Data decryption method and device, and storage medium

Abstract

The present disclosure relates to a data decryption method and device and a storage medium, and belongs to the field of information security. The method comprises the following steps: a server receives a first access password, encrypts the first access password by using a first public key to obtain a second access password, and an electronic device receives the second access password sent by the server; the second access password is decrypted by using a first private key corresponding to the first public key to obtain the first access password; a second data password stored in a specified area of the electronic device is obtained, the second data password is obtained by encrypting a first data password of the electronic device by using the first access password; the second data password is decrypted by using the first access password to obtain the first data password; and the encrypted user data in the electronic device is decrypted by using the first data password. The method can protect the security of user data and solve the problem that the user data in the electronic device cannot be unlocked.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the field of information security, and particularly relates to a data decryption method and device and storage medium. BACKGROUND

[0002] Nowadays, data encryption and decryption technology is widely used in various fields, and in the field of electronic devices, protecting user data is a permanent topic, and mobile phones are no exception. Taking Android as an example, in the related art, in recent years, the data of users is encrypted by a secret key generated by the mobile phone itself when the mobile phone is first started. In order to protect the data of users, the secret key needs to be protected, so there is a lock screen password. However, a problem arises, and the process of obtaining the secret key through the lock screen password will go through multiple intermediate file checks and multiple calls. Any problem in any place will cause the data to be unable to be decrypted, thereby causing the data of users to be lost and difficult to be retrieved. SUMMARY

[0003] In order to overcome the problems in the related art, the present disclosure provides a data decryption method, device and storage medium.

[0004] According to a first aspect of an embodiment of the present disclosure, a data decryption method is provided, applied to an electronic device, and the method comprises:

[0005] receiving a second access password from a server, the second access password being encrypted by the server using a first public key on a first access password;

[0006] decrypting the second access password by using a first private key corresponding to the first public key to obtain the first access password;

[0007] obtaining a second data password stored in a specified area of the electronic device, the second data password being encrypted by the first access password on a first data password of the electronic device;

[0008] decrypting the second data password by using the first access password to obtain the first data password;

[0009] decrypting encrypted user data in the user device by using the first data password.

[0010] Optionally, before the receiving the second access password sent by the server, the method further comprises:

[0011] sending the first access password to the server;

[0012] receiving a third access password from the server, the third access password being encrypted by the server using the first public key on the first access password;

[0013] decrypting the third access password by a first private key corresponding to the first public key to obtain the first access password;

[0014] encrypting the first data password by the first access password to obtain the second data password;

[0015] storing the second data password in the specified area.

[0016] Optionally, the method further comprises:

[0017] generating the first data password;

[0018] generating a first public-private key pair by a security application in the electronic device, the first public-private key pair comprising the first public key and the first private key, the security application running in a trusted execution environment of the electronic device;

[0019] sending the first public key to the server;

[0020] storing the first private key in the security application.

[0021] Optionally, the decrypting the second data password by the first access password to obtain the first data password comprises:

[0022] decrypting the second data password by the first access password by a security application in the electronic device, the security application running in a trusted execution environment of the electronic device.

[0023] Optionally, the storing the second data password in the specified area comprises:

[0024] storing the second data password in a secure partition located in the trusted execution environment of the electronic device.

[0025] Optionally, the method further comprises:

[0026] in a case where the electronic device is started for the first time, displaying prompt information for setting a first access password on a start-up interface;

[0027] in response to receiving a setting instruction for setting the first access password, jumping the start-up interface to a password setting interface provided by the server;

[0028] or,

[0029] In a case where the electronic device is not started for the first time, in response to a setting instruction for setting the first access password received on a setting interface of the electronic device, the setting interface is jumped to the password setting interface provided by the server, and the password setting interface is used for the user to set the first access password for decrypting user data of the electronic device on the server through the password setting interface.

[0030] According to a second aspect of the embodiments of the present disclosure, a data decryption method is provided, applied to a server, and the method comprises:

[0031] receiving a first access password input by a user for accessing user data of an electronic device;

[0032] encrypting the first access password by using a first public key corresponding to the electronic device to obtain a second access password;

[0033] sending the second access password to the electronic device, so that the electronic device decrypts the second access password by using a first private key corresponding to the first public key to obtain the first access password, and after obtaining a second data password stored in a specified area of the electronic device, the first access password is used to decrypt the second data password to obtain a first data password, which is used to decrypt encrypted user data in the electronic device.

[0034] Optionally, before the receiving of the first access password input by the user for decrypting the user data of the electronic device, the method further comprises:

[0035] receiving the first access password set by the user;

[0036] encrypting the first access password by using a first public key corresponding to the electronic device to obtain a third access password;

[0037] sending the third access password to the electronic device, so that the electronic device decrypts the third access password by using a first private key corresponding to the first public key to obtain the first access password, and after encrypting a first data password of the electronic device by using the first access password to obtain a second data password, the second data password is saved to the specified area.

[0038] Optionally, the first public key and the first private key are generated by a security application in the electronic device, the first public key is sent to the server by the electronic device after the security application generates the first public key and the first private key, and the security application runs in a trusted execution environment of the electronic device.

[0039] According to a third aspect of the embodiments of the present disclosure, a data decryption apparatus is provided, applied to an electronic device, and the apparatus comprises:

[0040] a first receiving module configured to receive a second access password from a server, the second access password being encrypted by the server from a first access password by using a first public key;

[0041] a first decryption module configured to decrypt the second access password by using a first private key corresponding to the first public key to obtain the first access password;

[0042] a obtaining module configured to obtain a second data password stored in a specified area of the electronic device, the second data password being encrypted by the first access password from a first data password of the electronic device;

[0043] a second decryption module configured to decrypt the second data password by using the first access password to obtain the first data password;

[0044] a third decryption module configured to decrypt encrypted user data in the user device by using the first data password.

