Method and apparatus for storing cipher text

Abstract

This application provides a method and apparatus for storing encrypted data. The method includes: displaying an encryption settings interface of an external storage device; receiving a first operation performed by a user on the encryption settings interface; encrypting a file in the external storage device in response to the first operation; receiving a second operation from the user; displaying a factory reset settings interface in response to the second operation; receiving a third operation performed by the user on the factory reset settings interface; performing a factory reset in response to the third operation; displaying an account verification interface; receiving verification information entered by the user on the account verification interface; and decrypting the encrypted file in the external storage device when the verification information passes verification, and when receiving an operation from the user to access a file in the external storage device. The above method and apparatus can solve the problem that data in the external storage device cannot be decrypted after a factory reset of an electronic device.

Description

[0001] This application is a divisional application of Chinese patent application filed on May 24, 2021, with application number 202110566480.8 and title "Method and apparatus for storing encrypted text". Technical Field

[0002] This application relates to the field of terminals, specifically to a method and apparatus for storing encrypted text. Background Technology

[0003] With the emergence of data-intensive services such as enhanced mobile broadband (eMBB) and high-definition video, electronic devices face the problem of insufficient storage space. External storage devices (such as secure digital storage cards, SD cards) connected to electronic devices can solve this problem. To ensure data security, the data on external storage devices needs to be encrypted and stored.

[0004] The key for the external storage is encrypted with the lock screen password and stored in the erasable partition of the electronic device. When the user performs a factory reset on the electronic device, the encrypted key (i.e., ciphertext) in the erasable partition is deleted before it can be saved, thus making the data in the external storage undecryptable. Summary of the Invention

[0005] This application provides a method and apparatus for storing encrypted data, which can solve the problem that data in external memory cannot be decrypted after an electronic device performs a factory-level reset.

[0006] In a first aspect, a method for storing ciphertext is provided, comprising: obtaining an encryption instruction, the encryption instruction instructing the encryption of a file in an external storage device; obtaining a feature value of a first account identifier according to the encryption instruction; encrypting a first key using the feature value of the first account identifier to generate first ciphertext, wherein the first key is used to encrypt a second key, and the second key is used to encrypt a first file in the external storage device; encrypting the feature value of the first account identifier to generate second ciphertext; and storing the first ciphertext and the second ciphertext in an ineradicable partition.

[0007] The encryption command is triggered by the user when encrypting the external storage device in the encryption settings interface. After the electronic device receives the encryption command, it generates a first ciphertext and a second ciphertext, and stores the first ciphertext and the second ciphertext in the non-erasable partition of the electronic device. In this way, the electronic device has completed the secure storage of the first ciphertext and the second ciphertext before the user performs a factory reset. After the electronic device completes the factory reset, the first key can be recovered from the non-erasable partition. Then, the first key can be used to decrypt the second key in the external storage device, and the second key can be used to decrypt the files in the external storage device, thereby solving the problem that files in the external storage device cannot be decrypted after a factory reset.

[0008] Optionally, the method further includes: obtaining instruction information for switching accounts; verifying the first account identifier according to the instruction information; after the first account identifier is verified, obtaining the feature value of the second account identifier; and updating the first ciphertext and the second ciphertext according to the feature value of the second account identifier.

[0009] Users can switch their currently logged-in account identifier (e.g., first account identifier) ​​on the account login interface. After the user triggers the electronic device to generate an instruction to switch accounts on the login interface, the electronic device can ask the user to enter the password corresponding to the first account identifier and verify the first account identifier. If the first account identifier is verified successfully, it indicates that the user switching account identifiers is a legitimate user. The electronic device can then obtain the second account identifier entered by the user and calculate its hash value (an example of a feature value). Subsequently, it uses the hash value of the second account identifier to update the first ciphertext and the second ciphertext. Specifically, the electronic device can first decrypt the first key, then use the hash value of the second account identifier to generate the updated first ciphertext, and then encrypt the hash value of the second account identifier to generate the updated second ciphertext. This scheme, after determining that the current user (the user switching account identifiers) is a legitimate user, uses the current user's account identifier (second account identifier) ​​to update the first and second ciphertexts, thereby removing the encryption and decryption permissions of the external storage device corresponding to the first account identifier, thus ensuring the security of the data in the external storage device.

[0010] Optionally, the method further includes: after the factory-level reset is completed, verifying the first account identifier; when the first account identifier is successfully verified, decrypting the first ciphertext and the second ciphertext to generate the first key.

[0011] After an electronic device undergoes a factory reset, an account verification mechanism is activated. This mechanism requires successful account verification before the electronic device can be used normally. Verifying the last logged-in account identifier before the factory reset (e.g., the first account identifier) ​​ensures that the user after the factory reset is a legitimate user, thereby ensuring the security of data stored on external storage.

[0012] Optionally, verifying the first account identifier includes:

[0013] When the factory reset protection (FRP) state is triggered, verify the first account identifier.

[0014] Optionally, the method further includes: encrypting the first key using a default value to generate a third ciphertext; encrypting the default value to generate a fourth ciphertext; and storing the third ciphertext and the fourth ciphertext in the non-erasable partition.

[0015] Since users may switch accounts, there is a risk of data leakage if the electronic device continues to use the first account identifier or the second account identifier to encrypt and save the first key after performing a factory reset. The electronic device can use the default value to encrypt and save the first key after decrypting it, thereby ensuring the security of the data in the external storage.

[0016] Optionally, the method further includes: copying the third ciphertext and the fourth ciphertext from the non-erasable partition to the erasable partition; generating the first key based on the third ciphertext and the fourth ciphertext in the erasable partition; and decrypting the encrypted first file in the external storage based on the first key.

[0017] Optionally, before verifying the first account identifier, the method further includes: obtaining a factory-level reset command triggered by the recovery interface; and formatting the data in the erasable partition according to the factory-level reset command.

[0018] Optionally, encrypting the first key using the feature value of the first account identifier includes: calling the key management module keymaster TA to execute: encrypting the first key using the feature value of the first account identifier; encrypting the feature value of the first account identifier includes: calling the keymaster TA to execute: encrypting the feature value of the first account identifier.

[0019] Optionally, storing the first ciphertext and the second ciphertext in the non-erasable partition includes: calling a trusted execution environment application programming interface to execute: storing the first ciphertext and the second ciphertext in the non-erasable partition.

[0020] Optionally, the first key is also used to encrypt a third key, which is used to encrypt a second file encrypted in the external storage.

[0021] Optionally, the method further includes: obtaining the feature value of the lock screen password according to the encryption instruction; encrypting the first key with the feature value of the lock screen password to generate a fifth ciphertext; encrypting the feature value of the lock screen password to generate a sixth ciphertext; and storing the fifth ciphertext and the sixth ciphertext in an erasable partition.

[0022] Optionally, encrypting the first key using the feature value of the lock screen password includes: calling keymaster TA to perform: encrypting the first key using the feature value of the lock screen password; encrypting the feature value of the lock screen password includes: calling keymaster TA to perform: encrypting the feature value of the lock screen password.

[0023] Optionally, the method further includes: obtaining a user-level reset command triggered by the settings interface; and backing up the fifth ciphertext and the sixth ciphertext to the non-erasable partition according to the user-level reset command.

[0024] Optionally, backing up the fifth ciphertext and the sixth ciphertext to the non-erasable partition according to the user-level reset instruction includes: decrypting the first key from the fifth ciphertext and the sixth ciphertext according to the user-level reset instruction; encrypting the first key using a default value to generate a seventh ciphertext; encrypting the default value to generate an eighth ciphertext; and storing the seventh ciphertext and the eighth ciphertext in the non-erasable partition.

[0025] Optionally, the method further includes: after a user-level reset is completed, copying the seventh ciphertext and the eighth ciphertext from the non-erasable partition to the erasable partition; decrypting the first key from the seventh ciphertext and the eighth ciphertext in the erasable partition; and decrypting the first file encrypted in the external storage according to the first key.

[0026] Optionally, the erasable partition is a data partition, and the characteristic value of the lock screen password is the hash value of the lock screen password.

[0027] Optionally, the non-erasable partition is a sec_storage partition, and the characteristic value of the first account identifier is the hash value of the first account identifier.

[0028] Secondly, another method for storing encrypted data is provided, comprising: displaying an encryption settings interface of an external storage device; receiving a first operation performed by a user on the encryption settings interface; encrypting a file in the external storage device in response to the first operation; receiving a second operation performed by the user; displaying a factory-level reset settings interface in response to the second operation; receiving a third operation performed by the user on the factory-level reset settings interface; performing a factory-level reset in response to the third operation; displaying an account verification interface; receiving verification information entered by the user on the account verification interface; and decrypting the encrypted file in the external storage device when the verification information passes verification, and when an operation by the user to access a file in the external storage device is received.

