Data processing method, device, terminal equipment and medium

Abstract

The embodiments of the present application provide a data processing method, apparatus, terminal device and medium, which are used to solve the problem in the prior art that, during encryption, the file to be encrypted is damaged due to abnormal interruption of the encryption process. In the embodiments of the present application, before the terminal device encrypts the file to be encrypted, the application layer of the terminal device notifies the vold process to add a checkpoint to the partition storing the file to be encrypted, and after the encryption of the file to be encrypted is completed, the application layer of the terminal device notifies the vold process to clear the checkpoint. Therefore, if the encryption process is abnormally interrupted, the corresponding f2fs file system can be restored to the storage state when the checkpoint was added by restarting the terminal device, and the file to be encrypted can be restored to the state before the encryption started. That is to say, even if the encryption process is abnormally interrupted, it can still be ensured that the file to be encrypted is not damaged.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a data processing method, apparatus, terminal equipment, and medium. Background Art

[0002] With the continuous development of information security technology, the application of encryption technology is becoming more and more widespread. To ensure the security of the file to be encrypted, the existing technology usually reads the data from the file to be encrypted, adds the read data to a new encrypted file, encrypts the new encrypted file, and deletes the file to be encrypted after the encryption is completed. However, this method can only store the new encrypted file when the device has space at least as large as the file to be encrypted. If there is not enough space, the encryption will fail because there is no space to store the new encrypted file. For example, if there is a 2GB file to be encrypted and the device has only 1GB of space left, the new encrypted file cannot be created because the remaining space is less than 2GB, resulting in encryption failure.

[0003] To encrypt files even when space is insufficient, existing techniques employ overwrite encryption. This method sequentially reads portions of data from the file, encrypts them, and then writes the encrypted portions back to the corresponding locations of the pre-encrypted data. This method encrypts and writes back simultaneously. However, this encryption method takes a long time, at least a dozen seconds. If the encryption process is interrupted, the file will be partially encrypted and partially unencrypted. Furthermore, the interruption may cause some of the encrypted data to become corrupted, rendering the file unusable. Summary of the Invention

[0004] The embodiments of the present application provide a data processing method, apparatus, terminal device, and medium for solving the problem in the prior art that, during encryption, the encryption process is abnormally interrupted, resulting in damage to the encrypted file.

[0005] In a first aspect, an embodiment of the present application provides a data processing method, the method comprising:

[0006] The application layer obtains the file to be encrypted corresponding to the encryption request, and saves the file to be encrypted in a partition of a Flash Friendly File System (f2fs) file system;

[0007] The application layer notifies the vold process to add a checkpoint for the partition;

[0008] The application layer encrypts the file to be encrypted and notifies the vold process to clear the checkpoint after the encryption is completed.

[0009] In a second aspect, an embodiment of the present application further provides a data processing device, the device comprising:

[0010] An acquisition and storage module is used for obtaining the file to be encrypted corresponding to the encryption request at the application layer, and saving the file to be encrypted in a partition of the f2fs file system;

[0011] A notification module, used for the application layer to notify the vold process to add a checkpoint for the partition;

[0012] The processing module is configured to encrypt the file to be encrypted at the application layer and notify the vold process to clear the checkpoint after the encryption is completed.

[0013] In a third aspect, an embodiment of the present application further provides a terminal device, the terminal device comprising:

[0014] displays, processors, and memory;

[0015] The display is used to display the screen display area;

[0016] The memory is configured to store instructions executable by the processor;

[0017] The processor is configured to execute the instructions to implement the steps in any of the above-mentioned data processing methods.

[0018] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium on which a computer program is stored, which, when executed by a processor, implements the steps in any of the above-mentioned data processing methods.

[0019] In an embodiment of the present application, the application layer of a terminal device obtains the file to be encrypted corresponding to the encryption request, stores the file to be encrypted in a partition of the f2fs file system, notifies the vold process to add a checkpoint to the partition, encrypts the file to be encrypted, and notifies the vold process to clear the checkpoint after the encryption is complete. Because in this embodiment of the present application, before encrypting the file to be encrypted, the application layer of the terminal device notifies the vold process to add a checkpoint to the partition storing the file to be encrypted, and after the encryption of the file to be encrypted is complete, the application layer of the terminal device notifies the vold process to clear the checkpoint, if the encryption process is abnormally interrupted, the corresponding f2fs file system can be restored to the storage state at the time of adding the checkpoint by restarting the terminal device, and the file to be encrypted can be restored to the state before the encryption began. In other words, even if the encryption process is abnormally interrupted, the file to be encrypted can still be ensured to be intact. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0021] Figure 1 A schematic structural diagram of a terminal device 100 is shown;

[0022] Figure 2 This is a software structure block diagram of a terminal device 100 according to an embodiment of the present application;

[0023] Figure 3 A schematic diagram of a data processing process provided in an embodiment of the present application;

[0024] Figure 4 A schematic diagram of a checkpoint adding process provided in an embodiment of the present application;

[0025] Figure 5 A schematic diagram of a process for encrypting multiple files to be encrypted provided in an embodiment of the present application;

[0026] Figure 6 A complete schematic diagram of an encryption process provided in an embodiment of the present application;

[0027] Figure 7 A schematic diagram of an encryption process provided in an embodiment of the present application;

[0028] Figure 8 A complete schematic diagram of a data processing process provided in an embodiment of the present application;

[0029] Figure 9 A schematic diagram of the structure of a data processing device provided in an embodiment of the present application;

[0030] Figure 10 Another structural diagram of the terminal device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0031] The present application will be further described in detail below with reference to the accompanying drawings. It is apparent that the embodiments described are only a portion of the embodiments of the present application, not all of them. All other embodiments derived by persons of ordinary skill in the art based on the embodiments of the present application without creative effort are intended to fall within the scope of protection of the present application.