[0045] Optionally, the apparatus further comprises:

[0046] a sending module configured to send the first access password to the server;

[0047] a second receiving module configured to receive a third access password from the server, the third access password being encrypted by the server from the first access password by using the first public key;

[0048] a fourth decryption module configured to decrypt the third access password by using the first private key corresponding to the first public key to obtain the first access password;

[0049] an encryption module configured to encrypt the first data password by using the first access password to obtain the second data password;

[0050] a first storage module configured to store the second data password in the specified area.

[0051] Optionally, the apparatus further comprises:

[0052] a generating module configured to generate the first data password;

[0053] a security module configured to generate, by a security application in the electronic device, a first public-private key pair, the first public-private key pair comprising the first public key and the first private key, the security application running in a trusted execution environment of the electronic device;

[0054] a sending module configured to send the first public key to the server;

[0055] a second storage module configured to store the first private key in the security application.

[0056] Optionally, the second decryption module is configured to:

[0057] decrypt, by the security application in the electronic device, the second data password by using the first access password, the security application running in the trusted execution environment of the electronic device.

[0058] Optionally, the first storage module is configured to:

[0059] store the second data password in a secure partition located in the trusted execution environment of the electronic device.

[0060] Optionally, the apparatus further comprises:

[0061] a display module configured to, in a case where the electronic device is started for the first time, display, on a start interface, prompt information for setting a first access password;

[0062] a communication module configured to, in response to receiving a setting instruction for setting the first access password, jump the start interface to a password setting interface provided by the server;

[0063] Alternatively,

[0064] the communication module is configured to, in a case where the electronic device is not started for the first time, in response to a setting instruction for setting the first access password received on a setting interface of the electronic device, jump the start interface to the password setting interface provided by the server, the password setting interface being used for the user to set, through the password setting interface, the first access password for decrypting user data of the electronic device on the server.

[0065] According to a fourth aspect of the embodiments of the present disclosure, a data decryption apparatus is provided, applied to a server, and the apparatus comprises:

[0066] a first receiving module configured to receive a first access password input by a user for accessing user data of an electronic device;

[0067] The first encryption module is configured to encrypt the first access password by using a first public key corresponding to the electronic device to obtain a second access password.

[0068] The sending module is configured to send the second access password to the electronic device, so that the electronic device decrypts the second access password by using a first private key corresponding to the first public key to obtain the first access password, and decrypts a second data password stored in the specified region of the electronic device by using the first access password to obtain the first data password after obtaining the second data password, where the first data password is used to decrypt encrypted user data in the electronic device.

[0069] Optionally, the apparatus further includes:

[0070] The second receiving module is configured to receive the first access password input by the user for the first time before receiving the first access password input by the user for decrypting user data of the electronic device.

[0071] The second encryption module is configured to encrypt the first access password by using a first public key corresponding to the electronic device to obtain a third access password.

[0072] The sending module is further configured to send the third access password to the electronic device, so that the electronic device decrypts the third access password by using a first private key corresponding to the first public key to obtain the first access password, and saves a second data password obtained by encrypting a first data password of the electronic device by using the first access password to the specified region.

[0073] Optionally, the first public key and the first private key are generated by a security application in the electronic device, the first public key is sent to the server by the electronic device after the security application generates the first public key and the first private key, and the security application runs in a trusted execution environment of the electronic device.

[0074] According to a fifth aspect of the embodiments of the present disclosure, a data decryption electronic device is provided, including:

[0075] a processor;

[0076] a memory for storing processor-executable instructions;

[0077] The processor is configured to execute the executable instructions to implement the steps of the method in any of the embodiments of the first aspect.

[0078] According to a sixth aspect of the embodiments of the present disclosure, another data decryption electronic device is provided, including:

[0079] a processor;

[0080] a memory for storing processor-executable instructions;

[0081] wherein the processor is configured to execute the executable instructions to implement the steps of the method according to any of the embodiments of the first aspect.

[0082] According to a seventh aspect of the embodiments of the present disclosure, a computer-readable storage medium is provided, which stores computer program instructions, and the computer program instructions are executed by a processor to implement the steps of the method according to any of the embodiments of the first aspect.

[0083] According to an eighth aspect of the embodiments of the present disclosure, a computer-readable storage medium is provided, which stores computer program instructions, and the computer program instructions are executed by a processor to implement the steps of the method according to any of the embodiments of the second aspect.

[0084] The technical solutions provided by the embodiments of the present disclosure can include the following beneficial effects:

[0085] In the above technical solutions, after receiving the first access password input by the user, the server encrypts the first access password by using the first public key to obtain a second access password and sends the second access password to the electronic device. After receiving the second access password, the electronic device decrypts the second access password by using the first private key corresponding to the first public key to obtain the first access password, and then obtains a second data password stored in a specified area of the electronic device. The second data password is obtained by encrypting a first data password of the electronic device by using the first access password, and the first data password is used to encrypt user data of the electronic device. The electronic device decrypts the second data password by using the first access password to obtain the first data password, and then decrypts the encrypted user data in the electronic device by using the first data password. Through the above technical solutions, a mechanism for unlocking the electronic device by the server is provided, which can protect the security of the user data and solve the problem of being unable to unlock the user data in the electronic device.

[0086] It should be understood that the foregoing general description and the following detailed description are only exemplary and explanatory, and cannot limit the present disclosure. BRIEF DESCRIPTION OF DRAWINGS

[0087] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate embodiments consistent with the present disclosure and serve to explain the principles of the present disclosure together with the specification.