[0029] The encryption command is triggered by the user when encrypting the external storage device in the encryption settings interface. After the electronic device receives the encryption command, it generates a first ciphertext and a second ciphertext, and stores the first and second ciphertexts in the non-erasable partition of the electronic device. In this way, the electronic device has completed the secure storage of the first and second ciphertexts before the user performs a factory reset. After the electronic device completes the factory reset, it can recover the first key from the non-erasable partition, and then use the first key to decrypt the second key in the external storage device, and use the second key to decrypt the files in the external storage device, thereby solving the problem that files in the external storage device cannot be decrypted after a factory reset.

[0030] Thirdly, an apparatus for storing encrypted text is provided, including a unit for performing either the first or second method. The apparatus may be a terminal device or a chip within a terminal device. The apparatus may include an input unit and a processing unit.

[0031] When the device is a terminal device, the processing unit may be a processor, and the input unit may be a communication interface; the terminal device may also include a memory for storing computer program code, which, when the processor executes the computer program code stored in the memory, causes the terminal device to perform either the first aspect or the second aspect.

[0032] When the device is a chip within a terminal device, the processing unit can be an internal processing unit of the chip, and the input unit can be an output interface, pin, or circuit, etc.; the chip may also include a memory, which can be an internal memory of the chip (e.g., registers, cache, etc.) or an external memory (e.g., read-only memory, random access memory, etc.); the memory is used to store computer program code, and when the processor executes the computer program code stored in the memory, it causes the chip to execute either the first aspect or the second aspect.

[0033] Fourthly, a computer-readable storage medium is provided that stores computer program code, which, when executed by a device storing encrypted text, causes the device to perform either the method of the first aspect or the second aspect.

[0034] Fifthly, a computer program product is provided, the computer program product comprising: computer program code, which, when the computer program code is run by a device storing encrypted text, causes the device to perform any one of the methods of the first aspect or the second aspect. Attached Figure Description

[0035] Figure 1 This is a schematic diagram of a hardware system applicable to the apparatus of this application;

[0036] Figure 2 This is a schematic diagram of a software system applicable to the apparatus of this application;

[0037] Figure 3 This is a schematic diagram of an encryption settings interface provided in this application;

[0038] Figure 4 This is a schematic diagram of an encrypted confirmation interface provided in this application;

[0039] Figure 5 This is a schematic diagram of an encryption process interface provided in this application;

[0040] Figure 6 This is a schematic diagram of a method for storing a key provided in this application;

[0041] Figure 7 This is a schematic diagram of an encryption process provided in this application;

[0042] Figure 8 This is a schematic diagram of a method for backing up and restoring keys in a user-level reset scenario provided in this application;

[0043] Figure 9 This is a schematic diagram illustrating the changes in encrypted storage in a storage area during a user-level reset scenario provided in this application;

[0044] Figure 10 This is a schematic diagram of a method for backing up keys in a factory-level reset scenario provided in this application;

[0045] Figure 11 This is a schematic diagram of an account login interface provided in this application;

[0046] Figure 12 This is a schematic diagram illustrating the changes in encrypted storage in the storage area when switching accounts, as provided in this application.

[0047] Figure 13 This is a schematic diagram of a factory-level reset settings interface provided in this application;

[0048] Figure 14 This is a schematic diagram of a factory-level reset confirmation interface provided in this application;

[0049] Figure 15 This is a schematic diagram of a factory-level reset process interface provided in this application;

[0050] Figure 16 This is a schematic diagram of a recovery key method in a factory-level reset scenario provided in this application;

[0051] Figure 17 This is a schematic diagram of an account verification interface provided in this application;

[0052] Figure 18 This is a schematic diagram illustrating the changes in encrypted storage in a storage area during a factory-level reset scenario provided in this application;

[0053] Figure 19 This is a schematic diagram of a device for storing encrypted text provided in this application;

[0054] Figure 20 This is a schematic diagram of an electronic device for storing encrypted text provided in this application. Detailed Implementation

[0055] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0056] Figure 1 A hardware system suitable for the apparatus of this application is shown.

[0057] Device 100 may be a mobile phone, smart screen, tablet computer, wearable electronic device, in-vehicle electronic device, augmented reality (AR) device, virtual reality (VR) device, laptop computer, ultra-mobile personal computer (UMPC), netbook, personal digital assistant (PDA), projector, etc. This application embodiment does not limit the specific type of device 100.

[0058] Device 100 may include a processor 110, an external memory interface 120, an internal memory 121, a universal serial bus (USB) interface 130, a charging management module 140, a power management module 141, a battery 142, an antenna 1, an antenna 2, a mobile communication module 150, a wireless communication module 160, an audio module 170, a speaker 170A, a receiver 170B, a microphone 170C, a headphone jack 170D, a sensor module 180, buttons 190, a motor 191, an indicator 192, a camera 193, a display screen 194, and a subscriber identification module (SIM) card interface 195, etc. The sensor module 180 may include a pressure sensor 180A, a gyroscope sensor 180B, a barometric pressure sensor 180C, a magnetic sensor 180D, an accelerometer sensor 180E, a distance sensor 180F, a proximity sensor 180G, a fingerprint sensor 180H, a temperature sensor 180J, a touch sensor 180K, an ambient light sensor 180L, a bone conduction sensor 180M, etc.

[0059] It should be noted that, Figure 1 The structure shown does not constitute a specific limitation on device 100. In other embodiments of this application, device 100 may include a... Figure 1 The components shown may include more or fewer components, or the device 100 may include... Figure 1 The components shown may be a combination of certain components, or the device 100 may include... Figure 1 Sub-components of some of the components shown. Figure 1 The components shown can be implemented in hardware, software, or a combination of software and hardware.

[0060] Processor 110 may include one or more processing units. For example, processor 110 may include at least one of the following processing units: application processor (AP), modem processor, graphics processing unit (GPU), image signal processor (ISP), controller, video codec, digital signal processor (DSP), baseband processor, and neural network processing unit (NPU). These different processing units may be independent devices or integrated devices.

[0061] The controller can generate operation control signals based on the instruction opcode and timing signals to complete the control of instruction fetching and execution.

[0062] The processor 110 may also include a memory for storing instructions and data. In some embodiments, the memory in the processor 110 is a cache memory. This memory can store instructions or data that the processor 110 has just used or that are used repeatedly. If the processor 110 needs to use the instruction or data again, it can retrieve it directly from the memory. This avoids repeated accesses, reduces the waiting time of the processor 110, and thus improves the efficiency of the system.

[0063] In some embodiments, processor 110 may include one or more interfaces. For example, processor 110 may include at least one of the following interfaces: an inter-integrated circuit (I2C) interface, an inter-integrated circuit sound (I2S) interface, a pulse code modulation (PCM) interface, a universal asynchronous receiver / transmitter (UART) interface, a mobile industry processor interface (MIPI), a general-purpose input / output (GPIO) interface, a SIM interface, and a USB interface.

[0064] The I2C interface is a bidirectional synchronous serial bus, including a serial data line (SDA) and a serial clock line (SCL). In some embodiments, the processor 110 may include multiple I2C buses. The processor 110 can couple to the touch sensor 180K, charger, flash, camera 193, etc., through different I2C bus interfaces. For example, the processor 110 can couple to the touch sensor 180K through the I2C interface, enabling the processor 110 and the touch sensor 180K to communicate through the I2C bus interface, thereby realizing the touch function of the device 100.

[0065] The I2S interface can be used for audio communication. In some embodiments, the processor 110 may include multiple I2S buses. The processor 110 can be coupled to the audio module 170 via the I2S bus to enable communication between the processor 110 and the audio module 170. In some embodiments, the audio module 170 can transmit audio signals to the wireless communication module 160 via the I2S interface to enable the function of answering phone calls through a Bluetooth headset.

[0066] The PCM interface can also be used for audio communication, sampling, quantizing, and encoding analog signals. In some embodiments, the audio module 170 and the wireless communication module 160 can be coupled via the PCM interface. In some embodiments, the audio module 170 can also transmit audio signals to the wireless communication module 160 via the PCM interface, enabling the function of answering phone calls through a Bluetooth headset. Both the I2S interface and the PCM interface can be used for audio communication.

