Data processing method, electronic device and related device applied to multiple TEEs

Abstract

The embodiment of the present application provides a data processing method, electronic device and related device applied to multiple TEEs, which can be applied to the field of terminal security. In this method, the electronic device includes a first TEE and a second TEE, the first TEE corresponds to a first file encryption key, and the second TEE corresponds to a second file encryption key. The electronic device can use the first file encryption key and the second file encryption key to encrypt data, perform multiple protections on the data, and improve data security. In addition, after encrypting the data, the electronic device can delete the first file encryption key and the second file encryption key to ensure the security of the file encryption key.

Description

Technical Field

[0001] The present application relates to the field of terminal technology, and in particular to a data processing method, electronic equipment and related devices applied to multiple TEEs. Background Art

[0002] With the continuous development of communication technology, more and more applications are installed in electronic devices. In order to protect user privacy and information security, a trusted execution environment (TEE) can be created in electronic devices to deploy high-level and more reliable security protection for electronic devices.

[0003] At present, as users' demand for electronic device security continues to increase, multiple TEEs can be created in electronic devices, but the current relevant technology does not reveal a data processing method applied to multiple TEEs. Summary of the invention

[0004] The embodiments of the present application provide a data processing method, electronic device and related apparatus applied to multiple TEEs, which are applied to the field of terminal technology and can realize data processing in electronic devices deployed with multiple TEEs, and in particular can realize data encryption and decryption processing in electronic devices deployed with multiple TEEs.

[0005] In the first aspect, the embodiment of the present application proposes a data processing method applied to multiple TEEs. The execution subject of the method can be an electronic device or a chip, module or processor in the electronic device. The following is an example of an electronic device. In this method, the electronic device may include multiple trusted execution environments TEEs, or it can be said that the electronic device has created multiple TEEs. The following is an example of multiple TEEs including a first TEE and a second TEE.

[0006] In this method, each TEE may correspond to a file encryption key, for example, the first TEE corresponds to the first file encryption key, and the second TEE corresponds to the second file encryption key. Taking the first TEE corresponding to the first file encryption key as an example, the first TEE corresponding to the first file encryption key can be understood as: the file encryption key used by the first TEE is the first file encryption key. Among them, the first file encryption key can be generated by the first TEE, or generated by other modules in the electronic device.

[0007] In the embodiment of the present application, when the electronic device is locked, the electronic device can use the first file encryption key and the second file encryption key to encrypt data to obtain a third ciphertext. In the embodiment of the present application, compared with the deployment method of a single TEE in the prior art, the file encryption keys of multiple TEEs can be used to encrypt data, thereby achieving multiple encryption of data and improving data security.

[0008] In addition, in order to ensure the security of the first file encryption key and the second file encryption key, the first file encryption key and the second file encryption key may not be stored in the electronic device, such as the electronic device may delete the first file encryption key and the second file encryption key. It should be understood that in order to facilitate decryption of data, when the electronic device is locked, the electronic device has stored the first ciphertext and the second ciphertext, the first ciphertext is the ciphertext obtained by encrypting the first file encryption key with the temporary key, and the second ciphertext is the ciphertext obtained by encrypting the second file encryption key with the temporary key.

[0009] Among them, the electronic device stores the first ciphertext and the second ciphertext. On the one hand, the first file encryption key and the second file encryption key are not stored in plain text, which can ensure the security of the first file encryption key and the second file encryption key. On the other hand, when the electronic device is unlocked, the electronic device can decrypt the first ciphertext and the second ciphertext to obtain the first file encryption key and the second file encryption key respectively, so that the electronic device uses the first file encryption key and the second file encryption key to decrypt data.

[0010] In the embodiment of the present application, in response to the user inputting the temporary key, the electronic device is unlocked. When the electronic device is unlocked, the electronic device can decrypt the first ciphertext according to the temporary key to obtain the first file encryption key, and decrypt the second ciphertext according to the temporary key to obtain the second file encryption key. The electronic device can use the first file encryption key and the second file encryption key to decrypt the third ciphertext to obtain the data.

[0011] In one possible implementation, the temporary key may be a secret key input by a user for unlocking the electronic device, for example, the temporary key is a lock screen password. Alternatively, the temporary key is obtained based on the lock screen password, for example, the electronic device may derive the temporary key based on the lock screen password.

[0012] In a possible implementation, an identifier of a temporary key is stored in the electronic device, and the identifier is used to indicate the temporary key. In this implementation, when the electronic device is unlocked, the electronic device can obtain the temporary key according to the identifier of the temporary key. In this example, for example, the temporary key can be stored in the electronic device, and the electronic device can determine the temporary key according to the identifier of the temporary key.

[0013] An embodiment of the present application provides a data encryption and decryption method suitable for multiple TEEs, wherein the electronic device includes a first TEE and a second TEE, the first TEE can correspond to a first file encryption key, and the second TEE can correspond to a second file encryption key. The electronic device can use the first file encryption key and the second file encryption key to encrypt data, perform multiple protections on the data, and improve data security.

[0014] In a possible implementation, when the electronic device uses the first file encryption key and the second file encryption key to encrypt data, the electronic device may combine the first file encryption key and the second file encryption key into a third file encryption key, and use the third file encryption key to encrypt the data.

[0015] In this implementation, the electronic device uses the combined first file encryption key and the second file encryption key to encrypt data, and multiple protections are provided to the data. In the current scenario where there is a TEE in the electronic device, the electronic device uses the file encryption key of the TEE to encrypt data. Once the file encryption key is cracked or leaked, the data in the electronic device will also be leaked. However, in the embodiment of the present application, a combination of multiple file encryption keys is used to encrypt data, which increases the complexity of the file encryption key and the data security.

[0016] In a possible implementation, when the electronic device is turned on, the electronic device may generate the first file encryption key and the second file encryption key. The electronic device may also use the temporary key to encrypt the first file encryption key to obtain the first ciphertext, use the temporary key to encrypt the second file encryption key to obtain the second ciphertext, and store the first ciphertext and the second ciphertext.

[0017] In this implementation, when the electronic device is turned on, the first file encryption key and the second file encryption key can be generated, which has higher security than the method in which the file encryption key is pre-stored in the electronic device. In addition, the electronic device can also encrypt the first file encryption key and the second file encryption key with a temporary key, which can ensure that the electronic device does not store the file encryption key in plain text, thereby ensuring the security of the first file encryption key and the second file encryption key.

[0018] In a possible implementation, the electronic device may include at least one temporary key. To facilitate distinguishing different temporary keys, the electronic device may store at least one temporary key and an identifier of each temporary key. After the electronic device encrypts the first file encryption key and the second file encryption key using the temporary key, the electronic device may store the identifier of the temporary key, so that when the electronic device decrypts the first ciphertext and the second ciphertext, it can determine the temporary key based on the identifier of the temporary key to decrypt the first ciphertext and the second ciphertext.

[0019] The following describes the data processing method for multiple TEEs provided by the embodiment of the present application in combination with the interaction of specific internal modules in the electronic device:

[0020] The electronic device further includes a rich execution environment (REE), wherein the REE includes a storage guard module and a key ring, the first TEE includes a first key management trusted application, and the second TEE includes a second key management trusted application.

[0021] In a possible implementation, the storage guard module requests the file encryption key from the first key management trusted application, and requests the file encryption key from the second key management trusted application.

[0022] Among them, the first key management trusted application generates the first file encryption key, and uses the temporary key to encrypt the first file encryption key to obtain the first ciphertext, and the first key management trusted application sends the first ciphertext and the identifier of the temporary key to the storage guardian module.

[0023] Among them, the second key management trusted application generates the second file encryption key, and uses the temporary key to encrypt the second file encryption key to obtain the second ciphertext, and the second key management trusted application sends the second ciphertext and the identifier of the temporary key to the storage guardian module.

[0024] The storage guard module stores the identifier of the temporary key, the first ciphertext, and the second ciphertext in the key ring.

[0025] In one possible implementation, before the storage guard module requests a file encryption key from the first key management trusted application and requests a file encryption key from the second key management trusted application, the storage guard module requests a storage key from the first key management trusted application and requests a storage key from the second key management trusted application.

[0026] The first key management trusted application generates a first storage key and sends the first storage key to the storage guardian module, and the second key management trusted application generates a second storage key and sends the second storage key to the storage guardian module.