[0088] Figure 1 is a flowchart of a data decryption method according to an exemplary embodiment.

[0089] Figure 2 is a flowchart of another data decryption method according to an example embodiment.

[0090] Figure 3 is a flowchart of yet another data decryption method according to an example embodiment.

[0091] Figure 4 is a block diagram of a data decryption apparatus according to an example embodiment.

[0092] Figure 5 is a block diagram of a data decryption apparatus according to an example embodiment.

[0093] Figure 6 is a block diagram of another data decryption apparatus according to an example embodiment.

[0094] Figure 7 is a block diagram of yet another data decryption apparatus according to an example embodiment. DETAILED DESCRIPTION

[0095] The example embodiments will be described in detail herein with reference to the attached drawings. The following description is made with reference to the accompanying drawings, in which like reference numerals refer to like elements, and by way of example only. The following description of example embodiments does not represent all of the implementations consistent with the present disclosure. Rather, they are merely examples in accordance with some aspects consistent with the present disclosure as detailed in the appended claims.

[0096] Figure 1 is a flowchart of a data decryption method according to an example embodiment, which is applied to an electronic device, such as Figure 1 as shown, the method can include the following steps.

[0097] In step S101, a second access password is received from a server, the second access password being encrypted by the server from a first access password using a first public key.

[0098] wherein after the server receives the first access password input by the user, the second access password is encrypted from the first access password using the first public key, and then the electronic device receives the second access password sent by the server.

[0099] In an example, the first access password is a pre-set password for accessing user data of the electronic device. In the electronic device, after first booting, a first data password for encrypting and decrypting user data is set in the electronic device, and after the first data password and the first access password are generated, the electronic device encrypts the first data password by using the first access password to obtain a second data password, and the second data password is stored in a specified area of the electronic device.

[0100] In an implementation, the first access password input by the user is input and set by the user in a page generated by the server, for example, when the electronic device is first booted, the password setting interface provided by the server is jumped to, so that the user sets the first access password in the password setting interface. In this implementation, the first access password can be a password corresponding to an account registered by the electronic device at the manufacturer thereof, or can be a specially set password. Alternatively, the first data password can also be generated by the electronic device when the electronic device is first booted. In another implementation, the first access password and the first data password can both be pre-set before the electronic device is shipped, wherein the first data password is pre-set and encrypted by using the pre-set first access password, the encrypted second data password is stored in a specified area of the electronic device before the electronic device is shipped, and the first access password can be obtained by the user after the user purchases the electronic device, for example, printed in the instruction manual of the electronic device.

[0101] It is worth mentioning that the encryption and decryption process of the first access password adopts asymmetric encryption, and a public-private key pair including the first public key and the first private key can be pre-generated by the electronic device, one of the first public key and the first private key can decrypt a file encrypted by the other. The public key is usually public, and the private key is usually secret, so the first public key can be sent to the server after being generated, and the first private key is only saved in the electronic device.

[0102] When the server receives the first access password input by the user again in step S101, the electronic device receives the second access password sent by the server and performs the decryption process of subsequent steps S102-S104 according to the second access password. Wherein, the server receiving the first access password input by the user again can be that the user cannot unlock the electronic device, the electronic device jumps to the password input interface provided by the server on its display interface, so that the user inputs the first access password in the password input interface, so that the server obtains the first access password; or it can be that the user cannot unlock the electronic device, logs in the password input interface provided by the server corresponding to the electronic device through another device, so that the user inputs the first access password in the password input interface, so that the server obtains the first access password, wherein the password input interface provided by the server can be logged in through the account and password registered in advance by the electronic device, so as to realize the unlocking of the electronic device through another device and remote unlocking.

[0103] In step S102, the second access password is decrypted by the first private key corresponding to the first public key to obtain the first access password.

[0104] For example, in order to ensure the security of the password, the first access password cannot be obtained by a third party during its transmission, and the sender is not a third party impersonation. Therefore, the asymmetric encryption method is adopted, and the sender and the receiver of the password need to have the public key and the private key in the same public-private key pair respectively. For example, after the electronic device receives the second access password sent by the server, the second access password is decrypted by the first private key. If the first access password is obtained by decryption, it indicates that the server has the first public key corresponding to the first private key, so as to determine the legal identity of the server and the authenticity of the first access password obtained after decryption.

[0105] In step S103, the second data password stored in the specified area of the electronic device is obtained, and the second data password is obtained by encrypting the first data password of the electronic device by the first access password.

[0106] In an example, the region designated by the electronic device can be a partition with security features in the electronic device. For example, it can be a partition with security features in an eMMC (Embedded Multi Media Card). The eMMC is a standard specification of an embedded memory established by the MMC (Multi Media Card) Association, mainly for products such as mobile phones or tablet computers. The RPMB can authenticate a write operation to ensure the legality of the written data, and only a designated Host can write data to the RPMB, and in reading data, to ensure that the read data is not counterfeit data, the RPMB provides a signature mechanism for verification. In actual applications, the RPMB is usually used to store data that needs to be protected from illegal tampering. In this embodiment, by storing the second data password in the RPMB, the second data password can be guaranteed not to be tampered with, thereby guaranteeing the validity of the second data password.

[0107] In step S104, the second data password is decrypted by the first access password to obtain the first data password.

[0108] Since the second data password is encrypted by the first access password from the first data password of the electronic device, after obtaining the first access password and the second data password, the second data password can be decrypted by the first access password, and the first data password can be obtained.

[0109] In step S105, the encrypted user data in the user device is decrypted by the first data password.