[0067] The UART interface is a universal serial data bus used for asynchronous communication. This bus can be a bidirectional communication bus. It converts the data to be transmitted between serial and parallel communication. In some embodiments, the UART interface is typically used to connect the processor 110 and the wireless communication module 160. For example, the processor 110 communicates with the Bluetooth module in the wireless communication module 160 via the UART interface to implement Bluetooth functionality. In some embodiments, the audio module 170 can transmit audio signals to the wireless communication module 160 via the UART interface to enable music playback through Bluetooth headphones.

[0068] The MIPI interface can be used to connect the processor 110 to peripheral devices such as the display screen 194 and the camera 193. The MIPI interface includes a camera serial interface (CSI) and a display serial interface (DSI). In some embodiments, the processor 110 and the camera 193 communicate via the CSI interface to enable the shooting function of the device 100. The processor 110 and the display screen 194 communicate via the DSI interface to enable the display function of the device 100.

[0069] The GPIO interface can be configured via software. It can be configured as a control signal interface or a data signal interface. In some embodiments, the GPIO interface can be used to connect the processor 110 to the camera 193, display screen 194, wireless communication module 160, audio module 170, and sensor module 180. The GPIO interface can also be configured as an I2C interface, I2S interface, UART interface, or MIPI interface.

[0070] USB interface 130 is a USB standard compliant interface, such as a Mini USB, Micro USB, or USB Type-C interface. USB interface 130 can be used to connect a charger to charge device 100, to transfer data between device 100 and peripheral devices, and to connect headphones for audio playback. USB interface 130 can also be used to connect other devices 100, such as AR devices.

[0071] Figure 1 The connection relationships between the modules shown are merely illustrative and do not constitute a limitation on the connection relationships between the modules of device 100. Optionally, the modules of device 100 may also adopt a combination of various connection methods described in the above embodiments.

[0072] The charging management module 140 receives power from a charger. The charger can be a wireless charger or a wired charger. In some wired charging embodiments, the charging management module 140 receives current from the wired charger via the USB interface 130. In some wireless charging embodiments, the charging management module 140 receives electromagnetic waves (current path shown as dashed lines) via the wireless charging coil of the device 100. While charging the battery 142, the charging management module 140 can also supply power to the device 100 via the power management module 141.

[0073] The power management module 141 connects the battery 142, the charging management module 140, and the processor 110. The power management module 141 receives input from the battery 142 and / or the charging management module 140, providing power to the processor 110, internal memory 121, display screen 194, camera 193, and wireless communication module 160, etc. The power management module 141 can also monitor parameters such as battery capacity, battery cycle count, and battery health status (e.g., leakage current, impedance). Optionally, the power management module 141 can be located within the processor 110, or the power management module 141 and the charging management module 140 can be located in the same device.

[0074] The wireless communication function of device 100 can be implemented by devices such as antenna 1, antenna 2, mobile communication module 150, wireless communication module 160, modem processor and baseband processor.

[0075] Antennas 1 and 2 are used to transmit and receive electromagnetic wave signals. Each antenna in device 100 can be used to cover one or more communication frequency bands. Different antennas can also be multiplexed to improve antenna utilization. For example, antenna 1 can be multiplexed as a diversity antenna for a wireless local area network. In some other embodiments, the antennas can be used in conjunction with a tuning switch.

[0076] Mobile communication module 150 can provide a wireless communication solution applied to device 100, such as at least one of the following: second generation (2G) th Generation 2G mobile communication solutions, third generation (3G) th Generation 3G mobile communication solutions, fourth generation (4G) th 5G mobile communication solutions, fifth generation (5G) th (5G) mobile communication solutions. The mobile communication module 150 may include at least one filter, switch, power amplifier, low noise amplifier (LNA), etc. The mobile communication module 150 can receive electromagnetic waves via antenna 1, and perform filtering and amplification on the received electromagnetic waves before transmitting them to a modem processor for demodulation. The mobile communication module 150 can also amplify the signal modulated by the modem processor, and the amplified signal is converted into electromagnetic waves and radiated out via antenna 1. In some embodiments, at least some functional modules of the mobile communication module 150 may be housed in the processor 110. In some embodiments, at least some functional modules of the mobile communication module 150 and at least some modules of the processor 110 may be housed in the same device.

[0077] The modem processor may include a modulator and a demodulator. The modulator modulates a low-frequency baseband signal to be transmitted into a mid-to-high frequency signal. The demodulator demodulates a received electromagnetic wave signal into a low-frequency baseband signal. The demodulator then transmits the demodulated low-frequency baseband signal to the baseband processor for processing. After processing by the baseband processor, the low-frequency baseband signal is transmitted to the application processor. The application processor outputs sound signals through audio devices (e.g., speaker 170A, receiver 170B) or displays images or videos through the display screen 194. In some embodiments, the modem processor may be a separate device. In other embodiments, the modem processor may be independent of the processor 110 and may be housed in the same device as the mobile communication module 150 or other functional modules.

[0078] Similar to the mobile communication module 150, the wireless communication module 160 can also provide a wireless communication solution applied to the device 100, such as at least one of the following: wireless local area networks (WLAN), Bluetooth (BT), Bluetooth Low Energy (BLE), ultra-wideband (UWB), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), and infrared (IR) technology. The wireless communication module 160 can be one or more devices integrating at least one communication processing module. The wireless communication module 160 receives electromagnetic waves via antenna 2, performs frequency modulation and filtering of the electromagnetic wave signal, and sends the processed signal to processor 110. The wireless communication module 160 can also receive signals to be transmitted from processor 110, perform frequency modulation and amplification on them, and convert the signals into electromagnetic waves that are radiated via antenna 2.

[0079] In some embodiments, antenna 1 of device 100 is coupled to mobile communication module 150, and antenna 2 of device 100 is coupled to wireless communication module 160, enabling electronic device 100 to communicate with networks and other electronic devices via wireless communication technology. This wireless communication technology may include at least one of the following communication technologies: Global System for Mobile Communications (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Time-Division Code Division Multiple Access (TD-SCDMA), Long Term Evolution (LTE), BT, GNSS, WLAN, NFC, FM, and IR technologies. The GNSS may include at least one of the following positioning technologies: Global Positioning System (GPS), Global Navigation Satellite System (GLONASS), BeiDou Navigation Satellite System (BDS), Quasi-Zenith Satellite System (QZSS), and Satellite Based Augmentation System (SBAS).

[0080] Device 100 can implement display functions via a GPU, a display screen 194, and an application processor. The GPU is a microprocessor for image processing, connected to the display screen 194 and the application processor. The GPU is used to perform mathematical and geometric calculations for graphics rendering. Processor 110 may include one or more GPUs, which execute program instructions to generate or modify display information.

[0081] The display screen 194 can be used to display images or videos. The display screen 194 includes a display panel. The display panel can be a liquid crystal display (LCD), an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode (AMOLED), a flexible light-emitting diode (FLED), a mini light-emitting diode (Mini LED), a micro light-emitting diode (Micro LED), a micro OLED, or a quantum dot light-emitting diode (QLED). In some embodiments, the device 100 may include one or N displays 194, where N is a positive integer greater than 1.

[0082] The device 100 can perform shooting functions through an ISP, camera 193, video codec, GPU, display 194, and application processor.

[0083] The ISP (Image Signal Processor) is used to process data fed back from the camera 193. For example, when taking a picture, the shutter is opened, and light is transmitted through the lens to the camera's photosensitive element. The light signal is converted into an electrical signal, and the camera's photosensitive element transmits the electrical signal to the ISP for processing, transforming it into an image visible to the naked eye. The ISP can perform algorithmic optimization of image noise, brightness, and color. The ISP can also optimize parameters such as exposure and color temperature of the shooting scene. In some embodiments, the ISP can be set in the camera 193.

[0084] Camera 193 is used to capture still images or videos. An object is projected onto a photosensitive element by generating an optical image through the lens. The photosensitive element can be a charge-coupled device (CCD) or a complementary metal-oxide-semiconductor (CMOS) phototransistor. The photosensitive element converts the light signal into an electrical signal, which is then passed to an ISP for conversion into a digital image signal. The ISP outputs the digital image signal to a DSP for processing. The DSP converts the digital image signal into a standard red-green-blue (RGB), YUV, or other image signal format. In some embodiments, device 100 may include one or N cameras 193, where N is a positive integer greater than 1.

[0085] A digital signal processor (DSP) is used to process digital signals. Besides digital image signals, it can also process other digital signals. For example, when device 100 selects a frequency point, the DSP can perform Fourier transforms on the frequency energy.

