Processing method and device of electronic equipment, electronic equipment and storage medium

Abstract

The invention discloses a processing method and device of electronic equipment, the electronic equipment and a storage medium, and the method comprises the steps: obtaining first data in response to a key generation request sent by a first application of the electronic equipment; the first data comprises a first key, and the first key is used for encrypting local user data of the electronic equipment; if the available value of the first storage space of the security hardware module does not meet the first preset threshold value, determining a first target storage space from the first storage space; second data are stored in the first target storage space; processing the second data based on a second storage space of the security hardware module, so that the first target storage space can be used for storing the first key; the processing comprises encrypting the second data; and storing the first data in the first target storage space, wherein the first data comprises the first key.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a processing method and device for an electronic device, an electronic device, and a storage medium. Background Art

[0002] At present, the key management is generally performed through the hardware security module to protect the data of the electronic device. However, the storage capacity of the hardware security module is generally small, and the number of keys that can be stored is limited. Summary of the invention

[0003] The technical solutions provided by this application are as follows:

[0004] A first aspect of the present application provides a processing method of an electronic device, wherein the electronic device includes a security hardware module, and the method includes:

[0005] In response to a key generation request sent by a first application of an electronic device, first data is obtained; the first data includes a first key, and the first key is used to encrypt local user data of the electronic device;

[0006] If the available value of the first storage space of the security hardware module does not meet the first preset threshold, determining a first target storage space from the first storage space; the first target storage space stores second data;

[0007] Processing the second data based on the second storage space of the secure hardware module so that the first target storage space can be used to store the first key; the processing includes encrypting the second data;

[0008] The first data is stored in the first target storage space, where the first data includes the first key.

[0009] Processing the second data based on the second storage space of the security hardware module includes:

[0010] Acquire a target key from a second storage space of the secure hardware module;

[0011] Encrypting the second data based on the target key to obtain encrypted second data;

[0012] The encrypted second data is migrated to a backup module; the backup module is a local module of the electronic device other than the security hardware module.

[0013] The processing method of the electronic device further includes:

[0014] In response to a first key acquisition request sent by a first application, acquiring an identifier from the first key acquisition request; the identifier includes at least one of a user identifier and an application identifier;

[0015] searching the first storage space and the third storage space for a first key corresponding to the identifier; the third storage space is used to store data obtained from the backup module;

[0016] If a first key corresponding to the identifier is found in the first storage space and the third storage space, the first key is returned to the first application;

[0017] If the first key corresponding to the identifier is not found in the first storage space and the third storage space, obtaining the encrypted first data from the backup module based on the identifier;

[0018] Decrypting the encrypted first data based on the target key to obtain the first data;

[0019] The first key included in the first data is returned to the first application.

[0020] The processing method of the electronic device further includes:

[0021] If the third storage space is not empty, overwriting the data in the third storage space with the first data;

[0022] If the third storage space is empty, the first data is stored in the third storage space.

[0023] The processing method of the electronic device also includes the following:

[0024] If the available value of the backup module does not meet the second preset threshold, deleting the second data that meets the first preset condition from the first storage space, and / or deleting the encrypted second data that meets the second preset condition from the backup module;

[0025] If the available value of the backup module does not meet the second preset threshold, the second data that meets the first preset condition is deleted from the first storage space, and / or the encrypted second data that meets the second preset condition in the backup module is migrated to the backup device associated with the security hardware module; the backup device is different from the electronic device.

[0026] The target key includes one of the following:

[0027] The target key is generated corresponding to the first application of the electronic device and is unique to the first application of the electronic device;

[0028] The target key is pre-configured and is not unique to the first application of the electronic device.

[0029] Determining a first target storage space from the first storage space includes:

[0030] A storage space corresponding to data satisfying a third preset condition is determined from the first storage space as a first target storage space.

