A data protection method, apparatus, device, and storage medium

Abstract

The application discloses a data protection method, device and equipment and a storage medium, and the method comprises the following steps: installing an application program needing data protection in a sandbox, and determining a to-be-protected file contained in the application program; determining an index value according to a serial number of a device installing the application program and the to-be-protected file, determining a target key based on the index value, and determining a target encryption algorithm based on the target key; encrypting the to-be-protected data through the target encryption algorithm, and storing the encrypted to-be-protected data into the to-be-protected file. The above technical scheme provides an isolated environment for the application program in execution, and after the target key is determined based on the index value and the target encryption algorithm is determined according to the target key, the to-be-protected data is encrypted based on the target encryption algorithm, the encrypted to-be-protected data is stored into the to-be-protected file, and the storage of the to-be-protected data is realized. The encryption protection of the data in the application program is realized without modifying the application program.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to information processing technology, and in particular, to a data protection method, device, equipment and storage medium. BACKGROUND

[0002] The rapid development of mobile Internet applications has changed the traditional business model of enterprises, improved work efficiency, but also greatly increased the possibility of facing various attacks. For Android applications, the most common security problem is whether other applications can access the data saved on the device without restriction.

[0003] In the prior art, Android applications can use user-based Linux protection mechanisms to identify and isolate applications, separate different applications, and protect applications and systems from malicious applications. Applications cannot interact with each other, and access permissions to the operating system will be limited.

[0004] Therefore, there is an urgent need for a data protection method that does not modify the application program and encrypts the data of the application program. SUMMARY

[0005] The present application provides a data protection method, device, equipment and storage medium, which encrypts the data of the application program without modifying the application program.

[0006] In a first aspect, the embodiments of the present application provide a data protection method, comprising:

[0007] Installing an application program that needs data protection in a sandbox, and determining the to-be-protected files contained in the application program;

[0008] After determining the index value according to the serial number of the device on which the application program is installed and the to-be-protected files, determining the target key based on the index value, and determining the target encryption algorithm based on the target key;

[0009] Encrypting the to-be-protected data through the target encryption algorithm, and storing the encrypted to-be-protected data into the to-be-protected files.

[0010] The embodiment of the application provides a data protection method, comprising: installing an application program requiring data protection in a sandbox, and determining a to-be-protected file contained in the application program; determining an index value according to a serial number of a device on which the application program is installed and the to-be-protected file, determining a target key based on the index value, and determining a target encryption algorithm based on the target key; encrypting to-be-protected data through the target encryption algorithm, and storing the encrypted to-be-protected data into the to-be-protected file. The technical solution has the advantages that the application program requiring data protection is first installed in the sandbox, the sandbox can provide an isolated environment for the application program in execution, and the to-be-protected file requiring data protection in the application program is determined, then the index value is determined, the target key is determined based on the index value, the target encryption algorithm is determined according to the target key, the to-be-protected data is further encrypted based on the target encryption algorithm, and the encrypted to-be-protected data is stored into the to-be-protected file, so that the storage of the to-be-protected data is realized. Without modifying the application program, the data in the application program is encrypted and protected.

[0011] Further, the target key is determined based on the index value, and the target encryption algorithm is determined based on the target key, comprising:

[0012] The target key is found in a pre-generated key lookup table based on the index value.

[0013] After the target key is decrypted to obtain a decrypted value, the target encryption algorithm is found in a pre-generated encryption algorithm lookup table based on the decrypted value.

[0014] Further, after the encrypted to-be-protected data is stored into the to-be-protected file, the method further comprises:

[0015] The encrypted to-be-protected data is decrypted based on the decrypted value and the target encryption algorithm to obtain the to-be-protected data, and the to-be-protected data is read.

[0016] Further, before the target key is found in the pre-generated key lookup table based on the index value, the method further comprises: determining the key lookup table, wherein the key lookup table comprises an encryption key lookup table and an encryption key pair lookup table.

[0017] Before the target encryption algorithm is found in the pre-generated encryption algorithm lookup table based on the decrypted value, the method further comprises: determining the encryption algorithm lookup table.

[0018] Further, when the key lookup table is an encryption key lookup table, the key lookup table is determined, comprising:

[0019] an encryption key is obtained by initializing a KeyGenerator using a secure random number generator, and performing a deterministic encryption algorithm on the encryption key.

[0020] determining the encryption key lookup table according to the encryption key set composed of the encryption key and the lookup table index;

[0021] When the key lookup table is included, determining the key lookup table comprises:

[0022] initializing a KeyPairGenerator using a secure random number generator to generate a key pair, encrypting the key pair using a deterministic encryption algorithm to obtain an encryption key pair;

[0023] determining the encryption key pair lookup table according to the encryption key pair set composed of the encryption key pair and the lookup table index.