[0027] The storage guard module uses the first storage key to request a file encryption key from the first key management trusted application, and the storage guard module uses the second storage key to request a file encryption key from the second key management trusted application. The first key management trusted application derives the first file encryption key based on the first storage key, and the second key management trusted application derives the second file encryption key based on the second storage key.

[0028] In this implementation, the storage guard module may first request a storage key from the first key management trusted application and the second key management trusted application. The storage key is used to derive a file encryption key, which can improve the security of the file encryption key.

[0029] In a possible implementation, after the storage guard module stores the identifier of the temporary key, the first ciphertext, and the second ciphertext in the key ring, it also includes performing a decryption step.

[0030] In a possible implementation, decrypting the first ciphertext according to the temporary key to obtain the first file encryption key, and decrypting the second ciphertext according to the temporary key to obtain the second file encryption key, include performing a decryption step. In other words, when the electronic device is unlocked, the electronic device can perform the decryption step to obtain the first file encryption key and the second file encryption key.

[0031] The electronic device further includes a universal flash memory, the first TEE further includes a first trusted application and a second trusted application; and the decryption step includes:

[0032] The key ring sends the identifier of the temporary key and the first ciphertext to the first trusted application. The first trusted application requests the temporary key from the first key management trusted application according to the identifier of the temporary key. The first trusted application decrypts the first ciphertext according to the temporary key to obtain the first file encryption key, and the first trusted application stores the first file encryption key in the universal flash memory.

[0033] The second trusted application requests the temporary key from the second key management trusted application based on the identifier of the temporary key, and the second trusted application decrypts the second ciphertext based on the temporary key to obtain the second file encryption key, and the second trusted application stores the second file encryption key in the universal flash memory.

[0034] In this way, after executing the above decryption steps, the electronic device can obtain the first file encryption key and the second file encryption key, such as the first file encryption key and the second file encryption key are stored in the universal flash memory. In this way, the electronic device can decrypt the third ciphertext according to the first file encryption key and the second file encryption key to obtain the data, thereby completing the data decryption.

[0035] Among them, because the first file encryption key and the second file encryption key are stored in the universal flash memory, when the electronic device is locked, the universal flash memory can encrypt data according to the erroneous first file encryption key and the second file encryption key stored therein to obtain a third ciphertext, and the universal flash memory deletes the first file encryption key and the second file encryption key stored in the universal flash memory.

[0036] Thus, in this implementation, the universal flash memory can implement data encryption.

[0037] In the second aspect, an embodiment of the present application provides a data processing device applied to multiple TEEs, which may be an electronic device, or a chip or chip system in an electronic device. The data processing device applied to multiple TEEs may include a display unit and a processing unit. When the data processing device applied to multiple TEEs is an electronic device, the display unit may be a display screen. The display unit is used to perform the display step so that the electronic device implements a data processing method applied to multiple TEEs described in the first aspect or any possible implementation of the first aspect.

[0038] When the data processing device applied to multiple TEEs is an electronic device, the processing unit may be a processor. The data processing device applied to multiple TEEs may also include a storage unit, which may be a memory. The storage unit is used to store instructions, and the processing unit executes the instructions stored in the storage unit to enable the electronic device to implement a data processing method applied to multiple TEEs described in the first aspect or any possible implementation of the first aspect.

[0039] When the data processing device applied to multiple TEEs is a chip or chip system in an electronic device, the processing unit may be a processor. The processing unit executes instructions stored in a storage unit so that the electronic device implements a data processing method applied to multiple TEEs described in the first aspect or any possible implementation of the first aspect. The storage unit may be a storage unit in the chip (e.g., a register, a cache, etc.), or a storage unit in the electronic device located outside the chip (e.g., a read-only memory, a random access memory, etc.).

[0040] The electronic device includes: a first trusted execution environment TEE and a second TEE, the first TEE corresponds to a first file encryption key, and the second TEE corresponds to a second file encryption key. A processing unit is used to:

[0041] When the electronic device is locked, encrypt data using the first file encryption key and the second file encryption key to obtain a third ciphertext, and delete the first file encryption key and the second file encryption key, wherein when the electronic device is locked, the electronic device has stored the first ciphertext and the second ciphertext, the first ciphertext is the ciphertext encrypted by the first file encryption key using the temporary key, and the second ciphertext is the ciphertext encrypted by the second file encryption key using the temporary key; and,

[0042] In response to the user inputting a temporary key, the electronic device is unlocked, and when the electronic device is unlocked, the first ciphertext is decrypted according to the temporary key to obtain a first file encryption key, and the second ciphertext is decrypted according to the temporary key to obtain a second file encryption key, and the third ciphertext is decrypted using the first file encryption key and the second file encryption key to obtain data.

[0043] In one possible implementation, the temporary key is obtained based on the lock screen password.

[0044] In a possible implementation, the processing unit is specifically configured to combine the first file encryption key and the second file encryption key into a third file encryption key, and use the third file encryption key to encrypt data.

[0045] In one possible implementation, the processing unit is also used to generate a first file encryption key and a second file encryption key when the electronic device is turned on, use a temporary key to encrypt the first file encryption key to obtain a first ciphertext, use a temporary key to encrypt the second file encryption key to obtain a second ciphertext, and store the first ciphertext and the second ciphertext.

[0046] In a possible implementation, the processing unit is further configured to store an identifier of the temporary key, and to obtain the temporary key according to the identifier of the temporary key before decrypting the first ciphertext according to the temporary key to obtain the first file encryption key.

[0047] In a possible implementation, the electronic device further includes a rich execution environment (REE), the REE includes a storage guard module and a key ring, the first TEE includes a first key management trusted application, and the second TEE includes a second key management trusted application.

[0048] The storage guard module requests a file encryption key from the first key management trusted application, and requests a file encryption key from the second key management trusted application. The first key management trusted application generates a first file encryption key, and encrypts the first file encryption key using a temporary key to obtain a first ciphertext. The first key management trusted application sends the first ciphertext and an identifier of the temporary key to the storage guard module.

[0049] The second key management trusted application generates a second file encryption key and encrypts the second file encryption key using the temporary key to obtain a second ciphertext. The second key management trusted application sends the second ciphertext and the identifier of the temporary key to the storage guard module, and the storage guard module stores the identifier of the temporary key, the first ciphertext, and the second ciphertext in the key ring.

[0050] In one possible implementation, before the storage guard module requests a file encryption key from the first key management trusted application and requests a file encryption key from the second key management trusted application, it also includes: the storage guard module requests a storage key from the first key management trusted application and requests a storage key from the second key management trusted application; the first key management trusted application generates a first storage key and sends the first storage key to the storage guard module; the second key management trusted application generates a second storage key and sends the second storage key to the storage guard module.

[0051] The storage guard module requests a file encryption key from a first key management trusted application, and requests a file encryption key from a second key management trusted application, including: the storage guard module uses the first storage key to request a file encryption key from the first key management trusted application, and the storage guard module uses the second storage key to request a file encryption key from the second key management trusted application.

[0052] The first key management trusted application generates a first file encryption key, including: the first key management trusted application derives the first file encryption key according to the first storage key.

[0053] The second key management trusted application generates a second file encryption key, including: the second key management trusted application derives the second file encryption key according to the second storage key.

[0054] In a possible implementation, after the storage guard module stores the identifier of the temporary key, the first ciphertext, and the second ciphertext in the key ring, the method further includes: executing a decryption step.

[0055] In a possible implementation, decrypting the first ciphertext according to the temporary key to obtain the first file encryption key, and decrypting the second ciphertext according to the temporary key to obtain the second file encryption key include: performing a decryption step.

[0056] In a possible implementation, the electronic device further includes a universal flash memory, and the first TEE further includes a first trusted application and a second trusted application; the decryption step includes:

[0057] The key ring sends an identifier of a temporary key and a first ciphertext to a first trusted application, the first trusted application requests a temporary key from a first key management trusted application based on the identifier of the temporary key, the first trusted application decrypts the first ciphertext based on the temporary key to obtain a first file encryption key, and the first trusted application stores the first file encryption key in a universal flash memory.

[0058] The second trusted application requests the temporary key from the second key management trusted application according to the identifier of the temporary key, the second trusted application decrypts the second ciphertext according to the temporary key to obtain the second file encryption key; and the second trusted application stores the second file encryption key in the universal flash memory.

