Encryption and decryption method and device, electronic equipment and readable storage medium

Abstract

The application provides a decryption method, device, electronic equipment and readable storage medium, the method comprises the following steps: in response to the setting request of the biological password input by the user, generating a first secret key; outputting the first prompt information to prompt the user to enter the biological password; collecting the first biological password input by the user; in response to the encryption request of the plaintext input by the user, the plaintext is encrypted by the first secret key to obtain the first ciphertext; in response to the decryption request of the plaintext input by the user, outputting the second prompt information to prompt the user to input the biological password; collecting the second biological password input by the user; using the first biological password to verify the second biological password; when the second biological password is verified, the plaintext is obtained by decrypting the first ciphertext according to the first secret key. In the embodiment of the application, the user can directly set the biological password when setting the password of the plaintext, without pre-inputting the first type of password, simplifying the step of setting the biological password of the user, and improving the user experience.

Description

Technical Field

[0001] This application relates to information security technology, and more particularly to an encryption / decryption method, apparatus, electronic device, and readable storage medium. Background Technology

[0002] The content within an application involves user privacy, and users can encrypt the content using Type 1 passwords such as numeric passwords, pattern passwords, or mixed passwords. However, users are prone to forgetting Type 1 passwords, so they tend to use Type 2 passwords, such as biometric passwords, to encrypt the content within the application.

[0003] Currently, users must first set a Type 1 password before they can set a biometric password, making the process of setting biometric password encryption complex and resulting in a poor user experience. Summary of the Invention

[0004] This application provides an encryption / decryption method, apparatus, electronic device, and readable storage medium, which simplifies the steps for users to set biometric passwords and improves user experience.

[0005] Firstly, this application provides an encryption / decryption method. The execution entity of this encryption / decryption method can be a terminal device or a processor or chip within the terminal device. The following description uses a terminal device as an example. In this encryption / decryption method, when the terminal device receives a user's biometric password setting request, the terminal device can generate a first key in response to the user's biometric password setting request. The terminal device outputs a first prompt message, which prompts the user to enter their biometric password. The terminal device can then collect the first biometric password entered by the user, indicating successful biometric password entry. Compared to current technical solutions, where users need to set a first type of password before setting a biometric password, this application allows users to directly set their biometric password, and generates a first key during the biometric password setting process. While ensuring security, this simplifies the steps for users to set their biometric password and improves user experience. The first type of password can be a numeric password, a pattern password, or a hybrid password.

[0006] In one possible implementation, the terminal device can generate the first key based on at least one of the following: a first random number, application signature information, and system characteristic information. Since the first random number, such as a salt value, can be a randomly generated string including random uppercase and lowercase letters, numbers, and characters, adding the first random number when generating the first key increases the difficulty of cracking the first key and improves its security.

[0007] The following describes the encryption and decryption process performed by the terminal device using the first biometric password:

[0008] The first method: After a user sets a biometric password, the user can input a plaintext encryption request to the terminal device. In response to the user's plaintext encryption request, the terminal device can encrypt the plaintext using the first key to obtain first ciphertext. When the user views this plaintext, they can input a plaintext decryption request to the terminal device. In response to the user's decryption request, the terminal device can output a second prompt message to prompt the user to input their biometric password. The terminal device collects the user's input second biometric password and can use the first biometric password to verify the second biometric password. Specifically, the terminal device can verify the second biometric password by comparing the first and second biometric passwords. For example, the terminal device can obtain the similarity between the first and second biometric passwords. When the similarity is greater than or equal to a preset similarity, the second biometric password passes verification. When the similarity is less than the preset similarity, the second biometric password fails verification. It should be understood that the similarity between the first and second biometric passwords can be the similarity between the biometric features of the first and second biometric passwords. When the second biometric password is verified, the terminal device can decrypt the first ciphertext using the first key to obtain the plaintext.

[0009] In one possible implementation, to improve the security of the first biometric password, the terminal device can store the first biometric password in a trusted application environment of the terminal device, and then use the first biometric password to verify the second biometric password in the trusted application environment, thereby improving the security of the first biometric password.

[0010] In the first approach, the terminal device needs to store the first key, which is then used to decrypt the first ciphertext. This first key has low security. In a possible implementation, the terminal device can store the first key, but instead, it can use it as an intermediate value in the encryption / decryption process, as shown in the second approach below:

[0011] The second method: After the user sets a biometric password, the user can input a plaintext encryption request to the terminal device. In response to the user's plaintext encryption request, the terminal device can generate a first encryption object, and then use the first encryption object to encrypt the first key to obtain second ciphertext. The terminal device can use the first key to encrypt the plaintext to obtain first ciphertext. After obtaining the first ciphertext, the terminal device can delete the first key, thus not storing the first key in the terminal device. When the user views the plaintext, they can input a plaintext decryption request to the terminal device. In response to the user's plaintext decryption request, the terminal device can output a second prompt message to prompt the user to input their biometric password. The terminal device collects the user's input second biometric password and can use the first biometric password to verify the second biometric password. The method by which the terminal device verifies the second biometric password can refer to the first method described above.

[0012] When the second biometric password is verified, the terminal device can generate a first decryption object, use the first decryption object to decrypt the second ciphertext to obtain the first key, and use the first key to decrypt the first ciphertext to obtain the plaintext.

[0013] The second method, compared to the first method, eliminates the need for the terminal device to store the first key. The terminal device can encrypt the first key using a first encryption object and decrypt the ciphertext using a first decryption object to obtain the first key, thereby improving the security of the first key.

[0014] In one possible implementation, the terminal device may not store the first encryption object and the first decryption object to prevent malicious applications from using the first encryption object and the first decryption object to recover the first key, and then using the first key to decrypt the ciphertext. In this embodiment, the terminal device may generate the first encryption object based on the first biometric password; or, the terminal device may generate the first encryption object based on system feature information and / or application signature information. Correspondingly, if the terminal device can generate the first encryption object based on the first biometric password, then the terminal device can generate the first decryption object based on the first biometric password. Alternatively, if the terminal device generates the first encryption object based on system feature information and / or application signature information, then the terminal device can generate the first decryption object based on the system feature information and / or application signature information. It should be understood that the parameters used by the terminal device to generate the first encryption object / first decryption object can be predefined.

[0015] In this method, the terminal device does not need to store the first encrypted object and the first decrypted object, thereby improving the security of encryption and decryption.

[0016] In one possible implementation, after setting a plaintext biometric password, the user can also add a password. The user can input a request to add a password into the terminal device, and the terminal device, in response to this request, outputs the second prompt message. This second prompt message prompts the user to enter their biometric password for verification. If the biometric password is successfully verified, the user can add the password. This method can prevent malicious users from arbitrarily adding plaintext passwords.

[0017] The user-input password is a third biometric password. The terminal device can collect the third biometric password entered by the user and verify it using the first biometric password; when the third biometric password passes verification, the first decryption object is generated. It should be understood that the terminal device's verification of the third biometric password using the first biometric password can refer to the relevant description of verifying the second biometric password. The terminal device's generation of the first decryption object can refer to the relevant description of the second method mentioned above. The terminal device can use the first decryption object to decrypt the second ciphertext, obtain the first key, and then output a third prompt message to prompt the user to enter a first password. This first password is a new password, and the third prompt message can be used to prompt the user to set a new password.

[0018] In this embodiment, since the first key is an intermediate quantity in the encryption and decryption process, it can be recovered using the first encryption object and the first decryption object to decrypt the first ciphertext and obtain the plaintext. Therefore, in this embodiment, the first key encrypted with the first biometric password can be decrypted using a user-added first password, thereby enabling the user to view the first ciphertext using the first password. In other words, the user can view the first ciphertext using either the first password or the first biometric password, eliminating the need for the user to remember multiple passwords and improving the user experience.

[0019] The following explains the encryption and decryption process performed by the terminal device using the first cipher:

[0020] The terminal device can collect the first password entered by the user, and then encrypt the first key based on the type of the first password entered by the user.

[0021] The first method: If the first password is the second type of password, then a second encrypted object is generated, where the second type of password is a biometric password; the first key is encrypted using the second encrypted object to obtain the third ciphertext. It should be understood that the terminal device can generate the second encrypted object in the same way as it generates the first encrypted object. Specifically, the terminal device can generate the second encrypted object based on system feature information and / or application signature information, or the first password.

[0022] The terminal device can decrypt the second ciphertext using a first biometric password or a first password to obtain a first key. The process of the terminal device decrypting the second ciphertext using the first password is described here. Specifically, in response to the user's decryption request for the plaintext, the terminal device outputs a fourth prompt message to prompt the user to enter a password. This fourth prompt message can prompt the user to enter a biometric password. When the terminal device collects the second password entered by the user, and the second password is a second type of password, the terminal device can verify the second password. When the second password passes verification, a second decryption object is generated; the second decryption object is used to decrypt the third ciphertext to obtain the first key; the first key is used to decrypt the first ciphertext to obtain the plaintext.

[0023] The terminal device can use a first password to verify a second password. Since both the first and second passwords are biometric passwords, the terminal device can verify the second password by comparing the first and second passwords. For example, the terminal device can obtain the similarity between the first and second passwords. When the similarity is greater than or equal to a preset similarity, the second password passes verification. When the similarity is less than the preset similarity, the second password fails verification. It should be understood that the similarity between the first and second passwords can be the similarity between the biometric features of the first password and the biometric features of the second password.