[0031] Another aspect of the present application provides a processing device of an electronic device, comprising:

[0032] An obtaining module, configured to obtain first data in response to a key generation request sent by a first application of an electronic device; the first data includes a first key, and the first key is used to encrypt local user data of the electronic device;

[0033] a determination module, configured to determine a first target storage space from the first storage space if the available value of the first storage space of the security hardware module does not meet a first preset threshold; the first target storage space stores second data;

[0034] A first processing module, configured to process the second data based on the second storage space of the security hardware module, so that the first target storage space can be used to store the first key and other data; the processing includes encrypting the second data;

[0035] The first saving module is used to save the first data in the first target storage space, where the first data includes the first key.

[0036] A third aspect of the present application provides an electronic device, including:

[0037] A memory for storing at least one set of instructions;

[0038] The processor is used to call and execute the instruction set in the memory, and execute the processing method of the electronic device as described in any one of the above by executing the instruction set.

[0039] A fourth aspect of the present application provides a storage medium carrying one or more computer programs. When the one or more computer programs are executed by an electronic device, the electronic device can implement a processing method of the electronic device as described in any one of the above. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale.

[0041] Figure 1 A schematic diagram of a process flow of a processing method for an electronic device provided in this application;

[0042] Figure 2 A schematic diagram of an implementation scenario of a processing method for an electronic device provided in this application;

[0043] Figure 3 Another flowchart of a processing method for an electronic device provided in the present application;

[0044] Figure 4 A schematic diagram of another implementation scenario of a processing method for an electronic device provided in the present application;

[0045] Figure 5 A schematic diagram of another implementation scenario of a processing method for an electronic device provided in the present application;

[0046] Figure 6 A schematic diagram of another implementation scenario of a processing method for an electronic device provided in the present application;

[0047] Figure 7 A schematic diagram of another process of a processing method for an electronic device provided in the present application;

[0048] Figure 8 A schematic diagram of another implementation scenario of a processing method for an electronic device provided in the present application;

[0049] Fig. 9 A schematic diagram of another implementation scenario of a processing method for an electronic device provided in the present application;

[0050] Fig.10 A schematic diagram of another implementation scenario of a processing method for an electronic device provided in the present application;

[0051] Fig.11 A schematic diagram of another implementation scenario of a processing method for an electronic device provided in the present application;

[0052] Fig.12 A schematic diagram of another implementation scenario of a processing method for an electronic device provided in the present application;

[0053] Fig.13 A schematic diagram of another process of a processing method for an electronic device provided in the present application;

[0054] Fig.14 A schematic diagram of another implementation scenario of a processing method for an electronic device provided in the present application;

[0055] Fig.15 A schematic diagram of another implementation scenario of a processing method for an electronic device provided in the present application;

[0056] Fig.16 A schematic diagram of the structure of a processing device of an electronic device provided in the present application. DETAILED DESCRIPTION

[0057] The following describes the embodiments of the present application in conjunction with the drawings in the embodiments of the present application. The terms used in the implementation method section of the present application are only used to explain the specific embodiments of the present application, and are not intended to limit the present application.

[0058] The embodiments of the present application are described below in conjunction with the accompanying drawings. Those skilled in the art will appreciate that, with the development of technology and the emergence of new scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0059] The terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and need not be used to describe a specific order or sequential order. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances, which is only to describe the distinction mode adopted by the objects of the same attributes when describing in the embodiments of the present application. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, so that the process, method, system, product or equipment comprising a series of units need not be limited to those units, but may include other units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0060] At present, generative artificial intelligence (generative AI) applications on personal computers (PCs) generally provide services based on cloud computing power. The user data required by generative AI applications needs to be uploaded to the cloud, and generative AI applications process based on the user data in the cloud. However, in the process of uploading user data to the cloud, user data is easily intercepted or eavesdropped, and the security of user data is poor.

[0061] In order to improve the security of user data, this application proposes to deploy one or more generative AI applications locally on the electronic device. Each generative AI application can generate user-customized content based on user data locally on the electronic device, thereby achieving the goal of not uploading user data to the cloud. This can improve the security of user data to a certain extent and eliminate users' security concerns about their personal data.

