data protection method provided in an embodiment of the present application can be a functional module in an electronic device that can call and execute a program, or a communication device used in an electronic device, such as a chip.

[0155] To provide a clearer understanding of the data protection method provided in the embodiments of the present application, the embodiments of the present application describe the data protection method provided in the embodiments of the present application using the first device as the server of the Samba protocol and the third device as the execution entities. When the first device, as the execution entity, implements the data protection method provided in the embodiments of the present application, there are two possible situations:

[0156] In the first case, the user's encrypted home directory does not exist in the external storage device of the first device. In this case, it is necessary to create an encrypted home directory for the user and set a protection policy for the data in the encrypted home directory: the access control policy of the home directory and the encryption and decryption policy of the data in the home directory.

[0157] The second case is that the user's encrypted home directory exists in the external storage device of the first device. In this case, it is necessary to obtain access rights to the encrypted home directory and encryption and decryption rights of the data in the encrypted home directory based on the pre-set protection policy for the data in the encrypted home directory in order to access or modify the data in the encrypted home directory.

[0158] When the third device acts as the execution entity, the user's encrypted home directory exists in the external storage device of the third device. The third device needs to obtain encryption and decryption permissions for the data in the encrypted home directory based on the pre-set protection policy for the data in the encrypted home directory in order to access or modify the data in the encrypted home directory.

[0159] The following first describes the first situation in which the first device acts as the execution entity to implement the data protection method provided in the embodiment of the present application.

[0160] See also Figure 3 , Figure 3 A flow chart of a data protection method provided in an embodiment of the present application is shown in the figure. As shown in the figure, the method is applied to a first device that supports the information service block service. The first device can be connected to an external storage device as a server in the Samba protocol to implement the data protection method provided in the first case above. The method includes:

[0161] In step 301, a first device receives a first account and a root key sent by a second device, wherein the root key is obtained after the first account and a first password corresponding to the first account are successfully verified.

[0162] In an embodiment of the present application, a first device can be connected to an external storage device. The first device is provided with a Samba service program, and the first device can serve as a server in the Samba protocol, while the client in the Samba protocol is the second device. For example, the first device can be a router, etc., and the second device can be a mobile phone, computer, tablet computer, etc.

[0163] The second device has a first application installed therein, where the first application is a matching application software. When a user needs to create a new account in the external storage device to store data, the user first needs to register the first account.

[0164] For example, a user can register a first account with a preset server through a first application on a second device and set a login password for the first account. After the first account is successfully registered, the user can log in to the first application on the second device using the first account and login password. The first application on the second device sends the first account and login password to the cloud server. After the cloud server successfully verifies the first account and login password, it generates a root key based on a preset root key generation rule and sends the root key to the second device.

[0165] Alternatively, a user can register a first account with a preset server through a first application on a second device and set a login password for the first account. After the first account is successfully registered, the cloud server generates a root key for the first account and stores the root key on the cloud server. The user then logs in to the first application on the second device using the first account and login password. The first application on the second device sends the first account and login password to the cloud server. After the cloud server successfully verifies the first account and login password, it retrieves the stored root key and sends it to the second device.

[0166] After the second device receives the root key sent by the preset server, it can establish a connection with the first device in a wired or wireless manner. After the connection is successful, the first account and the root key can be sent to the first device.

[0167] In the embodiment of the present application, the first account may be a mobile phone number, an email account, etc. Registering through a mobile phone number or an email account can facilitate subsequent retrieval or reset of the login password.

[0168] In addition, the first password can be the login password set by the user in the above example, or it can be a verification code obtained through a mobile phone number or email account.

[0169] For example, a user sends a first account to a preset server through a first application on a second device. The preset server sends a verification code to the first account. The user logs into the first application using the first account and verification code. The second device where the first application resides sends the first account and verification code to the cloud server. After the cloud service successfully verifies the first account and verification code, it sends the root key to the second device. The second device then sends the received root key and the first account to the first device.

[0170] In step 302 , when the encrypted home directory of the first account does not exist in the external storage device of the first device, the first device creates an encrypted home directory for the first account in the external storage device, wherein the data in the encrypted home directory of the first account is encrypted and decrypted based on the root key.

[0171] In an embodiment of the present application, when a first account logs in to a first application and connects to a first device for the first time, an encrypted home directory for the first account may not exist in the external storage device of the first device. In this case, an encrypted home directory can be created for the first account. After the encrypted home directory for the first account is created in the external storage device, the data in the encrypted home directory of the first account can be encrypted and decrypted based on the root key. That is, the first device sets an encryption and decryption policy for the data in the encrypted home directory. When the user needs to access or modify the data in the encrypted home directory of the first account, the data stored in the home directory needs to be encrypted or decrypted based on the obtained root key.

[0172] It should be noted that after the first device creates an encrypted home directory for the first account in the external storage device, there is no data created or stored by the user in the encrypted home directory; setting the data in the encrypted home directory of the first account to be encrypted and decrypted based on the root key means that when there is data created or stored by the user in the encrypted home directory of the first account, the user's data in the encrypted home directory is encrypted and decrypted based on the root key.

[0173] In step 303 , the first device receives the second account and the second password corresponding to the second account sent by the second device, and sets the second account and the second password as authentication information of the encrypted home directory of the first account when the external storage device is mounted on the first device.

[0174] In this embodiment of the present application, the second account can be a Samba-based account. Specifically, the second account and the second password corresponding to the second account are authentication information in the access control policy set by the first device for the encrypted home directory. After successful authentication of the second account and the second password, access rights to the first account's encrypted home directory are obtained.

[0175] The user can enter the second account and second password in the first application of the second device, and the second device sends the second account and second password to the first device. The first device sets the second account and second password as the authentication information of the access control policy of the encrypted home directory of the first account.

[0176] In an embodiment of the present application, when an encrypted home directory is first created in an external storage device for a first account, an encryption and decryption policy is set for the data in the encrypted home directory of the first account based on the root key, and an access control policy is set for the encrypted home directory of the first account based on the second account and the second password. When the external storage device is mounted on the first device, the security of the data in the encrypted home directory is improved through a double protection policy, that is, the access control policy of the encrypted home directory is used to ensure that only users who have obtained access rights to the encrypted home directory can access the encrypted home directory, and the encryption and decryption policy of the data in the encrypted home directory is used to ensure that the data in the encrypted home directory is stored in the form of ciphertext. When the external storage device is mounted on other electronic devices, even if the other electronic device does not have an access control policy for the encrypted home directory, the encryption and decryption policy of the data in the encrypted home directory can still be used to ensure that the data in the encrypted home directory is stored in the form of ciphertext, and only the root key obtained through the first account and the first password can decrypt the data in the encrypted home directory, ensuring that other users cannot access or modify the data in the encrypted home directory of the first account.

[0177] As another embodiment of the present application, after the first device creates an encrypted home directory for the first account in the external storage device, the method further includes:

[0178] The first device generates a master key for the encrypted home directory of the first account, and sets the master key for the encrypted home directory of the first account in the system kernel of the first device;

[0179] The first device encrypts and stores the master key of the encrypted home directory of the first account in an external storage device, wherein the root key is used to decrypt and obtain the master key encrypted and stored in the external storage device, and the data in the encrypted home directory of the first account is encrypted and decrypted based on the master key.