[0024] Further, determining the to-be-protected file included in the application program comprises:

[0025] determining the configuration item of the application program, and determining the to-be-protected file according to the configuration item.

[0026] Further, the configuration item includes an encryption item, and correspondingly, determining the to-be-protected file according to the configuration item comprises:

[0027] if the encryption item is a file name of a file included in the application program, then determining the to-be-protected file according to the file name;

[0028] if the encryption item is empty, then determining all files included in the application program as the to-be-protected file.

[0029] In a second aspect, an embodiment of the present application further provides a data protection device, comprising:

[0030] a determining module, configured to install an application program requiring data protection in a sandbox, and determine a to-be-protected file included in the application program;

[0031] an executing module, configured to determine a target key based on an index value determined according to a serial number of a device on which the application program is installed and the to-be-protected file, and determine a target encryption algorithm based on the target key;

[0032] an encrypting module, configured to encrypt to-be-protected data through the target encryption algorithm, and store the encrypted to-be-protected data into the to-be-protected file.

[0033] In a third aspect, an embodiment of the present application further provides a terminal device, comprising:

[0034] one or more processors;

[0035] a storage device, configured to store one or more programs,

[0036] When the one or more programs are executed by the one or more processors, the one or more processors implement the data protection method as any of the first aspect.

[0037] In a fourth aspect, the embodiments of the present application further provide a storage medium containing computer executable instructions for executing the data protection method as any of the first aspect when executed by a computer processor.

[0038] In a fifth aspect, the present application provides a computer program product, which includes computer instructions, when the computer instructions are run on a computer, make the computer execute the data protection method provided by the first aspect.

[0039] It should be noted that the above computer instructions can be stored on a computer readable storage medium in whole or in part. The computer readable storage medium can be packaged together with the processor of the data protection device, or packaged separately from the processor of the data protection device, and the present application does not limit the same.

[0040] The second aspect, the third aspect, the fourth aspect and the fifth aspect of the present application can refer to the detailed description of the first aspect; and the beneficial effects of the second aspect, the third aspect, the fourth aspect and the fifth aspect can refer to the beneficial effect analysis of the first aspect, which will not be repeated here.

[0041] In the present application, the name of the above-mentioned data protection device does not constitute a limitation to the device or functional module itself, and in actual implementation, these devices or functional modules can appear with other names. As long as the functions of each device or functional module are similar to those of the present application, they belong to the scope of the present application claims and their equivalent technologies.

[0042] These aspects or other aspects of the present application will be more apparent in the following description. BRIEF DESCRIPTION OF DRAWINGS

[0043] Figure 1 A flowchart of a data protection method provided for the first embodiment of the present application;

[0044] Figure 2 A flowchart of a data protection method provided for the second embodiment of the present application;

[0045] Figure 3 A structural schematic diagram of a data protection device provided for the third embodiment of the present application;

[0046] Figure 4 A structural schematic diagram of a terminal device provided for the fourth embodiment of the present application. DETAILED DESCRIPTION

[0047] The application will be further described below in conjunction with the drawings and embodiments. It should be understood that the specific embodiments described herein are merely exemplary and are not intended to limit the present application. In addition, it should be noted that only the parts related to the present application are shown in the drawings for the convenience of description.

[0048] The term "and / or" used herein is merely used to describe an associated relationship between associated objects, and means that three relationships can exist, for example, A and / or B can mean that A exists alone, A and B exist together, and B exists alone.

[0049] The terms "first" and "second" and the like in the specification of the present application and the drawings are used to distinguish different objects or different treatments of the same object, and are not used to describe a specific order of the objects.

[0050] In addition, the terms "include" and "have" and any variations thereof mentioned in the description of the present application are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device including a series of steps or units is not limited to the listed steps or units, but can optionally include other steps or units not listed or other steps or units inherent to the process, method, product or device.

[0051] Before the example embodiments are discussed in more detail, it should be mentioned that some example embodiments are described as processes or methods depicted as flowcharts. Although the flowcharts describe the operations (or steps) as sequential processes, many of the operations can be implemented in parallel, concurrently or simultaneously. In addition, the order of the operations can be rearranged. The processes can be terminated when their operations are completed, but can also have additional steps not included in the drawings. The processes can correspond to methods, functions, procedures, subroutines, etc. In addition, the embodiments and features in the embodiments can be combined with each other without conflict.

[0052] It should be noted that in the embodiments of the present application, the words "exemplary" or "for example" are used to mean serving as an example, instance, or illustration. Any embodiment or design presented as "exemplary" or "for example" in the embodiments of the present application should not be construed as being more preferred or advantageous than other embodiments or designs. Rather, the use of "exemplary" or "for example" is intended to present concepts in a concrete manner.