[0110] It can be understood that the user data can refer to data generated by the user operating the electronic device, data related to user privacy generated by the running of the electronic device, and other data that needs to be kept secret. These data can be all or part of the data in the electronic device. When the electronic device is first powered on, the user data is zero, and gradually accumulates in the subsequent use of the electronic device. Whenever new user data is generated, the electronic device can encrypt the new user data by the first data password. Therefore, the encrypted user data in the user device is decrypted by the first data password to obtain the user data of the electronic device, thereby unlocking the electronic device.

[0111] Optionally, in an embodiment, step S104 can include decrypting the second data password by the first access password through a security application in the electronic device, the security application running in a trusted execution environment of the electronic device.

[0112] Thus, in the above scheme, the first data password for encrypting / decrypting user data is stored in the designated area of the electronic device with security features in an encrypted form, which can ensure that the first access password cannot be obtained by external devices, and the first access password for obtaining the first data password is encrypted in an asymmetric manner during transmission, thereby ensuring the security of the first access password, thereby ensuring the security of the user's data, and at the same time, solving the problem that the electronic device cannot unlock the user data in the electronic device.

[0113] Figure 2 is a flowchart of another data decryption method according to an exemplary embodiment, which is applied in a server, as shown in Figure 2 The method can include the following steps.

[0114] In step S201, a first access password input by a user for accessing user data of an electronic device is received.

[0115] Wherein, the use and setting method of the first access password are the same as described in step S101, and can refer to step S101, which will not be repeated here.

[0116] In step S202, the first access password is encrypted by a first public key corresponding to the electronic device to obtain a second access password.

[0117] Wherein, the method of encrypting the first access password by the server using the first public key to obtain the second access password is the same as described in step S101, and can refer to step S101, which will not be repeated here.

[0118] It is worth mentioning that the public keys of multiple electronic devices can be stored in the server, so in step 201, the user device can first log in through the account and password corresponding to the electronic device before inputting the first access password, so that the server can identify that the first access password input currently is that of the electronic device, and thus obtain the first public key corresponding to the electronic device. Alternatively, the server stores the mapping relationship between each electronic device and different access passwords and different public keys, and when the server receives the first access password input by the user, the mapping relationship can be queried to determine which electronic device and the public key corresponding to the electronic device.

[0119] In step S203, the second access password is sent to the electronic device.

[0120] After sending the second access password to the electronic device, the electronic device decrypts the second access password by using a first private key corresponding to the first public key to obtain a first access password, and after obtaining the second data password stored in the specified area of the electronic device, the electronic device decrypts the second data password by using the first access password to obtain a first data password, and the first data password is used to decrypt the encrypted user data in the electronic device. The method of step S203 is the same as the method described in steps S102-S105, and will not be described again.

[0121] Through the above embodiment, a mechanism for unlocking the electronic device by the server is provided, which can solve the problem of being unable to unlock the user data in the electronic device while protecting the security of the user data.

[0122] Figure 3 is a flowchart of still another data decryption method according to an exemplary embodiment, as shown in FIG. 6, the method can include the following steps: Figure 3

[0123] In step S301, the electronic device generates a first data password.

[0124] In step S302, the electronic device generates a first public-private key pair by using a security application in the electronic device.

[0125] The first public-private key pair includes a first public key and a first private key, and the security application runs in a trusted execution environment of the electronic device. The use and generation method of the first data password are the same as those described in step S101, and can be referred to step S101, and will not be described again. The security application can be an application program for performing security-related operations, such as a mobile phone manager, or other security applications, which is built in the electronic device.

[0126] ​The security application is set up and runs in a trusted execution environment (Trusted Execution Environment, TEE) of the electronic device. The TEE was first proposed by the OMTP (Open Mobile Terminal Platform) specification, which provides a dual-system solution: in addition to a multimedia operating system, a separate secure operating system is provided in the same smart terminal, which is used to process sensitive information to ensure the security of the information. This solution is the predecessor of the TEE. The trusted execution environment TEE can be ensured not to be disturbed by the regular operating system, and is therefore called "trusted". This is achieved by creating a small operating system that can run independently in the TrustZone (secure world) kernel. Even if the phone is jailbroken or rooted, attackers cannot obtain data in this environment. The TEE is usually used in the following scenarios involving sensitive information: fingerprint verification, PIN code verification, etc. in mobile payment, secure storage of confidential data such as private keys, certificates, etc. Content protection such as DRM (Digital Rights Management), etc. The environment in the electronic device other than the TEE is called REE (Rich Execution Environment). The REE is the general environment of the electronic device, and usually runs a general OS (Operating System), such as Android, IOS system, etc.

[0127] In step S303, the electronic device sends the first public key to the server.

[0128] In step S304, the electronic device stores the first private key in the security application.

[0129] After generating the first public-private key pair through the security application described above, the electronic device can send the first public key to the server for encryption in the subsequent access password transmission process, while the first private key needs to be stored confidentially and saved in the security application.

[0130] In step S305, the server receives the first access password set by the user.

[0131] For example, the first access password can be set as the first access password set by the user when the first access password is first received. The first access password can be set through the following scenarios:

[0132] In the first implementation, in the case of first starting of the electronic device, a prompt information for setting the access password is displayed on the starting interface. After receiving a setting instruction for determining to set the access password, the starting interface is jumped to a password setting interface provided by the server. The password setting interface is used for the user to set the first access password for accessing the user data of the electronic device on the server through the password setting interface.