[0032] With the continuous development of information security technology, the application of encryption technology is becoming more and more widespread. To ensure the security of the file to be encrypted, the existing technology usually reads the data from the file to be encrypted, adds the read data to a new encrypted file, encrypts the new encrypted file, and deletes the file to be encrypted after the encryption is completed. However, this method can only store the new encrypted file when the device has space at least as large as the file to be encrypted. If there is not enough space, the encryption will fail because there is no space to store the new encrypted file. For example, if there is a 2GB file to be encrypted and the device has only 1GB of space left, the new encrypted file cannot be created because the remaining space is less than 2GB, resulting in encryption failure.

[0033] To encrypt files even when space is insufficient, existing techniques employ overwrite encryption. This method sequentially reads portions of data from the file, encrypts them, and then writes the encrypted portions back to the corresponding locations of the pre-encrypted data. This method encrypts and writes back simultaneously. However, this encryption method takes a long time, at least a dozen seconds. If the encryption process is interrupted, the file will be partially encrypted and partially unencrypted. Furthermore, the interruption may cause some of the encrypted data to become corrupted, rendering the file unusable.

[0034] To ensure that encrypted files are not damaged, embodiments of the present application provide a data processing method, apparatus, terminal device, and medium. The data processing method includes: the application layer of the terminal device obtains the encrypted file corresponding to an encryption request, saves the encrypted file in a partition of the f2fs file system, notifies the vold process to add a checkpoint to the partition, encrypts the encrypted file, and notifies the vold process to clear the checkpoint after encryption is complete. If the encryption process is abnormally interrupted, the f2fs file system can be restarted to restore to the time when the checkpoint was added. This ensures that the encrypted file is not damaged even if the encryption process is abnormally interrupted.

[0035] Figure 1 FIG1 shows a schematic diagram of the structure of a terminal device 100. It should be understood that Figure 1 The terminal device 100 shown is only an example, and the terminal device 100 may have more Figure 1 The more or less components shown in the figure can be combined with two or more components, or can have different component configurations. The various components shown in the figure can be implemented in hardware, software, or a combination of hardware and software including one or more signal processing and / or application specific integrated circuits.

[0036] Figure 1 FIG. 1 shows a block diagram of the hardware configuration of the terminal device 100 according to an exemplary embodiment. Figure 1 As shown, the terminal device 100 includes: a radio frequency (RF) circuit 110, a memory 120, a display unit 130, a camera 140, a sensor 150, an audio circuit 160, a wireless fidelity (Wi-Fi) module 170, a processor 180, a Bluetooth module 181, and a power supply 190 and other components.

[0037] RF circuit 110 can be used to receive and transmit signals during information transmission or calls. It can receive downlink data from the base station and pass it to processor 180 for processing; it can also send uplink data to the base station. Typically, RF circuits include but are not limited to antennas, at least one amplifier, a transceiver, a coupler, a low-noise amplifier, a duplexer, and other components.

[0038] The memory 120 can be used to store software programs and data. The processor 180 executes various functions and data processing of the terminal device 100 by running the software programs or data stored in the memory 120. The memory 120 may include high-speed random access memory and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device. The memory 120 stores the operating system that enables the terminal device 100 to run. In the present application, the memory 120 can store the operating system and various application programs, and may also store program code for executing the data processing method of the terminal device according to the embodiment of the present application.

[0039] The display unit 130 may be used to receive input digital or character information and generate signal input related to user settings and function control of the terminal device 100. Specifically, the display unit 130 may include a touch screen 131 disposed on the front of the terminal device 100, which may collect user touch operations on or near it, such as clicking a button.

[0040] The display unit 130 can also be used to display information input by the user or information provided to the user, as well as a graphical user interface (GUI) of various menus of the terminal device 100. Specifically, the display unit 130 may include a display screen 132 disposed on the front of the terminal device 100. The display screen 132 may be configured in the form of a liquid crystal display, a light-emitting diode, etc. The display unit 130 can be used to display the screen display area of the terminal device in this application.

[0041] The touch screen 131 can be covered on the display screen 132, or the touch screen 131 and the display screen 132 can be integrated to realize the input and output functions of the terminal device 100. The integrated touch screen can be simply called a touch display screen. In this application, the display unit 130 can display applications and corresponding operation steps.

[0042] Camera 140 can be used to capture still images or video. The lens generates an optical image of an object and projects it onto a photosensitive element. The photosensitive element can be a charge coupled device (CCD) or a complementary metal-oxide-semiconductor (CMOS) phototransistor. The photosensitive element converts the optical signal into an electrical signal, which is then transmitted to processor 180 for conversion into a digital image signal.

[0043] The terminal device 100 may further include at least one sensor 150, such as an acceleration sensor 151, a distance sensor 152, a fingerprint sensor 153, and a temperature sensor 154. The terminal device 100 may also be configured with other sensors such as a gyroscope, a barometer, a hygrometer, a thermometer, an infrared sensor, a light sensor, and a motion sensor.

[0044] The audio circuit 160, the speaker 161, and the microphone 162 can provide an audio interface between the user and the terminal device 100. The audio circuit 160 can transmit the electrical signal converted from the received audio data to the speaker 161, which is converted into a sound signal for output. The terminal device 100 can also be equipped with a volume button for adjusting the volume of the sound signal, and can also be used to combine other buttons to adjust the closed area. On the other hand, the microphone 162 converts the collected sound signal into an electrical signal, which is received by the audio circuit 160 and converted into audio data. The audio data is then output to the RF circuit 110 to be sent to, for example, another terminal device, or the audio data is output to the memory 120 for further processing.

[0045] Wi-Fi is a short-range wireless transmission technology. The terminal device 100 can help users send and receive emails, browse web pages, and access streaming media through the Wi-Fi module 170, which provides users with wireless broadband Internet access.