[0059] In a possible implementation, deleting the first file encryption key and the second file encryption key includes: the universal flash memory deleting the first file encryption key and the second file encryption key stored in the universal flash memory.

[0060] In a third aspect, an embodiment of the present application provides an electronic device, including a processor and a memory, the memory being used to store code instructions, and the processor being used to run the code instructions to execute the method described in the first aspect or any possible implementation of the first aspect.

[0061] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which a computer program or instructions are stored. When the computer program or instructions are run on a computer, the computer executes the method described in the first aspect or any possible implementation of the first aspect.

[0062] In a fifth aspect, an embodiment of the present application provides a computer program product including a computer program. When the computer program runs on a computer, the computer executes the method described in the first aspect or any possible implementation manner of the first aspect.

[0063] In a sixth aspect, the present application provides a chip or a chip system, the chip or chip system comprising at least one processor and a communication interface, the communication interface and the at least one processor are interconnected by a line, and the at least one processor is used to run a computer program or instruction to execute the method described in the first aspect or any possible implementation of the first aspect. The communication interface in the chip can be an input / output interface, a pin or a circuit, etc.

[0064] In a possible implementation, the chip or chip system described above in the present application further includes at least one memory, in which instructions are stored. The memory may be a storage unit inside the chip, such as a register, a cache, etc., or a storage unit of the chip (e.g., a read-only memory, a random access memory, etc.).

[0065] It should be understood that the second to sixth aspects of the present application correspond to the technical solutions of the first aspect of the present application, and the beneficial effects achieved by each aspect and the corresponding feasible implementation methods are similar and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] Figure 1 A schematic diagram of the structure of a current electronic device;

[0067] Figure 2 A flow chart of a data processing method in current electronic equipment;

[0068] Figure 3 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application;

[0069] Figure 4 Another structural schematic diagram of an electronic device provided in an embodiment of the present application;

[0070] Figure 5 A flowchart of an embodiment of a data processing method applied to multiple TEEs provided in an embodiment of the present application;

[0071] Figure 6 A flowchart of another embodiment of a data processing method applied to multiple TEEs provided in an embodiment of the present application;

[0072] Figure 7 A flowchart of another embodiment of a data processing method applied to multiple TEEs provided in an embodiment of the present application;

[0073] Figure 8 A flowchart of another embodiment of a data processing method applied to multiple TEEs provided in an embodiment of the present application;

[0074] Fig. 9Another schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0075] In order to clearly describe the technical solutions of the embodiments of the present application, some terms and technologies involved in the embodiments of the present application are briefly introduced below:

[0076] 1. Trusted execution environment (TEE): It can be called a secure execution environment. TEE can run a trusted execution environment operating system (TEE OS), and TEE can also provide trusted security services (such as fingerprint matching services, password verification services, face matching services, secure payment services, etc.) for client applications (CA). These security services can run in TEE OS in the form of trusted applications (TA).

[0077] In some embodiments, TEE may be an execution area constructed using a secure area of ​​a processor in an electronic device, and a trusted execution environment may provide a secure operating environment for the business.

[0078] In some embodiments, the electronic device can use the trust zone technology to establish the TEE in the trust zone, so that the confidentiality and integrity of the code and data loaded in the TEE can be protected. In some embodiments, unlike the trust zone technology, virtualization technology is a technology for running multiple operating systems on electronic devices. The electronic device can establish the TEE on a virtual machine so that the TEE can provide a secure business operation environment for business execution. The embodiment of the present application does not limit the construction method of the TEE.

[0079] 2. Rich execution environment (REE): It can be called a general execution environment. The rich execution environment operating system (REE OS) on a general-purpose processor and CA can run in REE.

[0080] 3. Data encryption methods include but are not limited to: full disk encryption (FDE), file based encryption (FBE), and metadata encryption (ME). The data may include but are not limited to user data on the electronic device.

[0081] Among them, full disk encryption refers to the process of encrypting (or encoding) all user data on an electronic device using a key. After encryption, all data created by the user will be automatically encrypted before being stored on the disk, and all read operations will be automatically decrypted before the data is fed back.

[0082] Among them, file-based encryption allows different data to be encrypted using different keys, and allows the encrypted data to be decrypted separately.

[0083] When metadata encryption is used, any content that is not encrypted by FBE will be encrypted. For example, the content may include directory layout, file size, permissions, and creation / modification time.

[0084] In the following embodiments, the data processing method applied to multiple TEEs provided in the embodiments of the present application is introduced by taking the use of FBE by an electronic device to encrypt and decrypt data as an example. When the electronic device uses other methods to encrypt and decrypt data, the method provided in the embodiments of the present application can also be used, and the description in the following embodiments can be referred to.

[0085] 4. Other terms

[0086] In the embodiments of the present application, words such as "first" and "second" are used to distinguish the same or similar items with substantially the same functions and effects. For example, the first chip and the second chip are only used to distinguish different chips, and their order is not limited. Those skilled in the art can understand that words such as "first" and "second" do not limit the quantity and execution order, and words such as "first" and "second" do not necessarily limit them to be different.

[0087] It should be noted that in the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0088] In the embodiments of the present application, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can represent: a, b, c, ab, a--c, bc, or abc, where a, b, c can be single or multiple.

[0089] 5. Electronic equipment

[0090] The electronic device of the embodiment of the present application may be a handheld device, a vehicle-mounted device, etc. deployed with multiple TEEs. For example, some electronic devices are: mobile phones, tablet computers, PDAs, laptop computers, mobile internet devices (MIDs), wearable devices, virtual reality (VR) devices, augmented reality (AR) devices, wireless terminals in industrial control, wireless terminals in self driving, wireless terminals in remote medical surgery, wireless terminals in smart grids, wireless terminals in transportation safety, wireless terminals in smart cities, wireless terminals in smart homes, cellular phones, cordless phones, session initiation protocol (SIP) phones, wireless local loop (WLL) stations, personal digital assistants (PDAs), handheld devices with wireless communication capabilities, computing devices or other processing devices connected to wireless modems, vehicle-mounted devices, wearable devices, terminal devices in 5G networks or future evolved public land mobile communication networks (public landmobile networks). The embodiments of the present application do not limit this.

[0091] As an example but not limitation, in the embodiments of the present application, the electronic device may also be a wearable device. Wearable devices may also be referred to as wearable smart devices, which are a general term for wearable devices that are intelligently designed and developed using wearable technology for daily wear, such as glasses, gloves, watches, clothing, and shoes. A wearable device is a portable device that is worn directly on the body or integrated into the user's clothes or accessories. Wearable devices are not only hardware devices, but also powerful functions achieved through software support, data interaction, and cloud interaction. Broadly speaking, wearable smart devices include full-featured, large-sized, and fully or partially independent of smartphones, such as smart watches or smart glasses, as well as devices that only focus on a certain type of application function and need to be used in conjunction with other devices such as smartphones, such as various types of smart bracelets and smart jewelry for vital sign monitoring.

[0092] In addition, in the embodiments of the present application, the electronic device can also be a terminal device in the Internet of Things (IoT) system. IoT is an important part of the future development of information technology. Its main technical feature is to connect objects to the network through communication technology, thereby realizing an intelligent network that interconnects people and machines and things.

[0093] The electronic devices in the embodiments of the present application may also be referred to as: terminal equipment, user equipment (UE), mobile station (MS), mobile terminal (MT), access terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication equipment, user agent or user device, etc.

[0094] In an embodiment of the present application, the electronic device may include a hardware layer, an operating system layer running on the hardware layer, and an application layer running on the operating system layer. The hardware layer includes hardware such as a central processing unit (CPU), a memory management unit (MMU), and a memory (also called main memory). The operating system (OS) may be any one or more computer operating systems that implement business processing through processes, such as a Linux operating system, a Unix operating system, an Android operating system, an iOS operating system, or a Windows operating system. The application layer includes applications such as browsers, address books, word processing software, and instant messaging software.

[0095] The following first introduces the TEE currently deployed in electronic devices and the data processing methods in electronic devices:

[0096] Figure 1 This is a schematic diagram of the structure of a current electronic device. Figure 1 , the electronic device may include: REE, TEE, and universal flash storage driver (UFS). The functions of REE and TEE can refer to the explanations in the above terms.