[0180] In an embodiment of the present application, the first device can also generate a master key for the first account's encrypted home directory. This master key can be used to derive a working key, and data in the encrypted home directory can be encrypted and decrypted based on the working key. The master key is encrypted and stored on the external storage device. Based on the root key of the encrypted home directory, the encrypted master key can be decrypted from the storage device to obtain the encrypted master key.

[0181] To have a clearer understanding of the root key, master key, and working key, refer to Figure 4 , Figure 4 is the relationship between the root key, master key and working key. Figure 4 As shown, when the first device sets the encryption and decryption policy for the data in the encrypted home directory of the first account, it sets the root key of the encrypted home directory of the first account to decrypt to obtain the master key encrypted and stored in the external storage device. The master key of the encrypted home directory is used to derive a working key, which is used to encrypt and decrypt the data stored in the encrypted home directory of the external storage device. When there are multiple home directories of the first account in the external storage device, the root key 1 of the first account A is decrypted to obtain the master key master key1. The master key1 is used to derive working keys 11, ..., and working keys 1n. Each working key encrypts and decrypts a file in the encrypted home directory of the first account A; the root key 2 of the first account B is decrypted to obtain the master key master key2. The master key2 is used to derive working keys 21, ..., and working keys 2n. Each working key encrypts and decrypts a file in the encrypted home directory of the first account B.

[0182] For the data stored in the encrypted home directory of the first account A corresponding to user A and the data stored in the encrypted home directory of the first account B corresponding to user B in the external storage device, refer to Figure 5 As shown, Figure 5A schematic diagram of the data in the encrypted home directory of the first account in the storage device provided in an embodiment of the present application. The storage device in the figure serves as an external storage device of the electronic device, and contains the encrypted home directory of the first account A of user A and the encrypted home directory of the first account B of user B. When the external storage device is mounted on the first device, the first device has an access control policy for the encrypted home directory. Therefore, the second account and the second password are required to obtain access rights to the encrypted home directory of the first account corresponding to the second account. The data stored in the encrypted home directory of the first account A includes: file 1, ..., file n, wherein file 1, ..., file n are encrypted and decrypted by working keys 11, ..., and working keys 1n derived from the master key, respectively; correspondingly, the data stored in the encrypted home directory of the first account B includes: file 1, ..., file n, which are encrypted and decrypted by working keys 21, ..., and working keys 2n, respectively.

[0183] pass Figure 4 and Figure 5 It can be understood that if a user needs to access or modify the data in the encrypted home directory of the first account, he needs to obtain access rights to the encrypted home directory of the first account based on the second account and the second password; he also needs to obtain the root key of the encrypted home directory of the first account based on the first account and the first password, decrypt the master key of the encrypted home directory of the first account based on the root key of the encrypted home directory of the first account, and decrypt the files in the encrypted home directory of the first account based on the master key of the encrypted home directory of the first account.

[0184] As another embodiment of the present application, the first device encrypting and storing the master key of the encrypted home directory of the first account in the external storage device includes:

[0185] The first device creates a key file of the first account in the external storage device;

[0186] The first device encrypts the master key of the encrypted home directory of the first account and stores it in the key file of the first account.

[0187] In an embodiment of the present application, a key file can be set for the first account, and the key file is stored in an external storage device. The master key of the encrypted home directory of the first account is encrypted and stored in the key file.

[0188] The second account and second password can also be encrypted and stored in the key file. When a user subsequently accesses or modifies data in the encrypted home directory of the first account, the first device decrypts the root key of the encrypted home directory of the first account to obtain the second account and second password, and obtains access rights to the encrypted home directory of the first account based on the decrypted second account and second password.

[0189] Of course, in actual applications, the master key of the encrypted home directory of the first account and the second account and second password can also be encrypted and stored in an external storage device in other forms, and the embodiment of the present application does not limit this.

[0190] In order to have a clearer understanding of the method of setting the data protection policy in the above embodiment, refer to Figure 6 , Figure 6 A timing diagram of a data protection method provided by an embodiment of the present application. As shown in the figure, a user enters a first account and a first password through a first application in a second device; the second device sends the first account and the first password to a server; after the server successfully verifies the first account and the first password, it generates a root key and sends the root key to the second device; after the second device receives the root key, it connects to the first device and sends the first account and the root key to the first device; the first device is connected to an external storage device. After the first device receives the root key, if the storage device as the external storage device of the first device does not have an encrypted home directory of the first account, the first device creates an encrypted home directory and a key file of the first account for the first account in the external storage device; the first device generates a master key for the encrypted home directory of the first account and sets the master key in the system kernel of the first device; the first device encrypts and stores the master key in the key file. If the encrypted home directory of the first account exists in the system kernel of the first device, if the first device receives a data access request or a data modification request for the encrypted home directory of the first account, the first device can automatically encrypt or decrypt the data in the encrypted home directory based on the master key in the system kernel.

[0191] Need to explain, Figure 6 In the timing diagram shown, the first device first creates a key file, then generates a master key, and encrypts and stores the master key in the key file. In actual applications, the operation of the first device creating a key file in an external storage device can be performed before encrypting and storing the master key in the key file; the operation of the first device setting the master key in the system kernel and the operation of the first device encrypting and storing the master key in the key file can also be set in different orders according to actual conditions. Figure 6 The timing diagram shown is only an example and does not impose any limitation on the embodiments of the present application.

[0192] The user can continue to enter the second account and second password in the first application of the second device, or the first application of the second device can generate the second account and second password. The second device sends the second account and second password to the first device, and the first device encrypts the second account and second password as authentication information of the encrypted home directory and stores them in the key file.

[0193] After the settings are completed, if the user logs out of the first account on the second device, or the first account login times out, the second device sends the logout information of the first account to the first device to control the first device to clear the master key in the system kernel of the first device and lock the encrypted home directory of the first account.

[0194] Figure 6 The timing diagram shown focuses on describing the information interaction between the server, the second device, the first device and the storage device, and the execution order of some steps is determined based on the internal logic.

[0195] As another embodiment of the present application, the root key may be generated from a root key material, and the root key material may include multiple sub-parts, at least one sub-part of the root key material being a verification sub-part.

[0196] Correspondingly, the first device receiving the first account and the root key sent by the second device includes:

[0197] The first device receives the verification subpart of the first account and root key material sent by the second device. The verification subpart of the root key material is obtained after the first account and the first password corresponding to the first account are successfully verified. That is, the verification subpart can be obtained from the preset server. The preset server sends the verification subpart of the root key material to the second device, and the second device sends the verification subpart of the first account and root key material to the first device. The specific process for the preset server to obtain the verification subpart of the root key material can be referred to the process for the preset server to obtain the root key described above and will not be repeated here.

[0198] In an embodiment of the present application, to improve the security of data in the external storage device, the root key material corresponding to the root key used to decrypt the external storage device to obtain the master key for the first account's encrypted home directory may be divided into at least two sub-parts. After the first device or other electronic device obtains the sub-parts of the root key material, a root key is generated based on the sub-parts of the root key material, and the master key for the first account's encrypted home directory is decrypted from the external storage device based on the root key.