[0062] However, the user data used by generative AI applications is generally obtained in the following way: collecting and organizing user data from multiple locations of the PC (such as word documents, PPT documents, Excel documents, etc. in different locations) into a designated folder (wherein, the user may collect and organize user data from multiple locations of the PC into a designated folder; or, the generative AI application may collect and organize user data from multiple locations of the PC into a designated folder), and then using the Embedding technology, the user data in the designated folder is generated into user data (such as structured relational data and structured vector data) that can be used by the generative AI application, so that the user data becomes part of the generative AI application. This method makes user data more centralized. If the generative AI application is maliciously copied by someone, the user data will be lost. In order to protect user data, the keys of each account of each generative AI application can be managed through the security hardware module of the electronic device, and the keys of each account are used to encrypt the user data corresponding to each account. However, the storage capacity of the security hardware module is generally small, and the number of keys stored is small. When the storage capacity of the security hardware module is full, the keys of some accounts cannot be stored in the security hardware module, resulting in the user data corresponding to the corresponding account cannot be protected. Therefore, the present application proposes a processing method for an electronic device, so that the security hardware module can be used to manage keys of more accounts, so that user data of more accounts can be protected.

[0063] The present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0064] Reference Figure 1 , is a flow chart of a processing method for an electronic device provided in Example 1 of the present application. The method can be applied to electronic devices. The present application does not limit the product type of the electronic device. For example, Figure 1 As shown, the method may include but is not limited to the following steps:

[0065] Step S101: In response to a key generation request sent by a first application of an electronic device, first data is obtained; the first data includes a first key, and the first key is used to encrypt local user data of the electronic device.

[0066] In this embodiment, the electronic device may include a security hardware module. The security hardware module of the electronic device may be a chip with an encryption engine. The chip with the encryption engine may generate a first key based on an encryption algorithm. For example, the security hardware module of the electronic device may be an LA1 chip or an LA3 chip. The LA1 chip may generate a first key based on SHA (Secure Hash Algorithm, secure hash algorithm) (the key length may be 256 bits); or, the LA1 chip may generate a first key based on AES (the key length may be 128 bits); or, the LA1 chip may generate a first key based on RSA (the key length may be 2048 bits).

[0067] The LA3 chip can generate a first key based on SHA-1, SHA-224, SHA-256, SHA-384 or SHA-512 (the key length can be 160 bits, 224 bits, 256 bits, 384 bits or 512 bits respectively); or, the LA3 chip can generate a first key based on AES (the key length can be 128 bits, 192 bits or 256 bits); or, the LA3 chip can generate a first key based on RSA (the key length can be 1024 bits, 2048 bits, 3072 bits or 4096 bits); or, the LA3 chip can generate a first key based on ECC (the key length can be 192 bits or 256 bits).

[0068] In response to a key generation request sent by a first application of the electronic device, a first key may be generated by a security hardware module of the electronic device.

[0069] If the electronic device has multiple first applications, each first application can send a key generation request respectively, and the security hardware module generates a first key for each first application respectively.

[0070] The first application of the electronic device may include but is not limited to: intelligent assistants, creative applications that support text generation, image generation, editing, etc., game applications, and educational applications, etc. These first applications can call local large models and personal knowledge graph data services to perform local data analysis and processing (PKG Service). The user interface of the first application can be used for the first application to interact with the user, such as the first application can obtain the user's input through the user interface.

[0071] It is understandable that the first application can be processed locally based on local computing resources of the electronic device.

[0072] Step S102: If the available value of the first storage space of the security hardware module does not meet the first preset threshold, determine a first target storage space from the first storage space; the first target storage space stores second data.

[0073] The security hardware module can store and manage the first key. The security hardware module can allocate a designated storage space for storing the first key. For example, the security hardware module can allocate a designated storage space of 8K Bytes, and the designated storage space of 8K Bytes can support the storage of 6 groups of first keys, 1 group of first keys is 1K Bytes, a total of 6K Bytes, and the remaining 2K Bytes can be used as an auxiliary expansion of the storage space other than 6K Bytes.