[0133] In an example, in the case of first starting, a prompt information for setting the access password is displayed on the starting interface. The prompt page can be displayed on a specially set independent page, or can be displayed in the form of a pop-up window or a dialog box on any page after starting. The prompt information can display "Confirm" and "Cancel" buttons. After the "Confirm" button is triggered, the electronic device receives the setting instruction. Alternatively, the electronic device can interact with the user through the voice assistant of the electronic device and give a voice prompt when the prompt page is displayed. After the voice prompt, voice listening is performed. When the user says "set" or "confirm" keywords are heard, the electronic device receives the setting instruction. After receiving the setting instruction, the electronic device is jumped from the current page to a password setting interface provided by the server, so that the user inputs and sets the first access password in the password setting interface.

[0134] In the second implementation, in the case of non-first starting of the electronic device, after receiving a setting instruction for determining to set the access password on the setting interface of the electronic device, the setting interface is jumped to a password setting interface provided by the server.

[0135] It can be understood that if the user does not perform the above-mentioned operation of setting the first access password after first starting, the user can manually initiate the setting process in subsequent use. For example, the user enters the setting interface of the electronic device. There is a button for setting the access password in the setting interface. When the user triggers the button, the electronic device is jumped from the current setting page to a password setting interface provided by the server.

[0136] After setting the first access password through the password setting interface, the electronic device sends the first access password to the server.

[0137] In step S306, the server encrypts the first access password by using the first public key to obtain a third access password.

[0138] In step S307, the electronic device receives the third access password sent by the server.

[0139] In step S308, the electronic device decrypts the third access password by using the first private key corresponding to the first public key to obtain the first access password.

[0140] In steps S305-S308, after the server obtains the first access password set by the user, the server encrypts the first access password using the first public key sent by the electronic device, and sends the third access password obtained by encryption to the electronic device. After the electronic device receives the third access password sent by the server, the electronic device decrypts the third access password using the first private key. If the first access password is successfully obtained after decryption, it indicates that the server has the first public key corresponding to the first private key, and thus can determine that the third access password sent by the server is valid, thereby determining the legal identity of the server and the authenticity of the first access password obtained after decryption.

[0141] In step S309, the electronic device encrypts the first data password using the first access password to obtain a second data password.

[0142] In step S310, the electronic device stores the second data password in a specified area.

[0143] In an example, the second data password can be stored in a secure partition in a trusted execution environment (TEE) of the electronic device, such as RPMB in MMC. For RPMB, refer to step S103, which will not be repeated. The steps S301, S302, S304, S310, and S309 described above can be executed in the TEE, and steps S303, S307, and S308 can be executed in the REE.

[0144] Through the above steps S301-S310, the setting of the first access password and the encryption and storage of the first data password are completed. When the user unlocks the electronic device due to forgetting the unlocking password or due to an error in the process of decrypting the user data by the device using the unlocking password, the user can achieve decryption of the user data of the electronic device by inputting the previously set first access password to the server again. The decryption process includes steps S311-S317.

[0145] In step S311, the server receives the first access password input by the user.

[0146] For example, the server receives the first access password input by the user again. The server can obtain the first access password in the following manners. For example, the user cannot unlock the electronic device, and the electronic device jumps to a password input interface provided by the server on a display interface of the electronic device, so that the user inputs the first access password in the password input interface, and the server obtains the first access password. For another example, the user cannot unlock the electronic device, and logs in a password input interface provided by the server and corresponding to the electronic device through another device, so that the user inputs the first access password in the password input interface, and the server obtains the first access password. The user can log in the password input interface provided by the server through an account and a password pre-registered by the electronic device, so as to perform the following steps through another device to realize decryption of data of the electronic device and unlocking of the electronic device. Moreover, the unlocking can be realized remotely.

[0147] In step S312, the server encrypts the first access password by using the first public key to obtain a second access password.

[0148] In step S313, the electronic device receives the second access password sent by the server.

[0149] In step S314, the second access password is decrypted by using a first private key corresponding to the first public key to obtain the first access password.

[0150] The steps S312 to S314 are the same as the method shown in steps S306 to S308, and will not be described herein again.

[0151] In step S315, the electronic device obtains the second data password stored in the specified area of the electronic device.

[0152] For example, the specified area is the RPMB, and the method for obtaining the second data password from the RPMB is the same as that in step S103, and will not be described herein again.

[0153] In step S316, the second data password is decrypted by using the first access password to obtain the first data password.

[0154] For example, the second data password can be decrypted by using the decrypted first access password through a security application running in a trusted execution environment (TEE) of the electronic device, so as to obtain the first data password used for encrypting the user data.

[0155] In step S317, the encrypted user data in the electronic device is decrypted by using the first data password.

[0156] The steps S315 and S316 can be executed in the TEE, and the steps S313, S314 and S317 can be executed in the REE.

[0157] In the technical solution, after receiving the first access password input by the user, the server encrypts the first access password by using the first public key to obtain a second access password and sends the second access password to the electronic device. After receiving the second access password, the electronic device decrypts the second access password by using the first private key corresponding to the first public key to obtain the first access password, and then obtains a second data password stored in a specified area of the electronic device. The second data password is obtained by encrypting a first data password of the electronic device by using the first access password. The first data password is used to encrypt user data of the electronic device. The electronic device decrypts the second data password by using the first access password to obtain the first data password, and then decrypts the encrypted user data in the electronic device by using the first data password. Through the technical solution, a mechanism for unlocking the electronic device by the server is provided, which can protect the security of the user data and solve the problem that the user data in the electronic device cannot be unlocked.

