Log encryption and decryption methods, devices, equipment and storage media

Abstract

This disclosure relates to a log encryption and decryption method, apparatus, device, and storage medium. The method includes: in response to detecting a target log generated in a trusted execution environment, performing a first encryption process on the target log in the trusted execution environment using a first preset encryption algorithm to obtain an encrypted log; performing a second encryption process on the decryption key in the first preset encryption algorithm to obtain an encrypted decryption key; transferring the encrypted log to a kernel log, and storing the encrypted decryption key in a designated storage location. This disclosure can reliably encrypt target logs in a trusted execution environment, thereby ensuring that users' personal privacy information is not leaked, and thus improving the information security of the terminal.

Description

Technical Field

[0001] This disclosure relates to the field of security encryption technology, and in particular to a log encryption and decryption method, apparatus, device and storage medium. Background Technology

[0002] Currently, biometric technologies such as fingerprint recognition have become essential features of smartphones and other terminal devices. Biometric technologies ensure the security of functions such as unlocking and electronic payments. Since unlocking and payments involve user privacy, they typically need to run within a TEE (Trusted Execution Environment). Because the TA (Trusted Application) logs in the TEE contain user privacy information, the TA logs require primary encryption. Summary of the Invention

[0003] To overcome the problems existing in the related technologies, the present disclosure provides a log encryption and decryption method, apparatus, device and storage medium to solve the defects in the related technologies.

[0004] According to a first aspect of the present disclosure, a log encryption method is provided, the method comprising:

[0005] In response to detecting a target log generated in a trusted execution environment, the target log is first encrypted using a first preset encryption algorithm in the trusted execution environment to obtain an encrypted log.

[0006] The decryption key in the first preset encryption algorithm is subjected to a second encryption process to obtain an encrypted decryption key;

[0007] The encrypted log is transferred to the kernel log, and the encrypted decryption key is saved in the designated storage location.

[0008] In one embodiment, the method further includes:

[0009] In response to detecting an indication message for performing log encryption processing, the operation of performing a first encryption processing on the target log using a first preset encryption algorithm in the trusted execution environment is executed.

[0010] In one embodiment, the second encryption process performed on the decryption key in the first preset encryption algorithm to obtain the encrypted decryption key includes:

[0011] Obtain the signature information of the image of the trusted execution environment;

[0012] Based on the second preset encryption algorithm, the signature information is used to perform an initial encryption process on the decryption key to obtain the decryption key after the initial encryption process;

[0013] The decryption key, which has undergone the first encryption process, is then encrypted a second time based on the third preset encryption algorithm to obtain the encrypted decryption key.

[0014] In one embodiment, the method further includes:

[0015] Determine the pre-defined storage location that requires root access;

[0016] The storage location is used as the set storage location, and the operation of saving the encrypted decryption key in the set storage location is performed.

[0017] According to a second aspect of the present disclosure, a log decryption method is provided, the method comprising:

[0018] The encrypted log is obtained from the kernel log, and the encrypted decryption key is obtained from the set storage location. The encrypted log is obtained by the target log generated in the trusted execution environment through the first encryption process of the first preset encryption algorithm. The encrypted decryption key is obtained by the decryption key of the encrypted log through the second encryption process.

[0019] The encrypted decryption key is subjected to a second decryption process to obtain the decryption key, wherein the algorithm of the second decryption process matches the algorithm of the second encryption process;

[0020] The encrypted log is decrypted using the decryption key based on the first decryption algorithm to obtain the target log, wherein the first decryption algorithm matches the first preset encryption algorithm.

[0021] In one embodiment, the encrypted decryption key is obtained by a second encryption process using a third decryption algorithm on the decryption key that has undergone initial encryption. The decryption key that has undergone initial encryption is obtained by a second preset encryption algorithm using the signature information of the image of the trusted execution environment.

[0022] The second decryption process, which involves performing a second decryption on the encrypted decryption key to obtain the decryption key, includes:

[0023] The encrypted decryption key is decrypted a second time based on the third decryption algorithm to obtain the decryption key after the first encryption. The third decryption algorithm is matched with the third preset encryption algorithm.

[0024] The decryption key that has undergone the initial encryption process is decrypted based on the second decryption algorithm to obtain the decryption key to be verified. The second decryption algorithm is matched with the second preset encryption algorithm.

[0025] The encrypted signature information is decrypted based on the second decryption algorithm to obtain decrypted signature information. The encrypted signature information is obtained by first encrypting the signature information using the second preset encryption algorithm.

[0026] In response to the decryption signature information being consistent with the pre-stored verification signature information, the decryption key to be verified is determined as the decryption key.

[0027] In one embodiment, the method further includes:

[0028] In response to detecting that the set storage location is a storage location that requires access based on root privileges, determine whether root privileges are currently available;

[0029] In response to determining that root privileges are currently available, the operation of obtaining the encrypted decryption key from the set storage location is performed based on the root privileges.

[0030] According to a third aspect of the present disclosure, a log encryption device is provided, the device comprising:

[0031] The first encryption module is configured to, in response to detecting a target log generated in a trusted execution environment, perform a first encryption process on the target log using a first preset encryption algorithm in the trusted execution environment to obtain an encrypted log;

[0032] The second encryption module is used to perform a second encryption process on the decryption key in the first preset encryption algorithm to obtain an encrypted decryption key;

[0033] The transfer-out and saving module is used to transfer the encrypted log to the kernel log and save the encrypted decryption key in a set storage location.

[0034] In one embodiment, the first encryption module is further configured to, in response to detecting an indication message for performing log encryption processing, perform the operation of performing a first encryption processing on the target log using a first preset encryption algorithm in the trusted execution environment.

[0035] In one embodiment, the second encryption module includes:

[0036] The signature information acquisition unit is used to acquire the signature information of the image of the trusted execution environment;

[0037] The key initial encryption unit is used to perform initial encryption processing on the decryption key using the signature information based on the second preset encryption algorithm, so as to obtain the decryption key after initial encryption processing;

[0038] The key secondary encryption unit is used to perform secondary encryption on the decryption key that has been initially encrypted based on a third preset encryption algorithm, thereby obtaining the encrypted decryption key.

[0039] In one embodiment, the device further includes:

[0040] The storage location determination module is used to determine the pre-set storage locations that need to be accessed based on root permissions;

[0041] The transfer-out saving module is also used to use the storage location as the set storage location, and to perform the operation of saving the encrypted decryption key in the set storage location.

[0042] According to a fourth aspect of the present disclosure, a log decryption apparatus is provided, the apparatus comprising:

[0043] The encryption key acquisition module is used to obtain encrypted logs from kernel logs and obtain encrypted decryption keys from a set storage location. The encrypted logs are obtained by first encryption processing of target logs generated in a trusted execution environment through a first preset encryption algorithm. The encrypted decryption keys are obtained by second encryption processing of the decryption keys of the encrypted logs.

[0044] The second decryption module is used to perform a second decryption process on the encrypted decryption key to obtain the decryption key, wherein the algorithm of the second decryption process matches the algorithm of the second encryption process.