[0074] Of course, the security hardware module can also allocate the entire storage space of the security hardware module for storing the first key. It can be understood that using the entire storage space of the security hardware module for storing the first key does not mean that the entire storage space is only used to store the first key, but that the storage location of the first key is not limited to a specified storage space, as long as there is free storage space in the entire storage space, the free storage space can be used to store the first key.

[0075] The first storage space may be a part of the designated storage space. Figure 2 As shown, the size of the storage space allocated by the security hardware module for storing the first key is 8K Bytes, and the size of the first storage space can be 0 Bytes-6K Bytes. The size of the storage space between address 0x00-address 0x01 is 1K Bytes; the size of the storage space between address 0x01-address 0x02 is 1K Bytes; the size of the storage space between address 0x02-address 0x03 is 1K Bytes; the size of the storage space between address 0x03-address 0x04 is 1K Bytes; the size of the storage space between address 0x04-address 0x05 is 1K Bytes; the size of the storage space between address 0x05-address 0x06 is 1K Bytes; the size of the storage space between address 0x06-address 0x07 is 1K Bytes; the size of the storage space between address 0x07-address 0x08 is 1K Bytes.

[0076] The first preset threshold value can be set as needed and is not limited in this application. For example, the first preset threshold value can be 1K Bytes. If the available value of the first storage space of the security hardware module is 0 Bytes, that is, there is no free storage space in the first storage space of the security hardware module, the first target storage space can be determined from the first storage space.

[0077] The second data may include but is not limited to: a second key or other application data other than the second key. The second key may be a key generated by the security hardware module in response to a key generation request sent by the second application. The second application may be the same as the first application, or the second application may be different from the first application. For example, the security hardware module may generate a first key in response to a key generation request r1 sent by the first application A11 corresponding to the user identifier user0001; the second key may be generated by the security hardware module in response to a key generation request r2 sent by the first application A11 corresponding to the user identifier user0002 before responding to the key generation request r1, and the second key may be used to encrypt the local user data corresponding to the first application A11 corresponding to the user identifier user0002 to obtain encrypted local user data; or, the second key may be generated by the security hardware module in response to a key generation request r3 sent by the second application A22 corresponding to the user identifier user0002 before responding to the key generation request r1, and the second key may be used to encrypt the local user data corresponding to the second application A22 corresponding to the user identifier user0002 to obtain encrypted local user data.

[0078] Step S103: Process the second data based on the second storage space of the security hardware module so that the first target storage space can be used to store the first key; the processing includes encrypting the second data.

[0079] The corresponding second data may include an implementation method of a second key. By processing the second key, the first target storage space can be used to store the first key, and the second key is in an encrypted state.

[0080] After processing the second data in the first target storage space so that the first target storage space can be used to store the first data, it should be possible to obtain the encrypted second key when the corresponding second application needs it, and after decrypting the encrypted second key, return the second key to the corresponding second application. For example, the second key is generated in response to a key generation request r2 sent by the second application A22 corresponding to the user identifier user0002. After processing the second data in the first target storage space so that the first target storage space can be used to store the first data, it should be possible to return the second key to the second application A22 after decrypting the encrypted second key when the second application A22 needs the second key corresponding to the user identifier user0002, so that the second application A22 can decrypt the encrypted local user data corresponding to the user identifier user0002 based on the second key.

[0081] Step S104: save the first data in the first target storage space, where the first data includes a first key.

[0082] The first data may further include: at least one of a user identifier of an account owned by the first application, a storage status identifier, first authentication information, and usage attribute information of the first key.

[0083] The first application may have one or more accounts, each of which corresponds to a user identifier. The user identifier is used to distinguish different users of the first application. Even if multiple users use the same application, the multiple users can distinguish each other's data and operations through their respective user identifiers.

[0084] The storage status identifier can be used to indicate whether the first key has been stored in the secure hardware module.

[0085] The first authentication information can be used to protect the transmission of the first key. For example, in the key generation stage, the first application can call the local large model and the personal knowledge graph data service to randomly generate password p (i.e., an implementation method of the first authentication information). The first application can send a key generation request to the security hardware module. The key generation request includes a first parameter. The first parameter includes a user identifier and a password p corresponding to the user identifier. The security hardware module responds to the key generation request and generates a first key (AES Key) corresponding to the user identifier and password p. If the available value of the first storage space of the security hardware module does not meet the first preset threshold, the first target storage space is determined from the first storage space, and the second data in the first target storage space is processed so that the first target storage space can be used to store the first key, user identifier and password p, and the second data can be in an encrypted state.