[0046] The processor 180 is the control center of the terminal device 100. It connects the various components of the entire terminal device using various interfaces and lines. It executes various functions of the terminal device 100 and processes data by running or executing software programs stored in the memory 120 and calling data stored in the memory 120. In some embodiments, the processor 180 may include one or more processing units; the processor 180 may also integrate an application processor and a baseband processor, wherein the application processor primarily processes the operating system, user interface, and application programs, and the baseband processor primarily processes wireless communications. It is understood that the above-mentioned baseband processor may not be integrated into the processor 180. In this application, the processor 180 can run the operating system, application programs, user interface display and touch response, as well as the data processing method of the terminal device in the embodiment of the application. In addition, the processor 180 is coupled to the display unit 130.

[0047] The Bluetooth module 181 is used to exchange information with other Bluetooth devices having a Bluetooth module through the Bluetooth protocol. For example, the terminal device 100 can establish a Bluetooth connection with a wearable electronic device (such as a smart watch) that also has a Bluetooth module through the Bluetooth module 181 to exchange data.

[0048] The terminal device 100 also includes a power supply 190 (e.g., a battery) that supplies power to various components. The power supply can be logically connected to the processor 180 via a power management system, thereby enabling the power management system to manage functions such as charging, discharging, and power consumption. The terminal device 100 may also be configured with a power button for turning the terminal device on and off, as well as for locking the screen.

[0049] Figure 2 It is a software structure block diagram of a terminal device 100 according to an embodiment of the present application.

[0050] A layered architecture divides software into several layers, each with distinct roles and responsibilities. Layers communicate with each other through software interfaces. In some embodiments, the Android system can be divided into four layers: the application layer, the application framework layer, the Android runtime and system libraries, and the kernel layer.

[0051] The application layer can include a series of application packages.

[0052] like Figure 2 As shown, the application package may include phone, MMS, WiFi, WeChat, information, alarm clock, gallery, calendar, WLAN and other applications.

[0053] The application framework layer provides an application programming interface (API) and programming framework for the applications in the application layer. The application framework layer includes some predefined functions.

[0054] like Figure 2 As shown, the application framework layer may include a window manager, a content provider, a view system, a phone manager, a resource manager, a notification manager, and the like.

[0055] The window manager is used to manage window programs. The window manager can obtain the display size, determine whether there is a status bar, lock the screen, take screenshots, etc.

[0056] Content providers are used to store and retrieve data and make it accessible to applications. Data can include videos, images, audio, calls made and received, browsing history and bookmarks, phone books, text messages, etc.

[0057] The view system includes visual controls, such as those for displaying text and images. The view system can be used to build applications. A display interface can consist of one or more views. For example, a display interface containing a text notification icon can include a view for displaying text and a view for displaying images.

[0058] The phone manager is used to provide communication functions of the terminal device 100, such as management of call status (including answering, hanging up, etc.).

[0059] The resource manager provides various resources for applications, such as localized strings, icons, images, layout files, video files, etc.

[0060] The Notification Manager allows applications to display notification information (such as the content of a short message) in the status bar. It can be used to convey notification-type messages and can disappear automatically after a short period of time without user interaction. For example, the Notification Manager is used to notify the completion of downloads, message reminders, etc. The Notification Manager can also be used to display notifications in the form of icons or scrolling text in the top status bar of the system, such as notifications from applications running in the background, or notifications that appear on the screen in the form of dialog windows. For example, text messages can be displayed in the status bar, prompts can be heard, the terminal device can vibrate, and the indicator light can flash.

[0061] Android Runtime includes core libraries and a virtual machine. Android runtime is responsible for scheduling and management of the Android system.

[0062] The core library consists of two parts: one is the function that needs to be called by the Java language, and the other is the Android core library.

[0063] The application layer and application framework layer run in a virtual machine. The virtual machine executes Java files in the application layer and application framework layer as binary files. The virtual machine manages object lifecycles, stack management, thread management, security and exception management, and garbage collection.

[0064] The system library can include multiple functional modules, such as surface manager, media library, 3D graphics processing library (such as OpenGL ES), 2D graphics engine (such as SGL), etc.

[0065] The surface manager is used to manage the display subsystem and provide fusion of 2D and 3D layers for multiple applications.

[0066] The media library supports playback and recording of a variety of common audio and video formats, as well as static image files. The media library can support a variety of audio and video encoding formats, such as: MPEG4, H.264, MP3, AAC, AMR, JPG, PNG, etc.

[0067] The 3D graphics processing library is used to implement 3D graphics drawing, image rendering, compositing, and layer processing.

[0068] A 2D (animation method) graphics engine is a drawing engine for 2D drawing.

[0069] The kernel layer is the layer between hardware and software. The kernel layer includes at least display driver, camera driver, audio driver, and sensor driver.

[0070] The terminal device 100 in the embodiment of the present application may be an electronic device including but not limited to a smart phone, a tablet computer, a wearable electronic device (such as a smart watch), a laptop computer, and the like.

[0071] Figure 3 A data processing process diagram provided in an embodiment of the present application includes the following steps:

[0072] S301: The application layer obtains the file to be encrypted corresponding to the encryption request, and saves the file to be encrypted in a partition of the f2fs file system.

[0073] The data processing process provided in the embodiment of the present application is applicable to a terminal device, which may be Figure 1 or Figure 2 The terminal device shown.

[0074] In an embodiment of the present application, if there is a need to encrypt a file to be encrypted, the terminal device can be operated, and the terminal device can obtain the corresponding encryption request through identification operation. Specifically, the user can select the file to be encrypted on the preset page of the encryption-related application installed on the terminal device and click a preset button, such as the "Encrypt" button. The application layer of the terminal device can obtain the encryption request, wherein the encryption request can carry the storage path corresponding to the file to be encrypted. After obtaining the storage path, the application layer of the terminal device can obtain the corresponding file to be encrypted based on the storage path.