[0086] Video codecs are used to compress or decompress digital video. Device 100 may support one or more video codecs. Thus, device 100 can play or record video in various encoding formats, such as Moving Picture Experts Group (MPEG) 1, MPEG 2, MPEG 3, and MPEG 4.

[0087] An NPU (Neural Processing Unit) is a processor that borrows from the structure of biological neural networks, such as the transmission patterns between neurons in the human brain, to quickly process input information and continuously learn. Through an NPU, device 100 can achieve intelligent cognitive functions, such as image recognition, facial recognition, speech recognition, and text understanding.

[0088] The external storage interface 120 can be used to connect an external storage card, such as a secure digital (SD) card, to enable the storage capacity of the expansion device 100. The external storage card communicates with the processor 110 through the external storage interface 120 to perform data storage functions. For example, music, video, and other files can be saved on the external storage card.

[0089] Internal memory 121 can be used to store computer executable program code, which includes instructions. Internal memory 121 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function (e.g., sound playback and image playback). The data storage area may store data created during the use of device 100 (e.g., audio data and phonebook). Furthermore, internal memory 121 may include high-speed random access memory and may also include non-volatile memory, such as at least one disk storage device, flash memory device, and universal flash storage (UFS). Processor 110 executes various processing methods of device 100 by running instructions stored in internal memory 121 and / or instructions stored in memory disposed in the processor.

[0090] The device 100 can implement audio functions, such as music playback and recording, through an audio module 170, a speaker 170A, a receiver 170B, a microphone 170C, a headphone jack 170D, and an application processor.

[0091] The audio module 170 is used to convert digital audio information into analog audio signals for output, and can also be used to convert analog audio input into digital audio signals. The audio module 170 can also be used for encoding and decoding audio signals. In some embodiments, the audio module 170, or some functional modules of the audio module 170, can be located in the processor 110.

[0092] The speaker 170A, also known as a loudspeaker, is used to convert audio electrical signals into sound signals. The device 100 can listen to music or make hands-free calls through the speaker 170A.

[0093] The receiver 170B, also known as the earpiece, is used to convert audio electrical signals into sound signals. When a user uses device 100 to answer a phone call or voice message, they can listen to the voice by bringing the receiver 170B close to their ear.

[0094] Microphone 170C, also known as a microphone or transducer, is used to convert sound signals into electrical signals. When a user makes a phone call or sends a voice message, they can input a sound signal into microphone 170C by speaking close to it. Device 100 may include at least one microphone 170C. In some embodiments, device 100 may include two microphones 170C to achieve noise reduction. In other embodiments, device 100 may also include three, four, or more microphones 170C to achieve functions such as sound source identification and directional recording. Processor 110 can process the electrical signals output by microphone 170C. For example, audio module 170 and wireless communication module 160 can be coupled through a PCM interface. After microphone 170C converts ambient sound into an electrical signal (such as a PCM signal), it transmits the electrical signal to processor 110 through the PCM interface. Processor 110 performs volume and frequency analysis on the electrical signal to determine the volume and frequency of the ambient sound.

[0095] The 170D headphone jack is used to connect wired headphones. The 170D headphone jack can be a USB 130 interface or a 3.5mm Open Mobile Terminal Platform (OMTP) standard interface, a CTIA (Cellular Telecommunications Industry Association of the USA) standard interface.

[0096] Pressure sensor 180A is used to sense pressure signals and can convert the pressure signals into electrical signals. In some embodiments, pressure sensor 180A can be disposed on display screen 194. Pressure sensor 180A can be of many types, such as resistive pressure sensor, inductive pressure sensor, or capacitive pressure sensor. Capacitive pressure sensor can include at least two parallel plates with conductive material. When force is applied to pressure sensor 180A, the capacitance between the electrodes changes, and device 100 determines the pressure intensity based on the change in capacitance. When a touch operation is applied to display screen 194, device 100 detects the touch operation based on pressure sensor 180A. Device 100 can also calculate the touch position based on the detection signal from pressure sensor 180A. In some embodiments, touch operations applied to the same touch position but with different touch operation intensities can correspond to different operation commands. For example: when a touch operation with an intensity less than a first pressure threshold is applied to the SMS application icon, a command to view an SMS is executed; when a touch operation with an intensity greater than or equal to the first pressure threshold is applied to the SMS application icon, a command to create a new SMS is executed.

[0097] The gyroscope sensor 180B can be used to determine the motion attitude of the device 100. In some embodiments, the gyroscope sensor 180B can determine the angular velocity of the device 100 around three axes (i.e., the x-axis, y-axis, and z-axis). The gyroscope sensor 180B can be used for image stabilization. For example, when the shutter is pressed, the gyroscope sensor 180B detects the angle of the device 100's shake, calculates the distance that the lens module needs to compensate based on the angle, and allows the lens to counteract the shake of the device 100 through reverse movement, thus achieving image stabilization. The gyroscope sensor 180B can also be used in scenarios such as navigation and motion-sensing games.

[0098] The barometric pressure sensor 180C is used to measure air pressure. In some embodiments, the device 100 calculates altitude using the air pressure value measured by the barometric pressure sensor 180C to assist in positioning and navigation.

[0099] The magnetic sensor 180D includes a Hall sensor. The device 100 can use the magnetic sensor 180D to detect the opening and closing of the flip cover. In some embodiments, when the device 100 is a flip phone, the device 100 can detect the opening and closing of the flip cover based on the magnetic sensor 180D. The device 100 can set features such as automatic flip unlocking based on the detected opening and closing state of the cover or the flip cover.

[0100] The accelerometer 180E can detect the magnitude of acceleration of device 100 in various directions (typically the x-axis, y-axis, and z-axis). When device 100 is stationary, it can detect the magnitude and direction of gravity. The accelerometer 180E can also be used to identify the attitude of device 100, serving as input parameters for applications such as screen orientation switching and pedometers.

[0101] Distance sensor 180F is used to measure distance. Device 100 can measure distance via infrared or laser. In some embodiments, such as in a shooting scenario, device 100 can utilize distance sensor 180F for distance measurement to achieve fast focusing.

[0102] The proximity sensor 180G may include, for example, a light-emitting diode (LED) and a light detector, such as a photodiode. The LED may be an infrared LED. Device 100 emits infrared light outward through the LED. Device 100 uses the photodiode to detect infrared reflected light from nearby objects. When reflected light is detected, device 100 can determine that an object is nearby. When no reflected light is detected, device 100 can determine that no object is nearby. Device 100 can use the proximity sensor 180G to detect whether the user is holding device 100 close to their ear for a call, so as to automatically turn off the screen to save power. The proximity sensor 180G can also be used for automatic unlocking and automatic screen locking in folding or pocket modes.

[0103] The ambient light sensor 180L is used to sense the ambient light intensity. The device 100 can adaptively adjust the brightness of the display screen 194 according to the sensed ambient light intensity. The ambient light sensor 180L can also be used to automatically adjust the white balance when taking pictures. The ambient light sensor 180L can also be used in conjunction with the proximity sensor 180G to detect whether the device 100 is in a pocket to prevent accidental activation.

[0104] The fingerprint sensor 180H is used to collect fingerprints. The device 100 can use the characteristics of the collected fingerprints to unlock the device, access app locks, take photos, and answer calls.

[0105] Temperature sensor 180J is used to detect temperature. In some embodiments, device 100 uses the temperature detected by temperature sensor 180J to execute a temperature handling strategy. For example, when the temperature reported by temperature sensor 180J exceeds a threshold, device 100 performs thermal protection by reducing the performance of a processor located near temperature sensor 180J to reduce power consumption. In other embodiments, when the temperature is below another threshold, device 100 heats battery 142 to prevent abnormal shutdown of device 100 due to low temperature. In still other embodiments, when the temperature is below yet another threshold, device 100 boosts the output voltage of battery 142 to prevent abnormal shutdown due to low temperature.

[0106] Touch sensor 180K, also known as a touch device, can be disposed on display screen 194. The touch sensor 180K and display screen 194 together form a touchscreen, also known as a touch display. Touch sensor 180K is used to detect touch operations applied to or near it. Touch sensor 180K can transmit the detected touch operation to the application processor to determine the type of touch event. Visual output related to the touch operation can be provided through display screen 194. In other embodiments, touch sensor 180K may also be disposed on the surface of device 100, and in a different location from display screen 194.