[0024] The second method: If the first password is a password of the first type, the terminal device generates a second key based on the second password and the second random number, and encrypts the first key using the second key to obtain the fourth ciphertext. In response to the user's request to decrypt the plaintext, the terminal device outputs a fourth prompt message to prompt the user to enter a password. The fourth prompt message may prompt the user to enter a biometric password or a password of the first type. When the terminal device collects the second password entered by the user, and the second password is a password of the first type, the terminal device generates a second key based on the second password and the second random number included in the fourth ciphertext; decrypts the fourth ciphertext using the second key to obtain the first key; and decrypts the first ciphertext using the first key to obtain the plaintext.

[0025] In this second approach, in one possible implementation, the terminal device, in response to the user's decryption request for the plaintext, may output a fourth prompt message. When the terminal device detects that the second password is a first-type password, it can verify the second password using the first password. Then, if the second password verification is successful, the second key is generated based on the second password and the second random number included in the fourth ciphertext. Since both the first and second passwords are first-type passwords, the terminal device can verify the second password by comparing whether the first and second passwords are the same. If the first and second passwords are the same, the second password passes verification; if the first and second passwords are different, the second password fails verification.

[0026] In both of the above methods, regardless of whether the first password set by the user is a first-type password or a second-type password, the user can use the first password to view the ciphertext encrypted with the first biometric password. The user does not need to remember multiple passwords, which can improve the user experience.

[0027] Secondly, embodiments of this application provide an encryption / decryption device, which can be the terminal device described in the first aspect above, or a chip or processor in the terminal device. The encryption / decryption device may include:

[0028] An encryption module is used to generate a first key in response to a user's biometric password setting request;

[0029] The output module is used to output the first prompt information, which prompts the user to enter the biometric password.

[0030] The first biometric password module is used to collect the first biometric password entered by the user.

[0031] The encryption module is further configured to respond to the encryption request of the plaintext input by the user, and encrypt the plaintext using the first key to obtain the first ciphertext;

[0032] The output module is further configured to respond to the user's input request to decrypt the plaintext and output a second prompt message, the second prompt message prompting the user to enter a biometric password;

[0033] The first biometric password module is also used to collect the second biometric password input by the user;

[0034] The second biometric password module is used to verify the second biometric password using the first biometric password;

[0035] The decryption module is used to decrypt the first ciphertext according to the first key to obtain the plaintext when the second biometric password is verified.

[0036] In one possible implementation, the second biometric module is configured to generate a first encryption object before encrypting the plaintext using the first key; encrypt the first key using the first encryption object to obtain the second ciphertext; and

[0037] After encrypting the plaintext with the first key to obtain the first ciphertext, the first key is then deleted.

[0038] In one possible implementation, the second biometric module is further configured to generate a first decryption object; the decryption module is specifically configured to use the first decryption object to decrypt the second ciphertext to obtain the first key; and use the first key to decrypt the first ciphertext to obtain the plaintext.

[0039] In one possible implementation, the second biometric module is specifically used to generate the first encrypted object based on the first biometric password; and to generate the first decrypted object based on the first biometric password. Alternatively,

[0040] The second biometrics module is specifically used to generate the first encrypted object based on system feature information and / or application signature information; and to generate the first decrypted object based on the system feature information and / or application signature information.

[0041] In one possible implementation, the second biometric password module is specifically used to compare and verify the second biometric password and the first biometric password; when the similarity between the second biometric password and the first biometric password is greater than or equal to a preset similarity, the second biometric password passes the verification.

[0042] In one possible implementation, the encryption / decryption device may include a random number generator for generating a first random number; the encryption module is specifically used to generate the first key based on at least one of the first random number, application signature information, and system feature information.

[0043] In one possible implementation, the output module is further configured to output the second prompt information in response to the user's request to add a password; the first biometric password module is further configured to collect the third biometric password input by the user; the second biometric password module is further configured to verify the third biometric password using the first biometric password; when the third biometric password passes verification, the first decryption object is generated; the decryption module is specifically configured to decrypt the second ciphertext using the first decryption object to obtain the first key; the output module is further configured to output a third prompt information, which prompts the user to enter the first password.

[0044] In one possible implementation, the first biometric password module is further configured to collect the first password input by the user; the encryption module is further configured to encrypt the first key based on the type of the first password input by the user.

[0045] In one possible implementation, the second biometric password module is further configured to generate a second encryption object if the first password is a password of the second type, wherein the second type of password is a biometric password; the first biometric password module is further configured to encrypt the first key using the second encryption object to obtain a third ciphertext.

[0046] In one possible implementation, the random number generator is further configured to generate a second random number; the encryption module is further configured to generate a second key based on the first key and the second random number if the first key is a first type of key, wherein the first type of key is a numeric key, a pattern key, or a hybrid key; and encrypt the first key with the second key to obtain a fourth ciphertext.

[0047] In one possible implementation, the first random number and the second random number are different.

[0048] In one possible implementation, the output module is further configured to respond to the user's input request to decrypt the plaintext by outputting a fourth prompt message, the fourth prompt message being used to prompt the user to enter a password; the decryption module is further configured to, when the user inputs a second password, decrypt the first ciphertext according to the second password to obtain the plaintext.

[0049] In one possible implementation, the second biometric module is further configured to verify the second password when the second password is a password of the second type; and to generate a second decryption object when the second password passes verification. The decryption module is further configured to decrypt the third ciphertext using the second decryption object to obtain the first key; and to decrypt the first ciphertext using the first key to obtain the plaintext.

[0050] In one possible implementation, the decryption module is further configured to, when the second password is a password of the first type, generate a second key based on the second password and the second random number included in the fourth ciphertext; decrypt the fourth ciphertext using the second key to obtain the first key; and decrypt the first ciphertext using the first key to obtain the plaintext.

[0051] Thirdly, embodiments of this application provide an electronic device, which can be the terminal device described in the first aspect above. The electronic device includes: a processor, a memory, and a display; the display and the memory are both coupled to the processor.

[0052] The display is used to output prompt information, which may include a first prompt information, a second prompt information, a third prompt information, and a fourth prompt information.

[0053] The memory is used to store computer executable program code, which includes instructions; when the processor executes the instructions, the instructions cause the electronic device to perform a method such as the first aspect or various possible implementations of the first aspect.

[0054] Fourthly, embodiments of this application provide an encryption / decryption apparatus, including a unit, module, or circuit for performing the methods provided in the first aspect or various possible embodiments of the first aspect. This encryption / decryption apparatus can be a terminal device, or a module applied to a terminal device, for example, a chip applied to a terminal device.

[0055] Fifthly, embodiments of this application provide a computer program product containing instructions that, when run on a computer, cause the computer to perform the methods described in the first aspect or various possible implementations of the first aspect.

[0056] Sixthly, embodiments of this application provide a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the methods described in the first aspect or various possible implementations of the first aspect.

[0057] The beneficial effects of the various possible implementations of the second to sixth aspects can be found in the first aspect and the beneficial effects of the various possible implementations of the first aspect, and will not be repeated here.

[0058] This application provides an encryption / decryption method, apparatus, electronic device, and readable storage medium. The method includes: generating a first key in response to a user-inputted biometric password setting request; outputting a first prompt message to prompt the user to enter a biometric password; acquiring the user-inputted first biometric password; encrypting plaintext using the first key to obtain first ciphertext in response to a user-inputted plaintext encryption request; outputting a second prompt message to prompt the user to enter a biometric password in response to a user-inputted plaintext decryption request; acquiring the user-inputted second biometric password; verifying the second biometric password using the first biometric password; and decrypting the first ciphertext using the first key to obtain plaintext when the second biometric password is successfully verified. In this application embodiment, the user can generate a first key when setting a biometric password, avoiding the current problem of needing to set a first type of password before setting a biometric password. Because the first key can serve as encrypted credential information, this application embodiment can simplify the steps for users to set biometric passwords and improve user experience while ensuring security. Attached Figure Description

[0059] Figure 1 This is a schematic diagram of the structure of a terminal device in an embodiment of this application;

[0060] Figure 2 A flowchart illustrating an embodiment of the encryption / decryption method provided in this application;

[0061] Figure 3 This is a schematic diagram of an interface change of a terminal device provided in an embodiment of this application;

[0062] Figure 4 This is a schematic diagram illustrating another interface change of the terminal device provided in an embodiment of this application;

[0063] Figure 5 This is a schematic diagram illustrating another interface change of the terminal device provided in an embodiment of this application;

[0064] Figure 6 A flowchart illustrating another embodiment of the encryption / decryption method provided in this application;

[0065] Figure 7 A simplified flowchart of the encryption and decryption process for terminal devices when setting up a biometric password for the first time;

[0066] Figure 8 A simplified flowchart of the process for using the first biometric encryption / decryption method on terminal devices;

[0067] Figure 9 A flowchart illustrating another embodiment of the encryption / decryption method provided in this application;

[0068] Figure 10A simplified flowchart for setting the first password and using the first password for encryption and decryption;

[0069] Figure 11 This is a schematic diagram illustrating another interface change of the terminal device provided in an embodiment of this application;

[0070] Figure 12 A schematic diagram of the password setting interface for a terminal device;

[0071] Figure 13 This is a schematic diagram illustrating another interface change of the terminal device provided in an embodiment of this application;

[0072] Figure 14 A flowchart illustrating another embodiment of the encryption / decryption method provided in this application;

[0073] Figure 15 A simplified flowchart for setting the first cipher and using it for encryption and decryption;

[0074] Figure 16 This is a schematic diagram illustrating another interface change of the terminal device provided in an embodiment of this application;

[0075] Figure 17 This is a schematic diagram illustrating another interface change of the terminal device provided in an embodiment of this application;

[0076] Figure 18 This is another structural schematic diagram of the terminal device in the embodiments of this application;

[0077] Figure 19 This is a schematic diagram of the system architecture applicable to the encryption and decryption methods provided in the embodiments of this application;

[0078] Figure 20 This is a flowchart illustrating another embodiment of the encryption / decryption method provided in this application. Detailed Implementation

[0079] With the rise of user privacy awareness, users are increasingly demanding encryption for their devices. Content in applications such as Messages, Contacts, Notes, and Social Media contains users' private information, requiring encryption. Currently, there are two main methods for encrypting content within applications: one is to encrypt all content within the application, and the other is to encrypt user-specified content. Because applications include content that doesn't need encryption, encrypting all content would require users to enter a password even to view non-encrypted content, resulting in a poor user experience. Therefore, encrypting user-specified content is currently the more common approach.