[0199] As another embodiment of the present application, the root key material may further include: a local sub-part;

[0200] Correspondingly, when the encrypted home directory of the first account does not exist in the external storage device of the first device, the method further includes:

[0201] The first device generates a local sub-portion of the root keying material and stores the local sub-portion of the root keying material in an external storage device.

[0202] As another embodiment of the present application, the root key material also includes an application sub-part stored in the first application of the second device.

[0203] In an embodiment of the present application, other sub-parts of the root key material may include at least one of a local sub-part and an application sub-part.

[0204] When the root keying material includes a local sub-portion, the first device generates the local sub-portion of the root keying material and stores the local sub-portion of the root keying material in the external storage device.

[0205] When the root key material includes an application subpart, the application subpart is stored in the first application of the second device, or in the first application of the third device, that is, the application subpart can be written into the application software during the development phase of the application software.

[0206] The verification sub-portion in the embodiment of the present application is obtained based on the first account and the first password, thereby achieving the effect of distinguishing different users by the first account. The local sub-portion can be stored in an external storage device. Therefore, even if the external storage device is mounted on another electronic device, the other electronic device can still obtain the local sub-portion from the external storage device and decrypt the master key of the encrypted main directory. The application sub-portion can be set in the supporting application software during the development phase of the supporting application software; thus, only the supporting application software can obtain the application sub-portion and decrypt the master key of the encrypted main directory.

[0207] As another embodiment of the present application, the first device receiving the second account number and the second password corresponding to the second account sent by the second device includes:

[0208] The first device receives a second account number and a second password corresponding to the second account number input by the user on the second device and sent by the second device;

[0209] Alternatively, the first device receives a second account number and a second password corresponding to the second account number generated by the second device and sent by the second device.

[0210] In this embodiment of the present application, a user can enter a second account and a second password through a first application on a second device, and the second device will send the received second account and second password to the first device. Alternatively, the first application on the second device can randomly generate a second account and a second password for the user. Of course, the first application on the second device can also display the second account and second password to remind the user to remember the second account and password.

[0211] As another embodiment of the present application, after the first device receives the second account number and the second password corresponding to the second account sent by the second device, the method further includes:

[0212] The first device encrypts the second account number and the second password and stores them in an external storage device, wherein the second account number and the second password are decrypted and obtained based on the root key.

[0213] In an embodiment of the present application, in order to avoid the user having to remember the first account and the first password, as well as the second account and the second password, in order to access the data in the encrypted main directory of the first account, which causes cumbersome operations for the user and the possibility of forgetting the account and password, the second account and the second password can be stored in an external storage device. When the user needs to access or modify the data in the encrypted main directory, the root key is obtained based on the first account and the first password, and the second account and the second password are obtained from the external storage device based on the root key. The access rights to the encrypted main directory of the first account are obtained through the obtained second account and the second password. Therefore, the user does not need to remember the second account and the second password to access the data in the encrypted main directory of the first account. At the same time, since the second account and the second password need to be obtained based on the first account and the first password, the security of the data is also guaranteed.

[0214] After describing the first case where the first device acts as an execution subject to implement the data protection method provided in the embodiment of the present application, the following describes the second case where the first device acts as an execution subject to implement the data protection method provided in the embodiment of the present application.

[0215] See also Figure 7 , Figure 7 The embodiments of this application provide Figure 3 The flowchart of a data protection method corresponding to the embodiment shown is as follows. Figure 3 In the embodiment shown, after the first device sets a protection policy for the data in the encrypted home directory of the first account, if the external storage device is still mounted on the first device, you can follow Figure 7 The data protection method provided by the illustrated embodiment accesses or modifies data in an encrypted home directory. Figure 7 The data protection method provided by the embodiment shown is applied to Figure 3 In the first device described in the illustrated embodiment, the method includes:

[0216] In step 701, a first device receives a first account and a root key sent by a second device, wherein the root key is obtained after the first account and a first password corresponding to the first account are successfully verified.

[0217] In the embodiment of the present application, this step is consistent with the content of step 301. For details, please refer to the description of step 301 and will not be repeated here.

[0218] In step 702, when the encrypted home directory of the first account exists in the external storage device of the first device, if the first device has set authentication information for the encrypted home directory of the first account, the first device obtains the second account and the second password corresponding to the second account, and uses the second account and the second password as the authentication information of the encrypted home directory for authentication.

[0219] In the embodiment of the present application, the encrypted home directory of the first account may exist in the external storage device of the first device, or the encrypted home directory of the first account may not exist. If the encrypted home directory of the first account does not exist in the external storage device of the first device, it means that the first account logs in to the first application and connects to the first device for the first time, and the first device executes Figure 3 In steps 302 to 303 of the illustrated embodiment, if the encrypted home directory of the first account exists in the external storage device of the first device, it indicates that this is not the first time that the first account logs in to the first application to connect to the first device, and the first device executes steps 702 to 704.

[0220] Figure 3 In the embodiment shown, what kind of data protection policy is set for the encrypted home directory of the first account? Accordingly, when it is necessary to access or modify the data in the encrypted home directory, it is necessary to obtain corresponding permissions based on what kind of data protection policy to access or modify the data in the encrypted home directory.

[0221] like Figure 3 In the embodiment shown, the protection policy set for the data in the home directory of the first account in the storage device includes: an access control policy for the encrypted home directory and an encryption and decryption policy for the data in the encrypted home directory. Figure 3 In the first device shown, the first device has set the authentication information corresponding to the access control policy for the encrypted home directory of the first account. Therefore, the first device needs to obtain the second account and the second password, and use the second account and the second password as the authentication information of the encrypted home directory for authentication.

[0222] The user can enter the second account and the second password in the first application of the second device, and the second device sends the second account and the second password to the first device. Of course, the first device can also decrypt and obtain the second account and the second password from the external storage device.

[0223] Step 703: After the second account and the second password are successfully authenticated, if the first device receives a data access request or a data modification request for the encrypted home directory of the first account sent by the second device, the first device responds to the received data access request or data modification request based on the root key.

[0224] In this embodiment of the present application, after the second account and second password are successfully authenticated, access to the first account's encrypted home directory has been granted. Therefore, the first application on the second device can display the first account's encrypted home directory and the files in the encrypted home directory. However, the files in the encrypted home directory are stored in ciphertext. The pre-set encryption and decryption policy for data in the encrypted home directory is: data in the encrypted home directory is encrypted and decrypted based on the root key.

[0225] When a user needs to access files in the encrypted home directory, the user can execute the operation of opening the files in the displayed encrypted home directory in the first application of the second device. After receiving the user's corresponding operation, the second device sends a data access request to the first device. After receiving the data access request, the first device can decrypt the corresponding file based on the root key of the encrypted home directory of the first account and open the file.

[0226] Similarly, when a user needs to create new data in the encrypted home directory of the first account, the user can perform the operation of creating new data in the encrypted home directory displayed by the first application on the second device. The second device sends a data creation request for the encrypted home directory of the first account and the data to be created to the first device. After the first device receives the data creation request for the encrypted home directory of the first account and the data to be created, the first device creates the data in the encrypted home directory of the first account on the external storage device and encrypts the newly created data based on the root key.

