Data protection method and system, key generation method and device and storage medium

Abstract

The invention is suitable for the technical field of information, and provides a data protection method and system, a key generation method and device and a storage medium. The method comprises the following steps: acquiring a data ciphertext of a target application and a ciphertext of a first key through a decryption request based on the target application; the ciphertext of the second key is obtained from the storage position associated with the target application, and the identity of the target application can be authenticated by comparing whether the ciphertext of the first key is consistent with the ciphertext of the second key; and after the authentication is passed, the data ciphertext is decrypted based on the plaintext of the first key and the preset key pair of the terminal device to obtain the data plaintext, double-end authentication can be performed based on the terminal device end and the developer end of the target application, and each target application has the unique corresponding first key. According to the method, the malicious application can be prevented from being counterfeited as the target application to steal the first key, the first key has the characteristic of easy management, and the information security in the application use process is improved while the management cost is effectively controlled.

Description

Technical Field

[0001] The present application belongs to the field of information processing technology, and in particular relates to a data protection method, system, key generation method, device and storage medium. Background Art

[0002] With the rapid development of electronic technology, a wide variety of applications can support terminal devices to realize various functions. Based on the business needs of the application, such as protecting algorithm models, protecting user information or encrypting sensitive data such as interactive information, the application needs to encrypt the above sensitive data to improve the security of sensitive data, thereby protecting the developer's intellectual property rights and the user's information security.

[0003] At present, terminal device manufacturers usually provide developers with key pairs (which can be symmetric keys or public-private key pairs) for encrypting sensitive data. Due to the management cost of key pairs, key pairs are usually shared by one or more models of terminal devices. If the key pair is leaked (for example, attackers develop malicious applications and run them to steal key pairs), attackers can crack sensitive data of various applications based on the key pair, resulting in sensitive data leakage and reducing information security during the use of applications. Summary of the invention

[0004] In view of this, embodiments of the present application provide a data protection method, system, key generation method, device and storage medium to solve the problem of poor information security during the use of existing applications.

[0005] A first aspect of an embodiment of the present application provides a data protection method, which is applied to a terminal device, and the method includes:

[0006] Based on a decryption request of the target application, obtaining a ciphertext of data of the target application and a ciphertext of the first key;

[0007] Obtaining a ciphertext of a second key from a storage location associated with the target application, the ciphertext of the second key being a ciphertext of a derived key corresponding to the target application;

[0008] If the ciphertext of the first key is consistent with the ciphertext of the second key, decrypt the ciphertext of the first key to obtain the plaintext of the first key;

[0009] Based on the plaintext of the first key and the preset key pair of the terminal device, the data ciphertext is decrypted to obtain the data plaintext; the preset key pair is a shared key pair of the model to which the terminal device belongs.

[0010] The first aspect of the embodiment of the present application provides a data protection method, which obtains the data ciphertext and the ciphertext of the first key of the target application through a decryption request based on the target application; obtains the ciphertext of the second key from the storage location associated with the target application, and the ciphertext of the second key is the ciphertext of the derived key corresponding to the target application; by comparing whether the ciphertext of the first key and the ciphertext of the second key are consistent, it can be verified whether the ciphertext of the first key carried by the target application and the ciphertext of the derived key uniquely corresponding to the target application are consistent, thereby authenticating the identity of the target application; and after the authentication is passed, the data ciphertext is decrypted based on the plaintext of the first key and the preset key pair of the terminal device to obtain the data plaintext, and two-way authentication can be performed based on the terminal device side and the developer side of the target application, and each application has a unique corresponding first key, so that the first key has a higher privacy level, which can effectively prevent malicious applications from impersonating the target application to steal the first key, and the first key is an independent key (not a key pair), which has the characteristics of easy storage, easy management and easy operation, and improves the information security during the use of the application while effectively controlling the management cost.

[0011] A second aspect of an embodiment of the present application provides a key generation method, which is applied to a server, the server is connected to a developer platform and a terminal device, the developer platform is used to initiate an encryption request for a target application, and the server stores a preset key pair of the terminal device, the method comprising:

[0012] Performing key derivation based on the encryption request of the target application to obtain a plain text of a derived key corresponding to the target application;

[0013] Encrypting the plain text of the derived key to obtain the cipher text of the derived key;

[0014] Encrypting the data plaintext of the target application based on the plaintext of the derived key and the preset key pair of the terminal device to obtain data ciphertext;

[0015] Sending the ciphertext of the derived key and the ciphertext of the data to a developer platform corresponding to the target application;

[0016] Among them, the derived key is the derived key in the data protection method provided in the first aspect of the embodiment of the present application.