[0053] In the description of the present application, the meaning of "a plurality of" is two or more, unless otherwise specified.

[0054] Embodiment one

[0055] Figure 1 A flow chart of a data protection method provided for the first embodiment of the present application, the embodiment can be applied to the case of needing to encrypt the data in the application program, and the method can be executed by the data protection, and specifically includes the following steps:

[0056] Step 110, installing the application program needing data protection in the sandbox, and determining the to-be-protected files contained in the application program.

[0057] The sandbox is a mechanism for providing an isolated environment for the executing application program, and can ensure the security of the application program and the system by strictly controlling the resources accessed by the executing application program.

[0058] Specifically, the application program needing to enhance data security is installed in the sandbox, and the state of the application program in the sandbox can be dynamically detected by the Hook technology, for example, saving data and reading data. When saving data, the data can be encrypted, and when reading data, the data can be decrypted. Of course, the configuration items can also be determined through the encryption configuration interface, and the to-be-protected files and the encryption policy are determined according to the configuration items. The to-be-protected files can include part or all of the files in the application program, and the encryption policy can include symmetric encryption and asymmetric encryption.

[0059] In actual application, if the configuration items include the file name, the to-be-protected files can be determined according to the file name; if the configuration items do not include the file name, all the files contained in the application program can be determined as the to-be-protected files.

[0060] In the embodiment of the present application, for the application program needing to enhance data security, the application program does not need to be modified, and only needs to be run in the sandbox to encrypt the data saved on the device.

[0061] Step 120, determining the index value according to the serial number of the device on which the application program is installed and the to-be-protected files, determining the target key based on the index value, and determining the target encryption algorithm based on the target key.

[0062] The device can be a terminal device, for example, a computer or a mobile phone, and the terminal device can correspond to a unique serial number.

[0063] The target key after decryption can be used to determine a target encryption algorithm, and the target encryption algorithm can be used to encrypt the data to be protected. According to the foregoing configuration item, it can be determined that the target encryption algorithm can be a symmetric encryption algorithm or an asymmetric encryption algorithm, if the configured encryption strategy is symmetric encryption, the Hook method can determine an index value through the serial number and the file to be protected, and determine an encryption key based on the index value; if the configured encryption strategy is asymmetric encryption, the Hook method can determine an index value through the serial number and the file to be protected, and determine an encryption key pair based on the index value.

[0064] Hook technology is also called hook method, and the hook method is used to capture and process the execution behavior of changing and reading files.

[0065] Specifically, the serial number of the terminal device installed with the application program and the file to be protected contained in the application program can determine an index value for a lookup table, and then based on the index value, a target key can be determined in the lookup table storing the key, and the target key can be an encryption key or an encryption key pair. After the encryption key or the encryption key pair is decrypted to obtain the target key, a target encryption algorithm can be determined in the lookup table storing the encryption algorithm based on the decrypted target key.

[0066] In the embodiment of the application, the index value, the lookup table storing the key and the lookup table storing the encryption algorithm can be used to determine the target key and further determine the target encryption algorithm, thereby providing algorithm support for encrypting the data to be protected.

[0067] Step 130, encrypting the data to be protected through the target encryption algorithm, and storing the encrypted data to be protected into the file to be protected.

[0068] The target encryption algorithm can be a symmetric encryption algorithm or an asymmetric encryption algorithm.

[0069] Specifically, the data to be protected can be encrypted through the symmetric encryption algorithm or the asymmetric encryption algorithm determined as described above, that is, the file stream in the Hook is encrypted, thereby realizing the protection of the data to be protected. Of course, after the data to be protected is encrypted, the data to be protected can be stored into the file to be protected, so that the data to be protected is protected from malicious attacks or malicious reading.

[0070] In the embodiment of the application, without modifying the application program, the sandbox technology, the Hook technology and the lookup table technology are used to encrypt and protect the data saved to the local by the application program running in the sandbox, thereby realizing the encryption protection of sensitive data in the application program and improving the security of the sensitive data in the application program.

[0071] The embodiment one of the present application provides a data protection method, which comprises the following steps: installing an application program which needs data protection in a sandbox, and determining a to-be-protected file contained in the application program; determining an index value according to a serial number of a device on which the application program is installed and the to-be-protected file, determining a target key based on the index value, and determining a target encryption algorithm based on the target key; encrypting to-be-protected data through the target encryption algorithm, and storing the encrypted to-be-protected data into the to-be-protected file. The technical scheme has the advantages that the application program which needs data protection is installed in the sandbox, the sandbox can provide an isolated environment for the application program in execution, and the to-be-protected file which needs data protection in the application program is determined, then the index value is determined, the target key is determined based on the index value, the target encryption algorithm is determined according to the target key, the to-be-protected data is further encrypted based on the target encryption algorithm, and the encrypted to-be-protected data is stored into the to-be-protected file, so that the storage of the to-be-protected data is realized. The data in the application program is encrypted and protected without modifying the application program.