[0086] In the user data generation or update stage, the first application may send a key acquisition request to the security hardware module, the key acquisition request may include a second parameter, the second parameter may include a user identifier and a password p, the security hardware module responds to the key acquisition request, and returns a first key corresponding to the user identifier in the key acquisition request when comparing the password p stored in the storage space of the security hardware module and the password p in the key acquisition request. The first application may encrypt the local user data of the electronic device based on the first key to obtain the encrypted user data;

[0087] After obtaining the encrypted user data, during the application loading phase, the first application may send a key acquisition request to the security hardware module. The key acquisition request may include a second parameter, which may include a user identifier and a password p. The security hardware module responds to the key acquisition request and, when comparing the password p already in the storage space of the security hardware module with the password p in the key acquisition request and finding that they are consistent, returns the first key corresponding to the user identifier in the key acquisition request. The first application may decrypt the encrypted user data based on the first key to obtain local user data of the electronic device.

[0088] For another example, in the key generation phase, the first application can call the local large model and personal knowledge graph data service to generate a first key pair (i.e., key pair (a, A)) based on ECDH encryption. The first application can send a key generation request to the security hardware module. The key generation request includes a first parameter, and the first parameter includes a user identifier and a first public key A corresponding to the user identifier. The security hardware module can respond to the key generation request, generate a first key (AESKey), generate a second key pair (i.e., key pair (b, B)) based on ECDH encryption, and generate a shared key bA of the security hardware module based on the first public key A and the second private key b (i.e., an implementation method of the first authentication information). If the available value of the first storage space of the security hardware module does not meet the first preset threshold, the first target storage space is determined from the first storage space, and the second data in the first target storage space is processed so that the first target storage space can be used to store the first key, the user identifier and the shared key bA, and the second data is in an encrypted state. The security hardware module returns the second public key B to the first application;

[0089] In the user data generation or update stage, the first application may send a key acquisition request to the security hardware module, the key acquisition request may include a second parameter, the second parameter may include a user identifier, the security hardware module responds to the key acquisition request, based on the shared key bA in the security hardware module corresponding to the user identifier in the key acquisition request, encrypts the first key to obtain the encrypted first key, and sends the encrypted first key to the first application; the first application may obtain the shared key aB based on the second public key B and the first private key a, decrypt the encrypted first key based on the shared key aB to obtain the first key, encrypt the local user data of the electronic device based on the first key to obtain the encrypted user data;

[0090] After obtaining the encrypted user data, in the application loading stage, the first application can send a key acquisition request to the security hardware module. The key acquisition request may include a second parameter, and the second parameter may include a user identifier. The security hardware module responds to the key acquisition request, encrypts the first key based on the shared key bA in the security hardware module corresponding to the user identifier in the key acquisition request, obtains the encrypted first key, and sends the encrypted first key to the first application; the first application can obtain the shared key aB based on the second public key B and the first private key a, decrypt the encrypted first key based on the shared key aB to obtain the first key; the first application can decrypt the encrypted user data based on the first key to obtain the local user data of the electronic device.

[0091] Among them, in the key pair (a, A), a is the first private key, A is the first public key, and A=aG.

[0092] In the key pair (b, B), b is the second private key, B is the second public key, and B=bG.

[0093] Shared key bA=baG, shared key aB=abG, that is, shared key bA=shared key aB.

[0094] In this embodiment, a first key is generated by responding to a key generation request sent by a first application of an electronic device. If the available value of the first storage space of the security hardware module does not meet the first preset threshold, a first target storage space is determined from the first storage space, and the first target storage space stores second data. The second data in the first target storage space is processed so that the first target storage space can be used to store the first data, and the risk of leakage of the second data can be reduced. On this basis, the first data is saved in the first target storage space, and the first data includes the first key, so that the security hardware module can store more keys to meet the needs of more accounts to encrypt local user data.