[0017] The second aspect of the embodiment of the present application provides a key generation method, which performs key derivation based on an encryption request of a target application to obtain a plaintext of a derived key corresponding to the target application; encrypts the plaintext of the derived key to obtain a ciphertext of the derived key; encrypts the data plaintext of the target application based on the plaintext of the derived key and a preset key pair of a terminal device to obtain a data ciphertext; sends the ciphertext of the derived key and the data ciphertext to a developer platform corresponding to the target application; the server generates a plaintext of the derived key so that each target application has a one-to-one corresponding derived key, and encrypts the data plaintext with the preset key pair, so that the developer can perform double-layer encryption on the sensitive data contained in the target application, thereby improving the security of the sensitive data, and effectively controlling the management cost by using derived keys with low generation cost and low management cost.

[0018] The third aspect of an embodiment of the present application provides a terminal device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the data protection method provided in the first aspect of the embodiment of the present application when executing the computer program.

[0019] A fourth aspect of the embodiment of the present application provides a data protection system, including a server, a developer platform, and a terminal device provided by the third aspect of the embodiment of the present application; the server is connected to the developer platform and the terminal device respectively;

[0020] The server is used to execute the steps of the key generation method provided in the second aspect of the embodiment of the present application;

[0021] The developer platform is used to:

[0022] Receiving the ciphertext of the derived key and the ciphertext of the data sent by the server;

[0023] The ciphertext of the derived key and the ciphertext of the data are encapsulated into a target application, and the ciphertext of the first key stored in the target application is the ciphertext of the derived key.

[0024] The fifth aspect of the embodiments of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the steps of the data protection method provided in the first aspect of the embodiments of the present application.

[0025] It can be understood that the beneficial effects of the third aspect mentioned above can be found in the relevant description of the first aspect mentioned above, and the beneficial effects of the fourth / fifth aspect mentioned above can be found in the relevant description of the first and second aspects mentioned above, which will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0027] Figure 1 This is a schematic diagram of the structure of a terminal device provided in an embodiment of the present application;

[0028] Figure 2 This is a schematic diagram of the architecture of an operating system running on a terminal device provided in an embodiment of the present application;

[0029] Figure 3 This is a schematic diagram of the first process of the data protection method provided in the embodiment of the present application;

[0030] Figure 4 This is a second flow chart of the data protection method provided in the embodiment of the present application;

[0031] Figure 5 This is a schematic diagram of the first process of the key generation method provided in the embodiment of the present application;

[0032] Figure 6 This is a schematic diagram of a second process of the key generation method provided in an embodiment of the present application;

[0033] Figure 7 It is a structural diagram of a data protection system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0034] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0035] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or combinations thereof.

[0036] It should also be understood that the term “and / or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0037] As used in the specification and appended claims of this application, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce [described condition or event] is detected" or "in response to detecting [described condition or event]", depending on the context.

[0038] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0039] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0040] In applications, terminal device manufacturers usually provide developers with key pairs (which can be symmetric keys or public-private key pairs) to encrypt sensitive data. Due to the management cost of key pairs, key pairs are usually shared by one or more models of terminal devices. If the key pairs are leaked (for example, attackers develop malicious applications and run them to steal key pairs), attackers can crack sensitive data of various applications based on the key pairs, resulting in sensitive data leakage and reducing information security during the use of applications.

[0041] In response to the above technical problems, an embodiment of the present application provides a data protection method, which obtains the data ciphertext and the ciphertext of the first key of the target application through a decryption request based on the target application; obtains the ciphertext of the second key from a storage location associated with the target application, and the ciphertext of the second key is the ciphertext of the derived key corresponding to the target application; by comparing whether the ciphertext of the first key and the ciphertext of the second key are consistent, it can be verified whether the ciphertext of the first key carried by the target application and the ciphertext of the derived key uniquely corresponding to the target application are consistent, thereby authenticating the identity of the target application; and after the authentication is passed, the data ciphertext is decrypted based on the plaintext of the first key and the preset key pair of the terminal device to obtain the data plaintext, and two-end authentication can be performed based on the terminal device side and the developer side of the target application. If the key provided by either end is incorrect, the data ciphertext cannot be decrypted. By combining the first key with low management cost with the preset key pair, the information security during the use of the application is improved while effectively controlling the management cost.

[0042] The data protection method provided in the embodiment of the present application can be applied to terminal devices. The terminal device can be a mobile phone, a tablet computer, a wearable device, a vehicle-mounted device, an augmented reality (AR) / virtual reality (VR) device, a notebook computer, an ultra-mobile personal computer (UMPC), a netbook, a personal digital assistant (PDA), etc. The embodiment of the present application does not impose any restrictions on the specific type of the terminal device.

[0043] Figure 1The schematic diagram of the structure of the terminal device 1 is shown as an example. The terminal device 1 includes a processor 10, a memory 20, an audio module 30, a camera module 40, a sensor module 50, an input module 60, a display module 70, a wireless communication module 80, and a power module 90. The audio module 30 may include a speaker 31 and a microphone 32, the camera module 40 may include a short-focus camera 41, a long-focus camera 42, and a flash 43, the sensor module 50 may include an infrared sensor 51, an acceleration sensor 52, a position sensor 53, a fingerprint sensor 54, and an iris sensor 55, the input module 60 may include a touch panel 61 and an external input unit 62, and the wireless communication module 80 may include wireless communication units such as Bluetooth, optical wireless communication (Optical Wireless), mobile communication (Mobile Communications), wireless local area network (Wireless Local Area Network, WLAN), near field communication (Near Field Communication, NFC) and ZigBee protocol (ZigBee).