[0080] The terminal device can use the system account password to encrypt user-specified content in an application. Users can set a password in the application's settings interface; this password corresponds to the system account (hereinafter referred to as the system password). This system password can be a numeric password, a pattern password, or a mixed password (a password consisting of letters, numbers, and symbols). The terminal device can generate a key based on the user-set system password and use this key to encrypt the user-specified content. When the user views the encrypted content, the terminal device prompts the user to enter the system password to decrypt the content. Numeric passwords, pattern passwords, and mixed passwords are referred to as the first type of password.

[0081] Users can also add other types of passwords, such as biometric passwords, in the application's settings interface. Biometric passwords can be fingerprints, iris scans, facial recognition, voiceprints, etc. Hereinafter, biometric passwords will be referred to as the second type of password. Taking adding a fingerprint as an example, when a user adds a fingerprint in the application's settings interface, the terminal device prompts the user to enter a system password for verification. Upon successful verification, the user can register their fingerprint, which the terminal device will collect and store. When the user wants to view encrypted content, the terminal device prompts the user to enter either a system password or a fingerprint. The user can enter a system password, allowing the terminal device to decrypt the encrypted content based on that password. Alternatively, the user can enter a fingerprint, and the terminal device will verify whether the stored fingerprint matches the entered fingerprint. If the fingerprints match, the terminal device will display the encrypted content.

[0082] In this encryption / decryption method, before setting a biometric password, the user needs to set a first-type password (such as a system password). The terminal device generates a key based on this first-type password and uses this key as the encryption credential. This method prevents malicious devices from directly using the biometric password to view encrypted content, thus improving encryption / decryption security. However, if the user changes the system password, the terminal device deletes the content encrypted with the old system password, making it unviewable and resulting in a poor user experience.

[0083] Terminal devices can bypass the system password and instead use a user-defined first-type password (non-system password), such as an application password, to encrypt user-specified content within an application. Similar to the above method, users can set an application password in the application's settings. The terminal device can then generate a key based on the application password as encryption credentials and use this key to encrypt user-specified content. When the user views the encrypted content, the terminal device prompts them to enter the application password to decrypt it. In this method, if the user changes the application password, the terminal device will not delete the content encrypted with the old application password. Therefore, the user can use the old password to view content encrypted with the old system password, thus solving the problem of users being unable to view content encrypted with the old system password. However, to ensure security in this encryption / decryption method, similar to the methods described above, users still need to set a first-type password before setting a biometric password, making it impossible for users to directly set a biometric password, and the biometric password setting process is complex.

[0084] This application provides an encryption / decryption method. When a user sets a biometric password, the terminal device can randomly generate a key as the encryption credential information, avoiding the step of the user manually setting the password. The user can directly set a biometric password to encrypt the content in the application. The encryption / decryption method of this application can simplify the biometric password setting steps and improve the user experience while ensuring encryption / decryption security.

[0085] It should be understood that in the embodiments of this application, the entity executing the encryption / decryption method can be a terminal device, or a chip or processor within the terminal device. It should be understood that the terminal device in the embodiments of this application can be referred to as user equipment (UE), mobile terminal, terminal, etc. The terminal device can be a personal digital assistant (PDA), a handheld device with wireless communication capabilities, a computing device, an in-vehicle device, or a wearable device; a virtual reality (VR) terminal device; an augmented reality (AR) terminal device; a wireless terminal in industrial control; a wireless terminal in self-driving; a wireless terminal in remote medical care; a wireless terminal in a smart grid; a wireless terminal in transportation safety; a wireless terminal in a smart city; a wireless terminal in a smart home, etc. The embodiments of this application do not specifically limit the form of the terminal device.

[0086] Figure 1 This is a schematic diagram of the structure of a terminal device in an embodiment of this application. For example... Figure 1 As shown, the terminal device 100 may include: a processor 110, a memory 120, a communication module 130, a camera 140, a display screen 150, and a sensor 160. It is understood that the structure illustrated in this embodiment does not constitute a specific limitation on the terminal device 100. In other embodiments of this application, the terminal device 100 may include more or fewer components than illustrated, or combine some components, or split some components, or arrange different components. The illustrated components may be implemented in hardware, software, or a combination of software and hardware. It is understood that the interface connection relationships between the modules illustrated in the embodiments of this application are merely illustrative and do not constitute a structural limitation on the terminal device 100. In other embodiments of this application, the terminal device 100 may also employ different interface connection methods or combinations of multiple interface connection methods as described in the above embodiments.

[0087] The processor 110 may include one or more processing units, such as an application processor (AP), a modem processor, a graphics processing unit (GPU), an image signal processor (ISP), a controller, a video codec, a digital signal processor (DSP), a baseband processor, a display processing unit (DPU), and / or a neural network processing unit (NPU). Different processing units may be independent devices or integrated into one or more processors. In some embodiments, the terminal device 100 may also include one or more processors 110. The processor may serve as the central nervous system and command center of the terminal device 100. The processor can generate operation control signals based on instruction opcodes and timing signals to control instruction fetching and execution. The processor 110 may also include a memory for storing instructions and data. In some embodiments, the memory in the processor 110 is a cache memory. This memory can store instructions or data that the processor 110 has recently used or is repeatedly used. If the processor 110 needs to use the instruction or data again, it can directly retrieve it from the memory. This avoids repeated accesses, reduces the waiting time of the processor 110, and thus improves the efficiency of the terminal device 100. In some embodiments, the processor 110 may include one or more interfaces. Interfaces may include an inter-integrated circuit (I2C) interface, an inter-integrated circuit sound (I2S) interface, a pulse code modulation (PCM) interface, a universal asynchronous receiver / transmitter (UART) interface, a mobile industry processor interface (MIPI), a general-purpose input / output (GPIO) interface, a subscriber identity module (SIM) interface, and / or a universal serial bus (USB) interface, etc.The USB interface can be a USB standard-compliant interface, such as a Mini USB interface, a Micro USB interface, or a USB Type-C interface. The USB interface can be used to connect a charger to charge the terminal device 100, to transfer data between the terminal device 100 and peripheral devices, or to connect headphones for audio playback.

[0088] The memory 120 can be used to store one or more computer programs, which include instructions. The processor 110 can execute the instructions stored in the internal memory 120, thereby enabling the terminal device 100 to perform various functional applications and data processing. The internal memory 120 may include a program storage area and a data storage area. The program storage area may store the operating system; it may also store one or more application programs (such as a gallery, contacts, etc.). The data storage area may store data created during the use of the terminal device 100 (such as photos, contacts, etc.). Furthermore, the internal memory 120 may include high-speed random access memory and may also include non-volatile memory, such as at least one disk storage device, flash memory, universal flash storage (UFS), etc. In some embodiments, the processor 110 can execute instructions stored in the internal memory 120 and / or instructions stored in memory disposed within the processor 110 to enable the terminal device 100 to perform various functional applications and data processing.

[0089] The communication module 130 can provide communication modules such as 2G / 3G / 4G / 5G for use on the terminal device 100, and / or communication modules such as wireless local area networks (WLAN), Bluetooth, global navigation satellite system (GNSS), frequency modulation (FM), NFC, and infrared (IR) for use on the terminal device 100. The communication module 130 is used to enable communication between the terminal device 100 and other devices.

[0090] Terminal device 100 can perform shooting functions through one or more cameras 140, video codecs, GPUs, and application processors. Among them, camera 140 can be used to capture facial images for facial recognition, and the captured facial images can be used to unlock, access, and set application locks, among other functions.

[0091] The terminal device 100 can realize display functions through a GPU, a display screen 150, and an application processor. The GPU is a microprocessor for image processing, connecting the display screen 150 and the application processor. The GPU is used to perform mathematical and geometric calculations and for graphics rendering. The processor 110 may include one or more GPUs, which execute instructions to generate or modify display information. The application processor may include a neural network (NN) computing processor, a display sub-system (DSS), etc.

[0092] The display screen 150 is used to display images, videos, etc. The display screen 150 includes a display panel. The display panel may be a liquid crystal display (LCD), an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode (AMOLED), a flexible light-emitting diode (FLED), a miniature LED, a microLED, a quantum dot light-emitting diode (QLED), etc. In some embodiments, the terminal device 100 may include one or N display screens 150, where N is a positive integer greater than 1.

[0093] A neural network (NN) computing processor, by borrowing the structure of biological neural networks, such as the transmission patterns between neurons in the human brain, can rapidly process input information and continuously learn on its own. The NPU enables intelligent cognitive applications in terminal devices 100, such as image recognition, facial recognition, speech recognition, and text understanding. The Display Sub-System (DSS), also known as the DPU, is used to adjust the colors of the display screen 150. The DPU can adjust the colors of the display screen using a 3D look-up table (3D LUT). The DPU can also perform image scaling, noise reduction, contrast enhancement, backlight brightness management, HDR processing, and Gamma adjustment of the display parameter.

[0094] The sensor 160 in this embodiment may include a pressure sensor 160A, a gyroscope sensor 160B, a proximity sensor 160C, an ambient light sensor 160D, a touch sensor 160E, a fingerprint sensor 160F, an iris sensor 160G, a voiceprint sensor 160H, a palm print sensor 160I, and a face recognition sensor 160J, etc. It should be understood that the types of sensors included in the terminal device 100 correspond to the types of biometric data collected by the terminal device 100 in this embodiment.