[0072] Embodiment two

[0073] Figure 2 A flow chart of a data protection method provided by the embodiment two of the present application is provided, and the embodiment is based on the embodiment one. As shown in the figure, the method can further comprise the following steps in the embodiment: Figure 2

[0074] Step 210: installing an application program which needs data protection in a sandbox, and determining a to-be-protected file contained in the application program.

[0075] In an implementation manner, the step 210 can specifically comprise the following steps:

[0076] installing the application program which needs data protection in the sandbox; determining a configuration item of the application program, and determining the to-be-protected file according to the configuration item.

[0077] In an implementation manner, the configuration item comprises an encryption item, and correspondingly, the step of determining the to-be-protected file according to the configuration item comprises the following steps:

[0078] if the encryption item is a file name of a file contained in the application program, then determining the to-be-protected file according to the file name; if the encryption item is empty, then determining all the files contained in the application program as the to-be-protected file.

[0079] ​Specifically, before data protection is performed on the application program, the files requiring data protection can be configured. If the encryption item of the configuration item includes the file name of the file contained in the application program, the file corresponding to the file name is determined as the file to be protected; if the encryption item of the configuration item is empty, it is determined that the encryption item is in an unconfigured state, at this time, the encryption can be performed on all the files contained in the application program by default, and then all the files contained in the application program are determined as the files to be protected.

[0080] In addition, the configuration item further includes an encryption policy, and the encryption policy can include symmetric encryption or asymmetric encryption. If the encryption policy is symmetric encryption, a target encryption algorithm is determined in a symmetric encryption algorithm lookup table based on the index value; if the encryption policy is asymmetric encryption, a target encryption algorithm is determined in an asymmetric encryption algorithm lookup table based on the index value.

[0081] In the embodiment of the application, after the application program requiring data protection is installed in the sandbox, the configuration item can be determined based on the encryption configuration interface, and the file to be protected can be determined according to the encryption item contained in the configuration item.

[0082] In step 220, after the index value is determined based on the serial number of the device on which the application program is installed and the file to be protected, a target key is determined based on the index value, and a target encryption algorithm is determined based on the target key.

[0083] In one implementation, step 220 can specifically include:

[0084] The index value is determined based on the serial number of the device on which the application program is installed and the file to be protected; a key lookup table is determined; the target key is determined by searching the pre-generated key lookup table based on the index value; an encryption algorithm lookup table is determined; after the decryption value is obtained by decrypting the target key, the target encryption algorithm is determined by searching the pre-generated encryption algorithm lookup table based on the decryption value.

[0085] The key lookup table can include an encryption key lookup table and an encryption key pair lookup table.

[0086] In one implementation, when the key lookup table includes the encryption key lookup table, the determination of the key lookup table includes:

[0087] The KeyGenerator is initialized using a secure random number generator to generate a key, the key is encrypted by a deterministic encryption algorithm to obtain an encryption key, and the encryption key lookup table is determined according to the encryption key set formed by the encryption key and the lookup table index.

[0088] In another implementation, when the key lookup table includes the encryption key pair lookup table, the determination of the key lookup table includes:

[0089] The KeyPairGenerator is initialized using the secure random number generator to generate a key pair, the key pair is encrypted by a deterministic encryption algorithm to obtain an encrypted key pair; and the encrypted key pair set formed by the encrypted key pair and a lookup table index are used to determine the encrypted key pair lookup table.

[0090] The secure random number generator can be used to encrypt a basic random number generator to provide a strong random number meeting encryption requirements. The KeyGenerator is used to generate a key. The KeyPairGenerator is used to generate a key pair.

[0091] In actual applications, the encrypted key or the encrypted key pair corresponding to the index value can be found in the encrypted key lookup table and the encrypted key pair lookup table.

[0092] It should be noted that the key lookup table can be generated before the key lookup table is found, and the encryption algorithm lookup table can be generated before the encryption algorithm lookup table is found.

[0093] Of course, the encryption algorithm can be determined to be a symmetric encryption algorithm or an asymmetric encryption algorithm through an encryption policy, and then the encryption algorithm lookup table is determined to be a symmetric encryption algorithm lookup table or an asymmetric encryption algorithm lookup table.

[0094] Table 1 is a symmetric encryption algorithm lookup table. As shown in Table 1, the index value can correspond to a unique symmetric encryption algorithm. If the encryption algorithm lookup table is a symmetric encryption algorithm lookup table, a unique symmetric encryption algorithm can be determined according to the index value.