[0044] In applications, the processor 10 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.

[0045] In application, the memory 20 may be an internal storage unit of the terminal device in some embodiments, such as a hard disk or memory of the terminal device. The memory 20 may also be an external storage device of the terminal device in other embodiments, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the terminal device. Further, the memory 20 may also include both an internal storage unit of the terminal device and an external storage device. The memory 20 is used to store computer programs 21 such as an operating system, an application program, and a boot loader (BootLoader). The memory 20 may also be used to temporarily store data that has been output or is to be output.

[0046] In application, the display module 70 can be a flat screen, a curved screen or a flexible screen, specifically a folding screen. The folding screen may include at least one flexible screen, or the folding screen may include at least one flexible screen and at least one flat screen or curved screen. The embodiment of the present application does not impose any restrictions on the specific type of the display module 70.

[0047] It is to be understood that the structure illustrated in the embodiment of the present application does not constitute a specific limitation on the terminal device 1. In other embodiments of the present application, the terminal device 1 may include more or fewer components than those illustrated, or may combine certain components, or different components, such as a graphics processor, etc. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0048] like Figure 2 As shown, the architecture diagram of the operating system running on the terminal device 1 provided in the embodiment of the present application, the layered architecture can divide the operating system into multiple layers, and the layers communicate with each other through software interfaces. In some embodiments, the operating system can be divided from top to bottom into an application layer 100, a framework layer 200, a system runtime layer 300, a hardware abstraction layer 400, and a Linux kernel layer 500.

[0049] It should be noted that the type of the operating system may be an Android system, an operating system customized based on the Android system, or other different types of operating systems. The embodiments of the present application do not impose any limitation on the specific type of the operating system.

[0050] In the application, the five layers of the operating system are introduced as follows:

[0051] The application layer 100 may include built-in applications 120 built into the system and upper layer applications 110 provided by third-party application providers. The application programs of the application layer 100 may interact directly with users to implement different functions provided by the application programs. For example, the application layer 100 may specifically include built-in applications such as email, phone, calendar, camera, contacts, and Bluetooth, and upper layer applications such as map positioning, food delivery, and video playback.

[0052] The framework layer (ApplicationFramwork) 200 may include an application programming interface (API) and a programming framework. The application programming interface may be used to provide an interface for operating system developers to develop applications, and may also be used to call corresponding basic services for applications in the application layer when implementing different functions. For example, the framework layer may include different types of application programming interfaces such as window managers, content providers, phone managers, positioning managers, and view systems.

[0053] The window manager is used to manage window programs. Specifically, it can be used to obtain the window size, determine whether there is a status bar, lock the screen, capture the screen, etc.

[0054] Content providers are used to store and retrieve data and make the data accessible to applications. The data may include videos, images, audio, call logs, contacts, browsing history, and bookmarks.

[0055] The phone manager is used to provide communication functions of the terminal device 1, such as management of call status, including answering and hanging up calls, etc.;

[0056] The positioning manager is used to obtain the location information of the terminal device 1, which may include different types of location information such as satellite location information (obtained through the global positioning system), network location information (obtained through a network positioning service), and fused location information (obtained through a fused positioning service);

[0057] The view system is used to provide visual controls, such as controls for displaying text and controls for displaying pictures, and is also used to build applications for displaying the application layer 100. The view system can run multiple visual controls at the same time, so that the terminal device can display multiple views at the same time, for example, a view that displays text and a view that displays pictures at the same time.

[0058] The system runtime layer (Native) 300 may include a C / C++ library 310 and an Android runtime library 320, wherein the C / C++ library 310 may include a drawing function library, a font engine, a rendering engine, a multimedia library, and a database engine, etc. The drawing function library may be OpenGL For Embedded Systems 3D (a 3D open graphics library running on embedded systems); the font engine is used to provide different fonts, and may be FreeType (a portable font engine); the rendering engine is used to render two-dimensional graphics or three-dimensional graphics, and may be Skia Graphics Library (an engine for rendering two-dimensional graphics); the multimedia library (Media Framework) is used to support the playback, recording, and playback of audio and video in different formats; the database engine is used to provide storage functions for different types of databases, so that different types of data can be stored in different types of databases according to actual needs, or different types of data can be stored in a unified database.