[0095] Furthermore, the storage method of storing the first data in the first target storage space can avoid moving a large amount of data in the first storage space, thereby reducing the complexity and time cost of storage operations.

[0096] As another optional embodiment of the present application, refer to Figure 3 , is a flow chart of a processing method of an electronic device provided in Example 2 of the present application. This embodiment is mainly an implementation method of step S103 in Example 1. Figure 3 As shown, step S103 may include but is not limited to the following steps:

[0097] Step S1031: Obtain a target key from the second storage space of the secure hardware module.

[0098] The second storage space may be a portion of a designated storage space allocated by the security hardware module. Figure 4 As shown, the size of the storage space allocated by the security hardware module for storing the first key is 8 KBytes, the address of the first storage space may be 0x00-0x06, and the address of the second storage space may be 0x07-0x08.

[0099] The second storage space may be used to store the target key.

[0100] Step S1032: Encrypt the second data based on the target key to obtain encrypted second data.

[0101] Step S1033: Migrate the encrypted second data to a backup module; the backup module is a local module of the electronic device other than the security hardware module.

[0102] The backup module may allocate a designated storage space for storing the encrypted second data migrated from the first storage space. For example, the backup module may allocate a designated storage space of 32K Bytes, and the designated storage space of 32K Bytes may support the storage of 32 sets of encrypted second data, and one set of encrypted second data is 1K Bytes. Figure 5 As shown, the address of the storage space specified in the backup module is 0x100-0x132. The size of the storage space between every two adjacent addresses is 1K Bytes.

[0103] In this embodiment, by using the target key in the security hardware module to encrypt the second data, the security of the second data can be improved. Migrating the encrypted second data to the backup module can effectively expand the available storage space, so that more keys can be securely stored.

[0104] In addition, storing the encrypted second data in the backup module can provide strong support for key recovery and disaster recovery. Once the data in the security hardware module is lost or damaged for various reasons, the backup module can be used to quickly restore the data, reducing the loss caused by data loss.

[0105] Although the security hardware module plays a vital role in ensuring data security, over-reliance on a single module can also bring potential risks. By migrating the encrypted secondary data to the backup module, the reliance on the security hardware module can be reduced, and the robustness and reliability of the entire data storage system can be improved.

[0106] In this embodiment, the processing method is introduced from the key generation stage, for example, Figure 6As shown, after creating local user data (which can be represented as PKG) of the electronic device, the generative AI application can ask the mainboard whether it supports the security hardware module (which can be represented as TAC); the mainboard can determine whether the TAC exists, and if so, feedback the existence of the TAC to the generative AI application; the generative AI application sends a key generation request to the TAC; if it does not exist, feedback the non-existence of the TAC to the generative AI application, and the generative AI application can generate a key and call the OS DPAPI to encrypt the key.

[0107] The TAC generates a first key in response to a key generation request sent by the generative AI application;

[0108] The TAC checks whether the available value of the first storage space does not meet the first preset threshold; if so, the TAC generates a target key and stores the target key in the second storage space; if not, the first key is stored in the first storage space;

[0109] The TAC determines a first target storage space from the first storage space;

[0110] The TAC encrypts the second data based on the target key, and migrates the encrypted second data to the backup module;

[0111] The first key is saved in the first target storage space.

[0112] As another optional embodiment of the present application, refer to Figure 7 , is a flow chart of a processing method of an electronic device provided in Example 3 of the present application, such as Figure 7 As shown, the method may include but is not limited to the following steps:

[0113] Step S201: In response to a key generation request sent by a first application of an electronic device, first data is obtained; the first data includes a first key, and the first key is used to encrypt local user data of the electronic device.

[0114] Step S202: If the available value of the first storage space of the security hardware module does not meet the first preset threshold, determine a first target storage space from the first storage space; the first target storage space stores second data.

[0115] The detailed process of steps S201-S202 can refer to the relevant introduction of steps S101-S102 in Example 1, which will not be repeated here.