[0045] The target log decryption module is used to decrypt the encrypted log using the decryption key based on the first decryption algorithm to obtain the target log, wherein the first decryption algorithm matches the first preset encryption algorithm.

[0046] In one embodiment, the encrypted decryption key is obtained by a second encryption process using a third decryption algorithm on the decryption key that has undergone initial encryption. The decryption key that has undergone initial encryption is obtained by a second preset encryption algorithm using the signature information of the image of the trusted execution environment.

[0047] The second decryption module using the encryption key includes:

[0048] The key secondary decryption unit is used to perform secondary decryption processing on the encrypted decryption key based on the third decryption algorithm to obtain the decryption key after the first encryption processing, wherein the third decryption algorithm is matched with the third preset encryption algorithm;

[0049] The key to be verified acquisition unit is used to decrypt the decryption key that has undergone the first encryption process based on the second decryption algorithm to obtain the decryption key to be verified. The second decryption algorithm is matched with the second preset encryption algorithm.

[0050] An encryption signature decryption unit is used to decrypt the encryption signature information based on the second decryption algorithm to obtain decrypted signature information, wherein the encryption signature information is obtained by first encrypting the signature information through the second preset encryption algorithm;

[0051] A decryption key determination unit is used to determine the decryption key to be verified as the decryption key in response to the decryption signature information matching the pre-stored verification signature information.

[0052] In one embodiment, the device further includes:

[0053] The root permission determination module is used to determine whether root permission is currently available in response to detecting that the set storage location is a storage location that needs to be accessed based on root permission;

[0054] The encrypted key acquisition module is also used to perform the operation of obtaining the encrypted decryption key from the set storage location in response to determining that root privileges are currently available.

[0055] According to a fifth aspect of the present disclosure, an electronic device is provided, the device comprising:

[0056] The processor and memory used to store processor-executable instructions;

[0057] The processor is configured as follows:

[0058] In response to detecting a target log generated in a trusted execution environment, the target log is first encrypted using a first preset encryption algorithm in the trusted execution environment to obtain an encrypted log.

[0059] The decryption key in the first preset encryption algorithm is subjected to a second encryption process to obtain an encrypted decryption key;

[0060] The encrypted log is transferred to the kernel log, and the encrypted decryption key is saved in the designated storage location.

[0061] According to a sixth aspect of the present disclosure, a computer-readable storage medium is provided having a computer program stored thereon that is implemented when executed by a processor:

[0062] In response to detecting a target log generated in a trusted execution environment, the target log is first encrypted using a first preset encryption algorithm in the trusted execution environment to obtain an encrypted log.

[0063] The decryption key in the first preset encryption algorithm is subjected to a second encryption process to obtain an encrypted decryption key;

[0064] The encrypted log is transferred to the kernel log, and the encrypted decryption key is saved in the designated storage location.

[0065] According to a seventh aspect of the present disclosure, an electronic device is provided, the device comprising:

[0066] The processor and memory used to store processor-executable instructions;

[0067] The processor is configured as follows:

[0068] The encrypted log is obtained from the kernel log, and the encrypted decryption key is obtained from the set storage location. The encrypted log is obtained by the target log generated in the trusted execution environment through the first encryption process of the first preset encryption algorithm. The encrypted decryption key is obtained by the decryption key of the encrypted log through the second encryption process.

[0069] The encrypted decryption key is subjected to a second decryption process to obtain the decryption key, wherein the algorithm of the second decryption process matches the algorithm of the second encryption process;

[0070] The encrypted log is decrypted using the decryption key based on the first decryption algorithm to obtain the target log, wherein the first decryption algorithm matches the first preset encryption algorithm.

[0071] According to an eighth aspect of the present disclosure, a computer-readable storage medium is provided having a computer program stored thereon that is implemented when executed by a processor:

[0072] The encrypted log is obtained from the kernel log, and the encrypted decryption key is obtained from the set storage location. The encrypted log is obtained by the target log generated in the trusted execution environment through the first encryption process of the first preset encryption algorithm. The encrypted decryption key is obtained by the decryption key of the encrypted log through the second encryption process.

[0073] The encrypted decryption key is subjected to a second decryption process to obtain the decryption key, wherein the algorithm of the second decryption process matches the algorithm of the second encryption process;

[0074] The encrypted log is decrypted using the decryption key based on the first decryption algorithm to obtain the target log, wherein the first decryption algorithm matches the first preset encryption algorithm.

[0075] The technical solutions provided by the embodiments of this disclosure may include the following beneficial effects:

[0076] This disclosure, in response to the detection of a target log generated in a trusted execution environment, performs a first encryption process on the target log using a first preset encryption algorithm in the trusted execution environment to obtain an encrypted log, and performs a second encryption process on the decryption key in the first preset encryption algorithm to obtain an encrypted decryption key. Then, the encrypted log is transferred to the kernel log, and the encrypted decryption key is stored in a set storage location. This enables reliable encryption of target logs in a trusted execution environment, thereby ensuring that users' personal privacy information is not leaked and improving the information security of the terminal.

[0077] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0078] The accompanying drawings, which are incorporated in and form a part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure.

[0079] Figure 1 This is a flowchart illustrating a log encryption method according to an exemplary embodiment;

[0080] Figure 2 This is a flowchart illustrating a log encryption method according to yet another exemplary embodiment;

[0081] Figure 3 This is a flowchart illustrating a log encryption method according to another exemplary embodiment;

[0082] Figure 4 This is a flowchart illustrating a log decryption method according to an exemplary embodiment;

[0083] Figure 5 This is a flowchart illustrating, according to an exemplary embodiment, how to perform a second decryption process on the encrypted decryption key to obtain the decryption key;

[0084] Figure 6This is a flowchart illustrating a log decryption method according to another exemplary embodiment;

[0085] Figure 7 This is a block diagram illustrating a log encryption device according to an exemplary embodiment;

[0086] Figure 8 This is a block diagram illustrating a log encryption device according to yet another exemplary embodiment;

[0087] Figure 9 This is a block diagram illustrating a log decryption apparatus according to an exemplary embodiment;

[0088] Figure 10 This is a block diagram illustrating a log decryption apparatus according to yet another exemplary embodiment;

[0089] Figure 11 This is a block diagram illustrating an electronic device according to an exemplary embodiment. Detailed Implementation

[0090] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this disclosure as detailed in the appended claims.

[0091] Figure 1 This is a flowchart illustrating a log encryption and decryption method according to an exemplary embodiment; the method of this embodiment can be applied to terminal devices (such as smartphones, tablets, laptops, or wearable devices).

[0092] like Figure 1 As shown, the method includes the following steps S101-S103:

[0093] In step S101, in response to detecting the target log generated in the trusted execution environment, the target log is first encrypted using a first preset encryption algorithm in the trusted execution environment to obtain an encrypted log.