[0059] The Android runtime 320 may include core libraries (Core Libraries) and an Android runtime environment (Android Runtime, ART), wherein after the Android 5.0 system, the Dalvik virtual machine is replaced by ART. The core library provides most of the functions of the Java language core library, so that developers can use the Java language to write Android applications. Compared with the Java Virtual Machine (Java Virtual Machine, JVM), the Dalvik virtual machine is specially customized for mobile devices, allowing multiple virtual machine instances to run simultaneously in limited memory, and each Dalvik application is executed as an independent Linux process. Independent processes can prevent all programs from being closed when the virtual machine crashes. The mechanism of ART, which replaces the Dalvik virtual machine, is different from Dalvik. Under Dalvik, every time an application runs, the bytecode needs to be converted into machine code by a just-in-time compiler, which slows down the running efficiency of the application. In the ART environment, when the application is installed for the first time, the bytecode will be pre-compiled into machine code, making it a truly local application.

[0060] The Hardware Abstraction Layer (HAL) 400 is an interface layer between the operating system kernel and the hardware circuit. Its purpose is to abstract the hardware. In order to protect the intellectual property rights of hardware manufacturers, it hides the hardware interface details of a specific platform, thereby providing a virtual hardware platform for the operating system, making it hardware-independent and portable on multiple platforms. From the perspective of software and hardware testing, the testing of software and hardware can be completed based on the hardware abstraction layer, so that the testing of software and hardware can be carried out in parallel.

[0061] The Linux kernel layer 500 can be used to provide system services of the operating system, including security services, memory management, process management, network protocol stack, driver model and other services of the operating system.

[0062] Understandably, Figure 2 The architecture diagram of an operating system is only shown by way of example. The operating system architecture can also be four-layer or six-layer, wherein the architecture of a four-layer operating system may include: an application layer, a framework layer, a system runtime layer and a Linux kernel layer; the architecture of a six-layer operating system may include: an application layer, a framework layer, a system runtime layer, a hardware abstraction layer, a Linux kernel layer and a hardware device layer. The embodiment of the method of the present application does not impose any limitation on the number of architecture layers and the specific architecture of the operating system.

[0063] like Figure 3 As shown, the data protection method provided in the embodiment of the present application is applied to a terminal device and includes the following steps S301 to S304:

[0064] Step S301: based on a decryption request of a target application, obtain a data ciphertext of the target application and a ciphertext of a first key.

[0065] In the application, the target application can be any application installed in the terminal device that contains sensitive data / encrypted data. Sensitive data / encrypted data can be divided into data ciphertext and data plaintext according to the encryption and decryption status. The target application can send the data ciphertext and the ciphertext of the first key at the same time when sending a decryption request, or carry the data ciphertext and the ciphertext of the first key in the decryption request.

[0066] The function of the first key is described below through step S302 and step S303:

[0067] Step S302: Obtain the ciphertext of the second key from a storage location associated with the target application, where the ciphertext of the second key is the ciphertext of the derived key corresponding to the target application;

[0068] Step S303: If the ciphertext of the first key is consistent with the ciphertext of the second key, decrypt the ciphertext of the first key to obtain the plaintext of the first key.

[0069] In the application, each target application will be assigned a unique corresponding derived key by the terminal device manufacturer during development, and the plaintext of the derived key is used to encrypt the plaintext data. When developing the target application, the ciphertext of the derived key needs to be encapsulated in the corresponding installation file, and when the terminal device manufacturer assigns the derived key to the target application, it will package the ciphertext of the derived key and the application identifier of the corresponding target application and send it to the terminal device for local recording; it should be noted that the ciphertext of the derived key encapsulated in the installation file is defined as the ciphertext of the first key, and the ciphertext of the derived key recorded by the terminal device in the storage location associated with the target application is defined as the ciphertext of the second key.

[0070] In the application, if the target application is indeed an application developed by the developer, the ciphertext of the first key encapsulated in the target application will be consistent with the ciphertext of the derived key; if the target application is not an application developed by the developer (for example, a malicious application developed by an attacker), the ciphertext of the first key encapsulated in the target application will be inconsistent with the ciphertext of the derived key. Therefore, when the target application initiates a decryption request, the ciphertext of the second key can be obtained from the storage location associated with the target application, and the ciphertext of the first key and the ciphertext of the second key are compared for consistency. If they are consistent, it means that the target application is indeed an application developed by the developer, and the terminal device can respond to the decryption request to decrypt the ciphertext of the first key to obtain the plaintext of the first key; if they are inconsistent, it means that the target application is not an application developed by the developer, and the terminal device stops responding to the decryption request of the target application and generates an alarm signal, which is used to warn the user that the target application has information theft behavior.

[0071] In the application, the ciphertext of the second key recorded by the terminal device can be hashed and encrypted, and before the ciphertext of the first key and the ciphertext of the second key are compared for consistency, the ciphertext of the first key is hashed, so that the ciphertext of the first key after the hash operation is compared with the ciphertext of the second key for consistency, so as to improve the security of the consistency comparison and avoid security risks in the consistency comparison when the derived keys of different applications are the same.