[0097] It should be understood that Figure 1 In the description, the FBE key framework is used as an example for electronic devices. The data processing method applied to multiple TEEs provided in the embodiments of the present application can also be applied to deployments with other types of key frameworks. Exemplary, other types of key frameworks include FDE key frameworks, ME key frameworks, etc.

[0098] It should be understood that the use of the FBE key framework by an electronic device can be understood as: the electronic device uses the FBE method to encrypt files. Files can be understood as all user data on the electronic device, such as photos in the gallery application, contacts in the phone application, chat records in the communication application, etc. It should be understood that the data and files in the following embodiments can all represent data (such as user data, etc.) in the electronic device encrypted based on FBE.

[0099] When an electronic device encrypts data using FBE, it allows different keys to be used to encrypt different files, and it allows encrypted data to be decrypted separately. In the following embodiments, the process of encrypting and decrypting data by an electronic device is taken as an example to describe the data encryption and decryption method currently used in electronic devices, as well as the data encryption and decryption method provided by the embodiments of the present application.

[0100] Reference Figure 1 , TEE may include: key management trusted application (keymaster TA) and FBE TA. REE may include: storage guard module, keyring, virtual file system (virtual file system, VFS), universal flash storage driver (universal flash storage driver, UFS driver), and FBE CA.

[0101] Keymaster TA, used to generate file encryption keys. File encryption keys are used to encrypt data.

[0102] FBE TA corresponds to FBE CA in REE, and the two can exchange information.

[0103] UFS, used to store file encryption keys.

[0104] In some embodiments, the storage daemon module may be Vold (volume daemon). Vold is a daemon process for storage devices, which may include but are not limited to removable hard disks (such as USB flash drives, SD cards, etc.). In the embodiments of the present application, the storage device includes universal flash storage (UFS) as an example for illustration. Vold is between the framework layer and the kernel layer, and is a bridge connecting the two layers.

[0105] A keyring can be used to store ciphertext, such as ciphertext obtained by encrypting a file encryption key.

[0106] VFS is used to manage files. For example, VFS can support operations on files, such as read operations, write operations, delete operations, and modify operations.

[0107] UFS driver, used to drive UFS work.

[0108] FBE CA corresponds to FBE TA in TEE, and the two can exchange information.

[0109] Figure 2 This is a flow chart of a data processing method in current electronic equipment. Figure 2 , the data processing method may include:

[0110] S201, Vold requests the keymaster TA to generate a first key.

[0111] The first key may be a storage key. The first key is used to request a keymaster TA to generate a file encryption key.

[0112] In some embodiments, Vold receives the first key from the keymaster TA and can write the first key to disk. Writing to disk can be understood as Vold writing the first key to a storage medium (such as a disk). Exemplarily, in the embodiment of the present application, Vold can write the first key to the disk in a corresponding directory of the data partition of Vold.

[0113] S202: Vold uses the first key to request the keymaster TA to generate a file encryption key.

[0114] S203, the keymaster TA generates a file encryption key, and encrypts the file encryption key using a temporary key to obtain a first ciphertext.

[0115] The temporary key is associated with the user's password.

[0116] In some embodiments, the keymaster TA may store the temporary key identifier and the temporary key. The temporary key identifier is used to indicate the temporary key.

[0117] S204, the keymaster TA sends the first ciphertext and the identifier of the temporary key to Vold.

[0118] S205, Vold sends the first ciphertext and the identifier of the temporary key to the FBE TA through the keyring, VFS, UFS driver, and FBE CA in sequence.

[0119] S206, the FBE TA uses the identifier of the temporary key to request the temporary key from the keymaster TA.

[0120] Because the keymaster TA stores the temporary key identifier and the temporary key, the keymaster TA can feedback the temporary key corresponding to the temporary key identifier to the FBE TA in response to the request of the FBE TA.

[0121] S207, the FBE TA decrypts the first ciphertext according to the temporary key to obtain a file encryption key, and stores the file encryption key in the UFS.

[0122] S208, UFS uses the file encryption key to encrypt the file to obtain a second ciphertext.

[0123] Figure 2 The data processing method currently applied to one TEE is introduced in the text, but as users' security requirements for electronic devices increase, multiple TEEs come into being. In some embodiments, multiple TEEs can be created in electronic devices to improve the data security in electronic devices. However, the data processing method applied to multiple TEEs is not disclosed in the current related technology. The embodiments of this application aim to provide a data processing method applied to multiple TEEs, and in particular, provide a method for data decryption and decryption applied to multiple TEEs.

[0124] Before introducing the data processing method for multiple TEEs provided in the embodiment of the present application, the applicable scenarios and the structure of the electronic device of the present application are first introduced:

[0125] In one possible scenario, when the electronic device is turned on, a file encryption key can be generated, and when the electronic device is locked, the file encryption key is used to encrypt the data in the electronic device. In order to ensure the security of the file encryption key, the electronic device can delete the file encryption key after using the file encryption key to encrypt the data in the electronic device. However, in order to facilitate the electronic device to decrypt the data, the electronic device can store the encrypted ciphertext of the file encryption key. Exemplarily, the embodiment of the present application is described by taking the lock screen password of the electronic device to encrypt the file encryption key as an example.

[0126] In this way, when the electronic device is unlocked, the electronic device can decrypt the ciphertext based on the lock screen password and first recover the file encryption key. The electronic device can use the file encryption key to decrypt the data, and the user can freely browse the data in the electronic device.

[0127] It should be understood that when the user changes the lock screen password, the electronic device can use the new lock screen password to encrypt and decrypt the file encryption key, and accordingly, the user uses the new lock screen password to unlock the electronic device. In this way, the electronic device can decrypt the ciphertext based on the new lock screen password, recover the file encryption key, and then use the file encryption key to decrypt the data, so that the user can freely browse the data in the electronic device.

[0128] It should be understood that the following embodiments introduce the data processing method applied to multiple TEEs provided by the embodiments of the present application from the perspective of an electronic device generating a file encryption key, using the file encryption key to encrypt data, and decrypting data. The new lock screen password can refer to the description in the following embodiments.

[0129] Reference Figure 1 and Figure 2 As described in, currently, an electronic device creates a TEE, and the keymaster TA in the TEE can create a file encryption key to encrypt data. When the electronic device is lost, or a malicious user uses the electronic device, once the file encryption key is cracked, the data in the electronic device will be leaked, and the data security is low. Accordingly, in an embodiment of the present application, an electronic device can create multiple TEEs, each TEE can generate a file encryption key, and the electronic device can use the multiple file encryption keys to perform multiple encryptions on the data to improve data security.

[0130] Figure 3 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. The electronic device may include at least one REE, at least one TEE, and a virtual machine monitor (VMM). It should be understood that Figure 3 In the figure, an electronic device including two REEs and three TEEs is used as an example for explanation.

[0131] In some embodiments, the electronic device may use virtual machine technology to create two REEs. The REE created using the virtual machine technology may be referred to as VM-REE. Figure 3 VM-REE1 and VM-REE2 may be included.

[0132] In some embodiments, the electronic device may use trust zone technology and / or virtual machine technology to create a TEE. Among them, the TEE created by the trust zone technology may be called a TZ TEE, and the TEE created by the virtual machine technology may be called a VM-TEE. For example, refer to Figure 3 , the electronic device may include VM-TEE1, VM-TEE2, and TZ TEE.

[0133] In some embodiments, each TEE can be used to generate a file encryption key, and the electronic device can use the file encryption key generated by at least two of the three TEEs to encrypt data (data in the REE) to improve data security.

[0134] VMM, also known as Hypervisor, is software, firmware or hardware used to create and execute virtual machines. Electronic devices can use VMM to create and execute VM-REE1, VM-REE2, and VM-TEE1, VM-TEE2.

[0135] It should be understood that the following embodiments take the electronic device including the first TEE, the second TEE, and the REE as an example to introduce the structure of the electronic device and the data processing method provided in the embodiments of the present application:

[0136] Figure 4 Another structural diagram of an electronic device provided in an embodiment of the present application. Figure 4 , the electronic device may include REE, a first TEE, a second TEE, and UFS.