[0094] A Trusted Execution Environment (TEE) is a secure area within the CPU. It runs in an isolated environment and in parallel with the operating system. The CPU ensures the confidentiality and integrity of code and data within the TEE. By using both hardware and software to protect data and code, the TEE is more secure than the operating system itself. Trusted applications running in the TEE can access the full functionality of the device's main processor and memory, while hardware isolation protects these components from user-installed applications running on the main operating system.

[0095] The aforementioned trusted execution environment may include a third-party trusted execution environment, such as the TEE from Doujia Technology.

[0096] In one embodiment, the target log may include the TA (Trusted Application) log of the trusted execution environment, such as the format log in the related art. This embodiment does not limit the specific form of the target log.

[0097] For example, when the operating system of the terminal device detects the target log generated in the trusted execution environment, it can use a first preset encryption algorithm in the trusted execution environment to perform a first encryption process on the target log, thereby obtaining the encrypted log and the corresponding encryption key.

[0098] It is worth noting that the first preset encryption algorithm can be set according to actual needs, such as setting it to the SMS4 algorithm, etc., and this embodiment does not limit it in this way.

[0099] In one embodiment, in response to detecting an indication message for performing log encryption processing, the operation of performing a first encryption processing on the target log using a first preset encryption algorithm in the trusted execution environment can be executed. That is, when a developer or user wishes to encrypt a target log generated in the trusted execution environment, an indication message for performing the first encryption processing on the log can be triggered. Then, the operating system of the terminal device can, upon detecting this indication message, execute the operation of performing the first encryption processing on the target log using the first preset encryption algorithm in the trusted execution environment. The triggering form of the indication message can be set according to actual needs, such as setting it to be considered as detecting the indication message when an encryption tag (TAG) is in an open state. This embodiment does not limit this. On the other hand, if the encryption tag (TAG) is detected to be in a closed state, the target log can be output in an unencrypted manner. It is understood that the state of the encryption tag (TAG) (i.e., open or closed state) can be preset by the user based on the actual need for encrypting the target log.

[0100] In step S102, the decryption key in the first preset encryption algorithm is subjected to a second encryption process to obtain an encrypted decryption key.

[0101] In this embodiment, after the target log is encrypted using a first preset encryption algorithm in the trusted execution environment to obtain the encrypted log and encryption key, the decryption key in the first preset encryption algorithm can be encrypted a second time to obtain the encrypted decryption key.

[0102] In one embodiment, the second preset encryption algorithm can be a preset encryption algorithm in the trusted execution environment. It is worth noting that the second preset encryption algorithm can be set according to actual needs, such as a shift algorithm and / or a negation algorithm (i.e., shifting and / or negating the encrypted string), etc. This embodiment does not limit this.

[0103] In step S103, the encrypted log is transferred to the kernel log, and the encrypted decryption key is saved in a set storage location.

[0104] In this embodiment, after performing a second encryption process on the decryption key in the first preset encryption algorithm to obtain the encrypted decryption key, the encrypted log obtained above can be transferred to the kernel log (i.e., the kernel log), thus enabling the target log to be output to the kernel log in a seemingly garbled format. Furthermore, the encrypted decryption key can also be saved in a designated storage location.

[0105] In one embodiment, the method for determining the above-mentioned storage location can be found in the following... Figure 3 The embodiments shown will not be described in detail here.

[0106] As described above, the method of this embodiment, in response to detecting a target log generated in a trusted execution environment, performs a first encryption process on the target log using a first preset encryption algorithm in the trusted execution environment to obtain an encrypted log, and performs a second encryption process on the decryption key in the first preset encryption algorithm to obtain an encrypted decryption key. Then, the encrypted log is transferred to the kernel log, and the encrypted decryption key is stored in a set storage location. This can reliably encrypt the target log in the trusted execution environment, thereby ensuring that the user's personal privacy information is not leaked, and thus improving the information security of the terminal.

[0107] Figure 2 This is a flowchart illustrating a log encryption method according to yet another exemplary embodiment; the method of this embodiment can be applied to terminal devices (e.g., smartphones, tablets, laptops, or wearable devices). Figure 2As shown, the method includes the following steps S201-S205:

[0108] In step S201, in response to detecting the target log generated in the trusted execution environment, the target log is first encrypted using a first preset encryption algorithm in the trusted execution environment to obtain an encrypted log.

[0109] In step S202, the decryption key in the first preset encryption algorithm is subjected to a second encryption process to obtain an encrypted decryption key.

[0110] The explanations and descriptions of steps S201-S202 can be found above. Figure 1 Steps S101-S102 in the illustrated embodiment will not be described in detail here.

[0111] In step S203, the signature information of the image of the trusted execution environment is obtained.

[0112] In this embodiment, in order to further improve the security of subsequent decryption of the encryption key, the signature information of the image of the trusted execution environment can be obtained, and then the security of the encryption key can be improved based on the verification of the signature information.

[0113] In one embodiment, the aforementioned signature information can be set as the OEM signature information of the terminal manufacturer based on actual needs; this embodiment does not limit this.

[0114] In step S204, the signature information is used to perform an initial encryption process on the decryption key based on the second preset encryption algorithm to obtain the decryption key after the initial encryption process.

[0115] In this embodiment, after obtaining the signature information of the image of the trusted execution environment, the signature information can be used to perform the first encryption process on the decryption key based on the second preset encryption algorithm to obtain the decryption key after the first encryption process.

[0116] The second preset encryption algorithm can be a preset encryption algorithm in the trusted execution environment. It is worth noting that the second preset encryption algorithm can be set according to actual needs, such as a shift algorithm and / or a negation algorithm (i.e., shifting and / or negating the encrypted string), etc. This embodiment does not limit this.

[0117] For example, after obtaining the signature information of the image of the trusted execution environment, the signature information and the decryption key can be encrypted for the first time based on the second preset encryption algorithm to obtain encrypted signature information and the decryption key after the first encryption. The encrypted signature information can be used to assist in verifying the legality of the decryption key after subsequent decryption processing.

[0118] In step S205, the encrypted log is transferred to the kernel log, and the encrypted decryption key and the encrypted signature information are saved in the designated storage location.

[0119] In this embodiment, after the signature information is used to perform the first encryption process on the decryption key based on the second preset encryption algorithm to obtain the decryption key after the first encryption process, the above-mentioned encryption log can be transferred to the kernel log, and the obtained encrypted decryption key and the above-mentioned encryption signature information can be saved in the set storage location.

[0120] In one embodiment, the explanation and description of setting the storage location can be found in the above. Figure 1 The embodiments shown will not be described in detail here.

[0121] As described above, this embodiment obtains the signature information of the image of the trusted execution environment, and uses the signature information to perform initial encryption on the decryption key based on the second preset encryption algorithm to obtain the decryption key after initial encryption. Then, the encrypted decryption key and the encrypted signature information are stored in the set storage location. This allows for subsequent retrieval and decryption of the encrypted signature information from the set storage location. Furthermore, when the decryption signature information matches the pre-stored verification signature information, the encrypted key is decrypted again based on the first decryption algorithm, thereby improving the security of decrypting the encrypted key.