[0095] The pressure sensor 160A is used to sense pressure signals and convert them into electrical signals. In some embodiments, the pressure sensor 160A can be disposed on the display screen 150. There are many types of pressure sensors 160A, such as resistive pressure sensors, inductive pressure sensors, and capacitive pressure sensors. A capacitive pressure sensor may include at least two parallel plates with conductive material. When force is applied to the pressure sensor 160A, the capacitance between the electrodes changes. The terminal device 100 determines the pressure intensity based on the change in capacitance. When a touch operation is applied to the display screen 150, the terminal device 100 detects the intensity of the touch operation based on the pressure sensor 160A. The terminal device 100 can also calculate the touch position based on the detection signal from the pressure sensor 160A. In some embodiments, touch operations applied to the same touch position but with different touch operation intensities can correspond to different operation commands. For example, when a touch operation with an intensity less than a first pressure threshold is applied to the SMS application icon, a command to view an SMS is executed. When a touch operation with an intensity greater than or equal to the first pressure threshold is applied to the SMS application icon, a command to create a new SMS is executed.

[0096] The gyroscope sensor 160B can be used to determine the motion attitude of the terminal device 100. In some embodiments, the gyroscope sensor 160B can determine the angular velocity of the terminal device 100 about three axes (i.e., the x, y, and z axes). The gyroscope sensor 160B can be used for image stabilization. For example, when the shutter is pressed, the gyroscope sensor 160B detects the angle of the shaking of the terminal device 100, calculates the distance that the lens module needs to compensate based on the angle, and allows the lens to counteract the shaking of the terminal device 100 by moving in the opposite direction, thus achieving image stabilization.

[0097] A distance sensor 160C is used to measure distance. The terminal device 100 can measure distance via infrared or laser. In some embodiments, during a shooting scene, the terminal device 100 can utilize the distance sensor 160C to measure distance for rapid focusing.

[0098] The ambient light sensor 160D is used to sense the ambient light intensity. The terminal device 100 can adaptively adjust the brightness of the display screen 150 according to the sensed ambient light intensity. The ambient light sensor 160D can also be used to automatically adjust the white balance when taking pictures.

[0099] Touch sensor 160E, also known as a touch panel, can be located on display screen 150. The touch sensor 160E and display screen 150 together form a touchscreen, also known as a touch display. Touch sensor 160E detects touch operations applied to or near it. The touch sensor can transmit the detected touch operation to the application processor to determine the type of touch event. Visual output related to the touch operation can be provided through display screen 150. In other embodiments, touch sensor 160E may also be located on the surface of terminal device 100, in a different position than display screen 150.

[0100] The fingerprint sensor 160F, also known as a fingerprint reader, is used to collect fingerprints. The terminal device 100 can utilize the collected fingerprint characteristics to achieve fingerprint unlocking, access and setting application locks, fingerprint photography, fingerprint answering of calls, etc. The iris sensor 160G, also known as an iris recognition sensor, is used to collect iris images. The terminal device 100 can utilize the collected iris images to achieve iris unlocking, access and setting application locks, answering calls, etc. The voiceprint sensor 160H, also known as a sound detection sensor, is used to collect the user's voice to determine the user's voiceprint. The palm print sensor 160I can be used to collect the user's palm print. The face recognition sensor 160J may include an infrared face recognition sensor and / or a visible light face recognition sensor to collect face images for face recognition. It should be understood that voiceprints, palm prints, face images, etc., can also enable users to unlock, access, and set application locks on the terminal device 100.

[0101] The encryption and decryption methods provided in this application will be described in detail below with reference to specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. Figure 2 This is a flowchart illustrating an embodiment of the encryption / decryption method provided in this application. Figure 2 As shown, the encryption / decryption method provided in this application embodiment may include:

[0102] S201, when a user's biometric password setting request is received, a first key is randomly generated and a first prompt message is output, which prompts the user to enter the biometric password.

[0103] It should be understood that the biometric password is a second type of password, and the "user-inputted biometric password setting request" in S201 can be replaced with "user-inputted second type of password setting request". The biometric password can be a user's biometric features such as fingerprints, irises, voiceprints, or faces. In this embodiment, when a user needs to set a plaintext biometric password, they can trigger a second type of password setting request on the terminal device by clicking or performing other operations. The plaintext is content visible to the user, also known as content to be encrypted, such as messages, emails, memos, or chat content. When the terminal device receives the user's second type of password setting request, it can randomly generate a first key, which can be used as encrypted credential information. Therefore, the user does not need to manually input a first type of password; using the first key as encrypted credential information, the user can directly set a second type of password, such as a first biometric password.

[0104] In one possible implementation, the terminal device can randomly generate the first key SK_ap using at least one of the following information: a first random number, application signature information, and system characteristic information. The first random number can be a salt value, a numerical value, a binary number, etc. The application signature information can be understood as the application developer's signature on the application. The system characteristic information can include the system version, the terminal device model, and the terminal device's International Mobile Equipment Identity (IMEI), etc. It should be understood that the more information the terminal device uses to generate the first key, the more complex the first key, and the higher the encryption and decryption security. In this embodiment, the terminal device can use a hash algorithm or an MD5 message digest algorithm to generate the first key based on the first random number, application signature information, or system characteristic information. Since the first random number, such as the salt value, can be a randomly generated string including random uppercase and lowercase letters, numbers, characters, etc., adding a first random number when generating the first key increases the difficulty of cracking the first key and improves its security.

[0105] After generating the first key, the terminal device can output a first prompt message to prompt the user to enter their biometric password. Optionally, the terminal device can display an interface for entering the biometric password, guiding the user to enter the first biometric password. Alternatively, the terminal device can also prompt the user to enter the first biometric password via voice or other means. This embodiment of the application does not limit the prompting method of the terminal device.

[0106] Figure 3This is a schematic diagram illustrating an interface change of a terminal device provided in an embodiment of this application. Figure 3 This example uses an application as a memo pad to illustrate how to encrypt notes within that memo pad. Figure 3 As shown, interface 301 is the main page of the memo app, displaying three notes recorded by the user. When the user needs to encrypt "Note 1," they can click the "|" control on interface 301 to access its drop-down menu. As shown in interface 302, the drop-down menu includes a "Settings" control. Clicking the "Settings" control redirects the user to interface 303, which is the memo app's settings page. Interface 303 displays an "Encrypt Privacy" control. Clicking this control redirects the user to interface 304, which is the password settings page. Interface 304 displays a password settings area, indicated by the dotted box in interface 304. The password settings area includes options for setting a password, such as fingerprint, face, iris, numeric, and pattern password. If the user clicks the "Fingerprint option," a request to enter a second type of password into the terminal device will be triggered. The terminal device will generate a first key, and interface 304 will redirect to interface 305. Interface 305 is used to prompt the user to enter their fingerprint, which serves as the first biometric password. For example, interface 305 may display a prompt message such as "Please enter your fingerprint."

[0107] S202, collect the first biometric password entered by the user.

[0108] Users can enter their first biometric password through the guided interface of the terminal device. Correspondingly, the terminal device can collect the user's entered first biometric password, such as a fingerprint. The interface for fingerprint entry in this embodiment is not described in detail. After the user enters their fingerprint, interface 305 can redirect to interface 306. Interface 306 is a successful fingerprint entry prompt page, indicating to the user that the terminal device has successfully collected the user's fingerprint. In this embodiment, the terminal device can store the first biometric password, and to ensure the security of the first biometric password, the terminal device can store the first biometric password in a trusted execution environment (TEE).

[0109] S203: When a user inputs a request to encrypt plaintext, the plaintext is encrypted using the first key to obtain the first ciphertext.

[0110] Ciphertext is content that is encrypted from plaintext and is not visible to the user. Figure 4 This is a schematic diagram illustrating another interface change of the terminal device provided in an embodiment of this application. It should be understood that... Figure 4 The interface of the terminal device shown is later than Figure 3The interface shown is as follows. When a user needs to encrypt a note in the memo, the terminal device displays the main page of the memo, such as interface 401, which is the same as interface 301 mentioned above. If the user needs to encrypt "Note 1", the user can select "Note 1" by long-pressing or other operations. After the user selects "Note 1", interface 401 can jump to interface 402. On interface 402, a selection mark, such as a checkmark, can be displayed to the right of "Note 1" to indicate that the user has selected "Note 1". It should be noted that an "Encrypt" control is displayed on interface 402. When the user clicks the "Encrypt" control, it can trigger an encryption request to input plaintext (Note 1) into the terminal device. When the terminal device receives the user's encryption request for "Note 1", it can encrypt "Note 1" using the first key to obtain the first ciphertext. After the terminal device completes the encryption of "Note 1", interface 402 can jump to interface 403, which can display a prompt message that "Note 1" has been encrypted, such as "This content has been encrypted. Please enter the password to view." Optionally, interface 403 can also display information such as the encryption time of "Note 1".

[0111] In this embodiment of the application, the terminal device may use, but is not limited to, the method of encrypting plaintext with the first key as follows: Advanced Encryption Standard-Cipher Block Chaining with Public Key Cryptography Standards with Padding, AES-CBC with PKCS padding.

[0112] S204, when a user inputs a plaintext decryption request, a second prompt message is output, which prompts the user to enter a biometric password.