[0072] In one embodiment, step S303 includes:

[0073] If the ciphertext of the first key is consistent with the ciphertext of the second key, the ciphertext of the first key is decrypted using the first key to obtain the plaintext of the first key.

[0074] In the application, the terminal device may store a first key pair, which is generated by the terminal device manufacturer and is used to decrypt the ciphertext of the first key and encrypt the plaintext of the first key. The security of the first key / derivative key can be improved by encrypting and decrypting the first key / derivative key through the first key pair, and the plaintext of the first key / derivative key is used to encrypt the data plaintext, thereby further improving the security of the data plaintext.

[0075] Among them, the key pair mentioned in the embodiment of the present application can be a symmetric key or a public-private key pair, and the encryption algorithm of the key pair and the derived key can include but is not limited to a symmetric encryption algorithm (Symmetric Encryption Algorithm), specifically RC4 (Rivest Cipher 4, a stream encryption algorithm), RC2 (Rivest Cipher 2, another stream encryption algorithm), DES (Data Encryption Standard) or AES (Advanced Encryption Standard) and other symmetric encryption algorithms.

[0076] Step S304: decrypt the data ciphertext based on the plaintext of the first key and a preset key pair of the terminal device to obtain the data plaintext; the preset key pair is a shared key pair of the model to which the terminal device belongs.

[0077] In the application, the terminal device can store a preset key pair locally. The preset key pair can be a shared key pair of the model of the terminal device, or a shared key pair between terminal devices of multiple models. After obtaining the plaintext of the first key, the data ciphertext can be decrypted by the plaintext of the first key and the preset key pair of the terminal device to obtain the data plaintext. Specifically, the second key pair can be composed of the plaintext of the first key and the preset key pair, or the plaintext of the first key and the preset key pair can be used to derive a key to obtain the second key pair, and the data ciphertext can be decrypted by the second key pair.

[0078] The following is a description of a specific method for decrypting data ciphertext:

[0079] In one embodiment, step S304 includes:

[0080] Derivation of a key based on the plaintext of the first key, a preset key pair of the terminal device, and an application identifier of the target application to obtain a second key pair;

[0081] The data ciphertext is decrypted using the second key to obtain the data plaintext.

[0082] In the application, the terminal device can also obtain the application identifier (ApplicationIdentifier) ​​of the target application. The application identifier can include the unique identifier of the application, the package name of the installation file and / or the public key certificate of the developer, and derive the key through the plaintext of the first key, the preset key pair of the terminal device and the application identifier of the target application to obtain the second key pair. By deriving the key through the above three parameters, the plaintext of the first key (distributed by the terminal device manufacturer), the preset key pair of the terminal device (locally stored in the terminal device) and the application identifier of the target application (which can represent the target application and / or the identity of the developer) can be verified at the same time, thereby performing three-end verification when decrypting the data ciphertext. Incorrect parameters at any end will result in decryption failure, which can further improve the security of the data ciphertext.

[0083] It should be noted that if the target application does not carry the ciphertext of the first key in step S301, the terminal device can decrypt the data ciphertext directly through the preset key pair of the terminal device in a traditional way to obtain the data plaintext, so as to improve the flexibility of the terminal device in data decryption.

[0084] In the application, the data ciphertext and the ciphertext of the first key of the target application are obtained through a decryption request based on the target application; the ciphertext of the second key is obtained from the storage location associated with the target application, and the ciphertext of the second key is the ciphertext of the derived key corresponding to the target application; by comparing whether the ciphertext of the first key and the ciphertext of the second key are consistent, it can be verified whether the ciphertext of the first key carried by the target application and the ciphertext of the derived key uniquely corresponding to the target application are consistent, thereby authenticating the identity of the target application; and after the authentication is passed, the data ciphertext is decrypted based on the plaintext of the first key and the preset key pair of the terminal device to obtain the data plaintext, and two-way authentication can be performed based on the terminal device side and the developer side of the target application, and each application has a unique corresponding first key, so that the first key has a higher privacy level, which can effectively prevent malicious applications from pretending to be the target application to steal the first key, and the first key is an independent key (not a key pair), which has the characteristics of easy storage, easy management and easy operation, and improves the information security during the use of the application while effectively controlling the management cost.

[0085] like Figure 4 As shown, in one embodiment, based on Figure 3 The corresponding embodiment includes the following steps S401 to S408:

[0086] Step S401: acquiring a first application identifier of a target application based on a decryption request of the target application;

[0087] Step S402: Acquire a second application identifier from a storage location associated with the target application, where the second application identifier is the application identifier of the target application.

[0088] In the application, each target application has a corresponding application identifier. It should be noted that the developer will assign an application identifier to the target application when developing the target application. The application identifier carried by the target application when it is installed on the terminal device is defined as the first application identifier. The target application is defined as the first application identifier by the terminal device manufacturer (described below). Figure 6 When the server in the corresponding embodiment initiates an encryption request, the terminal device manufacturer will record the application identifier of the target application and send it to the terminal device, and the application identifier recorded locally on the terminal device is defined as the second application identifier.