[0137] Reference Figure 4 ,REE can include: storage guardian module, key management interface, key ring, VFS, UFS driver, and FBE CA.

[0138] Among them, the functions of storage guard module, key ring, VFS, UFS driver, and FBE CA can be referred to Figure 1 and Figure 2 The key management interface can be a keymaster HAL (hardware abstraction) interface. The key management interface is used to implement the interaction between the storage guardian module (such as Vold) and the key management trusted application in each TEE.

[0139] and Figure 1 and Figure 2 The structure of the electronic device shown in FIG. 1 is different in that, because the electronic device in the embodiment of the present application may include multiple TEEs, the FBE CA may correspond to the FBE TA in each TEE. The FBE CA may exchange information with the FBE TA in each TEE.

[0140] The first TEE may include: a first key management trusted application, a first FBE TA, and a first inline crypto engine driver (ICE driver). The second TEE may include: a second key management trusted application, a second FBE TA, and a second ICE driver.

[0141] The first key management trusted application and the second key management trusted application can refer to Figure 1 and Figure 2 For the description of key management trusted application in the first FBE TA and the second FBE TA, please refer to Figure 1 and Figure 2 Related description of FBE TA.

[0142] In some embodiments, the first FBE TA may be referred to as a first trusted application, and the second FBE TA may be referred to as a second trusted application.

[0143] Reference Figure 4 , UFS may include ICE, ICE may include a key slot, and each TEE may correspond to a key slot. For example, ICE may include a first key register and a second key register. Among them, the first key register corresponds to the first key management trusted application, and the first key register can be used to store the file encryption key generated by the first key management trusted application. The second key register corresponds to the second key management trusted application, and the second key register can be used to store the file encryption key generated by the second key management trusted application.

[0144] The first ICE driver and the second ICE driver can drive the ICE to work. The functions of the first ICE driver and the second ICE driver are not described in detail in the embodiment of the present application, and reference may be made to the current related technologies.

[0145] It should be understood that Figure 3 and Figure 4The structure shown does not constitute a specific limitation on the electronic device. In other embodiments of the present application, the electronic device, REE, first TEE, and second TEE may include more or fewer components than shown in the figure, or combine some components, or split some components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0146] The following is a description of the data processing method for multiple TEEs provided by the embodiments of the present application in conjunction with specific embodiments. The following embodiments may be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0147] Figure 5 This is a flow chart of an embodiment of a data processing method for multiple TEEs provided in an embodiment of the present application. It should be understood that Figure 5 The first stage is to generate the file encryption key.

[0148] Reference Figure 5 , the data processing method applied to multiple TEEs provided in the embodiment of the present application may include:

[0149] S501: The storage guard module calls the key management interface to request the first key management trusted application and the second key management trusted application to store a key.

[0150] In some embodiments, when the electronic device is turned on, the storage guard module can request a storage key from the first key management trusted application and the second key management trusted application respectively by calling a key management interface.

[0151] The electronic device being powered on can be understood as: the electronic device being powered on for the first time, or each time the electronic device is powered on, or the electronic device being powered on when a preset condition is met. The preset condition can be, for example, being powered on N times in a row, or the electronic device being in a lost mode. N is an integer greater than or equal to 2.

[0152] Reference Figure 5 Exemplarily, the storage guardian module calls the key management interface and may send a first request to the first key management trusted application, where the first request is used to request a storage key. In response to the first request, the first key management trusted application may generate a first storage key and send the first storage key to the storage guardian module. In some embodiments, the first key management trusted application may generate the first storage key based on a user password or based on a random number, and the embodiments of the present application do not limit the manner in which the storage key is generated.

[0153] Similarly, the storage guard module calls the key management interface and can send a second request to the second key management trusted application, the second request is used to request a storage key. In response to the second request, the second key management trusted application can generate a second storage key and send the second storage key to the storage guard module.

[0154] S502: The storage guard module uses the first storage key to request a file encryption key from the first key management trusted application.

[0155] In some embodiments, the storage guard module may send a third request to the first key management trusted application, wherein the third request includes the first storage key. The third request is used to request a file encryption key.

[0156] S503: The first key management trusted application generates a first file encryption key, and uses a temporary key to encrypt the first file encryption key to obtain a first ciphertext.

[0157] In response to the third request, the first key management trusted application may derive a first file encryption key based on the first storage key. The algorithm used to derive the first file encryption key may include, but is not limited to: a key-related hash based message authentication code (HMAC) key derivation algorithm, a password based key derivation function 2 (PBKDF2) algorithm, Bcrypt, Scrypt, Argon2, etc., and the embodiments of the present application do not limit this.

[0158] In some embodiments, the temporary key may include a lock screen password, or a password for encrypting data set by a user, etc. The lock screen password may include but is not limited to: a digital password, a biometric password, and a graphic password, etc.

[0159] In some embodiments, the temporary key is obtained based on the lock screen password. For example, the temporary key can be the lock screen password, or the first key management trusted application can also derive an encryption factor based on the lock screen password or a user-defined password, and the first key management trusted application can derive the temporary key based on the encryption factor.

[0160] In the embodiment of the present application, the first key management trusted application can use the temporary key to encrypt the first file encryption key to obtain the first ciphertext. The purpose of the first key management trusted application using the temporary key to encrypt the first file encryption key is: on the one hand, the security of the first file encryption key can be guaranteed; on the other hand, only when the user inputs the temporary key, the electronic device can decrypt the first file encryption key based on the temporary key, and then decrypt the data, which can also ensure data security.

[0161] For example, when the temporary key is a lock screen key, the user can enter the lock screen key to unlock the electronic device when using the electronic device. Unlocking the electronic device is a necessary operation for the user to use the electronic device, so using the temporary key to encrypt the first file encryption key can make "the electronic device uses the lock screen password to decrypt the first file encryption key" integrated into the normal operation of the user, without causing additional operation burden to the user.

[0162] In some embodiments, S501 is an optional step. Exemplarily, the storage guard module can directly request the file encryption key from the first key management trusted application and the second key management trusted application. In this example, the first key management trusted application can generate the first file encryption key in response to the third request, and the second key management trusted application can generate the first file encryption key in response to the fourth request.

[0163] S504: The first key management trusted application sends the first ciphertext and the identifier of the temporary key to the storage guard module.

[0164] In some embodiments, there is at least one temporary key, and the at least one temporary key may include, for example, a lock screen password, and / or a password set by a user. Exemplarily, when the at least one temporary key includes a lock screen password, the lock screen password may be multiple, such as face 1 and digital password 1.

[0165] Accordingly, the first key management trusted application can store at least one temporary key. It should be understood that when the user sets the temporary key, the electronic device can store the temporary key in the first key management trusted application and the second key management trusted application, and this embodiment of the application does not limit this.

[0166] In order to distinguish the temporary key, the temporary key identifier can be used to distinguish the temporary key. The temporary key identifier may include but is not limited to: the name and number of the temporary key. For example, taking the lock screen password as an example, the name of the temporary key may be: fingerprint 1, face 1, digital password 1, etc.

[0167] The first key management trusted application may store at least one temporary key and an identifier of each temporary key.

[0168] S505: The storage guard module uses the second storage key to request a file encryption key from the second key management trusted application.

[0169] S506: The second key management trusted application generates a second file encryption key, and uses the temporary key to encrypt the second file encryption key to obtain a second ciphertext.

[0170] S507: The second key management trusted application sends the second ciphertext and the identifier of the temporary key to the storage guard module.

[0171] S505-S507 may refer to the description in S502-S504.

[0172] In some embodiments, there is no order distinction between S505 - S507 and S502 - S504 , and both can be executed simultaneously.

[0173] It is worth noting that the temporary key used to encrypt the second file encryption key in S506 may be the same as or different from the temporary key used to encrypt the first file encryption key in S503.

[0174] For example, when the temporary key used to encrypt the second file encryption key is different from the temporary key used to encrypt the first file encryption key, when unlocking the electronic device, the user can enter two temporary keys, one for decrypting the first ciphertext to obtain the first file encryption key, and the other for decrypting the second ciphertext to obtain the second file encryption key.

[0175] For the convenience of users, the temporary key used to encrypt the second file encryption key is the same as the temporary key used to encrypt the first file encryption key, for example, both are lock screen passwords. In this way, after the user enters the lock screen password to unlock the electronic device, the electronic device can use the lock screen password to decrypt the first ciphertext to obtain the first file encryption key, and use the lock screen password to decrypt the second ciphertext to obtain the second file encryption key, which is simple to operate.