[0113] When a user views encrypted plaintext, the terminal device can output a second prompt to ask the user to enter their biometric password. For example, Figure 5 This is a schematic diagram illustrating another interface variation of the terminal device provided in this application embodiment. Interface 501 is the same as interface 403 described above. When the user clicks, long-presses, or selects "Note 1" displayed on interface 501 through other operations, a decryption request for plaintext can be triggered to the terminal device. Interface 501 can jump to interface 502, which prompts the user to input their fingerprint. For example, interface 502 may display a prompt message such as "Input fingerprint to view notes". It should be understood that the above S204 can be replaced by: when a decryption request for plaintext input by the user is received, outputting a second prompt message, which prompts the user to input a first biometric password.

[0114] S205: Collect the second biometric password entered by the user, use the first biometric password to verify the second biometric password, and when the second biometric password passes the verification, use the first key to decrypt the first ciphertext to obtain the plaintext.

[0115] The user-entered biometric password is the second biometric password. The terminal device can use the first biometric password to verify the second biometric password. The terminal device can compare the first and second biometric passwords. If the similarity between the first and second biometric passwords is greater than or equal to a preset similarity, the second biometric password is deemed to have passed verification. If the similarity between the first and second biometric passwords is less than the preset similarity, the second biometric password is deemed to have failed verification.

[0116] In this embodiment, after generating the first key, the terminal device can store it. When the second biometric password is verified, the terminal device can use the stored first key to decrypt the first ciphertext to obtain the plaintext. Corresponding to the above encryption method, the terminal device decrypts the first ciphertext using the AES-CBC with PKCS padding algorithm to obtain the plaintext. Figure 5 As shown, when a user enters their fingerprint in interface 502, the terminal device can collect the fingerprint. Upon successful fingerprint verification, the terminal device can use the first key to decrypt the first ciphertext, obtaining the plaintext. Interface 502 then redirects to interface 503, which displays the content "Note 1".

[0117] In this embodiment, the terminal device can randomly generate a first key as encrypted credential information when the user sets their biometric password. This avoids the complex step of manually entering a first-type password beforehand, allowing the user to directly set their biometric password. The encryption / decryption method in this embodiment simplifies the biometric password setting process while ensuring security, thus improving the user experience.

[0118] While the above embodiments simplify the steps of setting biometric passwords, they require the terminal device to store a first key to decrypt the first ciphertext, resulting in low security for the first key. In this embodiment, the terminal device may not store the first key, thus improving its security. Figure 6 This is a flowchart illustrating another embodiment of the encryption / decryption method provided in this application. Figure 7 A simplified flowchart of the encryption and decryption process for terminal devices when setting up a biometric password for the first time. Figure 8 A simplified flowchart of the first biometric encryption / decryption process for terminal devices. The following is combined with... Figures 6-8 The encryption and decryption methods provided in the embodiments of this application will be described. For example... Figure 6 As shown, the above S203 can be replaced with:

[0119] S2031, When a user inputs a request to encrypt plaintext, a first encrypted object is generated.

[0120] In one possible implementation of this application embodiment, when the terminal device receives a user's plaintext encryption request, the terminal device can generate a first encryption object EO1 based on system feature information and / or application signature information. The encryption object (EO) is an object with encryption capabilities used to encrypt a key. Optionally, the encryption object can be a key factory object, a key object, or a cipher object, etc. In another possible implementation, when the terminal device receives a user's plaintext encryption request, it can generate the first encryption object EO1 based on a first biometric password. Figure 7 As shown, the terminal device can generate a first encrypted object based on a first biometric password, such as a fingerprint.

[0121] In this embodiment of the application, the terminal device may generate the first encrypted object in the following ways, but not limited to: the Advanced Encryption Standard (AES) algorithm, the Cipher Blockchain (CBC) algorithm, or the AES algorithm combined with the Public Key Cryptography Standards with Padding (PKCS Padding) algorithm, or the CBC algorithm combined with the PKCS Padding algorithm.

[0122] S2032, the first key is encrypted using the first encryption object to obtain the second ciphertext.

[0123] The terminal device uses a first encryption object EO1 to encrypt the first key SK_ap, obtaining a second ciphertext CT_sk_u1, which can be referred to as the key ciphertext. The terminal device can encrypt SK_ap using EO1 in a manner that includes, but is not limited to: AES algorithm, CBC algorithm, AES with PKCS Padding algorithm, or CBC with PKCS Padding algorithm. After generating the second ciphertext CT_sk_u1, the terminal device can store it.

[0124] S2033, the plaintext is encrypted using the first key to obtain the first ciphertext.

[0125] The terminal device uses the first key SK_ap to encrypt the plaintext PT_ap, obtaining the corresponding first ciphertext CT_ap. The method by which the terminal device encrypts PT_ap with SK_ap can be, but is not limited to, AES-CBC with PKCSpadding.

[0126] In this embodiment, after the terminal device generates the first ciphertext CT_ap, it can store the first ciphertext CT_ap. It should be understood that, in this application embodiment, the terminal device can delete the stored first key SK_ap after obtaining the first ciphertext, thereby preventing malicious applications from decrypting the first ciphertext CT_ap based on the stored first key SK_ap after the terminal device is cracked, thus improving encryption and decryption security.

[0127] In this embodiment, the order of S2032 and S2033 is not restricted. Specifically, if the terminal device executes S2032 first, it can delete the first key SK_ap after executing S2033. If the terminal device executes S2033 first, it can delete the first key SK_ap after executing S2032. If the terminal device executes both S2032 and S2033 simultaneously, it can delete the first key SK_ap after executing both S2032 and S2033.

[0128] Corresponding to the encryption process S203 above, the decryption process S205 above can be replaced by:

[0129] S2051: Collect the second biometric password input by the user, use the first biometric password to verify the second biometric password, and generate the first decryption object when the second biometric password passes the verification.

[0130] In this embodiment, the terminal device uses a first biometric password, and the verification of the second biometric password can be referred to the relevant description in S205. In one possible implementation, when the terminal device generates a first encrypted object based on system feature information and / or application signature information, and the second biometric password passes verification, the terminal device can generate a first decryption object DO1 based on the system feature information and / or application signature information. The decryption object (DO) is an object with decryption capabilities, and can be a key factory object, a key object, or a cipher object, etc. The terminal device can generate the first decryption object using, but is not limited to, the DES algorithm. In one possible implementation, when the terminal device uses the first biometric password to generate the first encrypted object, and the second biometric password passes verification, the terminal device can generate the first decryption object DO1 based on the first biometric password. Figure 8 As shown, the terminal device can generate a first decryption object DO1 based on the first biometric password.

[0131] In this embodiment, the terminal device can use the same parameters (such as the same system feature information and / or application signature information, or the first biometric password). Therefore, the first encryption object and the first decryption object generated by the terminal device are the same. The terminal device can then use the first decryption object to decrypt the second ciphertext to obtain the first key. In one possible implementation, the terminal device may not store the first encryption object and the first decryption object to prevent malicious applications from obtaining the first key SK_ap by decrypting the second ciphertext using the first encryption object and the first decryption object after the terminal device has been compromised. This improves the security of encryption and decryption.

[0132] It should be understood that the first encryption object and the first decryption object can be the same. The reason why the first encryption object can be used to encrypt the first key, and the first decryption object is used to decrypt the second ciphertext to obtain the first key, is because the terminal device has pre-set encryption and decryption processes. For example, when the terminal device receives a user's plaintext encryption request, it can execute the encryption process, in which the terminal device uses the first encryption object to encrypt the first key. When the terminal device receives a user's plaintext decryption request, it can execute the decryption process, in which the terminal device uses the first decryption object to decrypt the second ciphertext to obtain the first key.

[0133] S2052, use the first decryption object to decrypt the second ciphertext to obtain the first key.

[0134] Because the terminal device stores the second ciphertext CT_sk_u1, and this second ciphertext CT_sk_u1 is obtained by encrypting the first key SK_ap with the first encryption object ED1, the terminal device can use the first decryption object DO1 to decrypt the second ciphertext CT_sk_u1 to obtain the first key SK_ap. The terminal device can decrypt the second ciphertext using, but is not limited to, the following methods: AES algorithm, CBC algorithm, or AES with PKCS Padding algorithm, or CBC with PKCS Padding algorithm.

[0135] S2053, use the first key to decrypt the first ciphertext to obtain the plaintext.

[0136] Because the terminal device stores the first ciphertext CT_ap, and this first ciphertext CT_ap is obtained by encrypting the plaintext PT_ap with the first key SK_ap, the terminal device can use the decrypted first key SK_ap to decrypt the first ciphertext CT_ap to obtain the plaintext PT_ap. The method by which the terminal device decrypts the first ciphertext can be the same as the method by which the terminal device decrypts the second ciphertext.

[0137] In summary, in this embodiment of the application, the terminal device may not store the first key as the encryption credential information. The first key can be used as intermediate data for encrypting and decrypting plaintext. Even if the terminal device does not store the first key, it can still decrypt the first ciphertext encrypted by the first key because the terminal device can decrypt the encrypted first key based on the first biometric password set by the user, and thus recover the first key to decrypt the first ciphertext.

[0138] In one embodiment, the user can add a new password based on the first biometric password set, and the terminal device can use the above-described method. Figures 6-8 The encryption and decryption method described herein uses a new password added by the user to encrypt and decrypt the first key, allowing the terminal device to decrypt the first ciphertext using the first key. Therefore, when a user adds a new password, in this embodiment, the terminal device can use the new password or the first biometric password to decrypt the ciphertext encrypted with the first key, eliminating the need for the user to remember multiple passwords and improving the user experience.