[0158] Figure 4 is a block diagram of a data decryption apparatus according to an exemplary embodiment. The data decryption apparatus is applied to an electronic device, such as Figure 4 As shown in the figure, the data decryption apparatus 400 can include:

[0159] The first receiving module 401 is configured to receive a second access password from a server. The second access password is obtained by encrypting a first access password by using a first public key by the server.

[0160] The first decryption module 402 is configured to decrypt the second access password by using a first private key corresponding to the first public key to obtain the first access password.

[0161] The obtaining module 403 is configured to obtain a second data password stored in a specified area of the electronic device. The second data password is obtained by encrypting a first data password of the electronic device by using the first access password.

[0162] The second decryption module 404 is configured to decrypt the second data password by using the first access password to obtain the first data password.

[0163] The third decryption module 405 is configured to decrypt encrypted user data in the electronic device by using the first data password.

[0164] Optionally, the data decryption apparatus 400 further includes:

[0165] The sending module is configured to send the first access password to the server.

[0166] a second receiving module configured to receive a third access password from the server, the third access password being encrypted by the server using the first public key on the first access password;

[0167] a fourth decrypting module configured to decrypt the third access password by using a first private key corresponding to the first public key to obtain the first access password;

[0168] an encrypting module configured to encrypt a first data password by using the first access password to obtain a second data password;

[0169] a first storing module configured to store the second data password in a designated area.

[0170] Optionally, the data decryption apparatus 400 further includes:

[0171] a generating module configured to generate the first data password;

[0172] a security module configured to generate a first public-private key pair by using a security application in the electronic device, the first public-private key pair including a first public key and a first private key, the security application running in a trusted execution environment of the electronic device;

[0173] a sending module configured to send the first public key to the server;

[0174] a second storing module configured to store the first private key in the security application.

[0175] Optionally, the second decrypting module 404 is further configured to:

[0176] decrypt the second data password by using the first access password through the security application in the electronic device, the security application running in the trusted execution environment of the electronic device.

[0177] Optionally, the first storing module 409 is further configured to:

[0178] store the second data password in a secure partition located in the trusted execution environment of the electronic device.

[0179] Optionally, the apparatus further includes:

[0180] a displaying module configured to display prompt information for setting the first access password on a start-up interface in a case where the electronic device is started up for the first time;

[0181] a communication module configured to, in response to receiving a setting instruction for setting the first access password, jump the start-up interface to a password setting interface provided by the server;

[0182] or

[0183] The communication module is configured to, in the case that the electronic device is not started for the first time, in response to a setting instruction of setting the first access password received on the setting interface of the electronic device, jump the setting interface to a password setting interface provided by the server, and the password setting interface is used for the user to set the first access password for accessing the user data of the electronic device on the server through the password setting interface.

[0184] Figure 5 is a block diagram of a data decryption device according to an exemplary embodiment, which is applied to a server, as shown in the figure, the data decryption device 500 can include: Figure 5

[0185] The first receiving module 501 is configured to receive the first access password input by the user for accessing the user data of the electronic device;

[0186] The first encryption module 502 is configured to encrypt the first access password by using the first public key corresponding to the electronic device to obtain a second access password;

[0187] The sending module 503 is configured to send the second access password to the electronic device, so that the electronic device decrypts the second access password by using the first private key corresponding to the first public key to obtain the first access password, and after obtaining the second data password stored in the specified area of the electronic device, the first access password is used to decrypt the second data password to obtain a first data password, and the first data password is used to decrypt the encrypted user data in the electronic device.

[0188] Optionally, the data decryption device 500 further includes:

[0189] The second receiving module is configured to receive the first access password set by the user before the first access password input by the user for decrypting the user data of the electronic device;

[0190] The second encryption module is configured to encrypt the first access password by using the first public key corresponding to the electronic device to obtain a third access password;

[0191] The sending module 503 is further configured to send the third access password to the electronic device, so that the electronic device decrypts the third access password by using the first private key corresponding to the first public key to obtain the first access password, and after encrypting the first data password of the electronic device by using the first access password to obtain a second data password, the second data password is saved to the specified area.

[0192] ​Optionally, the first public key and the first private key are generated by a security application in the electronic device, the first public key is sent by the electronic device to the server after the security application generates the first public key and the first private key, and the security application runs in a trusted execution environment of the electronic device.

[0193] In the technical solution, the first access password input by the user is received by the server, the first access password is encrypted by the first public key to obtain a second access password, and the second access password is received after the server sends the second access password; the first access password is obtained by decrypting the second access password by using the first private key corresponding to the first public key; the second data password stored in the specified area of the electronic device is obtained, the second data password is obtained by encrypting the first data password of the electronic device by using the first access password; the first data password is obtained by decrypting the second data password by using the first access password; and the encrypted user data in the user device is decrypted by using the first data password. The present disclosure solves the problem that the user cannot unlock the electronic device in the related art. By using the access password set in the server, the security application and the secure partition built in the electronic device, the safety of the user data is protected, and a method for remotely unlocking the electronic device by the user is provided.

[0194] As to the apparatus in the above-mentioned embodiments, the specific manners in which various modules perform operations have been described in detail in the embodiments of the method, and thus will not be described here in detail.

[0195] The embodiments of the present disclosure further provide an electronic device, comprising: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to execute the executable instructions to implement the steps of the method according to any one of the embodiments shown in the above. Figure 1 Or Figure 3 the steps of the method according to any one of the embodiments shown in the above.

[0196] The embodiments of the present disclosure further provide another electronic device, comprising: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to execute the executable instructions to implement the steps of the method according to any one of the embodiments shown in the above. Figure 2 Or Figure 3 the steps of the method according to any one of the embodiments shown in the above.