[0176] It should be understood that in the embodiment of the present application, the temporary key used to encrypt the second file encryption key is the same as the temporary key used to encrypt the first file encryption key.

[0177] S508, the storage guard module stores the identifier of the temporary key, the first ciphertext and the second ciphertext in the key ring.

[0178] S509, the key ring sends the temporary key identifier, the first ciphertext, and the second ciphertext to the FBE CA through the VFS and UFS drivers.

[0179] S510, the FBE CA sends an identifier of a temporary key and a first ciphertext to the first FBE TA.

[0180] In some embodiments, when the storage guard module receives a first ciphertext from a first key management trusted application, it can identify that the first ciphertext corresponds to a first TEE. For example, the storage guard module can add a first identifier to the first ciphertext, and the first identifier is used to indicate the first TEE. Similarly, when the storage guard module receives a second ciphertext from a second key management trusted application, it can identify that the second ciphertext corresponds to a second TEE. For example, the storage guard module can add a second identifier to the second ciphertext, and the second identifier is used to indicate the second TEE.

[0181] In this example, when the storage guard module stores the temporary key identifier, the first ciphertext, and the second ciphertext in the key ring, it can also store the first identifier of the first ciphertext and the second identifier of the second ciphertext. In this way, when the key ring sends the temporary key identifier, the first ciphertext, and the second ciphertext to the FBE CA through the VFS and UFS drivers, it can also send the first identifier of the first ciphertext and the second identifier of the second ciphertext.

[0182] In this way, the FBE CA can identify that the first ciphertext corresponds to the first TEE through the first identifier, and identify that the second ciphertext corresponds to the second TEE through the second identifier. In this way, the FBE CA can send the identifier and the first ciphertext of the temporary key to the first FBE TA, and send the identifier and the second ciphertext of the temporary key to the second FBE TA.

[0183] S511: The first FBE TA uses the identifier of the temporary key to request the temporary key from the first key management trusted application.

[0184] In some embodiments, the first FBE TA may send a fifth request to the first key management trusted application, where the fifth request includes an identifier of the temporary key.

[0185] Because the first key management trusted application stores at least one temporary key and the identifier of each temporary key, in response to the fifth request, the first key management trusted application can determine the temporary key corresponding to the identifier of the temporary key based on the identifier of the temporary key from the first FBE TA, and feedback the temporary key to the first FBE TA.

[0186] S512: The first FBE TA uses the temporary key to decrypt the first ciphertext and obtain a first file encryption key.

[0187] S513: The first FBE TA sends the first file encryption key to the first ICE driver.

[0188] S514: The first ICE driver stores the first file encryption key in a first key register.

[0189] S515, the FBE CA sends the identifier of the temporary key and the second ciphertext to the second FBE TA.

[0190] S516: The second FBE TA uses the identifier of the temporary key to request the temporary key from the second key management trusted application.

[0191] S517: The second FBE TA uses the temporary key to decrypt the second ciphertext and obtain a second file encryption key.

[0192] S518: The second FBE TA sends the second file encryption key to the second ICE driver.

[0193] S519: The second ICE driver stores the second file encryption key in the second key register.

[0194] S515-S519 may refer to the description in S510-S514.

[0195] In some embodiments, there is no order distinction between S515 - S519 and S510 - S514 , and both can be executed simultaneously.

[0196] In some embodiments, S509 - S519 may be referred to as a decryption step, ie, a step of decrypting the first ciphertext and the second ciphertext.

[0197] In an embodiment of the present application, the electronic device can create a first TEE and a second TEE, the first TEE can generate a first file encryption key, and the second TEE can generate a second file encryption key. The electronic device can use the first file encryption key and the second file encryption key to encrypt data, perform multiple protections on the data, and improve data security.

[0198] The following is the second stage: encrypting data using the file encryption key

[0199] Reference Figure 6 , the data processing method applied to multiple TEEs provided in the embodiment of the present application may include:

[0200] S601, when the electronic device is locked, the UFS uses the first file encryption key and the second file encryption key to encrypt data to obtain a third ciphertext.

[0201] In some embodiments, the data may include but is not limited to: credential encrypted (CE) data and device encrypted (DE) data, wherein the CE data is located in the CE partition and the DE data is located in the DE partition.

[0202] When the electronic device is locked, UFS can use the first file encryption key and the second file encryption key to encrypt data to obtain a third ciphertext. In some embodiments, UFS can combine the first file encryption key and the second file encryption key into a third file encryption key, and use the third file encryption key to encrypt data to obtain a third ciphertext. Exemplarily, UFS can place the first file encryption key before the second file encryption key to obtain the third file encryption key. For example, if the first file encryption key is abcde and the second file encryption key is 12345, the third file encryption key can be abcde12345.

[0203] Alternatively, UFS may place the second file encryption key before the first file encryption key to obtain a third file encryption key. Alternatively, UFS may combine the first file encryption key and the second file encryption key according to certain specific rules to obtain a third file encryption key.

[0204] S602, UFS stores the third ciphertext in the data storage area.

[0205] In some embodiments, the third ciphertext of different data may correspond to different data storage areas. Exemplarily, for example, when the data is CE data, the third ciphertext may be stored in the CE partition. Or, for example, when the data is DE data, the third ciphertext may be stored in the DE partition. The CE partition and the DE partition may both be regarded as data storage areas.

[0206] S603: The UFS deletes the first file encryption key in the first key register and the second file encryption key in the second key register.

[0207] In some embodiments, there is no order distinction between S602 and S603 , and both can be executed simultaneously.

[0208] In an embodiment of the present application, after encrypting data using the first file encryption key and the second file encryption key, the first file encryption key in the first key register and the second file encryption key in the second key register can be deleted, which can ensure that the first file encryption key and the second file encryption key are not stored in the electronic device, and the security of the first file encryption key and the second file encryption key can be improved.

[0209] In addition, in the embodiment of the present application, the first file encryption key and the second file encryption key can be combined into a third file encryption key to perform multiple encryption protection on the data, which can improve data security.

[0210] After the electronic device encrypts the data using the first file encryption key and the second file encryption key, the electronic device can also decrypt the data using the first file encryption key and the second file encryption key. Figure 7 Description in .

[0211] Phase 3: Encrypting data using file encryption keys

[0212] Reference Figure 7 , the data processing method applied to multiple TEEs provided in the embodiment of the present application may include:

[0213] S701, in response to a user inputting a temporary key, the storage guard module triggers the key ring to send a temporary key identifier, a first ciphertext, and a second ciphertext to the FBE CA through the VFS and UFS drivers.

[0214] In some embodiments, the temporary key may be a lock screen password. In this example, the user may enter the lock screen password to unlock the electronic device. The operation of the user entering the lock screen password may be regarded as the operation of the user entering the temporary key. In this example, when the electronic device is unlocked, the storage guard module may trigger the key ring to send the temporary key identifier, the first ciphertext, and the second ciphertext to FBECA through the VFS and UFS drivers.

[0215] In some embodiments, the temporary key may be a password customized by the user, and the applicable scenario of the password customized by the user may be an unlocking scenario or other scenarios. Among them, when the user enters the password customized by the user, the electronic device can be unlocked, or the electronic device can be enabled to enter other scenarios. Other scenarios may be, for example, a scenario of logging into a certain application, or a scenario of decrypting a certain application, and accordingly, the data encrypted by the electronic device may be the data of the application. Among them, when the electronic device is unlocked or enters other scenarios, the storage guard module may trigger the key ring to send the temporary key identifier, the first ciphertext, and the second ciphertext to the FBE CA through the VFS and UFS drivers.

[0216] In some embodiments, the storage daemon module may send a decryption request to the key ring, and in response to the decryption request, the key ring may send an identifier of the temporary key, the first ciphertext, and the second ciphertext to the FBE CA through the VFS and UFS drivers.

[0217] S702, the FBE CA sends an identifier of a temporary key and a first ciphertext to the first FBE TA.

[0218] S703: The first FBE TA uses the identifier of the temporary key to request the first key management trusted application for the temporary key.