[0075] After obtaining the corresponding file to be encrypted, the application layer of the terminal device can save the file to be encrypted in a partition of the f2fs file system, wherein the file to be encrypted can be saved in the data partition. Typically, the location where the file to be encrypted is actually stored is the data / media of the f2fs file system.

[0076] From a user's perspective, encrypted files are typically stored in the / storage / emulated / directory. This directory is a virtual directory that uses a file system other than f2fs, typically a userspace (FUSE) file system. The virtual directory actually corresponds to a subdirectory of the data partition, such as / data / media, which typically uses the f2fs file system. Although the virtual directory and the actual directory share the same partition, they are completely different file systems. They act like shared storage and have a certain correspondence. For example, if a user takes a photo, the user may see it stored at / storage / emulated / 0 / DCIM / 1.png through an application on the terminal device. However, the photo is actually stored at / data / media / 0 / DCIM / 1.png on the terminal device.

[0077] S302: The application layer notifies the vold process to add a checkpoint for the partition.

[0078] To ensure that the encrypted file is not damaged, after obtaining the encrypted file, the application layer can use the checkpoint function of the f2fs file system to add a checkpoint to the partition storing the encrypted file. Since the application layer does not have the permission to add checkpoints to partitions, in this embodiment of the application, a pre-packaged interface can be provided, through which the application layer can add checkpoints to the partition storing the encrypted file.

[0079] Since the vold process has the authority to operate on the partition that stores the files to be encrypted, it is necessary to implement the addition of checkpoints through the vold process. Specifically, in an embodiment of the present application, the application layer can notify the vold process, and the vold process adds a checkpoint to the partition that stores the files to be encrypted, that is, leaving an archive point for the f2fs file system. The specific application layer can notify the vold process through a pre-packaged first interface, and the vold process adds a checkpoint to the partition that stores the files to be encrypted through a pre-packaged second interface.

[0080] It is worth noting that before the checkpoint in the partition is cleared, all operations on the files stored in the partition are only recorded in the cache and will not actually affect the files stored in the partition, that is, will not affect the files in the f2fs file system. For example, after adding a checkpoint to the data partition, many files are added, many files are modified, and some files are deleted in the data partition. As long as the terminal device is powered off and restarted, all operations performed after adding the checkpoint will be invalid, and the f2fs file system will be restored to the storage state when the checkpoint was added. Therefore, in the embodiment of the present application, a checkpoint can be added to the partition storing the to-be-encrypted file before encrypting it, thereby avoiding the problem of the to-be-encrypted file being damaged due to abnormal interruption of the encryption process.

[0081] S303: The application layer encrypts the file to be encrypted and notifies the vold process to clear the checkpoint after the encryption is completed.

[0082] After the application layer notifies the vold process to add a checkpoint for the partition storing the file to be encrypted, the application layer can encrypt the file to be encrypted. In the embodiment of the present application, the application layer can encrypt the file to be encrypted using the overwrite encryption method in the prior art, that is, extracting part of the data in the file to be encrypted and encrypting the part of the data, and after the encryption of the part of the data is completed, writing it back to the file to be encrypted, and extracting part of the remaining unencrypted data, repeating the above steps until all the data in the file to be encrypted is encrypted. Specifically, how to use the overwrite encryption method to encrypt the file to be encrypted is a prior art and will not be described in detail here. It is worth noting that using the overwrite encryption method to encrypt the file to be encrypted does not require additional space and can effectively encrypt the file to be encrypted. Since the file to be encrypted is encrypted, the security of the file to be encrypted can also be improved.

[0083] In this embodiment of the present application, after the encryption of a file is complete, the application layer can clear the added checkpoint, as the file is no longer damaged by abnormal interruptions in the encryption process. Since the application layer does not grant permission to partitions to clear checkpoints, in this embodiment of the present application, a pre-packaged interface can be provided, through which the application layer can clear the checkpoint.

[0084] Since the vold process has the authority to operate on the partition that stores the files to be encrypted, the checkpoint can be cleared through the vold process. Specifically, in an embodiment of the present application, the application layer can notify the vold process through the pre-packaged third interface, and the vold process clears the checkpoint through the pre-packaged fourth interface.

[0085] Among them, in the prior art, when encrypting a file to be encrypted, a low-level encryption method is usually adopted to improve the encryption speed, such as encrypting part of the data of the file to be encrypted. In the embodiment of the present application, the encrypted file is encrypted by a replication encryption method, which can not only achieve high-level encryption without the need for additional storage space, but also ensure that even if the file to be encrypted is damaged when the encryption process is abnormally interrupted, it can be restored to an undamaged state.

[0086] Because in the embodiment of the present application, before the terminal device encrypts the file to be encrypted, the application layer of the terminal device notifies the vold process to add a checkpoint for the partition storing the file to be encrypted, and after the encryption of the file to be encrypted is completed, the application layer of the terminal device notifies the vold process to clear the checkpoint. Therefore, if the encryption process is abnormally interrupted, the corresponding f2fs file system can be restored to the storage state when the checkpoint was added by restarting the terminal device, and the file to be encrypted can be restored to the state before the encryption started. That is to say, even if the encryption process is abnormally interrupted, it can still be ensured that the file to be encrypted is not damaged.

[0087] In order to add a checkpoint to a partition, based on the above embodiment, in the embodiment of the present application, the application layer notifies the vold process to add a checkpoint to the partition, including:

[0088] The application layer notifies the vold process through the system service (SystemServer) to add a checkpoint for the partition.

[0089] Since in actual application scenarios, the application layer cannot communicate directly with the vold process, the application layer cannot directly notify the vold process to add a checkpoint for the partition. However, the application layer can communicate with the SystemServer. Therefore, in an embodiment of the present application, in order to implement the addition of a checkpoint, the application layer of the terminal device can notify the vold process through the SystemServer to add a checkpoint for the partition that stores the file to be encrypted.