[0197] The present disclosure further provides a computer-readable storage medium having computer program instructions stored thereon, wherein the program instructions are executed by a processor to implement the steps of the data decryption method provided by the present disclosure.

[0198] Figure 6is a block diagram of another data decryption apparatus 600 according to an exemplary embodiment. The apparatus 600 can be, for example, an electronic device such as a mobile phone, a computer, a digital broadcasting terminal, a message receiver, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, and the like.

[0199] Referring to Figure 6 The apparatus 600 can include one or more of the following components: a processing component 602, a memory 604, a power supply component 606, a multimedia component 608, an audio component 610, an input / output (I / O) interface 612, a sensor component 614, and a communication component 616.

[0200] The processing component 602 usually controls overall operations of the apparatus 600, such as operations associated with displaying, making phone calls, data communications, camera operations, and recording operations. The processing component 602 can include one or more processors 620 to execute instructions to complete all or part of steps of the above-described data decryption method. In addition, the processing component 602 can include one or more modules to facilitate interaction between the processing component 602 and other components. For example, the processing component 602 can include a multimedia module to facilitate the interaction between the multimedia component 608 and the processing component 602.

[0201] The memory 604 is configured to store various types of data to support operations of the apparatus 600. Examples of these data include instructions for any application or method operating on the apparatus 600, contact data, phonebook data, messages, pictures, videos, and the like. The memory 604 can be implemented by any type of volatile or non-volatile storage devices or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0202] The power supply component 606 supplies electrical power for the various components of the apparatus 600. The power supply component 606 can include a power supply management system, one or more power sources, and other components associated with generating, managing and distributing power for the apparatus 600.

[0203] The multimedia component 608 includes a screen providing an output interface between the device 600 and a user. In some embodiments, the screen includes a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen can be implemented as a touch screen to receive input signals from a user. The touch panel includes one or more touch sensors to sense touch, swiping, and gestures on the touch panel. The touch sensors can not only sense a boundary of a touching or swiping action, but also detect duration and pressure associated with the touching or swiping action. In some embodiments, the multimedia component 608 includes a front camera and / or a rear camera. When the device 600 is in an operation mode, such as a shooting mode or a video mode, the front camera and / or the rear camera can receive external multimedia data. Each of the front and rear cameras can be a fixed optical lens system or have a focal length and optical zooming capability.

[0204] The audio component 610 is configured to output and / or input audio signals. For example, the audio component 610 includes a microphone (MIC) that is configured to receive an external audio signal when the device 600 is in an operation mode, such as a call mode, a recording mode, and a voice recognition mode. The received audio signal can be further stored in the memory 604 or transmitted via the communication component 616. In some embodiments, the audio component 610 also includes a speaker for outputting audio signals.

[0205] The I / O interface 612 provides an interface between the processing component 602 and peripheral interface modules, such as a keypad, a click wheel, buttons, and so on. The buttons can include, but are not limited to, a home button, a volume button, a start button, and a lock button.

[0206] The sensor component 614 includes one or more sensors to provide various state assessments for the device 600. For example, the sensor component 614 can detect an open / closed state of the device 600, relative positioning of components, such as a display and a keypad of the device 600, a change in position of the device 600 or a component of the device 600, presence or absence of user contact with the device 600, a change in orientation of the device 600 or acceleration / deceleration of the device 600, and a temperature change of the device 600. The sensor component 614 can include a proximity sensor configured to detect presence of an object in proximity to the device 600 without any physical touch. The sensor component 614 can also include a light sensor, such as a CMOS or CCD image sensor, for use in an imaging application. In some embodiments, the sensor component 614 can further include an acceleration sensor, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0207] The communication component 616 is configured to facilitate wired or wireless communication between the device 600 and other devices. The device 600 can access a wireless network based on a communication standard, such as WiFi, 2G, or 3G, or a combination thereof. In an exemplary embodiment, the communication component 616 receives a broadcast signal or broadcast related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 616 further includes a Near Field Communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on Radio Frequency Identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technology.

[0208] In an exemplary embodiment, the device 600 can be implemented with one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, micro-controllers, microprocessors, or other electronic components, for performing the data decryption method described above.

[0209] In an exemplary embodiment, a non-transitory computer readable storage medium including instructions, such as the memory 604 including instructions, is also provided, which can be executed by the processor 620 of the device 600 to complete the data decryption method described above. For example, the non-transitory computer readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disc, and an optical data storage device, etc.

[0210] In another exemplary embodiment, a computer program product is also provided, which contains a computer program capable of being executed by a programmable device, and the computer program has a code portion for executing the data decryption method described above when executed by the programmable device.

[0211] Figure 7 is a block diagram of a data decryption device 700 according to an exemplary embodiment. For example, the device 700 can be provided as a server. Referring to Figure 7 , the device 700 includes a processing component 722, which further includes one or more processors, and a memory resource represented by a memory 732, for storing instructions, such as an application program, executable by the processing component 722. The application program stored in the memory 732 can include one or more than one module each corresponding to a set of instructions. In addition, the processing component 722 is configured to execute the instructions to perform the data decryption method described above.

[0212] The apparatus 700 can also include a power supply component 726 configured to perform power management for the apparatus 700, a wired or wireless network interface 750 configured to connect the apparatus 700 to a network, and an input output (I / O) interface 758. The apparatus 700 can operate under the control of an operating system stored in the memory 732, such as Windows Server TM , Mac OS X TM , Unix TM , Linux TM , FreeBSD TM , or the like.

[0213] Other embodiments of the disclosure will be apparent to those skilled in the art from consideration of the specification and practice of the disclosure. It is intended that the specification and examples be considered as exemplary only, with the true scope and spirit of the disclosure being indicated by the following claims.