[0122] Figure 3 This is a flowchart illustrating a log encryption method according to another exemplary embodiment; the method of this embodiment can be applied to terminal devices (e.g., smartphones, tablets, laptops, or wearable devices). Figure 3 As shown, the method includes the following steps S301-S304:

[0123] In step S301, in response to detecting the target log generated in the trusted execution environment, the target log is first encrypted using a first preset encryption algorithm in the trusted execution environment to obtain an encrypted log.

[0124] In step S302, the decryption key in the first preset encryption algorithm is subjected to a second encryption process to obtain an encrypted decryption key.

[0125] The relevant explanations and descriptions of steps S301-S302 can be found above. Figure 1 Steps S101-S102 in the illustrated embodiment will not be described in detail here.

[0126] In step S303, the encrypted log is transferred to the kernel log, and the pre-set storage location that needs to be accessed based on root privileges is determined.

[0127] In this embodiment, when it is necessary to store the encrypted decryption key, in order to further improve the security of the encrypted decryption key, a pre-set storage location that requires access based on root privileges can be determined.

[0128] For example, if an application on a subsequent terminal device needs to obtain the encrypted decryption key, it must first obtain root privileges and then access the storage location based on those root privileges to obtain the encrypted decryption key. Without root privileges, the application cannot obtain the encrypted decryption key, thus improving its security.

[0129] In step S304, the storage location is set as the designated storage location, and the operation of saving the encrypted decryption key in the designated storage location is performed.

[0130] In this implementation, once a pre-set storage location that requires root access is determined, this storage location can be used as a designated storage location for storing the encrypted decryption key, and then the operation of saving the encrypted decryption key in the designated storage location can be performed.

[0131] As described above, this embodiment determines a pre-set storage location that requires root access, then uses that storage location as the designated storage location, and performs the operation of saving the encrypted decryption key in the designated storage location. This enables the encrypted decryption key to be saved to the storage location that requires root access, thereby improving the security of obtaining the encrypted decryption key in the future based on root access.

[0132] Figure 4 This is a flowchart illustrating a log decryption method according to an exemplary embodiment; the method of this embodiment can be applied to terminal devices (e.g., smartphones, tablets, laptops, or wearable devices). Figure 4 As shown, the method includes the following steps S401-S304:

[0133] In step S401, the encrypted log is obtained from the kernel log, and the encrypted decryption key is obtained from the set storage location.

[0134] In this embodiment, when it is necessary to use the above-mentioned Figure 1When decrypting the encrypted log in the encryption method shown in the embodiment, the encrypted log can be obtained from the kernel log first, and the encrypted decryption key can be obtained from the set storage location.

[0135] The encrypted log is obtained by first encryption of a target log generated in a trusted execution environment using a first preset encryption algorithm. The encrypted decryption key is obtained by second encryption of the decryption key of the encrypted log. For details of the encryption process, please refer to [link to relevant documentation]. Figure 1 The embodiments shown are not described in detail here.

[0136] In step S402, the encrypted decryption key is subjected to a second decryption process to obtain the decryption key.

[0137] In this embodiment, after obtaining the encrypted decryption key from a designated storage location, a second decryption process can be performed on the encrypted decryption key to obtain the decryption key. The algorithm for this second decryption process matches the algorithm for the second encryption process in the previous embodiment; that is, the algorithm for the second decryption process is the inverse algorithm of the second encryption process. For example, if information A is processed by the second encryption algorithm to obtain information B (i.e., encrypted information A), then information B can be processed by the second decryption algorithm to obtain information A.

[0138] For example, if the second preset encryption algorithm is a shift algorithm and / or inversion algorithm (i.e., shifting and / or inverting the encrypted string), the second decryption algorithm can be an inverse shift algorithm and / or inversion algorithm (i.e., shifting and / or inverting the encrypted string in the opposite direction).

[0139] In step S403, the encrypted log is decrypted using the decryption key based on the first decryption algorithm to obtain the target log.

[0140] The first decryption algorithm matches the first preset encryption algorithm, meaning the first decryption algorithm is the inverse algorithm of the first preset encryption algorithm. For example, if information A is processed by the first preset encryption algorithm to obtain information M (i.e., encrypted information A), then information M can be processed by the first decryption algorithm to obtain information A.

[0141] In this embodiment, after the encrypted decryption key is subjected to a second decryption process to obtain the decryption key, the encrypted log can be decrypted using the decryption key based on the first decryption algorithm to obtain the target log.

[0142] For example, if the first preset encryption algorithm is the SMS4 algorithm, the first decryption algorithm can be a decryption algorithm that is the opposite of the SMS4 algorithm.

[0143] As described above, the method of this embodiment obtains encrypted logs from kernel logs, acquires encrypted decryption keys from a set storage location, performs a second decryption process on the encrypted decryption keys to obtain the decryption key, and then uses the decryption key to decrypt the encrypted logs based on a first decryption algorithm to obtain the target logs. This method can accurately obtain target logs based on encrypted decryption keys and encrypted logs. Since the encrypted decryption key is obtained by the second encryption process of the decryption key of the encrypted logs, and the encrypted logs are obtained by the first encryption process of the target logs generated in the trusted execution environment through a first preset encryption algorithm, it can reliably encrypt and decrypt target logs in the trusted execution environment, thereby ensuring that users' personal privacy information is not leaked and improving the information security of the terminal.

[0144] Figure 5 This is a flowchart illustrating how to perform a second decryption process on the encrypted decryption key to obtain the decryption key, according to an exemplary embodiment. This embodiment, based on the above embodiment, provides an illustrative example of how to perform a second decryption process on the encrypted decryption key to obtain the decryption key.

[0145] In this embodiment, the encrypted decryption key is obtained by a second encryption process using a third decryption algorithm on the decryption key that has undergone initial encryption. The decryption key that has undergone initial encryption is obtained by a first encryption process using the signature information of the image of the trusted execution environment on the decryption key using a second preset encryption algorithm.

[0146] Based on this, such as Figure 5 As shown, the second decryption process performed on the encrypted decryption key in step S402 above to obtain the decryption key may include the following steps S501-S504:

[0147] In step S501, the encrypted decryption key is decrypted a second time based on the third decryption algorithm to obtain the decryption key that has been encrypted for the first time.

[0148] The third decryption algorithm matches the third preset encryption algorithm; that is, the third decryption algorithm is the inverse algorithm of the third preset encryption algorithm. For example, if information A is processed by the third preset encryption algorithm to obtain information N (i.e., encrypted information A), then information N can be processed by the third decryption algorithm to obtain information A. In this embodiment, since the "encrypted decryption key" is obtained by processing the "decryption key after the first encryption process" with the third preset encryption algorithm, a second decryption process is performed on the encrypted decryption key based on the third decryption algorithm to obtain the decryption key after the first encryption process.

[0149] In step S502, the decryption key that has undergone the initial encryption process is decrypted based on the second decryption algorithm to obtain the decryption key to be verified.