[0089] Step S403: If the first application identifier and the second application identifier are consistent, execute step S405;

[0090] Step S404: If the first application identifier and the second application identifier are different, stop responding to the decryption request of the target application and generate an alarm signal.

[0091] In the application, if the target application is indeed an application developed by the developer, the first application identifier carried by the target application will be consistent with the second application identifier; if the target application is not an application developed by the developer (for example, a malicious application developed by an attacker), the first application identifier carried by the target application will be inconsistent with the second application identifier. Therefore, when the target application initiates a decryption request, the second application identifier can be obtained from the storage location associated with the target application, and the first application identifier and the second application identifier are compared for consistency. If they are consistent, it means that the target application is indeed an application developed by the developer, and the terminal device can continue to respond to the decryption request and execute step S405; if they are inconsistent, it means that the target application is not an application developed by the developer, and the terminal device stops responding to the decryption request of the target application and generates an alarm signal, which is used to warn the user that the target application has information theft behavior.

[0092] Step S405, obtaining the data ciphertext of the target application and the ciphertext of the first key;

[0093] Step S406: Obtain the ciphertext of the second key from the storage location associated with the target application, where the ciphertext of the second key is the ciphertext of the derived key corresponding to the target application;

[0094] Step S407: If the ciphertext of the first key is consistent with the ciphertext of the second key, decrypt the ciphertext of the first key to obtain the plaintext of the first key;

[0095] Step S408: decrypt the data ciphertext based on the plaintext of the first key and a preset key pair of the terminal device to obtain the data plaintext; the preset key pair is a shared key pair of the model to which the terminal device belongs.

[0096] In the application, the data protection method provided by steps S405 to S408 can refer to the relevant descriptions in the above steps S301 to S304, which will not be repeated here.

[0097] In the application, before responding to the decryption request of the target application to obtain the data ciphertext of the target application and the ciphertext of the first key, the first application identifier carried by the target application can be compared with the second application identifier stored locally to determine whether the target application is a false application that poses a risk of information theft. If so, stop responding to the decryption request of the target application in a timely manner to prevent the terminal device from reading the ciphertext of the second key, thereby preventing the false application from stealing the second key, ensuring the information security of the second key, and thus improving the information security during the use of the application.

[0098] like Figure 5As shown, the key generation method provided in the embodiment of the present application is applied to a server, the server is connected to a developer platform and a terminal device, the developer platform is used to initiate an encryption request for a target application, and the server stores a preset key pair of the terminal device. The key generation method includes the following steps S501 to S504:

[0099] Step S501: perform key derivation based on the encryption request of the target application to obtain the plain text of the derived key corresponding to the target application.

[0100] In the application, the server is run by the terminal device manufacturer. The server can be connected to any developer platform and any terminal device. After the server receives the encryption request of the target application initiated by the developer platform, it can perform key derivation to obtain the plaintext of the derived key corresponding to the target application. Specifically, the server can generate a random string for key derivation to obtain the plaintext of the derived key. The length of the string can be set by the server, which can be an 8-bit, 12-bit or 16-bit string.

[0101] Step S502: Encrypt the plain text of the derived key to obtain the cipher text of the derived key.

[0102] In the application, after the plaintext of the derived key is generated, the plaintext of the derived key can be encrypted by an encryption algorithm to obtain the ciphertext of the derived key to protect the derived key. The type of encryption algorithm can refer to the encryption algorithm type of the above key pair and will not be repeated here.

[0103] Step S503: Based on the plain text of the derived key and the preset key pair of the terminal device, encrypt the data plain text of the target application to obtain the data ciphertext.

[0104] In the application, the server may store preset key pairs of all terminal devices connected to it. For any terminal device, the target application data plaintext may be encrypted based on the plaintext of the derived key of the target application and the preset key pair of the terminal device to obtain the data plaintext. It should be noted that the encryption and decryption of the data plaintext is reversible, that is, if the data plaintext can be encrypted based on the plaintext of the derived key and the preset key pair of the terminal device, the data ciphertext can also be decrypted based on the plaintext of the derived key and the preset key pair of the terminal device.

[0105] Step S504: Send the derived key ciphertext and the data ciphertext to the developer platform corresponding to the target application;

[0106] The derived key is the derived key in the above data protection method.

[0107] In the application, after the server completes the encryption of the plaintext of the derived key and the plaintext of the data, the encrypted ciphertext of the derived key and the ciphertext of the data can be returned to the developer platform, so that the developer platform can encapsulate the ciphertext of the derived key and the ciphertext of the data into the target application to protect the sensitive data of the target application.