[0227] When the user needs to perform other modification operations on the data in the encrypted home directory of the first account, the user can perform the data modification operation in the encrypted home directory displayed by the first application on the second device. The second device sends a data modification request for the encrypted home directory of the first account to the first device. After the first device receives the data modification request for the encrypted home directory of the first account, the first device decrypts the data to be modified based on the root key, performs the corresponding modification operation, and encrypts the modified data.

[0228] It should be noted that the above-described modification of data in the encrypted master directory is for illustrative purposes only. In actual applications, the data modification process may differ from the above-described one. In the embodiment of the present application, during the modification operation corresponding to the first device's response to the data modification request, data encryption and decryption are implemented based on the root key. Furthermore, modification of data in the encrypted master directory is not limited to creation, copying, cutting, pasting, and deletion, but may also include other data modification operations, such as editing documents stored in the encrypted master directory or processing images stored in the encrypted master directory.

[0229] Step 704: After the first device receives the logout information of the first account, the first device locks the encrypted home directory of the first account.

[0230] In an embodiment of the present application, if the user logs out of the first account in the first application of the second device or the login of the first account times out (for example, when the first account is logged in, the first application runs in the background for more than a preset time; when the first account is logged in, the time interval between the last detection of the user operating the display interface of the first application exceeds a preset time), the second device sends the logout information of the first account to the first device. After the first device receives the logout information of the first account, the first device locks the encrypted home directory of the first account. The encrypted home directory of the first account can be locked based on the access control policy, and the root key in the first device is cleared based on the data encryption and decryption policy.

[0231] In an embodiment of the present application, if the external storage device is still mounted on the first device, or the external storage device is disconnected from the first device and then re-mounted on the first device, since the access control policy of the first account's home directory is configured on the first device, when the user needs to access or modify the data in the encrypted home directory of the first account, the user needs to obtain access rights to the encrypted home directory of the first account based on the access control policy; and since the data in the encrypted home directory of the first account is stored in ciphertext form on the external storage device based on the data encryption and decryption policy, when the user needs to access or modify the encrypted home directory of the first account, the user also needs to obtain the root key of the encrypted home directory of the first account, so as to encrypt and decrypt the data in the encrypted home directory based on the root key of the encrypted home directory of the first account.

[0232] As another embodiment of the present application, when the encrypted home directory of the first account exists in the external storage device of the first device, the method further includes:

[0233] The first device decrypts the master key of the encrypted home directory of the first account from the external storage device based on the root key;

[0234] The first device sets the master key of the encrypted home directory of the first account in the system kernel of the first device.

[0235] Correspondingly, in step 703, the first device responds to the received data access request or data modification request based on the root key, including: the first device responds to the received data access request or data modification request based on the master key in the system kernel.

[0236] In step 704, the first device locks the encrypted home directory of the first account, including: the first device clearing the master key in the system kernel.

[0237] As another embodiment of the present application, the first device decrypts the master key of the encrypted home directory of the first account from the external storage device based on the root key, including:

[0238] The first device parses the encrypted information in the key file stored in the external storage device using the root key to obtain the master key of the encrypted home directory of the first account.

[0239] In the embodiments of the present application, based on Figure 4 In the data encryption and decryption strategy shown, the first device can decrypt the first account's encrypted home directory from an external storage device based on the root key; the first device sets the first account's encrypted home directory's master key in the system kernel of the first device; the user sends a data access request or data modification request to the first device through the first application in the second device, and the first device automatically derives a corresponding working key based on the master key in the system kernel, decrypts the data to be accessed or modified using the working key, and encrypts the data again after the access or modification is completed. When the user logs out of the first account in the first application on the second device, the second device sends a logout message to the first device. After the first device receives the logout message from the first account, the first device can clear the master key in the system kernel, meaning that the first device no longer has encryption and decryption permissions for the data in the first account's encrypted home directory.

[0240] Of course, if in the pre-set data encryption and decryption strategy, the master key of the encrypted home directory of the first account is encrypted and stored in the key file of the first account in the external storage device, the first device parses the encrypted information in the key file stored in the external storage device through the root key to obtain the master key of the encrypted home directory of the first account.

[0241] For a clearer understanding of the process of accessing or modifying data in an encrypted home directory based on pre-set data protection policies, see Figure 8 , Figure 8 The timing diagram of another data protection method provided by the embodiment of the present application is shown in the figure. The storage device in the figure can be used as an external storage device of the first device. Before the first device receives the root key sent by the second device, it can refer to Figure 6 The relevant description of the timing diagram shown is not repeated here. After the first device receives the root key sent by the second device, the first device decrypts the key file of the first account based on the root key, obtains the master key of the encrypted main directory of the first account, and sets the master key in the system kernel of the first device. The user enters the second account and second password through the first application of the second device; the second device sends the second account and second password entered by the user as authentication information to the first device; after the first device successfully authenticates the second account and second password, it obtains the data access request or data modification request sent by the user through the first application of the second device, and encrypts or decrypts the data in the encrypted main directory based on the master key in the system kernel, and performs corresponding data access or modification operations at the same time.

[0242] Of course, after the first device receives the exit information of the first account sent by the second device, the first device clears the master key in the system kernel of the first device and locks the encrypted home directory of the first account.

[0243] As another embodiment of the present application, the root key is generated by a root key material, the root key material includes at least two sub-parts, and one of the sub-parts is a verification sub-part.

[0244] Correspondingly, the first device receiving the first account and the root key sent by the second device includes:

[0245] The first device receives the first account and the verification sub-portion of the root key material sent by the second device, wherein the verification sub-portion of the root key material is obtained after the first account and the first password corresponding to the first account are successfully verified.

[0246] As another embodiment of the present application, when the root key material includes a local sub-part, before the first device responds to the received data access request or data modification request based on the root key, the method further includes:

[0247] The first device obtains a local sub-portion of the root key material from the external storage device.

[0248] When the root key material includes an application sub-portion, before the first device responds to a received data access request or data modification request based on the root key, the following further comprises:

[0249] The first device obtains, from the second device, an application sub-portion of the root key material stored in a first application of the second device.

[0250] In an embodiment of the present application, before the first device performs related operations based on the root key of the encrypted home directory of the first account, it is necessary to obtain the various sub-parts of the root key material, and after obtaining the various sub-parts of the root key material, it is also necessary to generate a root key based on the various sub-parts of the root key material.

[0251] It should be noted that in actual applications, when setting a protection strategy for encrypting data in the main directory, a certain number of sub-parts are set for the root key material. Accordingly, in the data access stage or the data modification stage, a certain number of sub-parts of the root key material need to be obtained to generate the root key.

[0252] As another embodiment of the present application, when accessing or modifying data in the encrypted home directory of the first account, the user can enter the previously set second account and second password in the first application of the second device to obtain access rights to the encrypted home directory, or the first device can decrypt the second account and second password from the external storage device based on the root key to obtain access rights to the encrypted home directory.