[0150] The second decryption algorithm is matched with the second preset encryption algorithm.

[0151] In this embodiment, after the encrypted decryption key is decrypted a second time to obtain the decryption key after the first encryption, the decryption key after the first encryption can be decrypted based on the second decryption algorithm to obtain the decryption key to be verified.

[0152] In step S503, the encrypted signature information is decrypted based on the second decryption algorithm to obtain the decrypted signature information.

[0153] The encrypted signature information is obtained by first encrypting the signature information using the second preset encryption algorithm.

[0154] In step S504, in response to the decryption signature information being consistent with the pre-stored verification signature information, the decryption key to be verified is determined as the decryption key.

[0155] In this embodiment, after the encrypted signature information is decrypted based on the second decryption algorithm to obtain the decrypted signature information, the decrypted signature information can be compared with the pre-stored verification signature information to determine whether the decrypted signature information is consistent with the pre-stored verification signature information; further, when it is determined that the decrypted signature information is consistent with the pre-stored verification signature information, the decryption key to be verified can be determined as the decryption key.

[0156] As can be seen from the above description, this embodiment performs a second decryption process on the encrypted decryption key based on a third decryption algorithm to obtain the decryption key after the first encryption process. The third decryption algorithm is matched with the third preset encryption algorithm.

[0157] The decryption key that has undergone initial encryption is decrypted using the second decryption algorithm to obtain a decryption key to be verified. The encrypted signature information is then decrypted using the second decryption algorithm to obtain decrypted signature information. In response to the fact that the decrypted signature information matches the pre-stored verification signature information, the decryption key to be verified is determined as the decryption key. This can improve the accuracy of obtaining the decryption key and thus improve the security of decrypting target logs based on the decryption key.

[0158] Figure 6 This is a flowchart illustrating a log decryption method according to another exemplary embodiment; the method of this embodiment can be applied to terminal devices (e.g., smartphones, tablets, laptops, or wearable devices). Figure 6 As shown, the method includes the following steps S601-S606:

[0159] In step S601, in response to detecting that the set storage location is a storage location that needs to be accessed based on root privileges, it is determined whether root privileges are currently available: if yes, then step S602 is executed; if no, then step S606 is executed.

[0160] In step S602, the encrypted log is obtained from the kernel log, and the encrypted decryption key is obtained from the set storage location based on the root privileges.

[0161] The encrypted decryption key includes a key obtained by applying a second encryption process of a second preset encryption algorithm to the encryption key of the encrypted log, and the encryption key includes a key obtained by applying a first encryption process of a first preset encryption algorithm to the encrypted log.

[0162] In step S603, the encrypted decryption key is subjected to a second decryption process to obtain the decryption key.

[0163] The second decryption algorithm is matched with the second preset encryption algorithm.

[0164] In step S604, the encrypted log is decrypted using the decryption key based on the first decryption algorithm to obtain the target log.

[0165] The first decryption algorithm is matched with the first preset encryption algorithm.

[0166] The explanations and descriptions of steps S602-S604 above can be found in the above... Figure 4 Steps S401-S403 in the illustrated embodiment will not be described in detail here.

[0167] In step S605, decryption failed.

[0168] As described above, this embodiment can improve the security of obtaining the encrypted decryption key based on root permissions by responding to the detection that the set storage location is a storage location that needs to be accessed based on root permissions, determining whether root permissions are currently available, and then, in response to the determination that root permissions are currently available, performing the operation of obtaining the encrypted decryption key from the set storage location based on the root permissions.

[0169] Figure 7 This is a block diagram illustrating a log encryption device according to an exemplary embodiment; the device of this embodiment can be applied to terminal devices (e.g., smartphones, tablets, laptops, or wearable devices). Figure 7 As shown, the device includes: a first encryption module 110, a second encryption module 120, and a transfer-out storage module 130, wherein:

[0170] The first encryption module 110 is configured to, in response to detecting a target log generated in a trusted execution environment, perform a first encryption process on the target log using a first preset encryption algorithm in the trusted execution environment to obtain an encrypted log;

[0171] The second encryption module 120 is used to perform a second encryption process on the decryption key in the first preset encryption algorithm to obtain an encrypted decryption key;

[0172] The transfer-out and storage module 130 is used to transfer the encrypted log to the kernel log and save the encrypted decryption key in a set storage location.

[0173] As described above, this embodiment, in response to the detection of a target log generated in a trusted execution environment, performs a first encryption process on the target log using a first preset encryption algorithm in the trusted execution environment to obtain an encrypted log, and performs a second encryption process on the decryption key in the first preset encryption algorithm to obtain an encrypted decryption key. Then, the encrypted log is transferred to the kernel log, and the encrypted decryption key is stored in a set storage location. This can reliably encrypt the target log in the trusted execution environment, thereby ensuring that the user's personal privacy information is not leaked, and thus improving the information security of the terminal.

[0174] Figure 8 This is a block diagram illustrating a log encryption device according to yet another exemplary embodiment; the device of this embodiment can be applied to terminal devices (such as smartphones, tablets, laptops, or wearable devices). The first encryption module 210, the second encryption module 220, and the transfer-out storage module 230 are as described above. Figure 7 The first encryption module 110, the second encryption module 120, and the transfer-out storage module 130 in the illustrated embodiment have the same functions, which will not be described in detail here. Figure 8As shown, the first encryption module 210 can also be used to perform the operation of performing the first encryption processing on the target log using a first preset encryption algorithm in the trusted execution environment in response to detecting the indication information for indicating log encryption processing.

[0175] In one embodiment, the second encryption module 220 may include:

[0176] The signature information acquisition unit 221 is used to acquire the signature information of the image of the trusted execution environment;

[0177] The key initial encryption unit 222 is used to perform initial encryption processing on the decryption key using the signature information based on the second preset encryption algorithm, so as to obtain the decryption key after initial encryption processing;

[0178] The key secondary encryption unit 223 is used to perform secondary encryption processing on the decryption key that has been initially encrypted based on a third preset encryption algorithm, thereby obtaining the encrypted decryption key.

[0179] In one embodiment, the above-described apparatus may further include:

[0180] Storage location determination module 250 is used to determine a pre-set storage location that needs to be accessed based on root privileges;

[0181] The transfer-out storage module 230 can also be used to use the storage location as the set storage location and perform the operation of saving the encrypted decryption key in the set storage location.

[0182] Figure 9 This is a block diagram illustrating a log decryption apparatus according to an exemplary embodiment; the apparatus of this embodiment can be applied to terminal devices (e.g., smartphones, tablets, laptops, or wearable devices). Figure 9 As shown, the device may include: an encryption key acquisition module 310, an encryption key second decryption module 320, and a target log decryption module 330, wherein:

[0183] The encryption key acquisition module 310 is used to obtain encrypted logs from the kernel logs and obtain encrypted decryption keys from a set storage location. The encrypted logs are obtained by first encryption processing of target logs generated in the trusted execution environment through a first preset encryption algorithm. The encrypted decryption keys are obtained by second encryption processing of the decryption keys of the encrypted logs.