[0108] In the application, a key is derived based on an encryption request of the target application to obtain a plaintext of a derived key corresponding to the target application; the plaintext of the derived key is encrypted to obtain a ciphertext of the derived key; based on the plaintext of the derived key and a preset key pair of the terminal device, the data plaintext of the target application is encrypted to obtain a data ciphertext; the ciphertext of the derived key and the data ciphertext are sent to a developer platform corresponding to the target application; the server generates a plaintext of the derived key so that each target application has a one-to-one corresponding derived key, and uses the preset key pair to encrypt the data plaintext, so that the developer can perform double-layer encryption on the sensitive data contained in the target application, thereby improving the security of the sensitive data, and effectively controlling the management cost by using derived keys with low generation cost and low management cost.

[0109] like Figure 6 As shown, in one embodiment, based on Figure 5 The corresponding embodiment includes the following steps S601 to S606:

[0110] Step S601: perform key derivation based on the encryption request of the target application to obtain the plain text of the derived key corresponding to the target application.

[0111] In the application, the key generation method provided in step S601 can refer to the relevant description in the above step S501, which will not be repeated here.

[0112] Step S602: Generate a first key pair based on the first key pair parameter and the preset key pair of the terminal device; the first key pair is used to encrypt the plaintext of the derived key and to decrypt the ciphertext of the derived key.

[0113] In the application, the server can generate the first key pair based on the first key pair parameters and the preset key pair of the terminal device. The first key pair parameters may include the number of characters of the first key pair, the encryption algorithm or storage location selected by the first key pair, etc. By combining the preset key pair to generate the first key pair, a correlation between the first key pair and the terminal device can be established, and double-layer encryption of the derived key can be achieved, thereby increasing the difficulty of cracking the first key pair.

[0114] Step S603: Encrypt the plain text of the derived key using the first key to obtain the cipher text of the derived key.

[0115] In an application, the first key pair can be used to encrypt the plain text of the derived key to obtain the cipher text of the derived key, and can also be used to decrypt the cipher text of the derived key to obtain the plain text of the derived key.

[0116] Step S604: deriving a key based on the plaintext of the derived key, the preset key pair of the terminal device and the application identifier of the target application to obtain a second key pair; the second key pair is used to encrypt the data plaintext and to decrypt the data ciphertext;

[0117] Step S605: Encrypt the data plaintext using the second key to obtain data ciphertext.

[0118] In the application, the first key pair is used to encrypt and decrypt the derived key. The server can also generate a second key pair based on the plaintext of the derived key to encrypt and decrypt sensitive data. The server can specifically derive the key based on the plaintext of the first key and the preset key pair of the terminal device to generate the second key pair; it can also derive the key based on the plaintext of the derived key, the preset key pair of the terminal device and the application identifier of the target application to generate the second key pair. It should be noted that when the server generates the second key pair, the more parameters used, the higher the complexity of the second key pair, and the corresponding higher the difficulty of cracking. The generation method and protection capability of the second key pair can refer to the relevant description in the above step S304, which will not be repeated here.

[0119] Step S606: Send the derived key ciphertext and the data ciphertext to the developer platform corresponding to the target application.

[0120] In the application, the key generation method provided in step S606 can refer to the relevant description in the above step S504, which will not be repeated here.

[0121] In the application, the server generates a first key pair based on the first key pair parameters and the preset key pair of the terminal device, and can establish a correlation between the first key pair and the preset key pair, thereby realizing double-layer encryption of the derived key (the preset key pair must be cracked first, and then the derived key is cracked), and the preset key pair is an existing key, which saves the resource cost of encrypting the derived key while improving the security of the derived key; then, based on the plaintext of the derived key, the preset key pair of the terminal device and the application identifier of the target application, a second key pair is generated to realize three-layer encryption of the data ciphertext (the second key pair is further cracked on the basis of cracking the derived key), further improving the security of the derived key.

[0122] It should be noted that, by using the present solution for data protection, in the event that the preset key pair is leaked, the data ciphertext can be protected by the first key; and each application has a unique corresponding first key, so that the first key has a high privacy level, which can effectively prevent malicious applications from impersonating the target application to steal the first key; combined with the double-layer encryption of the first key by the first key, and the triple-layer encryption of the data ciphertext by the second key, the risk of data leakage can be extremely avoided, and the information security during the use of the application can be improved.

[0123] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0124] like Figure 7 As shown, a data protection system 7 provided in an embodiment of the present application includes a server 2, a developer platform 3 and a terminal device 1; the server 2 is connected to the developer platform 3 and the terminal device 1 respectively, and the developer platform 3 is connected to the terminal device 1;

[0125] Server 2 is used to execute the steps of the above-mentioned key generation method;

[0126] Developer Platform 3 is used for:

[0127] Receiving the ciphertext of the derived key and the ciphertext of the data sent by server 2;

[0128] The ciphertext of the derived key and the ciphertext of the data are encapsulated into the target application, and the ciphertext of the first key stored in the target application is the ciphertext of the derived key.

[0129] In the application, the terminal device is used to execute the steps in the above data protection method embodiment applied to the terminal device, and the server is used to execute the steps in the above key generation method embodiment applied to the server.

[0130] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in the above-mentioned data protection method or key generation method embodiments can be implemented.