[0107] The bone conduction sensor 180M can acquire vibration signals. In some embodiments, the bone conduction sensor 180M can acquire vibration signals from the vibrating bone segments of the human vocal cords. The bone conduction sensor 180M can also contact the human pulse to receive blood pressure signals. In some embodiments, the bone conduction sensor 180M can also be incorporated into headphones to form bone conduction headphones. The audio module 170 can parse the voice signals from the vibrating bone segments of the vocal cords acquired by the bone conduction sensor 180M to realize voice functionality. The application processor can parse heart rate information from the blood pressure signals acquired by the bone conduction sensor 180M to realize heart rate detection functionality.

[0108] Button 190 includes a power button and volume buttons. Button 190 can be a mechanical button or a touch button. Device 100 can receive button input signals and implement functions related to the button input signals.

[0109] Motor 191 can generate vibrations. Motor 191 can be used for incoming call notifications or for haptic feedback. Motor 191 can produce different vibration feedback effects for touch operations applied to different applications. Motor 191 can also produce different vibration feedback effects for touch operations applied to different areas of the display screen 194. Different application scenarios (e.g., time reminders, receiving messages, alarm clocks, and games) can correspond to different vibration feedback effects. The touch vibration feedback effect can also be customized.

[0110] Indicator 192 can be an indicator light, which can be used to indicate charging status and power changes, or to indicate messages, missed calls and notifications.

[0111] The SIM card interface 195 is used to connect a SIM card. The SIM card can be inserted into the SIM card interface 195 to make contact with the device 100, or it can be removed from the SIM card interface 195 to detach from the device 100. The device 100 can support one or N SIM card interfaces, where N is a positive integer greater than 1. Multiple cards can be inserted into the same SIM card interface 195 simultaneously; the multiple cards can be of the same or different types. The SIM card interface 195 is also compatible with external memory cards. The device 100 interacts with the network through the SIM card to realize functions such as voice calls and data communication. In some embodiments, the device 100 uses an embedded SIM (eSIM) card, which can be embedded in the device 100 and cannot be separated from it.

[0112] The hardware system of device 100 has been described in detail above. The software system of device 100 is described below. The software system can adopt a layered architecture, event-driven architecture, microkernel architecture, microservice architecture, or cloud architecture. This application embodiment takes a layered architecture as an example to exemplarily describe the software system of device 100.

[0113] like Figure 2 As shown, a layered architecture software system is divided into several layers, each with a clear role and division of labor. Layers communicate with each other through software interfaces. In some embodiments, the software system can be divided into four layers, from top to bottom: the application layer, the application framework layer, the Android Runtime and system libraries, and the kernel layer.

[0114] The application layer can include applications such as camera, gallery, calendar, call, map, navigation, WLAN, Bluetooth, music, video, and SMS.

[0115] The application framework layer provides an application programming interface (API) and programming framework for applications in the application layer. The application framework layer may include some predefined functions.

[0116] For example, the application framework layer includes a window manager, content providers, a view system, a phone manager, a resource manager, and a notification manager.

[0117] The window manager is used to manage windowed applications. It can obtain the screen size, determine if a status bar is present, lock the screen, and capture the screen.

[0118] Content providers store and retrieve data, making that data accessible to applications. This data may include videos, images, audio, made and received phone calls, browsing history and bookmarks, and phone books.

[0119] A view system includes visual controls, such as controls for displaying text and controls for displaying images. View systems can be used to build applications. A display interface can consist of one or more views; for example, a display interface including a text notification icon can include views for displaying text and views for displaying images.

[0120] The phone manager is used to provide communication functions for device 100, such as the management of call status (connected or disconnected).

[0121] The file explorer provides applications with various resources, such as localized strings, icons, images, layout files, and video files.

[0122] The notification manager allows applications to display notifications in the status bar. These notifications can be used to deliver informational messages and can disappear automatically after a short pause, requiring no user interaction. For example, the notification manager can be used to notify users of download completions and message alerts. The notification manager can also manage notifications that appear as icons or scrollbar text in the system's top status bar, such as notifications from background applications. Furthermore, the notification manager can manage notifications that appear on the screen as dialog boxes, such as text messages in the status bar, sound alerts, electronic device vibrations, and indicator light flashing.

[0123] The Android Runtime consists of core libraries and a virtual machine. The Android runtime is responsible for the scheduling and management of the Android system.

[0124] The core library consists of two parts: one part is the functionalities that need to be called by the Java language, and the other part is the Android core library.

[0125] The application layer and application framework layer run in a virtual machine. The virtual machine executes the Java files of the application layer and application framework layer as binary files. The virtual machine is used to perform functions such as object lifecycle management, stack management, thread management, security and exception management, and garbage collection.

[0126] The system library can include multiple functional modules, such as: surface manager, media libraries, 3D graphics processing libraries (e.g., OpenGL ES for embedded systems) and 2D graphics engines (e.g., Skia graphics library (SGL)).

[0127] The Surface Manager is used to manage the display subsystem and provides the blending of 2D and 3D layers for multiple applications.

[0128] The media library supports playback and recording of various audio and video formats, as well as still image files. It supports multiple audio and video encoding formats, such as MPEG4, H.264, Moving Picture Experts Group Audio Layer III (MP3), Advanced Audio Coding (AAC), Adaptive Multi-rate (AMR), Joint Photographic Experts Group (JPG), and Portable Network Graphics (PNG).

[0129] The 3D graphics processing library can be used to implement 3D graphics drawing, image rendering, compositing, and layer processing.

[0130] A 2D graphics engine is a graphics engine for 2D drawing.

[0131] The kernel layer is the layer between hardware and software. It can include driver modules such as display drivers, camera drivers, audio drivers, and sensor drivers.

[0132] The workflow of the software and hardware systems of device 100 will be illustrated below with reference to the scene of the photo capture.

[0133] When a user touches the touch sensor 180K, a corresponding hardware interrupt is sent to the kernel layer. The kernel layer processes the touch operation into raw input events, which include information such as touch coordinates and a timestamp of the touch operation. These raw input events are stored in the kernel layer. The application framework layer retrieves these raw input events from the kernel layer, identifies the corresponding control, and notifies the application (APP) that controls the control. For example, if the touch operation is a single click and the APP corresponding to the control is a camera APP, the camera APP, after being activated by the single click, can call the camera driver in the kernel layer via API to control the camera 193 to take a picture.

[0134] The following uses device 100 as an example to introduce the method for storing encrypted text provided in this application.

[0135] To ensure the security of files in the external storage device, the files can be encrypted before being stored in the external storage device. The key to decrypt these files is stored in the internal storage of the device 100. In this way, the contents of the external storage device can only be read as plaintext within the device 100. When the external storage device is connected to other electronic devices, the contents of the external storage device cannot be decrypted by the other electronic devices because they do not store the key, thus ensuring the security of the files in the external storage device.

[0136] The external storage device can be an SD card, a USB flash drive, or other types of storage. It can establish a data connection with device 100 by insertion, wired, or wireless means. This application does not limit the specific type of external storage device or the connection method between it and device 100. The following explanation uses an SD card as an example.

[0137] Users can Figure 3 The encryption settings interface shown triggers the encryption process for the SD card. Users can click... Figure 3 Access the "encrypted memory card" in the system. Figure 4 The encryption settings confirmation screen is shown; subsequently, the user clicks... Figure 4 The "Encrypted Memory Card" option confirms the encryption of files on the SD card. The encryption process interface is as follows: Figure 5 As shown. This application does not limit the encryption algorithm used in the encryption process.

[0138] After files on an SD card are encrypted, the file encryption key (FEK) needs to be properly stored. One method for storing the FEK is to encrypt it multiple times before storing it on an erasable partition. This method is as follows: Figure 6 As shown.

[0139] Users Figure 3 After the encryption settings interface shown triggers the encryption process of the SD card, the SD card encryption settings module generates encryption instructions. Based on the lock screen password settings, there are two scenarios for the modules called by the encryption instructions.

[0140] Scenario 1: Lock screen password not set.

[0141] The SD card encryption module calls the encryption management module (Vold) to encrypt the FEK through this encryption command. If the user has not set a lock screen password, the default value (empty auth) can be used to encrypt the key (fileencryption key, encryption key, FEKEK) for FEK. The process of encrypting FEK will be described in detail below.

[0142] Scenario 2: Lock screen password has been set.

[0143] The SD card encryption module uses this encryption command to call the LockSettingsService to obtain the password hash value. The LockSettingsService then transmits the password hash value to the encryption management module (Vold) so that it can be used to encrypt the key for the FEK later. This password hash value is generated based on the lock screen password. For example, the lock screen service performs a hash calculation on the lock screen password when the user sets it to generate the password hash value. After the user triggers SD card encryption, it retrieves the previously saved password hash value and transmits it to the encryption management module.