[0116] Step S203: Acquire the target key from the second storage space of the security hardware module.

[0117] Step S204: Encrypt the second data based on the target key to obtain encrypted second data.

[0118] Step S205: Migrate the encrypted second data to a backup module; the backup module is a local module of the electronic device other than the security hardware module.

[0119] The detailed process of steps S203-S205 can refer to the relevant introduction of steps S1031-S1033 in Example 2, which will not be repeated here.

[0120] Step S206: Save the first data in the first target storage space, where the first data includes a first key.

[0121] Step S207: In response to the first key acquisition request sent by the first application, an identifier is acquired from the first key acquisition request. The identifier includes at least one of a user identifier and an application identifier.

[0122] In this embodiment, the electronic device may deploy one or more applications, and different applications may have different application identifiers. The application identifier of an application may be unique, and is used to uniquely represent the application in the electronic device.

[0123] Each application can have one or more accounts, and each account corresponds to a user ID. The user IDs under the same application can be used to distinguish different users of the application.

[0124] If an electronic device is deployed with an application, when a first key is generated, the first key and the user identification may be stored in association.

[0125] This associated storage may include the following two storage methods: the first storage method: storing the first key and the user identifier (i.e., the first data contains the first key and the user identifier) ​​in the first storage space at the same time; the second storage method: storing the first key (i.e., the first data contains the first key but does not contain the user identifier) ​​in the first storage space, and saving the corresponding relationship between the storage position of the first key in the first storage space and the user identifier in the association table. The association table may be saved in a storage space other than the designated storage space allocated for the storage of the first key in the security hardware module. For example, the designated storage space is 0x00-0x08, and the association table may be saved in a storage space other than 0x00-0x08 in the security hardware module.

[0126] Correspondingly, when the first data is encrypted and then migrated from the first storage space to the backup module, corresponding to the first storage method mentioned above, the first migration method is: migrating the user identifier and the encrypted first key to the backup module at the same time; corresponding to the second storage method mentioned above, the second migration method is: migrating the encrypted first key to the backup module, and updating the correspondence between the storage position of the first key in the first storage space and the user identifier in the association table to the correspondence between the storage position of the first key in the backup module and the user identifier.

[0127] Corresponding to the first storage mode, for example, the secure hardware module may generate a first key key11 in response to a key generation request r1 sent by the first application A11 corresponding to the user identifier user0001, such as Figure 8 As shown, the user identification user0001 and the first key key11 can be stored in 0x00-0x01 in the first storage space.

[0128] The security hardware module can generate a first key key12 in response to a key generation request r2 sent by the first application A11 corresponding to the user identifier user0002, such as Figure 8 As shown, the user identification user0002 and the first key key12 may be stored at 0x01-0x02 in the first storage space.

[0129] The security hardware module can generate a first key key13 in response to a key generation request r3 sent by the first application A11 corresponding to the user identifier user0003, such as Figure 8 As shown, the user identification user0003 and the first key key13 may be stored at 0x02-0x03 in the first storage space.

[0130] Corresponding to the second storage method, for example, the secure hardware module can generate a first key key11 in response to a key generation request r1 sent by the first application A11 corresponding to the user identifier user0001, such as Fig. 9 As shown, the first key key11 can be stored at 0x00-0x01 in the first storage space. Accordingly, referring to the association table, the corresponding relationship between the storage position of the first key key11 in the first storage space and the user identifier user0001 can be saved in the association table.

[0131] Relationship table

[0132]

[0133] The security hardware module can generate a first key key12 in response to a key generation request r2 sent by the first application A11 corresponding to the user identifier user0002, such as Fig. 9 As shown, the first key key12 can be stored in 0x01-0x02 in the first storage space. Accordingly, referring to the association table, the corresponding relationship between the storage position of the first key key12 in the first storage space and the user identifier user0002 can be saved in the association table.

[0134] Relationship table

[0135]

[0136] The security hardware module can generate a first key key13 in response to a key generation request r3 sent by the first application A11 corresponding to the user identifier user0003, such as Fig. 9 As shown, the first key key13 can be stored in 0x02-0x03 in the first storage space. Accordingly, referring to the association table, the corresponding relationship between the storage position of the first key key13 in the first storage space and the user identifier user0003 can be saved in the association table.