[0095] Table 1 symmetric encryption algorithm lookup table

[0096]

[0097] Table 2 is an asymmetric encryption algorithm lookup table. As shown in Table 2, the index value can also correspond to a unique asymmetric encryption algorithm. If the encryption algorithm lookup table is an asymmetric encryption algorithm lookup table, a unique asymmetric encryption algorithm can also be determined according to the index value.

[0098] Table 2 asymmetric encryption algorithm lookup table

[0099] Index value Encryption algorithm 1 256-bit AES (such as AES256_GCM_HKDF_4KB) 2 RSA 3 Diffie Hellman 4 RSA SSA-PSS ... ... n 256-bit public key elliptic curve encryption

[0100] Specifically, after the index value is determined, the target key corresponding to the index value can be determined in the encrypted key lookup table and the encrypted key pair lookup table. The target key can be an encrypted key or an encrypted key pair. After the encrypted key or the encrypted key pair is decrypted, a decrypted value is obtained. Based on the decrypted value, an encryption algorithm corresponding to the decrypted value can be determined in the symmetric encryption algorithm lookup table or the asymmetric encryption algorithm lookup table.

[0101] In the embodiment of the present application, after the target key is determined in the key lookup table according to the index value, the decryption value is obtained by decrypting the target key, and the target algorithm is determined in the encryption algorithm lookup table according to the decryption value.

[0102] In step 230, the to-be-protected data is encrypted by the target encryption algorithm, and the encrypted to-be-protected data is stored in the to-be-protected file.

[0103] In step 240, the encrypted to-be-protected data is decrypted based on the decryption value and the target encryption algorithm to obtain the to-be-protected data, and the to-be-protected data is read.

[0104] Specifically, the decryption value obtained by decrypting the target key can also cooperate with the target encryption algorithm to decrypt the encrypted to-be-protected data to obtain the to-be-protected data, facilitating the reading of the to-be-protected data.

[0105] In the embodiment of the present application, without modifying the application program, the sandbox technology, the Hook technology and the lookup table technology are used to encrypt the to-be-protected data of the application program running in the sandbox and save it to the local, and the encrypted to-be-protected data can also be decrypted to realize reading the to-be-protected data, thereby improving the security of sensitive data in the application program.

[0106] The second embodiment of the present application provides a data protection method, which comprises: installing an application program requiring data protection in a sandbox, and determining to-be-protected files contained in the application program; determining an index value based on a serial number of a device on which the application program is installed and the to-be-protected files, determining a target key based on the index value, and determining a target encryption algorithm based on the target key; encrypting to-be-protected data by the target encryption algorithm, and storing the encrypted to-be-protected data in the to-be-protected files; and decrypting the encrypted to-be-protected data based on the decryption value and the target encryption algorithm to obtain the to-be-protected data, and reading the to-be-protected data. The above technical solution first installs the application program requiring data protection in the sandbox, the sandbox can provide an isolated environment for the executing application program, and the to-be-protected files requiring data protection in the application program are determined, then the index value is determined, the target key is determined based on the index value, the target encryption algorithm is determined based on the target key, the to-be-protected data is further encrypted based on the target encryption algorithm, and the encrypted to-be-protected data is stored in the to-be-protected files to realize the storage of the to-be-protected data. Of course, the encrypted to-be-protected data can also be decrypted based on the decryption value and the target encryption algorithm to realize the reading of the to-be-protected data. Without modifying the application program, the data in the application program is encrypted and protected.

[0107] Embodiment three

[0108] Figure 3 A structural schematic diagram of a data protection device provided for Embodiment Three of the present application. The device can be applied to the case where data in an application program needs to be encrypted and stored. The device can be implemented by software and / or hardware, and is generally integrated in a terminal device, such as a computer device.

[0109] As shown in Figure 3 , the device comprises:

[0110] A determination module 310, configured to install an application program needing data protection in a sandbox, and determine a to-be-protected file contained in the application program;

[0111] An execution module 320, configured to determine an index value according to a serial number of a device on which the application program is installed and the to-be-protected file, determine a target key based on the index value, and determine a target encryption algorithm based on the target key;

[0112] An encryption module 330, configured to encrypt to-be-protected data by using the target encryption algorithm, and store the encrypted to-be-protected data into the to-be-protected file.

[0113] The data protection device provided by the embodiment comprises the following steps: an application program needing data protection is installed in a sandbox, and a to-be-protected file contained in the application program is determined; an index value is determined according to a serial number of a device on which the application program is installed and the to-be-protected file, a target key is determined based on the index value, and a target encryption algorithm is determined based on the target key; to-be-protected data is encrypted by using the target encryption algorithm, and the encrypted to-be-protected data is stored into the to-be-protected file. The above technical solution first installs an application program needing data protection in a sandbox. The sandbox can provide an isolated environment for an executing application program, and the to-be-protected file needing data protection in the application program is determined. Then, after the index value is determined, the target key is determined based on the index value, and the target encryption algorithm is determined according to the target key. Further, the to-be-protected data is encrypted based on the target encryption algorithm, and the encrypted to-be-protected data is stored into the to-be-protected file, thereby realizing the storage of the to-be-protected data. In the premise of not modifying the application program, the data in the application program is encrypted and protected.