[0253] Of course, if the pre-setting is to require the user to manually enter the second account and the second password, the user can still retrieve the second account and the second password after forgetting the second account and the second password.

[0254] For example, in response to a request to retrieve the second password corresponding to the second account, the first device decrypts the second account and the second password corresponding to the second account from the external storage device based on the root key, and sends the second account and the second password corresponding to the second account to the second device. Figure 9 The embodiment shown provides a method for retrieving the second account and the second password. Figure 9 The storage device in can serve as an external storage device of the first device.

[0255] After describing the first and second situations in which the first device acts as an execution subject to implement the data protection method provided in the embodiment of the present application, the third device acts as an execution subject to implement the data protection method provided in the embodiment of the present application.

[0256] See also Figure 10 , Figure 10 The embodiments of this application provide Figure 3 The flowchart of a data protection method corresponding to the embodiment shown is as follows. Figure 3 In the embodiment shown, after the first device sets a protection policy for the data in the encrypted home directory of the first account, if the external storage device is disconnected from the first device and mounted on another electronic device, it can be set according to Figure 10 The data protection method provided by the illustrated embodiment accesses or modifies data in an encrypted home directory. Figure 10 The data protection method provided by the embodiment shown is applied to Figure 3 For another electronic device other than the first device described in the illustrated embodiment, the other electronic device is referred to as a third device. The method includes:

[0257] Step 1001: In response to a first account and a first password corresponding to the first account received through a second application, a third device sends the first account and the first password corresponding to the first account to a preset server.

[0258] In this embodiment of the present application, the third device has not configured an access control policy for the first account, and the Samba service program may not be loaded on the third device. A second application may be installed on the third device. The first application and the second application are application software for different electronic devices. When the third device and the second device are the same, the first application and the second application may be the same application software.

[0259] For example, when a storage device is mounted on a router (first device), a mobile phone (second device) establishes a wireless connection with the router, and the user can access the data in the encrypted main directory of the first account in the external storage device of the router through the first application on the mobile phone (second device); when the storage device leaves the first device and is mounted on the mobile phone (third device), the user can also access the data in the encrypted main directory of the first account in the external storage device of the mobile phone through the second application (which may be the same as the first application) on the mobile phone (third device).

[0260] If the corresponding second application is installed on the third device, the user can enter the first account and the first password corresponding to the first account on the second application of the third device, and the third device sends the first account and the first password to the preset server to instruct the preset server to verify the first account and the first password.

[0261] In step 1002 , the third device receives a root key sent by the preset server after the first account and the first password are successfully verified.

[0262] In the embodiment of the present application, the process of obtaining the root key after the preset server verifies the first account and the first password can refer to the relevant description in step 301, which is not repeated here. The root key obtained by the third device is the same as the root key obtained by the first device when the first account is registered.

[0263] In step 1003, when the encrypted home directory of the first account exists in the external storage device of the third device and the third device has not set authentication information for the encrypted home directory of the first account, if the third device receives a data access request or a data modification request for the encrypted home directory of the first account, the third device responds to the received data access request or data modification request based on the root key.

[0264] In an embodiment of the present application, since the access control policy of the first account does not exist in the third device, when the storage device is mounted on the third device, there is no Samba protocol access barrier to the data in the encrypted home directory of the first account. However, the data in the encrypted home directory of the first account is stored in ciphertext. Therefore, if the user needs to access or modify the data in the encrypted home directory of the first account, it is not necessary to use the second account and the second password as authentication information for authentication, but it is necessary to encrypt and decrypt the data based on the root key. The user can perform access or modification operations on the data in the encrypted home directory of the first account in the second application of the third device to issue an access request or modification request. The process of the third device responding to the received data access request or data modification request based on the root key can refer to the relevant description in step 703 and will not be repeated here.

[0265] Step 1004: After the third device receives the logout information of the first account, the third device locks the encrypted home directory of the first account.

[0266] Before the third device receives the logout information of the first account, the third device does not allow other accounts except the first account to log in to the second application of the third device.

[0267] In the embodiment of the present application, the contents of step 1004 are similar to those of step 704 , and for details, please refer to the relevant description in step 704 .

[0268] Furthermore, since the third device is not configured with an access control policy for the first account's encrypted home directory, it is equivalent to not setting an access barrier for each first account's encrypted home directory on the external storage device. When two first accounts are logged into the third device's second application, the third device obtains the root key a for first account A's encrypted home directory and the root key b for second account B's encrypted home directory. Since there are no access barriers to first account A's encrypted home directory or to first account B's encrypted home directory on the third device, a user logging into the third device's second application using first account A can view the data in first account B's encrypted home directory. Similarly, a user logging into the third device's second application using first account B can also view the data in first account A's encrypted home directory. When a user requests data access or modification in first account B's encrypted home directory using first account A, the third device can decrypt the data in first account B's encrypted home directory using the obtained root key for first account B. To avoid this phenomenon, the third device can be configured to prevent accounts other than the first account from logging into the third device's second application until it receives a logout message from the first account. This means that the third device's second application cannot allow two first accounts to be logged into simultaneously. During the specific implementation process, it can be set as follows: when a first account is logged in in the second application of the third device, if the second application of the third device receives a login request from another first account, the login request from the other first account will be rejected; or the first account currently logged in will be controlled to log out, and a response will be given to the newly received login request from the other first account.

[0269] If the second application of the third device only allows one first account to be logged in at the same time, then the third device only has the root key of the current login state, and can only accept access or modification requests for the encrypted main directory issued by the first account in the current login state. Therefore, the first account in the login state can only access or modify the data in the encrypted main directory of the first account in the current login state; thereby ensuring that even if the storage device is mounted on an electronic device other than the first device, users cannot arbitrarily access the data in each other's encrypted main directory, thereby improving the security of the data in the storage device.

[0270] As another embodiment of the present application, when the encrypted home directory of the first account exists in the external storage device of the third device, the method further includes:

[0271] The third device decrypts the master key of the encrypted home directory of the first account from the external storage device based on the root key;

[0272] The third device sets the master key of the encrypted home directory of the first account in the system kernel of the third device.

[0273] Accordingly, in step 1003, the third device responding to the received data access request or data modification request based on the root key includes: the third device responding to the received data access request or data modification request based on the master key in the system kernel;

[0274] Correspondingly, in step 1004, the third device locking the encrypted home directory of the first account includes: the third device clearing the master key in the system kernel.

[0275] As another embodiment of the present application, when the master key of the encrypted home directory of the first account is encrypted and stored in the key file of the first account in the external storage device, the third device parses the encrypted information in the key file stored in the external storage device through the root key to obtain the master key of the encrypted home directory of the first account.

[0276] In the embodiments of the present application, the manner in which the third device obtains the master key of the encrypted home directory of the first account, the manner in which the third device responds to a received data access request or data modification request, and the manner in which the third device locks the encrypted home directory of the first account can refer to the manner in which the first device obtains the master key of the encrypted home directory of the first account, the manner in which the first device responds to a received data access request or data modification request, and the manner in which the first device locks the encrypted home directory of the first account. These details will not be repeated here.