[0090] Specifically, since the application layer can communicate with the SystemServer, and the SystemServer can communicate with the vold process, in an embodiment of the present application, an interface for communicating with the vold process can be pre-encapsulated in the SystemServer. For ease of distinction, it can be called the fifth interface, where the fifth interface can be "SystemServer->setDataCheckpoint()". The application layer can send a message to the SystemServer to add a checkpoint to the partition where the files to be encrypted are stored. The SystemServer calls the fifth interface to communicate with the vold process, informing the vold process that there is a need to add a checkpoint to the partition where the files to be encrypted are stored. The vold process adds a checkpoint to the partition where the files to be encrypted are stored.

[0091] In an embodiment of the present application, when the vold process adds a checkpoint to a partition storing files to be encrypted, it can do so through the "vold->setCheckpoint()" interface. Specifically, this interface and a pre-set instruction containing checkpoint parameters can be used to adjust the partition's mount parameters, assigning the checkpoint parameters to the partition storing files to be encrypted, and thus adding a checkpoint. For example, the vold process can add a checkpoint through the "mount -oremount -o checkpoint=disable:0 / data" instruction.

[0092] It is worth noting that if the encryption process is abnormally interrupted due to a restart or abnormal shutdown during the overwriting of the encrypted file, the next time the computer is turned on, the encrypted file will be restored to its state before the encryption started due to the checkpoint function, avoiding the possibility of damage.

[0093] Figure 4 A schematic diagram of a checkpoint adding process provided in an embodiment of the present application includes the following steps:

[0094] S401: The application layer sends a message to the SystemServer to add a checkpoint to the partition storing the file to be encrypted.

[0095] S402: SystemServer calls the fifth interface to communicate with the vold process, and informs the vold process that there is a need to add a checkpoint to the partition storing the file to be encrypted.

[0096] S403: The vold process adds a checkpoint to the partition storing the file to be encrypted.

[0097] In order to accurately clear the checkpoint, based on the above embodiments, in the embodiment of the present application, notifying the vold process to clear the checkpoint includes:

[0098] The application layer notifies the vold process through SystemServer to clear the checkpoint.

[0099] Similarly, in an embodiment of the present application, an interface for communicating with the vold process can be pre-encapsulated in the SystemServer. For ease of distinction, this interface can be referred to as the sixth interface, wherein the sixth interface can be "SystemServer->clearDataCheckpoint()". After the application layer completes encryption of the file to be encrypted, the application layer can send a message to the SystemServer to clear the checkpoint of the partition storing the file to be encrypted. The SystemServer communicates with the vold process by calling the sixth interface, notifying the vold process of the need to clear the checkpoint of the partition storing the file to be encrypted. The vold process clears the checkpoint of the partition storing the file to be encrypted. Specifically, when the vold process clears the checkpoint of the partition storing the file to be encrypted, it can clear the checkpoint through the "vold->clearCheckpoint()" interface. Specifically, when clearing the checkpoint, the checkpoint parameters of the partition are cleared, thereby clearing the checkpoint.

[0100] As the above description demonstrates, a clear path has been established from the application layer to the underlying layer, specifically the partitions storing the files to be encrypted. This allows for the addition or removal of checkpoints whenever needed. The application layer can first call the corresponding API to add a checkpoint and then encrypt the files to be encrypted using conventional overwrite encryption. Once the files to be encrypted are fully encrypted, the application layer calls the corresponding API to synchronize the encrypted files to the corresponding partitions.

[0101] To ensure that the files to be encrypted are not damaged, based on the above embodiments, in an embodiment of the present application, if the encryption request carries multiple files to be encrypted, notifying the vold process to clear the checkpoint after encryption is completed includes:

[0102] For each file to be encrypted, after the encryption of the file to be encrypted is completed, the vold process is notified to clear the checkpoint; the vold process determines whether there are other files to be encrypted currently;

[0103] If not, the vold process clears the checkpoint.

[0104] In actual application scenarios, a user may need to encrypt multiple files to be encrypted. In this case, the encryption request carries multiple files to be encrypted. In this case, the encryption request received by the terminal device carries multiple files to be encrypted. Because the encryption time of each file to be encrypted may vary, if the checkpoint is cleared while one or more files to be encrypted are still in the encryption process, it cannot be guaranteed that the files to be encrypted in the process will not be damaged. Therefore, in this embodiment of the application, the vold process can clear the checkpoint after the encryption of multiple files to be encrypted is completed.

[0105] Specifically, in an embodiment of the present application, if the encryption request carries multiple files to be encrypted, the application layer can start as many threads as the files to be encrypted, with each thread encrypting the files to be encrypted separately. For each file to be encrypted, after the corresponding thread completes encryption of the file to be encrypted, the application layer of the terminal device can notify the vold process to clear the checkpoint. The vold process can determine whether there are other files to be encrypted currently. If there are no other files to be encrypted currently, the vold process clears the checkpoint added to the partition storing the files to be encrypted. If there are other files to be encrypted currently, the vold process will not perform the checkpoint clearing operation for the time being, and will wait until there are no other files to be encrypted currently, and then clear the checkpoint added to the partition storing the files to be encrypted.

[0106] In the embodiment of the present application, when an encryption request carries multiple files to be encrypted, if there are no files to be encrypted being encrypted, the vold process clears the checkpoint added to the partition storing the files to be encrypted, thereby ensuring that the files to be encrypted are not damaged.

[0107] Figure 5 A schematic diagram of a process for encrypting multiple files to be encrypted provided in an embodiment of the present application includes the following steps:

[0108] S501: The application layer starts multiple threads.

[0109] The number of threads started is the same as the number of files to be encrypted carried in the encryption request.

[0110] S502: For each thread, the thread encrypts a file to be encrypted.

[0111] S503: For each file to be encrypted, after the encryption of the file to be encrypted is completed, the vold process is notified to clear the checkpoint.