[0114] On the basis of the above embodiment, the execution module 320 is specifically configured to:

[0115] determine an index value according to a serial number of a device on which the application program is installed and the to-be-protected file;

[0116] search a pre-generated key lookup table based on the index value to determine a target key;

[0117] After the target key is decrypted to obtain a decrypted value, a pre-generated encryption algorithm lookup table is searched based on the decrypted value to determine a target encryption algorithm.

[0118] On the basis of the above embodiment, the apparatus further comprises:

[0119] A decryption module is configured to decrypt the encrypted to-be-protected data based on the decrypted value and the target encryption algorithm to obtain the to-be-protected data and read the to-be-protected data.

[0120] On the basis of the above embodiment, the apparatus further comprises:

[0121] A first generation module is configured to determine a key lookup table, including an encryption key lookup table and an encryption key pair lookup table, before searching the key lookup table based on the index value.

[0122] A second generation module is configured to determine an encryption algorithm lookup table before searching the encryption algorithm lookup table based on the decrypted value.

[0123] In one implementation, when the key lookup table is an encryption key lookup table, the first generation module is specifically configured to:

[0124] initialize a KeyGenerator using a secure random number generator to generate a key, encrypt the key using a deterministic encryption algorithm to obtain an encryption key, and

[0125] determine the encryption key lookup table according to an encryption key set composed of the encryption key and a lookup table index.

[0126] In another implementation, when the key lookup table is an encryption key pair lookup table, the first generation module is specifically configured to:

[0127] initialize a KeyPairGenerator using a secure random number generator to generate a key pair, encrypt the key pair using a deterministic encryption algorithm to obtain an encryption key pair, and

[0128] determine the encryption key pair lookup table according to an encryption key pair set composed of the encryption key pair and a lookup table index.

[0129] On the basis of the above embodiment, the determination module 310 is specifically configured to:

[0130] install an application program that needs to be protected in a sandbox;

[0131] determine a configuration item of the application program and determine the to-be-protected file according to the configuration item.

[0132] Based on the above embodiments, the configuration item includes an encryption item. Accordingly, determining the file to be protected according to the configuration item includes:

[0133] If the encrypted item is the file name of a file contained in the application, then the file to be protected is determined based on the file name;

[0134] If the encryption item is empty, then all files contained in the application are determined to be the files to be protected.

[0135] The data protection device provided in the embodiments of the present invention can execute the data protection method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of executing the method.

[0136] It is worth noting that in the above-described embodiments of the data protection device, the various units and modules included are only divided according to functional logic, but are not limited to the above division, as long as the corresponding functions can be achieved; in addition, the specific names of each functional unit are only for easy differentiation and are not used to limit the scope of protection of the present invention.

[0137] Example 4

[0138] Figure 4 This is a schematic diagram of the structure of a terminal device provided in Embodiment 4 of the present invention. Figure 4 A block diagram of an exemplary terminal device 4 suitable for implementing embodiments of the present invention is shown. Figure 4 The terminal device 4 shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.

[0139] like Figure 4 As shown, terminal device 4 is presented in the form of a general-purpose computing terminal device. The components of terminal device 4 may include, but are not limited to: one or more processors or processing units 16, system memory 28, and bus 18 connecting different system components (including system memory 28 and processing unit 16).

[0140] Bus 18 represents one or more of several bus architectures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor, or a local bus using any of the various bus architectures. For example, these architectures include, but are not limited to, the Industry Standard Architecture (ISA) bus, the Micro Channel Architecture (MAC) bus, the Enhanced ISA bus, the Video Electronics Standards Association (VESA) local bus, and the Peripheral Component Interconnect (PCI) bus.

[0141] Terminal device 4 typically includes a variety of computer system readable media. These media can be any available media that is accessible by terminal device 4 and includes both volatile and non- volatile media, removable and non-removable media.

[0142] The system memory 28 can include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory 32. Terminal device 4 can further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, a storage system 34 can be provided for reading from and writing to non-removable, non-volatile magnetic media (e.g., a "hard drive"). Figure 4 Although not shown, a magnetic disk drive can also be utilized for reading from and writing to a removable, non-volatile magnetic disk (e.g., a "floppy disk"), and an optical disk drive can be utilized for reading from or writing to a removable, non-volatile optical disk (e.g., a CD-ROM, DVD-ROM or other optical media). In such instances, each drive can be connected to the bus 18 by one or more data media interfaces. The system memory 28 can include at least one program product having a set (e.g., at least one) of program modules that are configured to carry out the functions of embodiments of the application. Figure 4 The system memory 28 can include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory 32. Terminal device 4 can further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, a storage system 34 can be provided for reading from and writing to non-removable, non-volatile magnetic media (e.g., a "hard drive").