[0277] In order to have a clearer understanding of the process of the third device accessing or modifying the data in the encrypted home directory based on the data protection policy pre-set on the first device, refer to Figure 11A timing diagram of a data protection method is shown. As shown in the figure, the storage device in the figure can serve as an external storage device of a third device. A user can log in to the corresponding application software (second application) on the third device. The user enters the first account and first password in the second application of the third device. The third device sends the first account and first password to the server. The server verifies the received first account and first password. After successful verification, it generates a root key and sends the generated root key to the third device. After receiving the root key, the third device decrypts the key file of the first account based on the root key to obtain the master key of the encrypted home directory of the first account. The third device sets the master key in the system kernel of the third device. The user issues a data access request or data modification request through the second application on the third device. The third device encrypts or decrypts the data based on the master key in the system kernel and performs the corresponding data access operation or data modification operation. After the user issues a logout request through the second application on the third device, the third device sends the logout information of the first account to the server, simultaneously clears the master key in the system, and locks the encrypted home directory.

[0278] From this sequence diagram, it can be understood that if two first accounts are logged in at the same time in the third device, the master keys of the encrypted home directories of the two first accounts will exist in the system kernel of the third device at the same time. At the same time, since there is no access control policy for the encrypted home directory of the first account in the third device, the two accounts can access each other's encrypted home directory. When the data in the encrypted home directory needs to be accessed or modified, the third device receives a data access request or a data modification request, and it will decrypt the corresponding data based on the corresponding master key in the system kernel and perform the corresponding operation. Therefore, if the second application of the third device allows multiple first accounts to be logged in at the same time, multiple first accounts will be able to access or modify the data in each other's encrypted home directory, and the data in the encrypted home directory cannot be protected. Therefore, it is necessary to set the third device to not allow other accounts other than the first account to log in to the second application of the third device before receiving the logout information of the first account.

[0279] As another embodiment of the present application, the root key is generated by a root key material, the root key material includes at least two sub-parts, and one of the sub-parts is a verification sub-part.

[0280] The third device receives the root key sent by the preset server after the first account and the first password are successfully verified, including:

[0281] The third device receives the verification sub-part of the root key material sent by the preset server after the first account and the first password are successfully verified.

[0282] Before the third device responds to the received data access request or data modification request based on the root key, the method further includes: the third device obtaining a local sub-portion of the root key material from the external storage device.

[0283] Before the third device responds to the received data access request or data modification request based on the root key, the method further includes: the third device obtains an application sub-portion of the root key material stored in the second application of the third device.

[0284] In the embodiment of the present application, the process of the third device obtaining the various sub-parts of the root key material can refer to the process of the first device obtaining the various sub-parts of the root key material, and will not be repeated here.

[0285] It should be noted that in actual applications, if the preset server can obtain the root key based on the first account and the first password, the root key is no longer generated by the root key material; if the preset server can obtain the complete root key material based on the first account and the first password, the root key is generated by the root key material; if the preset server can obtain one sub-part of the root key material based on the first account and the first password, the root key is generated by the various sub-parts of the root key material. Before the first device or the third device generates the root key from the various sub-parts of the root key material, it is also necessary to obtain other sub-parts of the root key material.

[0286] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0287] The embodiment of the present application can divide the functional modules of the first device according to the above method example. For example, each functional module can be divided corresponding to each function, or two or more functions can be integrated into one processing module. The above integrated modules can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiment of the present application is schematic and is only a logical functional division. There may be other division methods in actual implementation. The following is an example of dividing each functional module corresponding to each function:

[0288] Reference Figure 12 , the first device 1200 supports information service block service, and the first device 1200 includes:

[0289] The root key receiving unit 1201 is configured to receive a first account and a root key sent by a second device, wherein the root key is obtained after the first account and a first password corresponding to the first account are successfully verified;

[0290] a home directory creation unit 1202 configured to create an encrypted home directory for the first account in the external storage device of the first device when the encrypted home directory of the first account does not exist, wherein the data in the encrypted home directory of the first account is encrypted and decrypted based on the root key;

[0291] The authentication information setting unit 1203 is used to receive the second account and the second password corresponding to the second account sent by the second device, and set the second account and the second password as the authentication information of the encrypted home directory of the first account when the external storage device is mounted on the first device.

[0292] As another embodiment of the present application, the first device 1200 further includes:

[0293] The master key setting unit 1204 is used to generate a master key for the encrypted home directory of the first account, and set the master key of the encrypted home directory of the first account in the system kernel of the first device; the master key of the encrypted home directory of the first account is encrypted and stored in an external storage device, wherein the root key is used to decrypt and obtain the encrypted master key stored in the external storage device, and the data in the encrypted home directory of the first account is encrypted and decrypted based on the master key.

[0294] As another embodiment of the present application, the master key setting unit 1204 is further configured to:

[0295] A key file of the first account is created in an external storage device; and a master key of the encrypted home directory of the first account is encrypted and stored in the key file of the first account.

[0296] As another embodiment of the present application, the root key is generated by a root key material, the root key material includes at least two sub-parts, and one of the sub-parts is a verification sub-part;

[0297] Correspondingly, the root key receiving unit 1201 is further configured to:

[0298] A first account and a verification sub-portion of the root key material sent by the second device are received, wherein the verification sub-portion of the root key material is obtained after the first account and a first password corresponding to the first account are successfully verified.

[0299] As another embodiment of the present application, the root key material further includes a local sub-part; the first device 1200 further includes:

[0300] The root key generating unit 1205 is configured to generate a local sub-portion of the root key material and store the local sub-portion of the root key material in an external storage device.

[0301] As another embodiment of the present application, the root key material also includes an application sub-part stored in the first application of the second device.

[0302] As another embodiment of the present application, the authentication information setting unit 1203 is further configured to:

[0303] Receive a second account number and a second password corresponding to the second account number input by the user on the second device and sent by the second device;

[0304] Or, receive a second account number and a second password corresponding to the second account generated by the second device and sent by the second device.

[0305] As another embodiment of the present application, the first device 1200 further includes:

[0306] The authentication information storage unit 1206 is configured to encrypt and store the second account number and the second password in an external storage device, wherein the second account number and the second password are obtained by decryption based on the root key.

[0307] As a schematic diagram of another functional module architecture of a first device, the first device 1200 includes:

[0308] The root key receiving unit 1201 is configured to receive a first account and a root key sent by a second device, wherein the root key is obtained after the first account and a first password corresponding to the first account are successfully verified;

[0309] An authentication information obtaining unit 1207 is configured to, when an encrypted home directory of a first account exists in an external storage device of the first device, obtain a second account and a second password corresponding to the second account if the first device has set authentication information for the encrypted home directory of the first account, and use the second account and the second password as authentication information for authentication of the encrypted home directory;

[0310] The data access modification unit 1208 is configured to respond to a data access request or data modification request for the encrypted home directory of the first account based on the root key if the second device receives a data access request or data modification request for the encrypted home directory of the first account after the second account and the second password are successfully authenticated.

[0311] The data locking unit 1209 is configured to lock the encrypted home directory of the first account after receiving the logout information of the first account.