[0112] S504: The vold process determines whether there are other files to be encrypted. If so, S503 is executed; if not, S505 is executed.

[0113] S505: The vold process clears the checkpoint.

[0114] Among them, in an embodiment of the present application, when encrypting multiple files to be encrypted, the encryption is processed synchronously by using multiple threads, that is, multiple threads are started at the same time, and each thread encrypts a different file to be encrypted respectively, thereby ensuring the stability of the encryption process of multiple files to be encrypted.

[0115] In order to ensure that the file to be encrypted is not damaged, based on the above embodiments, in the embodiment of the present application, after encrypting the file to be encrypted and before notifying the vold process to clear the checkpoint, the method further includes:

[0116] Update the number of files currently being encrypted;

[0117] The determination of whether there are other files to be encrypted currently includes:

[0118] According to whether the number of files currently being encrypted is a preset value, it is determined whether there are other files to be encrypted currently being encrypted.

[0119] In an embodiment of the present application, the application layer can start a thread for each file to be encrypted, and the thread can encrypt the file to be encrypted and update the number of files currently being encrypted. After the encryption of the file to be encrypted is completed, the number of files currently being encrypted is updated again. In an embodiment of the present application, when a user selects files to be encrypted on a preset page of an encryption-related application installed on a terminal device, the selection is made sequentially. The application layer can encrypt the files sequentially according to the order in which each file to be encrypted is selected by the user, or it can encrypt the files simultaneously.

[0120] The vold process of the terminal device can determine whether there are other files to be encrypted currently being encrypted based on whether the number of files currently being encrypted reaches a preset value. The preset value can be 0. Specifically, if the number of files currently being encrypted reaches 0, it is determined that there are no other files to be encrypted currently being encrypted.

[0121] In actual implementation, each time a file to be encrypted is about to be encrypted, the application layer notifies the vold process to add a checkpoint for the partition storing the file to be encrypted. The vold process uses a counter to determine whether the number of files being encrypted is 0. If the number of files being encrypted is 0, a checkpoint is added to the partition storing the file to be encrypted.

[0122] After the application layer starts multiple threads, each of the multiple threads encrypts each file to be encrypted. When each thread starts encrypting the file to be encrypted, the application layer will notify the vold process to add a checkpoint. The vold process will only add a checkpoint when it determines that the number of files being encrypted is 0. Specifically, for each thread, when the thread is ready to encrypt the file to be encrypted, the application layer can notify the vold process to add a checkpoint for the partition storing the file to be encrypted. The vold process globally records a counter, which records the number of files being encrypted. After the application layer notifies the vold process to add a checkpoint for the partition storing the file to be encrypted, the vold process determines whether to add a checkpoint by judging whether the number of files currently being encrypted is 0. If the number of files currently being encrypted is 0, a checkpoint is added and the number of files being encrypted is updated. If the number of files currently being encrypted is not 0, no checkpoint is added and the number of files being encrypted is updated by a preset value, which is 1. That is to say, when the vold process receives the notification to add a checkpoint, it will actually execute the step of adding a checkpoint if the number of files being encrypted is 0.

[0123] In actual implementation, each time encryption of a file is completed, the application layer notifies the vold process to clear the checkpoint for the partition storing the file to be encrypted. The vold process uses a counter to determine whether the number of files being encrypted is 0. If so, the checkpoint is cleared for the partition storing the file to be encrypted. Specifically, for each file to be encrypted, after encryption is completed, the application layer notifies the vold process to clear the checkpoint. The vold process updates the number of files being encrypted by subtracting a preset value, which is 1. After the update is complete, the vold process determines whether the number of files being encrypted is 0. If so, the checkpoint is cleared; if not, the checkpoint is not cleared. In other words, upon receiving a checkpoint clear notification, the vold process will only actually execute the checkpoint clearing step if the number of files being encrypted is 0.

[0124] Figure 6 A complete schematic diagram of an encryption process provided in an embodiment of the present application, the process includes the following steps:

[0125] S601: The application layer obtains an encryption request.

[0126] S602: The application layer obtains the file to be encrypted corresponding to the encryption request.

[0127] S603: The application layer notifies the vold process to add a checkpoint.

[0128] S604: The vold process determines whether the number of files currently being encrypted is a preset value. If so, S605 is executed; if not, S606 is executed.

[0129] S605: The vold process adds a checkpoint to the partition storing the file to be encrypted and executes S606.

[0130] S606: The vold process updates the number of files being encrypted.

[0131] Specifically, add 1 to the number of files being encrypted.

[0132] S607: The application layer encrypts the file to be encrypted, and after the encryption is completed, notifies the vold process to clear the checkpoint.

[0133] S608: The vold process updates the number of files being encrypted.

[0134] Specifically, the number of files being encrypted is reduced by 1.

[0135] S609: The vold process determines whether the number of files being encrypted is a preset value. If so, S610 is executed; if not, S611 is executed.

[0136] S610: The vold process clears the checkpoint for the partition storing the file to be encrypted and executes S611.

[0137] S611: End.

[0138] Figure 7 A schematic diagram of an encryption process is provided for an embodiment of the present application, wherein an encryption request carrying five files to be encrypted is used as an example for illustration.

[0139] Depend on Figure 7It can be seen that the application layer can start 5 threads, which can be called encryption threads here. These 5 encryption threads encrypt the files to be encrypted respectively. Among them, when encryption thread 1 starts to encrypt the corresponding file to be encrypted, the number of files currently being encrypted is 0, the vold process adds a checkpoint, and updates the number of files currently being encrypted. At this time, the number of files currently being encrypted is 1; when encryption thread 4 starts to encrypt the corresponding file to be encrypted, the number of files currently being encrypted is updated, and the number of files currently being encrypted is 2; when encryption thread 2 encrypts the corresponding file to be encrypted, the number of files currently being encrypted is updated, and the number of files currently being encrypted is 3; when encryption thread 3 starts to encrypt the corresponding file to be encrypted, the number of files currently being encrypted is updated, and the number of files currently being encrypted is 4; when encryption thread 5 starts to encrypt the corresponding file to be encrypted, the number of files currently being encrypted is updated, and the number of files currently being encrypted is 5.