[0214] It is to be understood that the disclosure is not limited to the precise construction described above and shown in the attached drawings, and that various modifications and changes can be made without departing from the scope thereof. The scope of the disclosure is limited only by the claims that follow.

Claims

1. A data decryption method, characterized in that: Used in electronic equipment, including: receiving a second access password from the server, where the second access password is obtained by the server encrypting the first access password using the first public key; Decrypting the second access password using a first private key corresponding to the first public key to obtain the first access password; Obtaining a second data password stored in a designated area of ​​the electronic device, where the second data password is obtained by encrypting the first data password of the electronic device by using the first access password; Decrypting the second data password using the first access password to obtain the first data password; decrypting the encrypted user data in the electronic device using the first data password; sending a first access password to the server; receiving a third access password from the server, where the third access password is obtained by the server encrypting the first access password using the first public key; decrypting the third access password using a first private key corresponding to the first public key to obtain the first access password; Encrypt the first data password using the first access password to obtain the second data password; The second data password is stored in the designated area.

2. The method according to claim 1, characterized in that The method further comprises: generating the first data password; generating a first public-private key pair by a security application in the electronic device, the first public-private key pair including the first public key and the first private key, the security application running in a trusted execution environment of the electronic device; Sending the first public key to the server; The first private key is stored in the secure application.

3. The method according to claim 1, characterized in that The decrypting the second data password using the first access password to obtain the first data password includes: The second data password is decrypted using the first access password through a security application in the electronic device, and the security application runs in a trusted execution environment of the electronic device.

4. The method according to claim 1, wherein The storing the second data password in the designated area includes: The second data cryptographically is stored in a secure partition located in a trusted execution environment of the electronic device.

5. The method according to claim 1, wherein The method further comprises: When the electronic device is started for the first time, a prompt for setting a first access password is displayed on a startup interface; In response to receiving the setting instruction for setting the first access password, jumping the startup interface to the password setting interface provided by the server; or, When the electronic device is not started for the first time, in response to a setting instruction for setting the first access password received on the setting interface of the electronic device, the setting interface is jumped to the password setting interface provided by the server, and the password setting interface is used for the user to set the first access password for decrypting user data of the electronic device on the server through the password setting interface.

6. A data decryption method, characterized in that: Applicable to servers, including: receiving a first access password input by a user for accessing user data of an electronic device; encrypting the first access password using a first public key corresponding to the electronic device to obtain a second access password; The second access password is sent to the electronic device, and the electronic device decrypts the second access password using the first private key corresponding to the first public key to obtain the first access password, and after obtaining the second data password stored in the designated area of ​​the electronic device, uses the first access password to decrypt the second data password to obtain the first data password, and the first data password is used to decrypt the encrypted user data in the electronic device.

7. The method according to claim 6, characterized in that Before receiving the first access password input by the user for decrypting the user data of the electronic device, the method further includes: receiving the first access password set by the user; encrypting the first access password using a first public key corresponding to the electronic device to obtain a third access password; The third access password is sent to the electronic device so that the electronic device decrypts the third access password using the first private key corresponding to the first public key to obtain the first access password, and after encrypting the first data password of the electronic device using the first access password to obtain the second data password, the second data password is saved and stored in the designated area.

8. The method according to claim 7, characterized in that The first public key and the first private key are generated by a security application in the electronic device, and the first public key is sent to the server by the electronic device after the security application generates the first public key and the first private key. The security application runs in a trusted execution environment of the electronic device.

9. A data decryption device, characterized in that: Applied to electronic equipment, the device comprises: A first receiving module is configured to receive a second access password from a server, where the second access password is obtained by the server encrypting the first access password using a first public key; a first decryption module, configured to decrypt the second access password using a first private key corresponding to the first public key to obtain the first access password; An acquisition module is configured to acquire a second data password stored in a designated area of ​​the electronic device, where the second data password is obtained by encrypting the first data password of the electronic device using the first access password; a second decryption module, configured to decrypt the second data password using the first access password to obtain the first data password; a third decryption module, configured to decrypt the encrypted user data in the electronic device using the first data password; a sending module, configured to send a first access password to the server; a second receiving module configured to receive a third access password from the server, where the third access password is obtained by the server encrypting the first access password using the first public key; a fourth decryption module, configured to decrypt the third access password using a first private key corresponding to the first public key to obtain the first access password; an encryption module configured to encrypt the first data password using the first access password to obtain a second data password; The first storage module is configured to store the second data password in a designated area.

10. A data decryption device, characterized in that: Applied to a server, the device includes: a first receiving module configured to receive a first access password input by a user for accessing user data of an electronic device; a first encryption module configured to encrypt the first access password using a first public key corresponding to the electronic device to obtain a second access password; a sending module, configured to send the second access password to the electronic device, so that the electronic device decrypts the second access password using the first private key corresponding to the first public key to obtain the first access password, and after obtaining the second data password stored in the designated area of ​​the electronic device, uses the first access password to decrypt the second data password to obtain the first data password, and the first data password is used to decrypt the encrypted user data in the electronic device.

11. A data decryption device, characterized in that: Used in electronic equipment, including: processor; a memory for storing processor-executable instructions; The processor is configured to execute the executable instructions to implement the steps of the method according to any one of claims 1 to 5.

12. A data decryption device, characterized in that: Applicable to servers, including: processor; a memory for storing processor-executable instructions; The processor is configured to execute the executable instructions to implement the steps of the method according to any one of claims 6 to 8.

13. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the program instructions are executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

14. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the program instructions are executed by a processor, the steps of the method described in any one of claims 6 to 8 are implemented.

Images