[0139] To more clearly illustrate the method by which the terminal device uses the new cipher to decrypt ciphertext encrypted with the first key, the following is combined with... Figures 9-13 The process of a user adding a new password to view encrypted content is described below. In the following embodiments, the new password is used as the first password, which can be either a first-type password or a second-type password. The following description will first use the first password as a second-type password, such as a fourth biometric password, as an example. Figure 9 This is a flowchart illustrating another embodiment of the encryption / decryption method provided in this application. Figure 10 A simplified flowchart illustrating the process of setting and using a primary cipher for encryption and decryption. (e.g.) Figure 9 As shown, the encryption / decryption method provided in this application embodiment may include:

[0140] S901: When a user's request to add a password is received, a second prompt message is output.

[0141] Users can add a primary password in the application's settings. When the terminal device receives a user's request to add a password, it can output a second prompt message, which prompts the user to enter a biometric password for verification. Once the user's biometric password is successfully verified, the user can add a new password, thus preventing malicious users from adding passwords without authorization. Figure 11 This is a schematic diagram illustrating another interface change of the terminal device provided in an embodiment of this application. For example... Figure 11As shown, interface 1101 is the password setting page for the memo. Interface 1101 can display an area for adding a password, as well as the fingerprint that the user has already set, such as fingerprint 1. The area for adding a password can include the "Add Password" option. For example, when the user clicks the "Add Password" option, it can trigger a request to enter an added password into the terminal device. Interface 1101 then jumps to interface 1102, where interface 1102 prompts the user to enter a first biometric password. Interface 1102 is the same as interface 502 described above.

[0142] Interface 1101 differs from interface 304 in that interface 304 is the page where the user sets their password for the first time, and the user has not yet set their first biometric password; therefore, interface 304 does not display an area for adding a password. It should be understood that in this embodiment, the user can add a password in the password setting area displayed on interface 1101. For example, if the user clicks the face option in the password setting area, they can add a facial password. When the user clicks the face option on interface 1101, interface 1101 can directly jump to interface 1105 to prompt the user to register their face. This embodiment does not restrict the interface for setting a password on the terminal device.

[0143] S902: Collect the third biometric password input by the user, use the first biometric password to verify the third biometric password, and generate the first decryption object when the third biometric password passes the verification.

[0144] It should be understood that the terminal device uses the first biometric password, verifies the third biometric password, and generates the first decryption object, as described in S205.

[0145] S903, use the first decryption object to decrypt the second ciphertext to obtain the first key.

[0146] like Figure 10 As shown, in this embodiment, S903 can refer to the relevant description in S2052 above.

[0147] S904, output the third prompt message, which is used to prompt the user to enter the first password.

[0148] After the user successfully verifies their third biometric password, the terminal device can output a third prompt message. This prompt message prompts the user to enter a first password, i.e., a new password. This first password can be either a first-type password or a second-type password. For example, after the user enters their fingerprint, interface 1102 can redirect to interface 1103, which can display controls for entering both the first-type and second-type passwords. The user can choose to enter either the first-type or the second-type first password.

[0149] S905: Collect the first password entered by the user. When the first password is a password of the second type, generate a second encrypted object.

[0150] Because the terminal device uses different encryption and decryption methods for the first type of password and the second type of password, in this embodiment, the terminal device can encrypt the first key based on the type of the first password entered by the user. Specifically, if the first password entered by the user is a second type of password, such as a fourth biometric password, this fourth biometric password can be different from the first biometric password. For example, if the first biometric password is a fingerprint, the fourth biometric password can be a face, iris, voiceprint, or other fingerprints different from the first biometric password. In this embodiment, a face is used as an example for illustration. For example, the user can select a control for the second type of password on interface 1103, and interface 1103 will jump to interface 1104. Interface 1104 can display selection controls for biometric passwords such as face, iris, voiceprint, and fingerprint. When the user clicks the "face" control, interface 1104 will jump to interface 1105. Interface 1105 prompts the user to register a face, and the user can register a face according to the guidance of the terminal device.

[0151] After collecting the fourth biometric password, the terminal device can generate a second encrypted object EO2. In this embodiment, the terminal device can generate the second encrypted object based on system feature information and / or application signature information, or based on the fourth biometric password. This process can be referred to the description of the terminal device generating the first encrypted object EO1. It should be noted that when the terminal device generates the second encrypted object based on system feature information and / or application signature information, the system feature information and / or application signature information used by the terminal device can be the same or different. Figure 10 The example illustrates how a terminal device generates a second encrypted object EO2 based on a fourth biometric password. For instance, when the terminal device captures a user's facial image, it can generate the second encrypted object EO2 based on that image.

[0152] S906, the first key is encrypted using the second encryption object to obtain the third ciphertext.

[0153] Similar to the encryption process of the first biometric password described above, the terminal device uses the second encryption object EO2 to encrypt the first key SK_ap, obtaining the third ciphertext CT_sk_u2. The terminal device can store the third ciphertext CT_sk_u2. It should be noted that after the user adds a fourth biometric password, the password setting interface can change from interface 1101 to... Figure 12The interface 1201 shown can also display a fourth biometric password set by the user, "face," compared to interface 1101. Optionally, interface 1201 can display delete controls, allowing the user to delete the set password. For example, delete controls can be displayed to the right of the fingerprint and face on interface 1201 respectively. For instance, if the user clicks the delete control to the right of the fingerprint, interface 1201 will redirect to interface 1202, which displays the user-set face. In this case, the user can only view the encrypted note 1 by entering their face.

[0154] After setting a primary password, the user can use this password to encrypt and decrypt Note 2 or Note 3. This process can be referenced from the process described above where the user encrypted and decrypted Note 1 using the primary biometric password. This section mainly describes the process by which the user can use the primary password (the new password) to view the content (Note 1) encrypted with the old password (the primary biometric password).

[0155] S907: When a user inputs a plaintext decryption request, a fourth prompt message is output, which prompts the user to enter a password.

[0156] The fourth prompt message may ask the user to enter a biometric password, such as a face or fingerprint. Figure 13 This is a schematic diagram illustrating another interface change of the terminal device provided in an embodiment of this application. For example... Figure 13 As shown, interface 1301 is the same as interface 403 described above. After the user sets the first password "face", if the user needs to view the encrypted note 1, the user can click "note 1" on interface 1301 to trigger a decryption request for the plaintext to be sent to the terminal device. Interface 1301 then redirects to interface 1302, which prompts the user to enter their fingerprint or face.

[0157] In one possible implementation, the first and fourth biometric passwords set by the user can be prioritized. Since the fourth biometric password set later by the user may be a password the user has recently preferred, it can be set to a higher priority. When the terminal device receives a decryption request for plaintext input by the user, the terminal device prompts the user to enter the fourth biometric password with the highest priority. It should be understood that if the user sets three or more passwords, when the terminal device receives a decryption request for plaintext input by the user, it can prompt the user to enter the password with the highest priority.

[0158] S908, if the second password input by the user is of the second type, then verify the second password. When the second password passes the verification, generate the second decryption object.

[0159] The terminal device can collect the second password entered by the user. When the second password is a second type of password, the second password can be a face or a fingerprint.

[0160] In one possible implementation, the terminal device can verify the second password using either a first biometric password or a fourth biometric password based on the biometric type of the second password. It should be understood that the biometric type can be the biometric type set by the user, such as a fingerprint or a face. Specifically, if the type of the second password is the same as the biometric type of the first biometric password, the terminal device can verify the second password using the first biometric password. If the type of the second password is the same as the biometric type of the fourth biometric password, the terminal device can verify the second password using the fourth biometric password. For example, if the second password is a face, the terminal device can verify the user-input face (second password) based on the user-registered face (fourth biometric password). It should be understood that the terminal device's ability to verify the second password using the fourth biometric password can be referred to the relevant description in S205 above.

[0161] In one possible implementation, the terminal device can verify the second password using either a first biometric password or a fourth biometric password. If either one passes verification, the second password is verified. For example, if the similarity between the second password and the first biometric password is greater than a preset similarity, or if the similarity between the second password and the fourth biometric password is greater than a preset similarity, then the second password is verified. If the user has set two different fingerprint passwords, the terminal device can use both fingerprint passwords to verify the second password.

[0162] In the following embodiments, the second password entered by the user is a face, the terminal device uses a fourth biometric password to verify the second password, and the second password is verified successfully as an example.

[0163] When the second password is verified, the terminal device can generate a second decryption object DO2. In this embodiment, the terminal device can generate the second decryption object based on system feature information and / or application signature information, or based on a fourth biometric password. This process can be referred to the description of the terminal device generating the first decryption object. Figure 10 The following example illustrates how a terminal device generates a second decryption object DO2 based on a fourth biometric password. The process of generating the second decryption object DO2 by the terminal device can be referred to the description of generating the first decryption object DO1 by the terminal device described above.

[0164] It should be understood that users can also enter their fingerprints to view the first encrypted message; the process can be referred to above. Figure 7 The relevant description is provided in the document. This embodiment of the application uses the example of a user viewing the first encrypted text using facial recognition for illustration.

[0165] S909, the second decryption object is used to decrypt the third ciphertext to obtain the first key.

[0166] Because the terminal device stores a third ciphertext CT_sk_u2, and this third ciphertext CT_sk_u2 is obtained by encrypting the first key SK_ap with the second encryption object EO2, the terminal device can use the second decryption object DO2 to decrypt the stored third ciphertext CT_sk_u2 to obtain the first key SK_ap.

[0167] S910 uses the first key to decrypt the first ciphertext, obtaining the plaintext.

[0168] The terminal device stores a first ciphertext CT_ap, which is obtained by encrypting plaintext PT_ap with a first key SK_ap. Therefore, the terminal device can use the decrypted first key SK_ap to decrypt the first ciphertext CT_ap to obtain the plaintext. For example, if the terminal device can view Note 1 using facial recognition, the above interface 1302 can jump to the interface 503 above to display the content of Note 1.