[0144] Vold is responsible for implementing the core encryption and decryption functions. Vold triggers encryption or decryption logic for the SD card by calling the encryption or decryption library.

[0145] When a file system (such as eCryptfs) creates a file on an SD card, it generates a random number for each file. For example, when eCryptfs creates a new file, it uses a random number function provided by the kernel to create a random number, which is called FEK. FEK is used to encrypt files on the SD card and to decrypt encrypted files on the SD card.

[0146] Optionally, eCryptfs uses the Open Pretty Good Privacy (OpenPGP) file format to store encrypted files. The encrypted files can be divided into multiple logical blocks (extents), and the size of each logical block is adjustable, but the size of each logical block is usually no larger than the size of a physical page.

[0147] After files on the SD card are encrypted, the FEK (File Encryption Key) needs to be encrypted and saved. Vold unmounts and remounts the file system when the user sets the SD card to be encrypted, generating a random number, which is FEKEK (an example of the first key). FEKEK is used to encrypt the FEK (an example of the second key), where FEKEK is set by Vold to the kernel's keyring. The file system retrieves FEKEK from the keyring when encrypting the FEK. The encrypted FEK is stored in the metadata of the encrypted file.

[0148] After FEK is encrypted, FEKEK also needs to be encrypted and stored. Since Vold is a module in a rich execution environment (REE), its security does not meet the requirements and it cannot encrypt FEKEK. Vold can call the key management module in the trust execution environment (TEE), namely the keymaster trusted application (TA), through the client application (CA), and the keymaster TA will complete the encryption of FEKEK.

[0149] The keymaster TA can use the password hash and encrypt FEKEK according to the Advanced Encryption Standard (AES) to generate ciphertext 1 (an example of the fifth ciphertext). Then, the keymaster TA can use the hardware unique key (HUK) and encrypt the password hash again according to AES to generate keymaster_key_blob (an example of the sixth ciphertext). The keymaster TA stores ciphertext 1 and keymaster_key_blob in an erasable partition ( / data path).

[0150] Since the HUK of each device is unique, using the HUK to encrypt the password hash value ensures that the keymaster_key_blob can only be decrypted on device 100, thereby ensuring the security of encrypted files on the SD card.

[0151] Figure 6 The encryption process involved is as follows Figure 7 As shown.

[0152] If there are two files to be encrypted on the SD card (file1 and file2), the file system generates two random numbers for these two files, namely FEK1 and FEK2; then, the file system uses FEK1 to encrypt file1 and uses FEK2 to encrypt file2.

[0153] After files 1 and 2 are encrypted, the file system obtains FEKEK from the keyring and uses FEKEK to encrypt FEK1 and FEK2 respectively. The encrypted FEK1 is stored in the metadata of file 1, and the encrypted FEK2 is stored in the metadata of file 2.

[0154] Subsequently, Vold calls the keymaster TA through the CA, and the keymaster TA encrypts the FEKEK using the password hash value; then, the keymaster TA encrypts the password hash value using the hardware HUK.

[0155] When it is necessary to decrypt encrypted files on the SD card, device 100 performs... Figure 7 The reverse of the encryption process is illustrated below. For example, Vold calls the keymaster TA via the CA to perform the following decryption steps: The keymaster TA retrieves keymaster_key_blob and ciphertext 1 from the erasable partition. First, it decrypts keymaster_key_blob using HUK to obtain the password hash value. Then, it uses the password hash value to decrypt ciphertext 1 to obtain FEKEK. After Vold obtains FEKEK from the keymaster TA, it sets FEKEK to the keyring. The file system retrieves FEKEK from the keyring, decrypts it, and then uses FEK to decrypt the decrypted file on the SD card.

[0156] For example, when eCryptfs opens an encrypted file, it reads the metadata from the file header through the underlying file system and passes this metadata to the Keystore module (which includes the keymaster TA). The Keystore module obtains the FEKEK from the keyring, uses the FEKEK to decrypt the encrypted FEK in the metadata, and generates its own FEK. Subsequently, eCryptfs uses the FEK to decrypt the encrypted file. During the decryption process, each extent of the encrypted file is read into a page cache and decrypted via the Kernel Crypto API.

[0157] When device 100 performs a first-type reset (also known as a "user-level reset," i.e., the user resets device 100 through the system settings menu), the data in the erasable area will be erased. At this time, device 100 can back up Ciphertext 1 and keymaster_key_blob, thus preventing the files on the SD card from becoming undecryptable due to the deletion of Ciphertext 1 and keymaster_key_blob. The backup process for a user-level reset is as follows: Figure 8 As shown.

[0158] The user restores the factory settings through the settings interface of the device 100. The device 100 verifies the lock screen password entered by the user. For example, the device 100 calculates the password hash value and then compares the calculated password hash value with the saved password hash value. If the two password hash values ​​are the same, the verification is confirmed to be successful.

[0159] After successful verification, the application framework sends a factory reset broadcast message. Upon receiving this broadcast message, Vold initiates the backup key process, decrypting the FEKEK from the erasable partition via the CA calling the keymaster TA. The FEKEK is then encrypted using the default value (empty auth), and this default value is further encrypted using HUK. The encrypted FEKEK and the default value (an example of the seventh and eighth ciphertexts) are stored in the non-erasable partition.

[0160] In this application, the non-erasable partition refers to the storage area where data will not be erased during the second type of reset (also known as "factory-level reset", i.e., when the user does not reset the device 100 through the system settings menu). The non-erasable partition can be / sec_storage or other secure storage areas in the TEE, such as the replay-protected memory block (RPMB).

[0161] After device 100 is restored to factory settings and restarted, it checks whether the SD card is present. When the SD card is present, the keymaster TA copies the encrypted FEKEK and default values ​​from the non-erasable partition to the erasable partition, so that the FEK can be recovered using the encrypted FEKEK and default values, and the files on the SD card can be decrypted.

[0162] In summary, the changes in the keys stored in the storage area before and after the user-level reset performed by device 100 are as follows: Figure 9 As shown.

[0163] After the user instructs device 100 to perform a user-level reset, device 100 is triggered to perform key backup. During the key backup phase, ciphertext 1 and keymaster_key_blob are stored in the erasable partition. Ciphertext 1 and keymaster_key_blob are decrypted and encrypted, and stored in the non-erasable partition in the form of "default value encrypted FEKEK and HUK encrypted default value".

[0164] After the key backup is complete, device 100 enters the formatting stage. During the formatting stage, data in the erasable partition is erased, while data in the non-erasable partition is retained.

[0165] After formatting is complete, device 100 enters the key recovery phase. During the key recovery phase, the ciphertext (default FEKEK encrypted with default values ​​and default values ​​encrypted with HUK) in the non-erasable partition is copied to the erasable partition, thus completing the key recovery.

[0166] During the aforementioned user-level reset process, the user needs to format device 100 through the system settings menu. Device 100 has the opportunity to back up the ciphertext (encrypted FEKEK) in the erasable partition, allowing files on the SD card to still be decrypted after device 100 is formatted. However, when the user does not perform a second type of reset (i.e., factory reset) on device 100 through the system settings menu, the ciphertext in the erasable partition will be deleted without being copied to the non-erasable partition, resulting in files on the SD card being undecryptable after device 100 is formatted.

[0167] The following describes another embodiment of the method for storing encrypted text provided in this application, which enables files on the SD card to still be decrypted after the device 100 has undergone a factory reset. This embodiment can be applied to the device 100 in conjunction with the "user-level reset" embodiment described above, or it can be applied to the device 100 alone.

[0168] Users Figure 3 After the setup interface shown triggers encryption of the SD card, device 100 executes... Figure 10 The key backup process is shown below. Figure 10 As shown, the SD card encryption setting module calls the account login module via encryption commands for subsequent processing. Based on the account login status, the account login module processes data in two ways:

[0169] Scenario 3: The user is not logged into their account.

[0170] Account login module display Figure 11 The account login interface shown prompts the user to log in to their account (e.g., a Honor account). After successful account login, the account login module calculates the hash value of the account identifier (ID), and then transmits the hash value of the account ID to Vold.

[0171] Scenario 4: The user is already logged into their account.

[0172] The account login module obtains the hash value of the account ID and transmits it to Vold. Optionally, if the account login module has not calculated the hash value of the account ID before the user triggers SD card encryption, then the account login module calculates the hash value of the account ID when the user triggers SD card encryption; if the account login module has already calculated the hash value of the account ID before the user triggers SD card encryption, then the account login module directly obtains the hash value of the account ID when the user triggers SD card encryption.