[0312] As another embodiment of the present application, the first device 1200 further includes:

[0313] The master key acquisition unit 1210 is configured to decrypt the first account's encrypted home directory from the external storage device based on the root key and set the first account's encrypted home directory's master key in the system kernel of the first device.

[0314] Accordingly, the access or modification data unit 1208 is further used to:

[0315] Responding to a data access request or a data modification request based on a master key in the system kernel;

[0316] The data locking unit 1209 is further configured to clear the master key in the system kernel.

[0317] As another embodiment of the present application, the master key obtaining unit 1210 is further configured to:

[0318] The encrypted information in the key file stored in the external storage device is parsed using the root key to obtain the master key of the encrypted home directory of the first account.

[0319] As another embodiment of the present application, the root key is generated by a root key material, the root key material includes at least two sub-parts, and one of the sub-parts is a verification sub-part;

[0320] The root key receiving unit 1201 is further configured to receive a first account and a verification sub-portion of the root key material sent by the second device, wherein the verification sub-portion of the root key material is obtained after the first account and the first password corresponding to the first account are successfully verified.

[0321] As another embodiment of the present application, the root key material further includes a local sub-part;

[0322] The first device 1200 further includes:

[0323] The root key obtaining unit 1211 is configured to obtain a local sub-portion of the root key material from an external storage device.

[0324] It is also used to obtain, from the second device, an application sub-portion of the root key material stored in the first application of the second device.

[0325] As another embodiment of the present application, the authentication information obtaining unit 1207 is further configured to:

[0326] Receive a second account number and a second password corresponding to the second account number input by the user on the second device and sent by the second device;

[0327] Alternatively, the second account number and the second password corresponding to the second account number are decrypted from the external storage device based on the root key.

[0328] As another embodiment of the present application, the first device 1200 further includes:

[0329] The authentication information retrieval unit 1212 is used to respond to the received retrieval request for the second password corresponding to the second account, decrypt the second account and the second password corresponding to the second account from the external storage device based on the root key, and send the second account and the second password corresponding to the second account to the second device.

[0330] It should be noted that the information interaction, execution process, etc. between the above-mentioned first devices / units are based on the same concept as the method embodiment of this application. Their specific functions and technical effects can be found in the method embodiment section and will not be repeated here.

[0331] The embodiment of the present application can divide the functional modules of the third device according to the above method example. For example, each functional module can be divided corresponding to each function, or two or more functions can be integrated into one processing module. The above integrated modules can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiment of the present application is schematic and is only a logical functional division. There may be other division methods in actual implementation. The following is an example of dividing each functional module corresponding to each function:

[0332] Reference Figure 13 , the third device 1300 includes:

[0333] The first account receiving unit 1301 is configured to send the first account and the first password corresponding to the first account to a preset server in response to the first account and the first password corresponding to the first account received through the second application;

[0334] The root key receiving unit 1302 is configured to receive the root key sent by the preset server after the first account and the first password are successfully verified;

[0335] The data access modification unit 1303 is configured to respond to a data access request or data modification request for the first account's encrypted home directory based on the root key when the third device receives a data access request or data modification request for the first account's encrypted home directory, if the third device has not set authentication information for the first account's encrypted home directory in the external storage device of the third device.

[0336] The data locking unit 1304 is configured to lock the encrypted home directory of the first account after receiving the logout information of the first account;

[0337] Before the third device receives the logout information of the first account, other accounts other than the first account are not allowed to log in to the second application of the third device.

[0338] As another embodiment of the present application, the third device 1300 further includes:

[0339] The master key acquisition unit 1305 is configured to decrypt the first account's encrypted home directory from the external storage device based on the root key and set the first account's encrypted home directory's master key in the system kernel of the third device.

[0340] Accordingly, the data access modification unit 1303 is further configured to:

[0341] Responding to received data access requests or data modification requests based on a master key in the system kernel;

[0342] The data locking unit 1304 is further configured to clear the master key in the system kernel.

[0343] As another embodiment of the present application, the master key obtaining unit 1305 is further configured to:

[0344] The encrypted information in the key file stored in the external storage device is parsed using the root key to obtain the master key of the encrypted home directory of the first account.

[0345] As another embodiment of the present application, the root key is generated by a root key material, the root key material includes at least two sub-parts, and one of the sub-parts is a verification sub-part.

[0346] The root key receiving unit 1302 is further configured to receive a verification sub-part of the root key material sent by the preset server after the server successfully verifies the first account and the first password.

[0347] As another embodiment of the present application, the root key material further includes a local sub-part; the third device 1300 further includes:

[0348] The root key obtaining unit 1306 is configured to obtain a local sub-portion of the root key material from an external storage device.

[0349] An application sub-portion of the root key material stored in the second application of the third device is obtained.

[0350] It should be noted that the information interaction, execution process, etc. between the above-mentioned third devices / units are based on the same concept as the method embodiment of this application. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0351] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the division of the above-mentioned functional units is used as an example for illustration. In actual applications, the above-mentioned functions can be distributed and completed by different functional units as needed, that is, the internal structure of the first device / third device can be divided into different functional units to complete all or part of the functions described above. The functional units in the embodiment can be integrated into one processing unit, or each unit can exist physically alone, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units are only for the convenience of distinguishing each other and are not used to limit the scope of protection of this application. The specific working process of the units in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0352] An embodiment of the present application further provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments can be implemented.

[0353] An embodiment of the present application further provides a computer program product. When the computer program product is run on a first device, the first device can implement the steps in the above-mentioned various method embodiments.

[0354] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and when the computer program is executed by the processor, it can implement the steps of the above-mentioned various method embodiments. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include at least: any entity or device capable of carrying the computer program code to the first device, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electric carrier signal, a telecommunication signal and a software distribution medium. For example, a USB flash drive, a mobile hard disk, a magnetic disk or an optical disk. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electric carrier signals and telecommunication signals.

[0355] The present application also provides a chip system, comprising a processor coupled to a memory, the processor executing a computer program stored in the memory to implement the steps of any method embodiment of the present application. The chip system can be a single chip or a chip module composed of multiple chips.

[0356] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant description of other embodiments.

[0357] Those skilled in the art will appreciate that the units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0358] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present application, and should all be included in the scope of protection of the present application.

Claims

1. A data protection method, characterized in that: Applied to a first device supporting an information service block service, the method includes: The first device receives a first account and a root key sent by the second device, wherein the root key is obtained after the first account and a first password corresponding to the first account are successfully verified; When the encrypted home directory of the first account does not exist in the external storage device of the first device, the first device creates an encrypted home directory for the first account in the external storage device, wherein data in the encrypted home directory of the first account is encrypted and decrypted based on the root key; The first device receives the second account and the second password corresponding to the second account sent by the second device, and sets the second account and the second password as authentication information of the encrypted home directory of the first account when the external storage device is mounted on the first device; The root key is generated by a root key material, the root key material includes at least two sub-parts, and one of the sub-parts is a verification sub-part, The first device receiving the first account and the root key sent by the second device includes: The first device receives the first account and the verification sub-part of the root key material sent by the second device, wherein the verification sub-part of the root key material is obtained after the first account and a first password corresponding to the first account are successfully verified.