[0131] If the integrated module is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When the computer program is executed by the processor, the steps of the above-mentioned method embodiments can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable storage medium may at least include: any entity or device that can carry the computer program code to the camera terminal device, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electric carrier signal, a telecommunication signal, and a software distribution medium. For example, a USB flash drive, a mobile hard disk, a disk or an optical disk.

[0132] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0133] Those of ordinary skill in the art will appreciate that the modules and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0134] In the embodiments provided in the present application, it should be understood that the disclosed terminal device and method can be implemented in other ways. For example, the terminal device embodiments described above are only schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules, which can be electrical, mechanical or other forms.

[0135] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A data protection method, characterized in that: Applied to a terminal device, the method comprises: Based on a decryption request of the target application, obtaining a ciphertext of data of the target application and a ciphertext of the first key; Obtaining a ciphertext of a second key from a storage location associated with the target application, the ciphertext of the second key being a ciphertext of a derived key corresponding to the target application; If the ciphertext of the first key is consistent with the ciphertext of the second key, decrypt the ciphertext of the first key to obtain the plaintext of the first key; Based on the plaintext of the first key and the preset key pair of the terminal device, the data ciphertext is decrypted to obtain the data plaintext; the preset key pair is a shared key pair of the model to which the terminal device belongs.

2. The data protection method according to claim 1, characterized in that: If the ciphertext of the first key is consistent with the ciphertext of the second key, decrypting the ciphertext of the first key to obtain the plaintext of the first key includes: If the ciphertext of the first key is consistent with the ciphertext of the second key, the ciphertext of the first key is decrypted using the first key to obtain the plaintext of the first key.

3. The data protection method according to claim 1, characterized in that: The decrypting the data ciphertext based on the plaintext of the first key and the preset key pair of the terminal device to obtain the data plaintext includes: Performing key derivation based on the plaintext of the first key, the preset key pair of the terminal device, and the application identifier of the target application to obtain a second key pair; The data ciphertext is decrypted using the second key to obtain data plaintext.

4. The data protection method according to any one of claims 1 to 3, characterized in that: The method further comprises: Based on the decryption request of the target application, obtaining a first application identifier of the target application; Acquire a second application identifier from a storage location associated with the target application, where the second application identifier is an application identifier of the target application; If the first application identifier and the second application identifier are consistent, executing the step of obtaining the ciphertext of the first key and the ciphertext of the data of the target application and subsequent steps; If the first application identifier is different from the second application identifier, stop responding to the decryption request of the target application and generate an alarm signal.

5. A key generation method, characterized in that: The method is applied to a server, the server is connected to a developer platform and a terminal device, the developer platform is used to initiate an encryption request for a target application, and the server stores a preset key pair of the terminal device. The method includes: Performing key derivation based on the encryption request of the target application to obtain a plain text of a derived key corresponding to the target application; Encrypting the plain text of the derived key to obtain the cipher text of the derived key; Encrypting the data plaintext of the target application based on the plaintext of the derived key and the preset key pair of the terminal device to obtain data ciphertext; Sending the ciphertext of the derived key and the ciphertext of the data to a developer platform corresponding to the target application; Wherein, the derived key is the derived key in the data protection method described in any one of claims 1 to 4.

6. The key generation method according to claim 5, characterized in that: The encrypting the plain text of the derived key to obtain the cipher text of the derived key includes: Generate a first key pair based on a first key pair parameter and a preset key pair of the terminal device; the first key pair is used to encrypt the plaintext of the derived key and to decrypt the ciphertext of the derived key; The plain text of the derived key is encrypted by using the first key to obtain the ciphertext of the derived key.

7. The key generation method according to claim 5, characterized in that: The step of encrypting the data plaintext of the target application based on the plaintext of the derived key and the preset key pair of the terminal device to obtain the data ciphertext includes: Performing key derivation based on the plaintext of the derived key, the preset key pair of the terminal device and the application identifier of the target application to obtain a second key pair; the second key pair is used to encrypt the data plaintext and to decrypt the data ciphertext; The data plaintext is encrypted using the second key to obtain data ciphertext.

8. A terminal device, characterized in that: The method comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the data protection method as claimed in any one of claims 1 to 4 when executing the computer program.

9. A data protection system, characterized in that: It comprises a server, a developer platform and a terminal device as claimed in claim 8; the server is connected to the developer platform and the terminal device respectively, and the developer platform is connected to the terminal device; The server is used to perform the steps of the key generation method according to any one of claims 5 to 7; The developer platform is used to: Receiving the ciphertext of the derived key and the ciphertext of the data sent by the server; The ciphertext of the derived key and the ciphertext of the data are encapsulated into a target application, and the ciphertext of the first key stored in the target application is the ciphertext of the derived key.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the computer program implements the steps of the data protection method according to any one of claims 1 to 4, or implements the steps of the key generation method according to any one of claims 5 to 7.

Images