[0143] A user can enter commands and information into the terminal device 4 through one or more input devices 16, such as a keyboard, a pointing device, a microphone, etc. These and other input devices 16 can be connected to the processing unit 12 through an input / output (I / O) interface 22 coupled to the bus 18. A display 24 or other type of output device can also be connected to the bus 18 via the I / O interface 22. In one embodiment, the display 24 can be a touch screen display, and the display 24 and the input device 16 can be combined into a single input / output device.

[0144] Terminal device 4 can also communicate to one or more external devices 14 such as a keyboard, a pointing device, a display 24, etc.; one or more devices that enable a user to interact with terminal device 4; and / or one or more devices that enable terminal device 4 to communicate with one or more other computing devices. Such communication can be via an input / output (I / O) interface 22. Still yet, terminal device 4 can communicate with one or more networks such as a local area network (LAN), a general wide area network (WAN), and / or a public network such as the Internet, via a network adapter 20. As Figure 4 illustrated, network adapter 20 can communicate with the other components of terminal device 4 via bus 18. It should be appreciated that although not shown, other hardware and / or software components that are used in connection with the ​Other hardware and / or software modules can be used in conjunction with the terminal device 4, as shown, including, but not limited to, microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0145] The processing unit 16 performs various functional applications and page displays by running programs stored in the system memory 28, such as implementing the data protection method provided by the embodiments of the present application, which includes:

[0146] Installing an application program requiring data protection in a sandbox and determining a to-be-protected file contained in the application program;

[0147] After determining an index value according to a serial number of a device on which the application program is installed and the to-be-protected file, determining a target key based on the index value, and determining a target encryption algorithm based on the target key;

[0148] Encrypting to-be-protected data by using the target encryption algorithm, and storing the encrypted to-be-protected data into the to-be-protected file.

[0149] Of course, those skilled in the art can understand that the processor can also implement the technical solutions of the data protection method provided by any of the embodiments of the present application.

[0150] Embodiment Five

[0151] The embodiment five of the present application provides a computer readable storage medium, which stores a computer program, and the program is executed by a processor to implement, for example, the data protection method provided by the embodiments of the present application, which includes:

[0152] Installing an application program requiring data protection in a sandbox and determining a to-be-protected file contained in the application program;

[0153] After determining an index value according to a serial number of a device on which the application program is installed and the to-be-protected file, determining a target key based on the index value, and determining a target encryption algorithm based on the target key;

[0154] Encrypting to-be-protected data by using the target encryption algorithm, and storing the encrypted to-be-protected data into the to-be-protected file.

[0155] The computer storage medium of the embodiments of the present application can adopt any combination of one or more computer readable media. The computer readable medium can be a computer readable signal medium or a computer readable storage medium. The computer readable storage medium may, for example, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or apparatus, or any combination thereof. More specific examples (non-exhaustive list) of the computer readable storage medium include an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, the computer readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus or device.

[0156] The computer readable signal medium can include a data signal propagated in baseband or propagated as a carrier wave, in which computer readable program code is embodied. Such propagated data signals can take a wide variety of forms, including but not limited to electro-magnetic signals, optical signals, or any suitable combination thereof. Computer readable signal medium can also be any computer readable medium that is not a storage medium, that is capable of storing the program for use by or in connection with the instruction execution system, apparatus or device.

[0157] The program code embodied on the computer readable medium can be transmitted using any appropriate medium, including but not limited to wireless, wire line, optical fiber cable, RF, etc., or any suitable combination of the above.

[0158] Computer program code for carrying out operations of the present application can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider). In some embodiments of the present application, electronic mail (email) can be utilized as the

[0159] Those of ordinary skill in the art should understand that the modules or steps of the present application described above can be implemented by a general computing device, which can be centralized on a single computing device or distributed on a network composed of multiple computing devices. Alternatively, the modules or steps can be implemented by computer-executable program codes, which can be stored in a storage device and executed by a computing device, or implemented by individual integrated circuit modules, or implemented by multiple modules or steps in a single integrated circuit module. Thus, the present application is not limited to any particular combination of hardware and software.

[0160] Note that the above merely describes the preferred embodiments of the present application and the principles of the applied technology. Those of ordinary skill in the art will understand that the present application is not limited to the specific embodiments described herein, and that various obvious changes, modifications and substitutions can be made by those of ordinary skill in the art without departing from the scope of the present application. Therefore, although the present application has been described in detail through the above embodiments, the present application is not limited to the above embodiments, and can include more other equivalent embodiments without departing from the concept of the present application, and the scope of the present application is determined by the appended claims.