[0173] After Vold obtains the hash value of the account ID, it calls the keymaster TA through the CA, and the keymaster TA encrypts and backs up the FEKEK.

[0174] The keymaster TA can use the hash value of the account ID and encrypt the FEKEK using AES to generate ciphertext 2 (an example of the first ciphertext). Then, the keymaster TA can use the HUK and encrypt the hash value of the account ID using AES to generate keymaster_key_blob_bak (an example of the second ciphertext). The keymaster TA calls the TEE API to store ciphertext 2 and keymaster_key_blob_bak in a non-erasable partition ( / sec_storage path), thus completing the FEK backup.

[0175] Because the HUK of each device is unique, the hash value of the account ID is encrypted using the HUK, ensuring that the keymaster_key_blob_bak can only be decrypted on device 100, thereby ensuring the security of encrypted files on the SD card.

[0176] Figure 10 In the method shown, after the user triggers encryption of the SD card through the settings interface, the device 100 can back up the FEKEK at any time before performing a factory-level reset. Even if the device 100 subsequently performs a factory-level reset, the FEKEK can be restored after restarting, thus solving the problem that files on the SD card cannot be decrypted after a factory-level reset.

[0177] Optionally, device 100 performs Figure 10 Following the method shown, if the user changes their login account ID, Vold obtains the hash value of the new account ID and updates ciphertext2 and keymaster_key_blob_bak using the hash value of the new account ID. The update process is as follows: Figure 12 As shown.

[0178] The following describes the process of decrypting files on the SD card after device 100 performs a factory-level reset.

[0179] The user first locks (or powers off) device 100, then presses a key combination (e.g., "Volume" + "Power") to enter recovery mode, displaying something like... Figure 13 The factory reset settings interface is shown. After the user clicks "Restore Factory Settings," device 100 displays... Figure 14 The confirmation screen shown. The user is on... Figure 13 After clicking "Restore Factory Settings" on the interface shown, device 100 performs a factory-level reset and displays... Figure 15 The factory-level reset interface shown.

[0180] After completing the factory-level reset, device 100 restarts and runs the startup wizard program. Figure 16The key recovery process is shown below.

[0181] The boot wizard program calls the phone retrieval module to determine if the factory reset protection (FRP) status has been triggered. The phone retrieval module uses the anti-theft CA to call the anti-theft TA to determine if the FRP status has been triggered. If the FRP status has been triggered, the phone retrieval module displays... Figure 17 The account verification interface shown verifies the account associated with the FRP status (i.e., the account that was last logged in before device 100 performed a factory reset). After the user enters the correct password on this interface, the phone retrieval module notifies Vold that the account verification was successful. Subsequently, Vold calls the keymaster TA via CA to perform the following key recovery steps.

[0182] The keymaster TA retrieves keymaster_key_blob_bak and ciphertext 2 from the non-erasable partition. First, it decrypts keymaster_key_blob_bak using HUK to obtain the hash value of the account ID. Then, it decrypts ciphertext 2 using the hash value of the account ID to obtain FEKEK.

[0183] The keymaster TA re-encrypts the FEKEK using the default value (empty auth) to generate a third ciphertext, and then encrypts the default value using HUK to generate a fourth ciphertext. The encrypted FEKEK and the default value are stored as backup keys in the non-erasable partition ( / sec_storage path). Subsequently, the keymaster TA copies the encrypted FEKEK and the default value to the erasable partition ( / data path) for use when encrypting or decrypting files on the SD card. After the device 100 performs a factory reset, the old lock screen password is cleared. The above embodiment allows the device 100 to use the default value as a key to decrypt the SD card without setting a new lock screen password.

[0184] Optionally, the keymaster TA may not use the default value to encrypt FEKEK, and may directly copy keymaster_key_blob_bak and ciphertext 2 from the non-erasable partition to the erasable partition. In this case, the device 100 may prompt the user to set a new lock screen password so that the FEKEK can be encrypted using the new lock screen password.

[0185] When files on the SD card need to be encrypted, the keymaster TA decrypts the FEKEK from the erasable partition and transfers it to the key ring via Vold. After the file system encrypts the file on the SD card using the FEK, it retrieves the FEKEK from the key ring, encrypts the FEK using the FEKEK, and stores the encrypted FEK in the file's metadata.

[0186] When a file on the SD card needs to be decrypted, the keymaster TA decrypts the FEKEK from the erasable partition and transfers it to the key ring via Vold. The file system uses the FEKEK to decrypt the FEK from the file's metadata on the SD card, and then uses the FEK to decrypt the file.

[0187] In summary, the changes in the keys stored in the storage area before and after the factory-level reset of device 100 are as follows: Figure 18 As shown.

[0188] When the user instructs device 100 to encrypt files on the SD card, device 100 is triggered to perform key backup. During the key backup phase, the erasable partition stores ciphertext 1 and keymaster_key_blob, and the non-erasable partition stores ciphertext 2 and keymaster_key_blob_bak. Ciphertext 1 is a FEKEK encrypted using a password hash value, keymaster_key_blob is a password hash value encrypted using HUK, ciphertext 2 is a FEKEK encrypted using a hash value of the account ID, and keymaster_key_blob_bak is a hash value of the account ID encrypted using HUK.

[0189] After the user instructs device 100 to perform a factory reset, device 100 enters the factory reset stage and performs formatting. During the factory reset stage, data in the erasable partition is erased, while data in the non-erasable partition is retained.

[0190] After formatting is complete, device 100 enters the key recovery phase. During the key recovery phase, the ciphertext (ciphertext 2 and keymaster_key_blob_bak) in the non-erasable partition is decrypted and encrypted, and copied to the erasable partition in the form of "default value encrypted FEKEK and HUK encrypted default value", thus completing the key recovery.

[0191] The foregoing has detailed examples of methods for storing encrypted text provided in this application. It is understood that the corresponding apparatus, in order to achieve the above functions, includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should readily recognize that, based on the units and algorithm steps of the examples described in conjunction with the embodiments disclosed herein, this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0192] This application can divide the device for storing encrypted text into functional units based on the above method example. For example, each function can be divided into a separate functional unit, or two or more functions can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. It should be noted that the unit division in this application is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0193] Figure 19 This is a schematic diagram of a device for storing encrypted text provided in this application. The device 1900 includes a processing unit 1910 and an input unit 1920.

[0194] Input unit 1920 is used to: obtain encryption instructions, the encryption instructions instructing the encryption of files in external storage;

[0195] The processing unit 1910 is configured to: obtain the feature value of the first account identifier according to the encryption instruction; encrypt the first key using the feature value of the first account identifier to generate the first ciphertext, wherein the first key is used to encrypt the second key and the second key is used to encrypt the first file in the external storage; encrypt the feature value of the first account identifier to generate the second ciphertext; and store the first ciphertext and the second ciphertext in an ineradicable partition.

[0196] Optionally, the input unit 1920 is also used to: obtain instruction information for switching accounts;

[0197] The processing unit 1910 is further configured to: verify the first account identifier according to the instruction information; after the first account identifier is verified, obtain the feature value of the second account identifier; and update the first ciphertext and the second ciphertext according to the feature value of the second account identifier.

[0198] Optionally, the processing unit 1910 is further configured to: determine whether the FRP state has been triggered; when the FRP state has been triggered, verify the first account identifier; when the first account identifier is successfully verified, decrypt the first ciphertext and the second ciphertext to generate the first key.

[0199] Optionally, the processing unit 1910 is further configured to: encrypt the first key using a default value to generate a third ciphertext; encrypt the default value to generate a fourth ciphertext; and store the third ciphertext and the fourth ciphertext in the non-erasable partition.

[0200] Optionally, the processing unit 1910 is further configured to: copy the third ciphertext and the fourth ciphertext from the non-erasable partition to the erasable partition; generate the first key based on the third ciphertext and the fourth ciphertext in the erasable partition; and decrypt the file in the external storage based on the first key.

[0201] The specific manner in which the device 1900 performs the method of saving ciphertext and the beneficial effects thereof can be found in the relevant description in the method embodiments.

[0202] Figure 20 A schematic diagram of the structure of an electronic device provided in this application is shown. Figure 20 The dashed lines in the diagram indicate that the unit or module is optional. Device 2000 can be used to implement the methods described in the above method embodiments.