[0219] S704: The first FBE TA uses the temporary key to decrypt the first ciphertext and obtain a first file encryption key.

[0220] S705: The first FBE TA sends a first file encryption key to the first ICE driver.

[0221] S706: The first ICE driver stores the first file encryption key in the first key register.

[0222] S707, the FBE CA sends the identifier of the temporary key and the second ciphertext to the second FBE TA.

[0223] S708: The second FBE TA uses the identifier of the temporary key to request the second key management trusted application for the temporary key.

[0224] S709: The second FBE TA uses the temporary key to decrypt the second ciphertext and obtain a second file encryption key.

[0225] S710: The second FBE TA sends a second file encryption key to the second ICE driver.

[0226] S711: The second ICE driver stores the second file encryption key in the second key register.

[0227] S712, UFS uses the first file encryption key and the second file encryption key to decrypt the third ciphertext to obtain data.

[0228] In some embodiments, the UFS may combine the first file encryption key and the second file encryption key into a third file encryption key, and use the third file encryption key to decrypt the third ciphertext in the data storage area to obtain data.

[0229] In some embodiments, S701 - S712 may be referred to as a decryption step, ie, a step of decrypting the first ciphertext and the second ciphertext.

[0230] In an embodiment of the present application, because the electronic device deletes the first file encryption key and the second file encryption key after encrypting data using the first file encryption key and the second file encryption key, in a scenario where data needs to be decrypted, the electronic device can first determine the temporary key based on the identifier of the temporary key, and use the temporary key to decrypt the first ciphertext to obtain the first file encryption key, and use the temporary key to decrypt the second ciphertext to obtain the second file encryption key, and then the electronic device can use the first file encryption key and the second file encryption key to decrypt the third ciphertext to obtain the data, so that the user can freely browse the data.

[0231] As in the above example, the data processing method for multiple TEEs provided by the embodiment of the present application is introduced from the perspective of the internal module of the electronic device. The following introduces the data processing method for multiple TEEs provided by the embodiment of the present application with the electronic device as the execution subject.

[0232] Reference Figure 8 , the data processing method applied to multiple TEEs provided in the embodiment of the present application may include:

[0233] S801, when the screen of the electronic device is locked, encrypt data using the first file encryption key and the second file encryption key to obtain a third ciphertext.

[0234] In an embodiment of the present application, the electronic device includes: a first trusted execution environment TEE and a second TEE, wherein the first TEE corresponds to a first file encryption key, and the second TEE corresponds to the first file encryption key.

[0235] Among them, the first file encryption key corresponding to the first TEE can be understood as the first file encryption key is used for the first TEE. In some embodiments, the first file encryption key is generated by a module in the first TEE, and the description in the above embodiment can be referred to. Alternatively, the first file encryption key is not generated by the first TEE, but the first TEE can use the first file encryption key.

[0236] Similarly, the second file encryption key corresponding to the second TEE can be understood as the second file encryption key used for the second TEE. In some embodiments, the first file encryption key is generated by a module in the second TEE, and the description in the above embodiments can be referred to. Alternatively, the second file encryption key is not generated by the second TEE, but the second TEE can use the first file encryption key.

[0237] In an embodiment of the present application, when the electronic device is locked, the electronic device may use the first file encryption key and the second file encryption key to encrypt data to obtain a third ciphertext.

[0238] In some embodiments, the electronic device can combine the first file encryption key and the second file encryption key into a third file encryption key, and use the third file encryption key to encrypt data to obtain a third ciphertext. The method of combining the first file encryption key and the second file encryption key can refer to the description in S601.

[0239] S802, delete the first file encryption key and the second file encryption key, wherein, when the electronic device is locked, the electronic device has stored the first ciphertext and the second ciphertext, the first ciphertext is the ciphertext obtained by encrypting the first file encryption key with the temporary key, and the second ciphertext is the ciphertext obtained by encrypting the second file encryption key with the temporary key.

[0240] It should be understood that before the electronic device uses the first file encryption key and the second file encryption key to encrypt data, the first file encryption key and the second file encryption key may be stored in the electronic device. After the electronic device uses the first file encryption key and the second file encryption key to encrypt data, in order to improve the security of the first file encryption key and the second file encryption key, the electronic device may delete the first file encryption key and the second file encryption key stored therein.

[0241] However, in an embodiment of the present application, in order to facilitate data decryption, when the electronic device is locked, the electronic device has stored a first ciphertext and a second ciphertext, the first ciphertext being the ciphertext encrypted by the first file encryption key using a temporary key, and the second ciphertext being the ciphertext encrypted by the second file encryption key using a temporary key.

[0242] In some embodiments, before the electronic device locks the screen, the electronic device can use a temporary key to encrypt a first file encryption key to obtain a first ciphertext, and use the temporary key to encrypt a second file encryption key to obtain a second ciphertext, and the electronic device can store the first ciphertext and the second ciphertext.

[0243] Exemplarily, when the electronic device is turned on, the electronic device may generate a first file encryption key and a second file encryption key, and use a temporary key to encrypt the first file encryption key to obtain a first ciphertext, and the electronic device uses the temporary key to encrypt the second file encryption key to obtain a second ciphertext. The electronic device may store the first ciphertext and the second ciphertext.

[0244] In addition, at least one temporary key may be stored in the electronic device. To facilitate distinguishing different temporary keys, at least one temporary key and an identifier of each temporary key may be stored in the electronic device.

[0245] In order to facilitate decryption of the first ciphertext and the second ciphertext and obtain the first file encryption key and the second file encryption key, in some embodiments, the electronic device may store an identifier of a temporary key, which is a secret key used to encrypt the first file encryption key and the second file encryption key. Exemplarily, for example, after the electronic device encrypts the first file encryption key using the temporary key to obtain the first ciphertext and encrypts the second file encryption key using the temporary key to obtain the second ciphertext, the electronic device may store the first ciphertext, the second ciphertext, and the identifier of the temporary key, which is used to decrypt the first ciphertext and the second ciphertext.

[0246] S803: In response to the user inputting a temporary key, the electronic device is unlocked.

[0247] S804, when the electronic device is unlocked, decrypting the first ciphertext according to the temporary key to obtain the first file encryption key, and decrypting the second ciphertext according to the temporary key to obtain the second file encryption key.

[0248] In some embodiments, the user inputs a temporary key, and the electronic device can decrypt the first ciphertext according to the temporary key to obtain the first file encryption key, and decrypt the second ciphertext according to the temporary key to obtain the second file encryption key.

[0249] In some embodiments, because the electronic device stores an identifier of a temporary key decryption for decrypting the first ciphertext and the second ciphertext, the electronic device can obtain a temporary key decryption for decrypting the first ciphertext and the second ciphertext from at least one temporary key based on the identifier of the temporary key, and decrypt the first ciphertext based on the temporary key to obtain the first file encryption key, and decrypt the second ciphertext based on the temporary key to obtain the second file encryption key.

[0250] S805: Decrypt the third ciphertext using the first file encryption key and the second file encryption key to obtain data.

[0251] The embodiments of the present application have the same technical solutions as the above embodiments, and the beneficial effects achieved in various aspects and corresponding feasible implementation methods are similar, which will not be repeated here.

[0252] It should be noted that the module names involved in the embodiments of the present application can be defined as other names as long as the functions of each module can be achieved, and there is no specific restriction on the names of the modules.

[0253] It should be noted that the data involved in the embodiments of the present application (including but not limited to data used for analysis, stored data, displayed data, etc.) are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0254] The data processing method applied to multiple TEEs in the embodiment of the present application has been described above. The device for executing the above method provided in the embodiment of the present application is described below. Those skilled in the art can understand that the method and the device can be combined and referenced with each other, and the relevant device provided in the embodiment of the present application can perform the steps in the above data processing method applied to multiple TEEs.

[0255] The data processing method for multiple TEEs provided in the embodiment of the present application can be applied to electronic devices with communication functions. The electronic devices include terminal devices, and the specific device form of the terminal devices can refer to the above-mentioned related descriptions, which will not be repeated here.

[0256] The present application embodiment provides an electronic device, referring to Fig. 9, the electronic device may include: a processor 901 (such as a CPU), and a memory 902. The memory 902 may include a high-speed random access memory (RAM), and may also include a non-volatile memory (NVM), such as at least one disk memory. The memory 902 may store various instructions for completing various processing functions and implementing the method steps of the present application.