[0169] In this embodiment of the application, if the user adds and sets a fourth biometric password, the user can use the fourth biometric password to decrypt the first key encrypted with the first biometric password, and then view the plaintext encrypted with the first key. That is, the user can use the fourth biometric password to view the encrypted plaintext, and the user does not need to remember multiple passwords, thus improving the user experience.

[0170] The following explanation uses the first type of password as an example. The first type of password can be a numeric password, a pattern password, or a mixed password, etc. Figure 14 This is a flowchart illustrating another embodiment of the encryption / decryption method provided in this application. Figure 15 A simplified flowchart illustrating the process of setting the first cipher and using it for encryption and decryption. (See diagram below.) Figure 14 As shown, the encryption / decryption method provided in this application embodiment may include:

[0171] S1401, when a user's request to add a password is received, the first prompt message is output.

[0172] S1402: Collect the third biometric password input by the user, use the first biometric password to verify the third biometric password, and generate the first decryption object when the third biometric password passes the verification.

[0173] S1403, use the first decryption object to decrypt the second ciphertext to obtain the first key.

[0174] S1404, output the third prompt message.

[0175] The S1401-S1404 in the embodiments of this application can be referred to the relevant descriptions in S901-1004 above.

[0176] S1405: Collect the first password entered by the user. When the first password is a password of type 1, generate a second key based on the first password and the second random number.

[0177] Figure 16 This is a schematic diagram illustrating another interface change of the terminal device provided in an embodiment of this application. Figure 16 Interfaces 1601, 1602, and 1603 can be the same as interfaces 1101, 1102, and 1103 described above. In this embodiment, the user can choose to input a first type of password to set a first password. For example, the user can click the first type of password control on interface 1603, and interface 1603 will jump to interface 1604. Interface 1604 can display selection controls for numeric passwords (e.g., 6 digits), pattern passwords, mixed passwords, or numeric passwords of other lengths. When the user clicks the 6-digit numeric password control, interface 1604 will jump to interface 1605. Interface 1605 prompts the user to enter a 6-digit numeric password. Correspondingly, when the user enters a 6-digit numeric password, the terminal device can collect the 6-digit numeric password. This embodiment does not elaborate on the interface of the terminal device guiding the user to set a 6-digit numeric password.

[0178] In one possible implementation, in this embodiment of the application, the user can add a password in the password setting area displayed on interface 1601. For example, when the user clicks the numeric password option on interface 1601, interface 1601 can directly jump to interface 1605 to prompt the user to enter a numeric password.

[0179] It should be understood that the encryption and decryption process of the first type of cipher differs from that of the second type of cipher described above. For example... Figure 15 As shown, when the first password is a first type of password, the terminal device can generate a second key to encrypt the first key based on the first password. However, to increase the difficulty of cracking and improve the security of the first key, a second random number can be added in this embodiment. The terminal device can then generate a second key SK_u to encrypt the first key SK_ap based on the first password and the second random number. The method by which the terminal device generates the second key using the first password and the second random number can be, but is not limited to, a hash algorithm or an MD5 algorithm.

[0180] For example, after a user adds and sets a 6-digit numeric password, interface 1605 can redirect to interface 1606, which can display the password set by the user, such as a fingerprint or a 6-digit numeric password. It should be understood that... Figure 16The interface showing the successful setting of the first password and the process of returning to the password setting page are omitted. Optionally, a delete control can be displayed on interface 1106, allowing the user to delete the set password, as described above. Optionally, in this embodiment, a modification control can be displayed on interface 1606 for the 6-digit numeric password. By clicking the modification control, the user can modify the 6-digit numeric password to a new 6-digit numeric password.

[0181] S1406, the first key is encrypted using the second key to obtain the fourth ciphertext.

[0182] The terminal device can encrypt the first key SK_ap using the second key SK_u to obtain the fourth ciphertext CT_sk_u3. It should be understood that the terminal device can store the fourth ciphertext CT_sk_u3, which includes a second random number. For example, if the fourth ciphertext consists of a string of numbers and letters, the first to third characters of this string are the second random number. Similar to the above embodiments, the terminal device may not store the second key SK_u to prevent malicious applications from decrypting the fourth ciphertext CT_sk_u3 using the second key SK_u to obtain the first key SK_ap after the terminal device has been compromised, thus improving encryption and decryption security.

[0183] Corresponding to the above-mentioned setting of the first password, when a user uses the first password to view plaintext, the terminal device can perform the following steps:

[0184] S1407, when a user inputs a plaintext decryption request, the fourth prompt message is output.

[0185] The fourth prompt message may prompt the user to enter a biometric password or a first-type password, such as a fingerprint or a 6-digit numeric password. S1407 in this embodiment can be referred to the relevant description of S907 above. Figure 17 This is a schematic diagram illustrating another interface change of the terminal device provided in an embodiment of this application. For example... Figure 17 As shown, interface 1701 is the same as interface 403 described above. After the user sets the first password (6-digit numeric password), if the user needs to view the encrypted note 1, the user can click "Note 1" on interface 1701 to trigger a decryption request for the plaintext to be sent to the terminal device. Interface 1701 then redirects to interface 1702. Interface 1702 prompts the user to enter a 6-digit numeric password or fingerprint to guide the user to enter the first biometric password or first password.

[0186] S1408, if the second password entered by the user is a password of the first type, then generate a second key based on the second password and the second random number included in the fourth ciphertext.

[0187] like Figure 15 As shown, the terminal device can collect the first password entered by the user and generate a second key SK_u based on the first password and the second random number included in the fourth ciphertext CT_sk_u3. It should be understood that the user can also enter the first biometric password to view the first ciphertext; this process can be referred to the above. Figure 7 The relevant description is provided in the document. This embodiment of the application uses the example of a user viewing the first encrypted text using a first password for illustration.

[0188] In one possible implementation, S1408 above can be replaced by: if the second password entered by the user is a password of the first type, then the second password is verified using the first password; when the second password is verified, a second key is generated based on the second password and the second random number included in the fourth ciphertext.

[0189] Since both the first and second passwords are of the first type, the terminal device can verify the second password by comparing whether the first and second passwords are the same. If the first and second passwords are the same, the second password passes verification; if they are different, the second password fails verification. For example, if the first password is 1234 and the user enters the second password 2345, the terminal device determines that the first and second passwords are different, and the second password fails verification. If the user enters the second password 1234, then the first and second passwords are the same, and the second password passes verification.

[0190] Optionally, when the second password fails to verify, the terminal device may output a fifth prompt message, which is used to indicate to the user that the password entered is incorrect.

[0191] S1409, use the second key to decrypt the fourth ciphertext to obtain the first key.

[0192] Because the terminal device stores the fourth ciphertext CT_sk_u3, and this fourth ciphertext CT_sk_u3 is obtained by encrypting the first key SK_ap with the second key SK_u, the terminal device can use the decrypted second key SK_u to decrypt the stored fourth ciphertext CT_sk_u3 to obtain the first key SK_ap.

[0193] If the second password entered by the user differs from the first password set by the user, the second key generated by the terminal device cannot decrypt the fourth ciphertext. Optionally, the terminal device may output a fifth prompt message.

[0194] S1410, use the first key to decrypt the first ciphertext to obtain the plaintext.

[0195] In this embodiment, S1410 can be referred to the relevant description of S910 above. For example, the terminal device can decrypt Note 1 using a 6-digit numeric password, and the interface 1702 can jump to interface 503 to display the content of Note 1. In this embodiment, if the user adds a first type of password, the user can use that first type of password to decrypt and obtain a first key, and then use the first key to decrypt the encrypted plaintext, improving the user experience.

[0196] In this embodiment, the user can add a first type of password, and the user can use the added first type of password to decrypt plaintext encrypted with a first biometric password. The user does not need to remember the passwords corresponding to different plaintexts, which is convenient for the user and improves the user experience.

[0197] Figure 18 This is a schematic diagram of another structure of the terminal device in an embodiment of this application. Here, we will first combine... Figure 18 The execution environment in a terminal device is described below. The execution environment in a terminal device includes the application execution environment and the trusted execution environment (TEE). The trusted execution environment coexists with the application execution environment and provides security services for encryption and decryption processes within the terminal device. It should be understood that the trusted execution environment is an independent secure area within the terminal device. The terminal device can protect the data in the trusted execution environment through hardware and software, thereby ensuring the confidentiality and integrity of the data within the trusted execution environment. In short, data running in the trusted execution environment is confidential and tamper-proof. At least one application, such as a memo app, messaging app, or address book, can run in the application execution environment.

[0198] like Figure 18 As shown, the terminal device may include a random number generator, an encryption module, a decryption module, a first biometric password module, and a second biometric password module. The random number generator, encryption module, decryption module, and first biometric password module operate in an application execution environment, while the second biometric password module operates in a trusted execution environment.

[0199] A random number generator is used to generate a first random number and a second random number. A first biometric password module is used to collect biometric passwords. The first biometric password module may include units for collecting biometric passwords such as fingerprint units, face units, and iris units. During the encryption of plaintext by the terminal device, the first biometric password module can send the collected user's biometric password to a second biometric password module, which then executes steps S2031 and S905 in the above embodiments to generate a first encrypted object or a second encrypted object, and sends the first encrypted object or the second encrypted object to the encryption module. The encryption module is used to execute steps S2032, S2033, S906, S1405, and S1406 in the above embodiments to encrypt the plaintext. Similarly, during the decryption process of the terminal device, the first biometric password module can send the collected user's biometric password to the second biometric password module, which verifies the user's biometric password or generates a first or second decryption object based on the user's biometric password. This involves executing steps S2051, S902, S908, and S1402 in the above embodiments, and sending the generated first or second decryption object to the decryption module. The decryption module is used to execute steps S2052, S903, S909, S910, S1403, S1408, S1409, and S1410 in the above embodiments to decrypt the ciphertext.