[0203] The device 2000 includes one or more processors 2001, which can support the implementation of the methods in the method embodiments. The processor 2001 can be a general-purpose processor or a special-purpose processor. For example, the processor 2001 can be a central processing unit (CPU), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, such as discrete gates, transistor logic devices, or discrete hardware components.

[0204] The processor 2001 can be used to control the device 2000, execute software programs, and process data from the software programs. The device 2000 may also include a communication unit 2005 for inputting (receiving) and outputting (transmitting) signals.

[0205] For example, device 2000 may be a chip, communication unit 2005 may be the input and / or output circuit of the chip, or communication unit 2005 may be the communication interface of the chip, and the chip may be a component of terminal equipment or other electronic equipment.

[0206] For example, device 2000 can be a terminal device, communication unit 2005 can be the transceiver of the terminal device, or communication unit 2005 can be the transceiver circuit of the terminal device.

[0207] The device 2000 may include one or more memories 2002 storing a program 2004. The program 2004 can be executed by the processor 2001 to generate instructions 2003, causing the processor 2001 to execute the method described in the above method embodiments according to the instructions 2003. Optionally, the memory 2002 may also store data. Optionally, the processor 2001 may also read data stored in the memory 2002 (e.g., first ciphertext and second ciphertext), which may be stored at the same storage address as the program 2004, or it may be stored at a different storage address than the program 2004.

[0208] The processor 2001 and memory 2002 can be configured separately or integrated together, for example, integrated on the system-on-chip (SOC) of the terminal device.

[0209] This application also provides a computer program product that, when executed by processor 2001, implements the methods described in any of the method embodiments of this application.

[0210] The computer program product can be stored in memory 2002, for example, program 2004. Program 2004 is finally converted into an executable object file that can be executed by processor 2001 after processing such as preprocessing, compilation, assembly and linking.

[0211] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a computer, implements the methods described in any of the method embodiments of this application. The computer program may be a high-level language program or an executable object program.

[0212] The computer-readable storage medium is, for example, memory 2002. Memory 2002 can be volatile memory or non-volatile memory, or memory 2002 can include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0213] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process and technical effects of the above-described apparatus and equipment can be referred to the corresponding processes and technical effects in the foregoing method embodiments, and will not be repeated here.

[0214] In the several embodiments provided in this application, the systems, apparatuses, and methods disclosed can be implemented in other ways. For example, some features of the method embodiments described above can be ignored or not performed. The apparatus embodiments described above are merely illustrative; the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Multiple units or components can be combined or integrated into another system. Furthermore, the coupling between units or components can be direct coupling or indirect coupling, including electrical, mechanical, or other forms of connection.

[0215] It should be understood that in the various embodiments of this application, the sequence number of each process does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0216] Furthermore, the terms "system" and "network" are often used interchangeably in this paper. The term "and / or" in this paper merely describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. Additionally, the character " / " in this paper generally indicates that the preceding and following related objects have an "or" relationship.

[0217] In summary, the above description is merely a preferred embodiment of the technical solution of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A method for storing encrypted text, characterized in that, include: Displays the encryption settings interface for the external storage device; Receive the first operation performed by the user on the encryption settings interface; In response to the first operation, the file in the external storage is encrypted; Receive the user's second operation; In response to the second operation, the factory-level reset settings interface is displayed; Receive the third operation performed by the user on the factory-level reset settings interface; In response to the third operation, a factory-level reset is performed; Display the account verification interface; Receive the verification information entered by the user on the account verification interface; When the verification information passes, and when a user accesses a file in the external storage device, the encrypted file in the external storage device is decrypted; The first operation performed by the user on the encryption settings interface includes: Receive an encryption instruction triggered by the first operation, the encryption instruction instructing the encryption of the file in the external storage; The method further includes: The feature value of the first account identifier is obtained according to the encryption instruction; The first key is encrypted using the feature value of the first account identifier to generate the first ciphertext, wherein the first key is used to encrypt the second key, and the second key is used to encrypt the first file in the external storage. Encrypt the feature value of the first account identifier to generate the second ciphertext; Store the first ciphertext and the second ciphertext in an indelible partition.

2. The method according to claim 1, characterized in that, The method further includes: Get instructions on switching accounts; Verify the first account identifier according to the instruction information; After the first account identifier is verified, the feature value of the second account identifier is obtained; Update the first ciphertext and the second ciphertext according to the feature value of the second account identifier.

3. The method according to claim 1, characterized in that, Before decrypting the encrypted file in the external storage, the method further includes: After the factory-level reset is completed, the first account identifier is verified according to the verification information; When the first account identifier is successfully verified, the first ciphertext and the second ciphertext are decrypted to generate the first key.

4. The method according to claim 3, characterized in that, The step of verifying the first account identifier based on the verification information includes: When the factory-level reset protection state has been triggered, the first account identifier is verified according to the verification information.

5. The method according to claim 3, characterized in that, The method further includes: The first key is encrypted using the default value to generate the third ciphertext; Encrypt the default value to generate the fourth ciphertext; The third and fourth ciphertexts are stored in the non-erasable partition.

6. The method according to claim 5, characterized in that, The method further includes: Copy the third ciphertext and the fourth ciphertext from the non-erasable partition to the erasable partition; The first key is generated based on the third ciphertext and the fourth ciphertext in the erasable partition; The encrypted first file in the external storage is decrypted using the first key.

7. The method according to any one of claims 1 to 6, characterized in that, The factory-level reset in response to the third operation includes: The third operation obtains the factory-level reset command triggered in the factory-level reset settings interface; The data in the erasable partition is formatted according to the factory-level reset command.

8. The method according to any one of claims 1 to 6, characterized in that, The step of encrypting the first key using the feature value of the first account identifier includes: Invoke the key management module to execute: Encrypt the first key using the characteristic value of the first account identifier; The encrypted feature value of the first account identifier includes: The key management module is invoked to encrypt the characteristic value of the first account identifier.

9. The method according to any one of claims 1 to 6, characterized in that, The step of storing the first ciphertext and the second ciphertext in a non-erasable partition includes: Invoke the Trusted Execution Environment (TEX) application interface line: Store the first ciphertext and the second ciphertext in the non-erasable partition.

10. The method according to any one of claims 1 to 6, characterized in that, The first key is also used to encrypt a third key, which is used to encrypt a second file in the external storage.

11. The method according to any one of claims 1 to 6, characterized in that, The method further includes: The characteristic value of the lock screen password is obtained according to the encryption instruction; The first key is encrypted using the feature value of the lock screen password to generate the fifth ciphertext; Encrypt the feature value of the lock screen password to generate the sixth ciphertext; The fifth and sixth ciphertexts are stored in an erasable partition.

12. The method according to claim 11, characterized in that, The step of encrypting the first key using the feature value of the lock screen password includes: Invoke the key management module to encrypt the first key using the feature value of the lock screen password; The feature value of encrypting the lock screen password includes: The key management module is invoked to encrypt the feature value of the lock screen password.

13. The method according to claim 11, characterized in that, The method further includes: Retrieve user-level reset commands triggered by the settings interface; The fifth and sixth ciphertexts are backed up to the non-erasable partition according to the user-level reset command.

14. The method according to claim 13, characterized in that, The step of backing up the fifth and sixth ciphertexts to the non-erasable partition according to the user-level reset command includes: The first key is decrypted from the fifth ciphertext and the sixth ciphertext according to the user-level reset instruction; The first key is encrypted using the default value to generate the seventh ciphertext; Encrypt the default value to generate the eighth ciphertext; The seventh and eighth ciphertexts are stored in the non-erasable partition.

15. The method according to claim 14, characterized in that, The method further includes: After the user-level reset is completed, the seventh ciphertext and the eighth ciphertext are copied from the non-erasable partition to the erasable partition; The first key is decrypted from the seventh and eighth ciphertexts in the erasable partition; The encrypted first file in the external storage is decrypted using the first key.

16. The method according to claim 11, characterized in that, The erasable partition is a data partition, and the characteristic value of the lock screen password is the hash value of the lock screen password.

17. The method according to any one of claims 1 to 6, characterized in that, The non-erasable partition is a secure storage partition, and the characteristic value of the first account identifier is the hash value of the first account identifier.

18. A device for storing encrypted text, characterized in that, The apparatus includes a processor and a memory for storing a computer program, and the processor for calling and running the computer program from the memory, causing the apparatus to perform the method of any one of claims 1 to 17.

19. A chip, characterized in that, Includes a processor, which, when executing instructions, performs the method as described in any one of claims 1 to 17.

20. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, causes the processor to perform the method of any one of claims 1 to 17.

Images