[0257] Optionally, the electronic device involved in the present application may further include: a power supply 903, a communication bus 904 and a communication port 905. The above-mentioned communication port 905 is used to realize the connection and communication between the electronic device and other peripherals. In the embodiment of the present application, the memory 902 is used to store computer executable program code, and the program code includes instructions; when the processor 901 executes the instruction, the instruction causes the processor 901 of the electronic device to perform the action in the above-mentioned method embodiment, and its implementation principle and technical effect are similar, which will not be repeated here.

[0258] Optionally, the electronic device involved in the present application may further include: a display screen 906. The display screen 906 is used to display an interface of the electronic device.

[0259] The embodiment of the present application provides a chip. The chip includes a processor, and the processor is used to call a computer program in a memory to execute the technical solution in the above embodiment. Its implementation principle and technical effect are similar to those of the above related embodiments, and will not be repeated here.

[0260] The embodiments of the present application also provide a computer-readable storage medium. The computer-readable storage medium stores a computer program. The above method is implemented when the computer program is executed by the processor. The method described in the above embodiment can be implemented in whole or in part by software, hardware, firmware, or any combination thereof. If implemented in software, the function can be stored as one or more instructions or codes on a computer-readable medium or transmitted on a computer-readable medium. Computer-readable media can include computer storage media and communication media, and can also include any medium that can transfer a computer program from one place to another. The storage medium can be any target medium that can be accessed by a computer.

[0261] In one possible implementation, a computer-readable medium may include RAM, ROM, compact disc read-only memory (CD-ROM) or other optical disk storage, disk storage or other magnetic storage devices, or any other medium that is intended to carry or store the required program code in the form of instructions or data structures and can be accessed by a computer. Moreover, any connection is appropriately referred to as a computer-readable medium. For example, if a coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL) or wireless technology (such as infrared, radio and microwave) is used to transmit software from a website, server or other remote source, the coaxial cable, fiber optic cable, twisted pair, DSL or wireless technology such as infrared, radio and microwave are included in the definition of medium. Disks and optical disks as used herein include optical disks, laser disks, optical disks, digital versatile disks (DVD), floppy disks and Blu-ray disks, where disks usually reproduce data magnetically, while optical disks reproduce data optically using lasers. Combinations of the above should also be included in the scope of computer-readable media.

[0262] An embodiment of the present application provides a computer program product, which includes a computer program. When the computer program is executed, the computer executes the above method.

[0263] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable device to generate a machine, so that the instructions executed by the processing unit of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0264] The above specific implementation methods further illustrate the purpose, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above are only specific implementation methods of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solutions of the present invention should be included in the scope of protection of the present invention.

Claims

1. A data processing method applied to multiple TEEs, characterized in that: Applied to an electronic device, the electronic device includes: a first trusted execution environment TEE and a second TEE, the first TEE corresponds to a first file encryption key, and the second TEE corresponds to a second file encryption key, the method includes: When the electronic device is locked, encrypting data using the first file encryption key and the second file encryption key to obtain a third ciphertext; deleting the first file encryption key and the second file encryption key, wherein when the electronic device is locked, the electronic device has stored a first ciphertext and a second ciphertext, the first ciphertext being a ciphertext encrypted by the first file encryption key using a temporary key, and the second ciphertext being a ciphertext encrypted by the second file encryption key using the temporary key; In response to a user inputting the temporary key, the electronic device is unlocked; When the electronic device is unlocked, the first ciphertext is decrypted according to the temporary key to obtain the first file encryption key, and the second ciphertext is decrypted according to the temporary key to obtain the second file encryption key; The first file encryption key and the second file encryption key are used to decrypt the third ciphertext to obtain the data.

2. The method according to claim 1, characterized in that: The temporary key is obtained based on the lock screen key.

3. The method according to claim 1 or 2, characterized in that: The step of encrypting data using the first file encryption key and the second file encryption key includes: combining the first file encryption key and the second file encryption key into a third file encryption key; The data is encrypted using the third file encryption key.

4. The method according to claim 1 or 2, characterized in that: The method further comprises: When the electronic device is turned on, generating the first file encryption key and the second file encryption key; Using the temporary key, encrypting the first file encryption key to obtain the first ciphertext; Using the temporary key, encrypting the second file encryption key to obtain the second ciphertext; The first ciphertext and the second ciphertext are stored.

5. The method according to claim 4, characterized in that The method further comprises: storing an identifier of the temporary key; Before decrypting the first ciphertext according to the temporary key to obtain the first file encryption key, the method further includes: The temporary key is obtained according to the identifier of the temporary key.

6. The method according to claim 4, characterized in that The electronic device further includes a rich execution environment REE, the REE includes a storage guard module and a key ring, the first TEE includes a first key management trusted application, and the second TEE includes a second key management trusted application; The generating the first file encryption key and the second file encryption key comprises: The storage guard module requests a file encryption key from the first key management trusted application, and requests a file encryption key from the second key management trusted application; The first key management trusted application generates the first file encryption key, and uses the temporary key to encrypt the first file encryption key to obtain the first ciphertext; The first key management trusted application sends the first ciphertext and the identifier of the temporary key to the storage guard module; The second key management trusted application generates the second file encryption key, and uses the temporary key to encrypt the second file encryption key to obtain the second ciphertext; The second key management trusted application sends the second ciphertext and an identifier of the temporary key to the storage guard module; The storage guard module stores the identifier of the temporary key, the first ciphertext, and the second ciphertext in the key ring.

7. The method according to claim 6, characterized in that Before the storage guard module requests the file encryption key from the first key management trusted application and requests the file encryption key from the second key management trusted application, the storage guard module further includes: The storage guard module requests the first key management trusted application to store a key, and requests the second key management trusted application to store a key; The first key management trusted application generates a first storage key, and sends the first storage key to the storage guard module; The second key management trusted application generates a second storage key and sends the second storage key to the storage guard module; The storage guard module requests a file encryption key from the first key management trusted application, and requests a file encryption key from the second key management trusted application, including: The storage guardian module uses the first storage key to request a file encryption key from the first key management trusted application, and the storage guardian module uses the second storage key to request a file encryption key from the second key management trusted application; The first key management trusted application generates the first file encryption key, including: The first key management trusted application derives the first file encryption key according to the first storage key; The second key management trusted application generates the second file encryption key, including: The second key management trusted application derives the second file encryption key according to the second storage key.

8. The method according to claim 6, characterized in that After the storage guard module stores the identifier of the temporary key, the first ciphertext, and the second ciphertext in the key ring, the storage guard module further includes: Perform the decryption step.

9. The method according to claim 6, characterized in that The decrypting the first ciphertext according to the temporary key to obtain the first file encryption key, and decrypting the second ciphertext according to the temporary key to obtain the second file encryption key, comprises: Perform the decryption step.

10. The method according to claim 8 or 9, characterized in that: The electronic device further includes a universal flash memory, and the first TEE further includes a first trusted application and a second trusted application; the decryption step includes: The key ring sends the identifier of the temporary key and the first ciphertext to the first trusted application; The first trusted application requests the temporary key from the first key management trusted application according to the identifier of the temporary key; The first trusted application decrypts the first ciphertext according to the temporary key to obtain the first file encryption key; The first trusted application stores the first file encryption key in the universal flash memory; The second trusted application requests the temporary key from the second key management trusted application according to the identifier of the temporary key; The second trusted application decrypts the second ciphertext according to the temporary key to obtain the second file encryption key; The second trusted application stores the second file encryption key in the general flash memory.

11. The method according to claim 10, characterized in that The deleting the first file encryption key and the second file encryption key includes: The universal flash memory deletes the first file encryption key and the second file encryption key stored in the universal flash memory.

12. An electronic device, characterized in that: include: Processor and memory; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the electronic device performs the method according to any one of claims 1 to 11.

13. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 11 is implemented.

14. A chip system, characterized in that: The system comprises at least one processor and a communication interface, wherein the communication interface and the at least one processor are interconnected via a line, and the at least one processor is used to run a computer program or instruction to execute the method according to any one of claims 1 to 11.

15. A computer program product, characterized in that The invention comprises a computer program, which, when being executed, causes a computer to execute the method according to any one of claims 1 to 11.

Images