[0140] When encryption thread 1 completes encryption of the corresponding file to be encrypted, it updates the number of files currently being encrypted. At this time, the number of files being encrypted is 4; when encryption thread 4 completes encryption of the corresponding file to be encrypted, it updates the number of files currently being encrypted. At this time, the number of files being encrypted is 3; when encryption thread 2 completes encryption of the corresponding file to be encrypted, it updates the number of files currently being encrypted. At this time, the number of files being encrypted is 2; when encryption thread 3 completes encryption of the corresponding file to be encrypted, it updates the number of files currently being encrypted. At this time, the number of files being encrypted is 1; when encryption thread 5 completes encryption of the corresponding file to be encrypted, it updates the number of files currently being encrypted. At this time, the number of files being encrypted is the preset number, and the vold process clears the checkpoint.

[0141] In order to ensure that the file to be encrypted is not damaged, based on the above embodiments, in the embodiment of the present application, the application layer encrypts the file to be encrypted including:

[0142] The application layer encrypts the file to be encrypted, generates cache data, and stores the cache data in a cache;

[0143] After notifying the vold process to clear the checkpoint, the method further includes:

[0144] The cache data is synchronized from the cache to the partition.

[0145] In an embodiment of the present application, when encrypting a file to be encrypted, the application layer generates cache data corresponding to the file to be encrypted and stores this cache data in the cache. This cache data does not occupy actual disk space. After the application layer notifies the vold process to clear the checkpoint, the application layer synchronizes the cache data from the cache to the partition storing the file to be encrypted. Specifically, the vold process clears the checkpoint parameters mounted on the partition storing the file to be encrypted, and the application layer synchronizes the cache data to the partition.

[0146] The cache data in the embodiment of the present application is stored in the cache, which does not require additional space, and can ensure the security and stability of the complete encryption process of the file to be encrypted without occupying additional space.

[0147] To ensure that the file to be encrypted is not damaged, based on the above embodiments, in the embodiment of the present application, after notifying the vold process to add a checkpoint for the partition and before notifying the vold process to clear the checkpoint, the method further includes:

[0148] If a data synchronization operation is detected and data is stored in the cache, the operation of synchronizing the data in the cache to the partition is not performed.

[0149] In actual application scenarios, after a checkpoint is added to the partition that stores the file to be encrypted, if data synchronization operations such as file system data synchronization (fsync) and file system unmount (umount) are triggered, the data already in the cache will be written back to the partition. At this time, if the encryption of the file to be encrypted is not completed, part of the data in the file to be encrypted may be encrypted and part of the data may not be encrypted and damaged. Therefore, in an embodiment of the present application, after adding a checkpoint, if a data synchronization operation is detected and data is stored in the cache, the step of synchronizing the data in the cache to the partition that stores the file to be encrypted will not be executed.

[0150] Since there may be other scenarios for adding checkpoints in actual application scenarios, to distinguish them, in an embodiment of the present application, when the application layer notifies the vold process to add a checkpoint for a partition, it may also notify the vold process to add a preset mount parameter for the partition storing the files to be encrypted. For example, the preset mount parameter may be forcerecord. Specifically, the vold process may add the forcerecord mount parameter to the partition using the command "mount -o remount -ocheckpoint=disable:0–oforcerecord / data" and add a checkpoint. The partition can then determine that this checkpoint is added in response to the encryption process. An encryption flag can be added to the partition. At this point, all data synchronization operations related to the file system will be ignored by default to prevent cached data from being mistakenly written to the partition. After the encryption of the files to be encrypted is completed, when the application layer notifies the vold process to clear the checkpoint, it notifies vold to clear the preset mount parameter. It is worth noting that the forcerecord mount parameter is not currently supported by the file system, requiring business personnel to encapsulate the corresponding interface to add the forcerecord mount parameter to the partition.

[0151] Figure 8 A complete schematic diagram of a data processing process provided in an embodiment of the present application includes the following steps:

[0152] S801: The application layer obtains the file to be encrypted corresponding to the encryption request.

[0153] S802: The application layer notifies the vold process to add the checkpoint and forcerecord mount parameters for the partition storing the files to be encrypted.

[0154] S803: The vold process adds the forcerecord mount parameter to the partition and adds a checkpoint.

[0155] An encryption tag can be added to the partition to prevent the data synchronization operation of the file system. That is, if a data synchronization operation is detected, the corresponding data synchronization step will not be performed.

[0156] S804: The application layer encrypts the file to be encrypted, and after the encryption is completed, notifies the vold process to clear the checkpoint and forcerecord mounting parameters.

[0157] S805: The vold process clears the checkpoint and forcerecord mount parameters.

[0158] The encryption mark in the partition can be cleared. If a data synchronization operation is detected at this time, the corresponding data synchronization steps are executed.

[0159] Figure 9 A schematic diagram of the structure of a data processing device provided in an embodiment of the present application, the device comprising:

[0160] The acquisition and storage module 901 is used for the application layer to obtain the file to be encrypted corresponding to the encryption request and save the file to be encrypted in a partition of the f2fs file system;

[0161] Notification module 902, configured for the application layer to notify the vold process to add a checkpoint for the partition;

[0162] The processing module 903 is configured to encrypt the file to be encrypted at the application layer and notify the vold process to clear the checkpoint after the encryption is completed.

[0163] In a possible implementation, the notification module 902 is specifically configured for the application layer to notify the vold process through the SystemServer to add a checkpoint for the partition.