[0184] The encryption key second decryption module 320 is used to perform a second decryption process on the encrypted decryption key to obtain the decryption key, wherein the algorithm of the second decryption process matches the algorithm of the second encryption process;

[0185] The target log decryption module 330 is used to decrypt the encrypted log using the decryption key based on the first decryption algorithm to obtain the target log, wherein the first decryption algorithm matches the first preset encryption algorithm.

[0186] As described above, the device in this embodiment obtains encrypted logs from kernel logs, acquires encrypted decryption keys from a set storage location, performs a second decryption process on the encrypted decryption keys to obtain the decryption keys, and then uses the decryption keys to decrypt the encrypted logs based on a first decryption algorithm to obtain the target logs. The first decryption algorithm matches the first preset encryption algorithm, which can accurately obtain the target logs, ensure that the user's personal privacy information is not leaked, and thus improve the information security of the terminal.

[0187] Figure 10 This is a block diagram illustrating a log decryption device according to yet another exemplary embodiment; the device of this embodiment can be applied to terminal devices (such as smartphones, tablets, laptops, or wearable devices). The encryption key acquisition module 410, the encryption key second decryption module 420, and the target log decryption module 430 are as described above. Figure 9 The encrypted key acquisition module 310, the encrypted key second decryption module 320, and the target log decryption module 330 in the illustrated embodiment have the same functions, which will not be described in detail here.

[0188] like Figure 10 As shown, the above-mentioned encrypted decryption key is obtained by a second encryption process of the decryption key that has undergone the first encryption process using a third decryption algorithm. The decryption key that has undergone the first encryption process is obtained by the first encryption process of the decryption key using the signature information of the image of the trusted execution environment using a second preset encryption algorithm.

[0189] The second decryption module 420, which uses the encryption key, can include:

[0190] The key secondary decryption unit 421 is used to perform secondary decryption processing on the encrypted decryption key based on the third decryption algorithm to obtain the decryption key after the first encryption processing. The third decryption algorithm is matched with the third preset encryption algorithm.

[0191] The key acquisition unit 422 is used to decrypt the decryption key that has undergone the first encryption process based on the second decryption algorithm to obtain the decryption key to be verified. The second decryption algorithm is matched with the second preset encryption algorithm.

[0192] The encryption signature decryption unit 423 is used to decrypt the encryption signature information based on the second decryption algorithm to obtain decrypted signature information, wherein the encryption signature information is obtained by the signature information through the first encryption process of the second preset encryption algorithm;

[0193] The decryption key determination unit 424 is configured to determine the decryption key to be verified as the decryption key in response to the decryption signature information matching the pre-stored verification signature information.

[0194] In one embodiment, the above-described apparatus may further include:

[0195] The root permission determination module 440 is used to determine whether root permission is currently available in response to detecting that the set storage location is a storage location that needs to be accessed based on root permission;

[0196] The encrypted key acquisition module 410 can also be used to perform the operation of obtaining the encrypted decryption key from the set storage location based on the root permission, in response to determining that root permission is currently available.

[0197] Regarding the apparatus in the above embodiments, the specific manner in which each module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0198] Figure 11 This is a block diagram illustrating an electronic device according to an exemplary embodiment. For example, device 900 may be a mobile phone, computer, digital broadcasting terminal, messaging device, game console, tablet device, medical device, fitness device, personal digital assistant, etc.

[0199] Reference Figure 11 The device 900 may include one or more of the following components: a processing component 902, a memory 904, a power supply component 906, a multimedia component 908, an audio component 910, an input / output (I / O) interface 912, a sensor component 914, and a communication component 916.

[0200] Processing component 902 typically controls the overall operation of device 900, such as operations associated with display, telephone calls, data communication, camera operation, and recording. Processing component 902 may include one or more processors 920 to execute instructions to perform all or part of the steps of the methods described above. Furthermore, processing component 902 may include one or more modules to facilitate interaction between processing component 902 and other components. For example, processing component 902 may include a multimedia module to facilitate interaction between multimedia component 908 and processing component 902.

[0201] Memory 904 is configured to store various types of data to support the operation of device 900. Examples of this data include instructions for any application or method operating on device 900, contact data, phonebook data, messages, pictures, videos, etc. Memory 904 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0202] Power supply component 906 provides power to various components of device 900. Power supply component 906 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to device 900.

[0203] Multimedia component 908 includes a screen that provides an output interface between the device 900 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touchscreen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensors may sense not only the boundaries of the touch or swipe action but also the duration and pressure associated with the touch or swipe operation. In some embodiments, multimedia component 908 includes a front-facing camera and / or a rear-facing camera. When the device 900 is in an operating mode, such as a shooting mode or a video mode, the front-facing camera and / or the rear-facing camera may receive external multimedia data. Each front-facing camera and rear-facing camera may be a fixed optical lens system or have focal length and optical zoom capabilities.

[0204] Audio component 910 is configured to output and / or input audio signals. For example, audio component 910 includes a microphone (MIC) configured to receive external audio signals when device 900 is in an operating mode, such as call mode, recording mode, and voice recognition mode. The received audio signals may be further stored in memory 904 or transmitted via communication component 916. In some embodiments, audio component 910 also includes a speaker for outputting audio signals.

[0205] I / O interface 912 provides an interface between processing component 902 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include, but are not limited to, home buttons, volume buttons, power buttons, and lock buttons.

[0206] Sensor assembly 914 includes one or more sensors for providing status assessments of various aspects of device 900. For example, sensor assembly 914 may detect the on / off state of device 900, the relative positioning of components such as the display and keypad of device 900, changes in the position of device 900 or a component of device 900, the presence or absence of user contact with device 900, the orientation or acceleration / deceleration of device 900, and temperature changes of device 900. Sensor assembly 914 may also include a proximity sensor configured to detect the presence of nearby objects without any physical contact. Sensor assembly 914 may also include a light sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, sensor assembly 914 may also include an accelerometer, a gyroscope, a magnetometer, a pressure sensor, or a temperature sensor.

[0207] Communication component 916 is configured to facilitate wired or wireless communication between device 900 and other devices. Device 900 can access wireless networks based on communication standards, such as WiFi, 2G or 3G, 4G or 5G, or combinations thereof. In one exemplary embodiment, communication component 916 receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In one exemplary embodiment, communication component 916 also includes a near-field communication (NFC) module to facilitate short-range communication. For example, the NFC module may be implemented based on radio frequency identification (RFID) technology, Infrared Data Association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology, and other technologies.

[0208] In an exemplary embodiment, device 900 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the methods described above.

[0209] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 904 including instructions, which can be executed by a processor 920 of device 900 to perform the above-described method. For example, the non-transitory computer-readable storage medium may be a ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device, etc.

[0210] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the disclosure herein. This disclosure is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the following claims.

[0211] It should be understood that this disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this disclosure is limited only by the appended claims.