2. The method according to claim 1, wherein After the first device creates an encrypted home directory for the first account in the external storage device, the method further includes: The first device generates a master key for the encrypted home directory of the first account, and sets the master key for the encrypted home directory of the first account in a system kernel of the first device; The first device encrypts and stores the master key of the encrypted home directory of the first account in the external storage device, wherein the root key is used to decrypt and obtain the master key encrypted and stored in the external storage device, and the data in the encrypted home directory of the first account is encrypted and decrypted based on the master key.

3. The method according to claim 2, wherein The first device encrypting and storing the master key of the encrypted home directory of the first account in the external storage device includes: The first device creates a key file of the first account in the external storage device; The first device encrypts and stores the master key of the encrypted home directory of the first account in the key file of the first account.

4. The method according to claim 1, wherein The root keying material also includes a local sub-portion; When the encrypted home directory of the first account does not exist in the external storage device of the first device, the method further includes: The first device generates a local sub-portion of the root keying material and stores the local sub-portion of the root keying material in the external storage device.

5. The method according to claim 1, wherein The root keying material also includes an application sub-portion stored in the first application of the second device.

6. The method according to claim 1, wherein The first device receiving the second account and the second password corresponding to the second account sent by the second device includes: The first device receives, from the second device, a second account number and a second password corresponding to the second account number entered by a user on the second device; or, The first device receives, from the second device, a second account number generated by the second device and a second password corresponding to the second account number.

7. The method according to claim 6, wherein After the first device receives the second account and the second password corresponding to the second account sent by the second device, the method further includes: The first device encrypts and stores the second account and the second password in the external storage device, wherein the second account and the second password are obtained by decryption based on the root key.

8. A data protection method, characterized in that: Applied to a first device supporting an information service block service, the method includes: The first device receives a first account and a root key sent by the second device, wherein the root key is obtained after the first account and a first password corresponding to the first account are successfully verified; When the encrypted home directory of the first account exists in the external storage device of the first device, if the first device has set authentication information for the encrypted home directory of the first account, the first device obtains a second account and a second password corresponding to the second account, and uses the second account and the second password as the authentication information for the encrypted home directory for authentication; After the second account and the second password are successfully authenticated, if the first device receives a data access request or a data modification request for the encrypted home directory of the first account from the second device, the first device responds to the received data access request or data modification request based on the root key; After the first device receives the logout information of the first account, the first device locks the encrypted home directory of the first account; The root key is generated by a root key material, the root key material includes at least two sub-parts, and one of the sub-parts is a verification sub-part, The first device receiving the first account and the root key sent by the second device includes: The first device receives the first account and the verification sub-part of the root key material sent by the second device, wherein the verification sub-part of the root key material is obtained after the first account and a first password corresponding to the first account are successfully verified.

9. The method according to claim 8, wherein When the encrypted home directory of the first account exists in the external storage device of the first device, the method further includes: The first device decrypts the external storage device based on the root key to obtain a master key of the encrypted home directory of the first account; The first device sets the master key of the encrypted home directory of the first account in the system kernel of the first device; Accordingly, the first device responding to the received data access request or data modification request based on the root key includes: The first device responds to the received data access request or data modification request based on the master key in the system kernel; The first device locking the encrypted home directory of the first account includes: The first device clears the master key in the system kernel.

10. The method according to claim 9, wherein The first device decrypting the first account's encrypted home directory from the external storage device based on the root key includes: The first device parses the encrypted information in the key file stored in the external storage device using the root key to obtain the master key of the encrypted home directory of the first account.

11. The method according to claim 9, wherein The root keying material also includes a local sub-portion; Before the first device responds to the received data access request or data modification request based on the root key, the method further includes: The first device obtains a local sub-portion of the root keying material from the external storage device.

12. The method according to claim 9, wherein Before the first device responds to the received data access request or data modification request based on the root key, the method further includes: The first device obtains, from the second device, an application sub-portion of the root key material stored in a first application of the second device.

13. The method according to claim 9, wherein The first device acquiring the second account and the second password corresponding to the second account includes: The first device receives, from the second device, a second account number and a second password corresponding to the second account number entered by a user on the second device; or, The first device decrypts and obtains the second account and a second password corresponding to the second account from the external storage device based on the root key.

14. The method according to claim 9, wherein When the encrypted home directory of the first account exists in the external storage device of the first device, the method further includes: In response to a received request to retrieve the second password corresponding to the second account, the first device decrypts the second account and the second password corresponding to the second account from the external storage device based on the root key, and sends the second account and the second password corresponding to the second account to the second device.

15. A data protection method, characterized in that: include: In response to the first account and the first password corresponding to the first account received through the second application, the third device sends the first account and the first password corresponding to the first account to a preset server; The third device receives the root key sent by the preset server after successfully verifying the first account and the first password; When the encrypted home directory of the first account exists in the external storage device of the third device and the third device has not set authentication information for the encrypted home directory of the first account, if the third device receives a data access request or a data modification request for the encrypted home directory of the first account, the third device responds to the received data access request or data modification request based on the root key; After the third device receives the logout information of the first account, the third device locks the encrypted home directory of the first account; Before the third device receives the logout information of the first account, the third device does not allow other accounts except the first account to log in to the second application of the third device; The root key is generated by a root key material, the root key material includes at least two sub-parts, and one of the sub-parts is a verification sub-part, The third device receiving the root key sent by the preset server after the first account and the first password are successfully verified includes: The third device receives the verification sub-part of the root key material sent by the preset server after successfully verifying the first account and the first password.

16. The method according to claim 15, wherein When the encrypted home directory of the first account exists in the external storage device of the third device, the method further includes: The third device decrypts the external storage device based on the root key to obtain the master key of the encrypted home directory of the first account; The third device sets the master key of the encrypted home directory of the first account in the system kernel of the third device; Accordingly, the third device responding to the received data access request or data modification request based on the root key includes: The third device responds to the received data access request or data modification request based on the master key in the system kernel; The third device locking the encrypted home directory of the first account includes: The third device clears the master key in the system kernel.

17. The method according to claim 16, wherein The third device decrypting the external storage device based on the root key to obtain the master key of the encrypted home directory of the first account includes: The third device parses the encrypted information in the key file stored in the external storage device using the root key to obtain the master key of the encrypted home directory of the first account.

18. The method according to claim 15, wherein The root keying material also includes a local sub-portion; Before the third device responds to the received data access request or data modification request based on the root key, the third device further includes: The third device obtains a local sub-portion of the root keying material from the external storage device.

19. The method according to claim 15, wherein Before the third device responds to the received data access request or data modification request based on the root key, the method further includes: The third device obtains an application sub-portion of the root key material stored in a second application of the third device.

20. An electronic device, characterized in that: The electronic device includes a processor configured to run a computer program stored in a memory to implement the method according to any one of claims 1 to 7 and / or the method according to any one of claims 8 to 14, or the method according to any one of claims 15 to 19.

21. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which, when executed on a processor, implements the method according to any one of claims 1 to 7 and / or the method according to any one of claims 8 to 14, or the method according to any one of claims 15 to 19.

Images