[0164] In one possible implementation, the processing module 903 is specifically configured to, if the encryption request carries multiple files to be encrypted, notify the vold process to clear the checkpoint for each file to be encrypted after the encryption of the file to be encrypted is completed; the vold process determines whether there are other files to be encrypted currently being encrypted; if not, the vold process clears the checkpoint.

[0165] In a possible implementation, the processing module is further configured to update the number of files currently being encrypted;

[0166] Specifically, it is used to determine whether there are other files to be encrypted that are currently being encrypted based on whether the number of files currently being encrypted is a preset value.

[0167] In a possible implementation, the processing module 903 is specifically configured to encrypt the file to be encrypted at the application layer, generate cache data, and store the cache data in a cache;

[0168] It is also used to synchronize the cache data from the cache to the partition.

[0169] In a possible implementation, the processing module 903 is further configured to, if a data synchronization operation is detected and data is stored in the cache, not perform an operation of synchronizing the data in the cache to the partition.

[0170] Based on the same inventive concept, Figure 10 Another structural diagram of the terminal device provided in the embodiment of the present application is as follows Figure 10 As shown, it includes: one or more (including two) processors 1001 and a communication interface 1002.

[0171] The processor 1001 stores a computer program. When the program is executed by the processor 1001 , the processor 1001 executes the steps of the data processing method in any of the above embodiments.

[0172] Optionally, the terminal device further includes a memory 1003, which may include a read-only memory and a random access memory, and provides operation instructions and data to the processor. Part of the memory may also include a non-volatile random access memory (NVRAM).

[0173] In some embodiments, as Figure 10 As shown, the memory 1003 stores the following elements, execution modules or data structures, or their subsets, or their extended sets.

[0174] like Figure 10 As shown, in some embodiments of the present application, corresponding operations are performed by calling operation instructions stored in the memory 1003 (the operation instructions may be stored in the operating system).

[0175] like Figure 10 As shown, the processor 1001 controls the processing operations of the head-end device, and the processor can also be called a central processing unit (CPU).

[0176] like Figure 10 As shown, the memory 1003 may include a read-only memory and a random access memory, and provides instructions and data to the processor. A portion of the memory 1003 may also include NVRAM. For example, in an application, the communication interface and the memory are coupled together through a bus system 1004, wherein the bus system 1004 may include a power bus, a control bus, and a status signal bus in addition to a data bus. However, for the sake of clarity, the following are not used in the following text: Figure 10 Various buses are labeled as bus system 1004.

[0177] Based on the above embodiments, the present application also provides a computer-readable storage medium, which stores a computer program that can be executed by a processor. When the program runs on the processor, the processor implements the steps of the data processing method in any of the above embodiments when executing.

[0178] Since the principle of solving the problem provided by the computer-readable medium is similar to the data processing method, after the processor executes the computer program in the computer-readable medium, the steps implemented can refer to the above embodiments, and the repeated parts will not be repeated.

[0179] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0180] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0181] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0182] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1a process or multiple processes and / or boxes Figure 1 The steps for the function specified in one or more boxes.

[0183] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A data processing method, characterized in that: Applied to a terminal device, the method includes: The application layer obtains the file to be encrypted corresponding to the encryption request, and saves the file to be encrypted in a partition of the flash-friendly f2fs file system; The application layer notifies the vold process to add a checkpoint for the partition; The application layer encrypts the file to be encrypted and notifies the vold process to clear the checkpoint after the encryption is completed.

2. The method according to claim 1, characterized in that The application layer notifies the vold process to add a checkpoint for the partition, including: The application layer notifies the vold process through the system service SystemServer to add a checkpoint for the partition.

3. The method according to claim 1, characterized in that If the encryption request carries multiple files to be encrypted, notifying the vold process to clear the checkpoint after encryption is completed includes: For each file to be encrypted, after the encryption of the file to be encrypted is completed, the vold process is notified to clear the checkpoint; the vold process determines whether there are other files to be encrypted currently; If not, the vold process clears the checkpoint.

4. The method according to claim 3, characterized in that After encrypting the file to be encrypted and before notifying the vold process to clear the checkpoint, the method further includes: Update the number of files currently being encrypted; The determination of whether there are other files to be encrypted currently includes: According to whether the number of files currently being encrypted is a preset value, it is determined whether there are other files to be encrypted currently being encrypted.

5. The method according to claim 1, wherein The application layer encrypts the file to be encrypted including: The application layer encrypts the file to be encrypted, generates cache data, and stores the cache data in a cache; After notifying the vold process to clear the checkpoint, the method further includes: The cache data is synchronized from the cache to the partition.

6. The method according to claim 5, characterized in that After notifying the vold process to add a checkpoint for the partition and before notifying the vold process to clear the checkpoint, the method further includes: If a data synchronization operation is detected and data is stored in the cache, the operation of synchronizing the data in the cache to the partition is not performed.

7. A data processing device, characterized in that: The device comprises: An acquisition and storage module is used for the application layer to obtain the file to be encrypted corresponding to the encryption request, and save the file to be encrypted in a partition of the flash-friendly f2fs file system; A notification module, used for the application layer to notify the vold process to add a checkpoint for the partition; The processing module is configured to encrypt the file to be encrypted at the application layer and notify the vold process to clear the checkpoint after the encryption is completed.

8. The device according to claim 7, characterized in that The notification module is specifically used for the application layer to notify the vold process through the system service SystemServer to add a checkpoint for the partition.

9. A terminal device, characterized in that: The terminal device includes: displays, processors, and memory; The display is used to display the screen display area; The memory is configured to store instructions executable by the processor; The processor is configured to execute the instructions to implement the steps in the data processing method according to any one of claims 1 to 6.

10. A computer-readable storage medium, characterized in that A computer program is stored thereon, and when the program is executed by a processor, the steps in the data processing method according to any one of claims 1 to 6 are implemented.

Images