Claims

1. A log encryption method, characterized in that, The method includes: In response to detecting a target log generated in a trusted execution environment, the target log is first encrypted using a first preset encryption algorithm in the trusted execution environment to obtain an encrypted log. The decryption key in the first preset encryption algorithm is subjected to a second encryption process to obtain an encrypted decryption key; The encrypted log is transferred to the kernel log, and the encrypted decryption key is saved in a designated storage location; The step of performing a second encryption process on the decryption key in the first preset encryption algorithm to obtain an encrypted decryption key includes: Obtain the signature information of the image of the trusted execution environment; Based on the second preset encryption algorithm, the signature information is used to perform an initial encryption process on the decryption key to obtain the decryption key after the initial encryption process; The decryption key, which has undergone the first encryption process, is encrypted a second time based on the third preset encryption algorithm to obtain the encrypted decryption key. The step of using the signature information to perform an initial encryption process on the decryption key based on the second preset encryption algorithm to obtain the decryption key after the initial encryption process includes: The signature information and the decryption key are first encrypted based on the second preset encryption algorithm to obtain encrypted signature information and the decryption key after the first encryption. The encrypted signature information is used to compare with the pre-stored verification signature information after being decrypted by the second decryption algorithm. In response to the comparison being consistent, the decryption of the decryption key after the first encryption is triggered based on the second decryption algorithm. The second decryption algorithm is matched with the second preset encryption algorithm.

2. The method according to claim 1, characterized in that, The method further includes: In response to detecting an instruction message indicating log encryption processing, the operation of performing a first encryption processing on the target log using a first preset encryption algorithm in the trusted execution environment is executed.

3. The method according to claim 1, characterized in that, The method further includes: Determine the pre-defined storage location that requires root access; The storage location is used as the set storage location, and the operation of saving the encrypted decryption key in the set storage location is performed.

4. A log decryption method, characterized in that, The method includes: The encrypted log is obtained from the kernel log, and the encrypted decryption key is obtained from the set storage location. The encrypted log is obtained by the target log generated in the trusted execution environment through the first encryption process of the first preset encryption algorithm. The encrypted decryption key is obtained by the decryption key of the encrypted log through the second encryption process. The encrypted decryption key is subjected to a second decryption process to obtain the decryption key, wherein the algorithm of the second decryption process matches the algorithm of the second encryption process; The encrypted log is decrypted using the decryption key based on the first decryption algorithm to obtain the target log, wherein the first decryption algorithm matches the first preset encryption algorithm; The encrypted decryption key is obtained by a second encryption process using a third preset encryption algorithm on the decryption key that has undergone initial encryption. The decryption key that has undergone initial encryption is obtained by a first encryption process using the signature information of the image of the trusted execution environment on the decryption key using a second preset encryption algorithm. The second decryption process, which involves performing a second decryption on the encrypted decryption key to obtain the decryption key, includes: The encrypted decryption key is decrypted a second time based on the third decryption algorithm to obtain the decryption key after the first encryption. The third decryption algorithm is matched with the third preset encryption algorithm. The decryption key that has undergone the initial encryption process is decrypted based on the second decryption algorithm to obtain the decryption key to be verified. The second decryption algorithm is matched with the second preset encryption algorithm. The encrypted signature information is decrypted based on the second decryption algorithm to obtain decrypted signature information. The encrypted signature information is obtained by first encrypting the signature information using the second preset encryption algorithm. In response to the decryption signature information being consistent with the pre-stored verification signature information, the decryption key to be verified is determined as the decryption key.

5. The method according to claim 4, characterized in that, The method further includes: In response to detecting that the set storage location is a storage location that requires access based on root privileges, determine whether root privileges are currently available; In response to determining that root privileges are currently available, the operation of obtaining the encrypted decryption key from the set storage location is performed based on the root privileges.

6. A log encryption device, characterized in that, The device includes: The first encryption module is configured to, in response to detecting a target log generated in a trusted execution environment, perform a first encryption process on the target log using a first preset encryption algorithm in the trusted execution environment to obtain an encrypted log; The second encryption module is used to perform a second encryption process on the decryption key in the first preset encryption algorithm to obtain an encrypted decryption key; The transfer-out and saving module is used to transfer the encrypted log to the kernel log and save the encrypted decryption key in a set storage location; The second encryption module includes: The signature information acquisition unit is used to acquire the signature information of the image of the trusted execution environment; The key initial encryption unit is used to perform initial encryption processing on the decryption key using the signature information based on the second preset encryption algorithm, so as to obtain the decryption key after initial encryption processing; The key secondary encryption unit is used to perform secondary encryption on the decryption key that has been encrypted once, based on a third preset encryption algorithm, so as to obtain the encrypted decryption key. The key initial encryption unit is further configured to perform initial encryption processing on the signature information and the decryption key based on the second preset encryption algorithm, respectively, to obtain encrypted signature information and the decryption key after initial encryption processing. The encrypted signature information is used to compare with pre-stored verification signature information after being decrypted by the second decryption algorithm, and in response to the comparison being consistent, triggering decryption processing of the decryption key after initial encryption processing based on the second decryption algorithm; the second decryption algorithm is matched with the second preset encryption algorithm.

7. The apparatus according to claim 6, characterized in that, The first encryption module is further configured to, in response to detecting an indication message for performing log encryption processing, perform the operation of performing a first encryption processing on the target log using a first preset encryption algorithm in the trusted execution environment.

8. The apparatus according to claim 6, characterized in that, The device further includes: The storage location determination module is used to determine the pre-set storage locations that need to be accessed based on root permissions; The transfer-out saving module is also used to use the storage location as the set storage location, and to perform the operation of saving the encrypted decryption key in the set storage location.

9. A log decryption device, characterized in that, The device includes: The encryption key acquisition module is used to obtain encrypted logs from kernel logs and obtain encrypted decryption keys from a set storage location. The encrypted logs are obtained by first encryption processing of target logs generated in a trusted execution environment through a first preset encryption algorithm. The encrypted decryption keys are obtained by second encryption processing of the decryption keys of the encrypted logs. The second decryption module is used to perform a second decryption process on the encrypted decryption key to obtain the decryption key, wherein the algorithm of the second decryption process matches the algorithm of the second encryption process. The target log decryption module is used to decrypt the encrypted log using the decryption key based on the first decryption algorithm to obtain the target log, wherein the first decryption algorithm is matched with the first preset encryption algorithm; The encrypted decryption key is obtained by a second encryption process using a third preset encryption algorithm on the decryption key that has undergone initial encryption. The decryption key that has undergone initial encryption is obtained by a first encryption process using the signature information of the image of the trusted execution environment on the decryption key using a second preset encryption algorithm. The second decryption module using the encryption key includes: The key secondary decryption unit is used to perform secondary decryption processing on the encrypted decryption key based on the third decryption algorithm to obtain the decryption key after the first encryption processing, wherein the third decryption algorithm is matched with the third preset encryption algorithm; The key to be verified acquisition unit is used to decrypt the decryption key that has undergone the first encryption process based on the second decryption algorithm to obtain the decryption key to be verified. The second decryption algorithm is matched with the second preset encryption algorithm. An encryption signature decryption unit is used to decrypt the encryption signature information based on the second decryption algorithm to obtain decrypted signature information, wherein the encryption signature information is obtained by first encrypting the signature information through the second preset encryption algorithm; The decryption key determination unit is used to determine the decryption key to be verified as the decryption key in response to the fact that the decryption signature information is consistent with the pre-stored verification signature information.