[0200] It should be understood that in the embodiments of this application, the biometric password is verified by the second biometric password module running in the trusted execution environment, or the steps of generating the first encryption object, the first decryption object, the first encryption object, or the second decryption object in the above embodiments are executed, which can ensure that the first encryption object, the first decryption object, the first encryption object, or the second decryption object is not tampered with, thereby improving the security of encryption and decryption.

[0201] The above embodiments illustrate the encryption and decryption methods executed by the terminal device in this application embodiment. In this application embodiment, the encryption and decryption methods can also be implemented by the interaction between the terminal device and the server. Figure 19 This is a schematic diagram of the system architecture applicable to the encryption and decryption methods provided in the embodiments of this application. For example... Figure 19 As shown, the system architecture may include terminal devices and servers. The server can be an application server, an account server, or a key server; this embodiment does not limit the type of server. During the plaintext encryption process, the terminal device can interact with the server, which generates a first key and returns it to the terminal device. The terminal device then uses the first key to encrypt the plaintext.

[0202] Figure 20 This is a flowchart illustrating another embodiment of the encryption / decryption method provided in this application. Figure 20 As shown, S201 in the above embodiment can be replaced with:

[0203] S2011: When a user's biometric password setting request is received, a key request is sent to the server.

[0204] S2012, Receive the first key from the server and output the first prompt message.

[0205] In this approach, if a user possesses multiple terminal devices simultaneously, they can use different passwords to decrypt encrypted messages between these devices, thus improving the user experience. For example, a user has device 1 and device 2. The first key is generated by the terminal device based on a first random number, application signature information, or system characteristic information. Because the first random number is randomly generated, the first random numbers generated by device 1 and device 2 are different. Furthermore, if device 1 and device 2 use different systems, their system characteristic information will also be different. Therefore, when the user sets a first biometric password on device 1 and device 2, the first key on device 1 and device 2 will be different. If the user encrypts memo 1 on device 1 using a fingerprint and encrypts memo 1 on device 2 using facial recognition, then when device 1 sends the encrypted memo 1 from device 1 to device 2, the user can only decrypt the encrypted memo 1 using their fingerprint. Therefore, the user needs to remember multiple passwords.

[0206] However, in this embodiment, the first key is generated by the server. When the user sets the passwords for Device 1 and Device 2, the first key requested by Device 1 and Device 2 from the server is the same. Therefore, if the user encrypts Memo 1 on Device 1 using a fingerprint and encrypts Memo 1 on Device 2 using a face scan, then when Device 1 sends the encrypted Memo 1 from Device 1 to Device 2, according to the principle of the above encryption and decryption method, the user can decrypt the encrypted Memo 1 using either a fingerprint or a face scan. Optionally, when the server is an account server, Device 1 and Device 2 can log in to the same account to request the same first key from the account server.

[0207] In this method, when transmitting encrypted messages between multiple devices, the user can decrypt the encrypted messages using a password set on any one of the devices. The user does not need to remember passwords for multiple devices, which can improve the user experience.

[0208] It should be noted that the above Figure 18The modules shown can be one or more integrated circuits configured to implement the above methods, such as one or more application-specific integrated circuits (ASICs), one or more digital signal processors (DSPs), or one or more field-programmable gate arrays (FPGAs). For example, when one of the above modules is implemented through processing element scheduler code, the processing element can be a general-purpose processor, such as a central processing unit (CPU) or other processor capable of calling program code. Furthermore, these modules can be integrated together to implement a system-on-a-chip (SoC).

[0209] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of this application is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., a solid-state disk (SSD)).

[0210] The term "multiple" in this article refers to two or more. The term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. Furthermore, the character " / " in this article generally indicates an "or" relationship between the preceding and following related objects; in formulas, the character " / " indicates a "division" relationship between the preceding and following related objects.

[0211] It is understood that the various numerical designations used in the embodiments of this application are merely for descriptive convenience and are not intended to limit the scope of the embodiments of this application. In the embodiments of this application, the order of the above-mentioned process numbers does not imply the order of execution; the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

Claims

1. An encryption / decryption method, characterized in that, include: In response to the user's request to set a biometric password, a first key is generated; Output the first prompt message, which prompts the user to enter their biometric password; Collect the first biometric password entered by the user; In response to the user's request to encrypt plaintext, a first encrypted object is generated; The first key is encrypted using the first encryption object to obtain the second ciphertext; The plaintext is encrypted using the first key to obtain the first ciphertext; Delete the first key; In response to the user's input request to decrypt the plaintext, a second prompt message is output, prompting the user to enter a biometric password; Collect the second biometric password input by the user; The first biometric password is used to verify the second biometric password; When the second biometric password is verified, the first decryption object is generated; The first decryption object is used to decrypt the second ciphertext to obtain the first key; The first ciphertext is decrypted using the first key to obtain the plaintext; The method further includes: In response to the user's request to add a password, the second prompt message is output; Collect the third biometric password input by the user; The first biometric password is used to verify the third biometric password; When the third biometric password is verified, the first decryption object is generated; The first decryption object is used to decrypt the second ciphertext to obtain the first key; Output a third prompt message, which is used to prompt the user to enter a password.

2. The method according to claim 1, characterized in that, The generation of the first encrypted object includes: Based on the first biometric password, the first encrypted object is generated; The generation of the first decryption object includes: The first decryption object is generated based on the first biometric password.

3. The method according to claim 1, characterized in that, The generation of the first encrypted object includes: The first encrypted object is generated based on system feature information and / or application signature information; The generation of the first decryption object includes: The first decryption object is generated based on the system feature information and / or the application signature information.

4. The method according to any one of claims 1-3, characterized in that, The step of verifying the second biometric password using the first biometric password includes: The second biometric password and the first biometric password are compared and verified; When the similarity between the second biometric password and the first biometric password is greater than or equal to a preset similarity, the second biometric password passes verification.

5. The method according to any one of claims 1-3, characterized in that, The generation of the first key includes: The first key is generated based on at least one of the following: a first random number, the application's signature information, and system characteristic information.

6. The method according to claim 1, characterized in that, After outputting the third prompt message, the following is also included: Collect the first password entered by the user; The first key is encrypted based on the type of the first password input by the user.

7. The method according to claim 6, characterized in that, The step of encrypting the first key based on the type of the first password input by the user includes: If the first password is a password of the second type, then a second encrypted object is generated, where the second type of password is a biometric password; The first key is encrypted using the second encryption object to obtain the third ciphertext.

8. The method according to claim 6, characterized in that, The step of encrypting the first key based on the type of the first password input by the user includes: If the first password is a first type of password, then a second key is generated based on the first password and the second random number. The first type of password is a numeric password, a pattern password, or a mixed password. The first key is encrypted using the second key to obtain the fourth ciphertext.

9. The method according to claim 7 or 8, characterized in that, The method further includes: In response to the user's request to decrypt the plaintext, a fourth prompt message is output, which prompts the user to enter a password; When the second password input by the user is collected, the first ciphertext is decrypted according to the second password to obtain the plaintext.

10. The method according to claim 9, characterized in that, The step of decrypting the first ciphertext according to the second cipher to obtain the plaintext includes: When the second password is a password of the second type, verify the second password; When the second password is verified, a second decryption object is generated; The third ciphertext is decrypted using the second decryption object to obtain the first key; The first ciphertext is decrypted using the first key to obtain the plaintext.

11. The method according to claim 9, characterized in that, The fourth ciphertext includes a second random number. The step of decrypting the first ciphertext according to the second ciphertext to obtain the plaintext includes: When the second password is a password of the first type, a second key is generated based on the second password and the second random number included in the fourth ciphertext; The fourth ciphertext is decrypted using the second key to obtain the first key; The first ciphertext is decrypted using the first key to obtain the plaintext.

12. An encryption / decryption device, characterized in that, include: An encryption module is used to generate a first key in response to a user's biometric password setting request; The output module is used to output the first prompt information, which prompts the user to enter the biometric password. The first biometric password module is used to collect the first biometric password entered by the user. The encryption module is further configured to generate a first encryption object in response to the encryption request of the plaintext input by the user; The first key is encrypted using the first encryption object to obtain the second ciphertext; The plaintext is encrypted using the first key to obtain the first ciphertext; the first key is then deleted. The output module is also configured to respond to the user's plaintext decryption request and output a second prompt message, which prompts the user to enter a biometric password. The first biometric password module is also used to collect the second biometric password input by the user; The second biometric password module is used to verify the second biometric password using the first biometric password; The decryption module is used to generate a first decryption object when the second biometric password is verified. The first decryption object is used to decrypt the second ciphertext to obtain the first key; The first ciphertext is decrypted using the first key to obtain the plaintext; The output module is also configured to output the second prompt information in response to the user's request to add a password; The first biometric password module is also used to collect the third biometric password input by the user; The second biometric password module is further configured to verify the third biometric password using the first biometric password; The decryption module is also used to generate the first decryption object when the third biometric password is verified. The first decryption object is used to decrypt the second ciphertext to obtain the first key; The output module is also used to output a third prompt message, which prompts the user to enter a password.

13. An electronic device, characterized in that, include: A memory, a processor, and a display; wherein the processor is configured to couple with the memory and the display; The display is used to output prompt information; The memory is used to store computer-executable program code, which includes instructions; The processor is used to read and execute instructions in the memory to implement the method of any one of claims 1-11.

14. A computer-readable storage medium, characterized in that, The computer storage medium stores computer instructions, which, when executed by a computer, cause the computer to perform the method according to any one of claims 1-11.

15. A computer program product, characterized in that, The computer program product includes computer instructions that, when executed by a computer, cause the computer to perform the method according to any one of claims 1-11.

Images