Claims

1. A data protection method for the encrypted storage of the data of an application program without modification of the application program, characterized in that, The application comprises the following steps: installing an application requiring data protection in a sandbox, determining a configuration item of the application, and determining a to-be-protected file contained in the application according to the configuration item; wherein the configuration item comprises an encryption item, and the sandbox is used to provide an isolated environment for the application in execution; determining an index value according to a serial number of a device on which the application is installed and the to-be-protected file, and searching a pre-generated key lookup table based on the index value to determine a target key; after obtaining a decryption value by decrypting the target key, searching a pre-generated encryption algorithm lookup table based on the decryption value to determine a target encryption algorithm; encrypting to-be-protected data by using the target encryption algorithm, and storing the encrypted to-be-protected data into the to-be-protected file; wherein the step of determining the to-be-protected file contained in the application according to the configuration item comprises: if the encryption item is a file name of a file contained in the application, determining the to-be-protected file according to the file name; if the encryption item is empty, determining all files contained in the application as the to-be-protected file; before searching the pre-generated key lookup table based on the index value, the method further comprises determining the key lookup table, wherein the key lookup table comprises an encryption key lookup table and an encryption key pair lookup table; before searching the pre-generated encryption algorithm lookup table based on the decryption value, the method further comprises determining the encryption algorithm lookup table; when the key lookup table is the encryption key lookup table, the step of determining the key lookup table comprises: initializing a KeyGenerator by using a secure random number generator to generate a key, encrypting the key by using a deterministic encryption algorithm to obtain an encryption key; determining the encryption key lookup table according to an encryption key set composed of the encryption key and a lookup table index; when the key lookup table is the encryption key pair lookup table, the step of determining the key lookup table comprises: initializing a KeyPairGenerator by using a secure random number generator to generate a key pair, encrypting the key pair by using a deterministic encryption algorithm to obtain an encryption key pair; determining the encryption key pair lookup table according to an encryption key pair set composed of the encryption key pair and a lookup table index.

2. The data protection method of claim 1, wherein, after storing the encrypted to-be-protected data into the to-be-protected file, the method further comprises: decrypting the encrypted to-be-protected data based on the decryption value and the target encryption algorithm to obtain the to-be-protected data, and reading the to-be-protected data.

3. A data protection apparatus adapted for the encrypted storage of data of an application program without modification of the application program, characterized in that The application comprises the following steps: a determining module is configured to install an application requiring data protection in a sandbox, determine a configuration item of the application, and determine a to-be-protected file contained in the application according to the configuration item; wherein the configuration item comprises an encryption item, and the sandbox is used to provide an isolated environment for the application in execution; The execution module is configured to determine an index value according to a serial number of a device on which the application is installed and the file to be protected, and determine a target key based on the index value by searching a pre-generated key lookup table; and determine a target encryption algorithm based on a decryption value obtained by decrypting the target key by searching a pre-generated encryption algorithm lookup table. The encryption module is configured to encrypt the data to be protected by using the target encryption algorithm, and store the encrypted data to be protected in the file to be protected. The configuration item is used to determine the file to be protected included in the application, and includes: If the encryption item is a file name of a file included in the application, the file to be protected is determined according to the file name. If the encryption item is empty, all the files included in the application are determined as the file to be protected. The apparatus further includes: The first generation module is configured to determine the key lookup table before searching the pre-generated key lookup table based on the index value, and the key lookup table includes an encryption key lookup table and an encryption key pair lookup table. The second generation module is configured to determine the encryption algorithm lookup table before searching the pre-generated encryption algorithm lookup table based on the decryption value. When the key lookup table is the encryption key lookup table, the first generation module is specifically configured to: initialize a KeyGenerator by using a secure random number generator to generate a key, and encrypt the key by using a deterministic encryption algorithm to obtain an encryption key; determine the encryption key lookup table according to an encryption key set composed of the encryption key and a lookup table index. When the key lookup table is the encryption key pair lookup table, the first generation module is specifically configured to: initialize a KeyPairGenerator by using a secure random number generator to generate a key pair, and encrypt the key pair by using a deterministic encryption algorithm to obtain an encryption key pair; determine the encryption key pair lookup table according to an encryption key pair set composed of the encryption key pair and a lookup table index.

4. A terminal device, characterized by comprising: The device includes: one or more processors; a storage apparatus configured to store one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors are caused to implement the data protection method according to any one of claims 1-2.

5. A storage medium containing computer executable instructions for performing the data protection method according to any one of claims 1-2 when executed by a computer processor.

Images