10. The apparatus according to claim 9, characterized in that, The device further includes: The root permission determination module is used to determine whether root permission is currently available in response to detecting that the set storage location is a storage location that needs to be accessed based on root permission; The encrypted key acquisition module is also used to perform the operation of obtaining the encrypted decryption key from the set storage location in response to determining that root privileges are currently available.

11. An electronic device, characterized in that, The device includes: The processor and memory used to store processor-executable instructions; The processor is configured as follows: In response to detecting a target log generated in a trusted execution environment, the target log is first encrypted using a first preset encryption algorithm in the trusted execution environment to obtain an encrypted log. The decryption key in the first preset encryption algorithm is subjected to a second encryption process to obtain an encrypted decryption key; The encrypted log is transferred to the kernel log, and the encrypted decryption key is saved in a designated storage location; The step of performing a second encryption process on the decryption key in the first preset encryption algorithm to obtain an encrypted decryption key includes: Obtain the signature information of the image of the trusted execution environment; Based on the second preset encryption algorithm, the signature information is used to perform an initial encryption process on the decryption key to obtain the decryption key after the initial encryption process; The decryption key, which has undergone the first encryption process, is encrypted a second time based on the third preset encryption algorithm to obtain the encrypted decryption key. The step of using the signature information to perform an initial encryption process on the decryption key based on the second preset encryption algorithm to obtain the decryption key after the initial encryption process includes: The signature information and the decryption key are first encrypted based on the second preset encryption algorithm to obtain encrypted signature information and the decryption key after the first encryption. The encrypted signature information is used to compare with the pre-stored verification signature information after being decrypted by the second decryption algorithm. In response to the comparison being consistent, the decryption of the decryption key after the first encryption is triggered based on the second decryption algorithm. The second decryption algorithm is matched with the second preset encryption algorithm.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that, This program is implemented when it is executed by the processor: In response to detecting a target log generated in a trusted execution environment, the target log is first encrypted using a first preset encryption algorithm in the trusted execution environment to obtain an encrypted log. The decryption key in the first preset encryption algorithm is subjected to a second encryption process to obtain an encrypted decryption key; The encrypted log is transferred to the kernel log, and the encrypted decryption key is saved in a designated storage location; The step of performing a second encryption process on the decryption key in the first preset encryption algorithm to obtain an encrypted decryption key includes: Obtain the signature information of the image of the trusted execution environment; Based on the second preset encryption algorithm, the signature information is used to perform an initial encryption process on the decryption key to obtain the decryption key after the initial encryption process; The decryption key, which has undergone the first encryption process, is encrypted a second time based on the third preset encryption algorithm to obtain the encrypted decryption key. The step of using the signature information to perform an initial encryption process on the decryption key based on the second preset encryption algorithm to obtain the decryption key after the initial encryption process includes: The signature information and the decryption key are first encrypted based on the second preset encryption algorithm to obtain encrypted signature information and the decryption key after the first encryption. The encrypted signature information is used to compare with the pre-stored verification signature information after being decrypted by the second decryption algorithm. In response to the comparison being consistent, the decryption of the decryption key after the first encryption is triggered based on the second decryption algorithm. The second decryption algorithm is matched with the second preset encryption algorithm.

13. An electronic device, characterized in that, The device includes: The processor and memory used to store processor-executable instructions; The processor is configured as follows: The encrypted log is obtained from the kernel log, and the encrypted decryption key is obtained from the set storage location. The encrypted log is obtained by the target log generated in the trusted execution environment through the first encryption process of the first preset encryption algorithm. The encrypted decryption key is obtained by the decryption key of the encrypted log through the second encryption process. The encrypted decryption key is subjected to a second decryption process to obtain the decryption key, wherein the algorithm of the second decryption process matches the algorithm of the second encryption process; The encrypted log is decrypted using the decryption key based on the first decryption algorithm to obtain the target log, wherein the first decryption algorithm matches the first preset encryption algorithm; The encrypted decryption key is obtained by a second encryption process using a third preset encryption algorithm on the decryption key that has undergone initial encryption. The decryption key that has undergone initial encryption is obtained by a first encryption process using the signature information of the image of the trusted execution environment on the decryption key using a second preset encryption algorithm. The second decryption process, which involves performing a second decryption on the encrypted decryption key to obtain the decryption key, includes: The encrypted decryption key is decrypted a second time based on the third decryption algorithm to obtain the decryption key after the first encryption. The third decryption algorithm is matched with the third preset encryption algorithm. The decryption key that has undergone the initial encryption process is decrypted based on the second decryption algorithm to obtain the decryption key to be verified. The second decryption algorithm is matched with the second preset encryption algorithm. The encrypted signature information is decrypted based on the second decryption algorithm to obtain decrypted signature information. The encrypted signature information is obtained by first encrypting the signature information using the second preset encryption algorithm. In response to the decryption signature information being consistent with the pre-stored verification signature information, the decryption key to be verified is determined as the decryption key.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that, This program is implemented when it is executed by the processor: The encrypted log is obtained from the kernel log, and the encrypted decryption key is obtained from the set storage location. The encrypted log is obtained by the target log generated in the trusted execution environment through the first encryption process of the first preset encryption algorithm. The encrypted decryption key is obtained by the decryption key of the encrypted log through the second encryption process. The encrypted decryption key is subjected to a second decryption process to obtain the decryption key, wherein the algorithm of the second decryption process matches the algorithm of the second encryption process; The encrypted log is decrypted using the decryption key based on the first decryption algorithm to obtain the target log, wherein the first decryption algorithm matches the first preset encryption algorithm; The encrypted decryption key is obtained by a second encryption process using a third preset encryption algorithm on the decryption key that has undergone initial encryption. The decryption key that has undergone initial encryption is obtained by a first encryption process using the signature information of the image of the trusted execution environment on the decryption key using a second preset encryption algorithm. The second decryption process, which involves performing a second decryption on the encrypted decryption key to obtain the decryption key, includes: The encrypted decryption key is decrypted a second time based on the third decryption algorithm to obtain the decryption key after the first encryption. The third decryption algorithm is matched with the third preset encryption algorithm. The decryption key that has undergone the initial encryption process is decrypted based on the second decryption algorithm to obtain the decryption key to be verified. The second decryption algorithm is matched with the second preset encryption algorithm. The encrypted signature information is decrypted based on the second decryption algorithm to obtain decrypted signature information. The encrypted signature information is obtained by first encrypting the signature information using the second preset encryption algorithm. In response to the decryption signature information being consistent with the pre-stored verification signature information, the decryption key to be verified is determined as the decryption key.

Images