[0137] Relationship table

[0138]

[0139] For example, when there is no free storage space in the first storage space, if the encrypted first key key13 is migrated to the backup module, the storage location of the encrypted first key key13 in the backup module is 0x100-0x101, and the association table can be updated as follows:

[0140] Relationship table

[0141]

[0142] If the electronic device is deployed with multiple applications, when the first key is generated, the first key, the application identifier and the user identifier may be stored in association.

[0143] This associated storage may include the following two storage methods: the first storage method: storing the first key, application identifier and user identifier (i.e., the first data contains the first key, application identifier and user identifier) ​​in the first storage space at the same time; the second storage method: storing the first key (i.e., the first data contains the first key but does not contain the application identifier and the user identifier) ​​in the first storage space, and at the same time saving the corresponding relationship between the storage position of the first key in the first storage space, the application identifier and the user identifier in the association table. The association table may be saved in a storage space other than the designated storage space allocated for the storage of the first key in the security hardware module. For example, the designated storage space is 0x00-0x08, and the association table may be saved in a storage space other than 0x00-0x08 in the security hardware module.

[0144] Correspondingly, when the first data is encrypted and then migrated from the first storage space to the backup module, corresponding to the first storage method mentioned above, the first migration method is: migrating the application identifier, user identifier and encrypted first key to the backup module at the same time; corresponding to the second storage method mentioned above, the second migration method is: migrating the encrypted first key to the backup module, and updating the correspondence between the storage position of the first key in the first storage space, the application identifier and the user identifier in the association table to the correspondence between the storage position of the first key in the backup module, the application identifier and the user identifier.

[0145] Corresponding to the first storage mode, for example, the secure hardware module may generate a first key key11 in response to a key generation request r1 sent by the first application A11 corresponding to the user identifier user0001, such as Fig.10 As shown, the application identifier app0001, the user identifier user0001 and the first key key11 of the first application A11 can be stored in 0x00-0x01 in the first storage space.

[0146] The security hardware module can generate a first key key12 in response to a key generation request r2 sent by the first application A11 corresponding to the user identifier user0002, such as Fig.10 As shown, the application identifier app0001, the user identifier user0002 and the first key key12 of the first application A11 may be stored at 0x01-0x02 in the first storage space.

[0147] The security hardware module can generate a first key key21 in response to a key generation request r3 sent by the second application A22 corresponding to the user identifier user0001, such as Fig.10As shown, the application identifier app0002, the user identifier user0001 and the first key key21 of the second application A22 may be stored in 0x02-0x03 in the first storage space.

[0148] Corresponding to the second storage method, for example, the secure hardware module can generate a first key key11 in response to a key generation request r1 sent by the first application A11 corresponding to the user identifier user0001, such as Fig.11 As shown, the first key key11 can be stored at 0x00-0x01 in the first storage space. Accordingly, referring to the association table, the corresponding relationship between the storage position of the first key key11 in the first storage space, the application identifier app0001 of the first application A11 and the user identifier user0001 can be saved in the association table.

[0149] Relationship table

[0150]

[0151] The security hardware module can generate a first key key12 in response to a key generation request r2 sent by the first application A11 corresponding to the user identifier user0002, such as Fig.11 As shown, the first key key12 can be stored in 0x01-0x02 in the first storage space. Accordingly, referring to the association table, the corresponding relationship between the storage position of the first key key12 in the first storage space, the application identifier app0001 of the first application A11 and the user identifier user0002 can be saved in the association table.

[0152] Relationship table

[0153]

[0154] The security hardware module can generate a first key key21 in response to a key generation request r3 sent by the second application A22 corresponding to the user identifier user0001, such as Fig.11 As shown, key21 can be stored in 0x02-0x03 in the first storage space. Accordingly, referring to the association table, the corresponding relationship between the storage position of the first key key21 in the first storage space, the application identifier app0002 of the second application A22 and the user identifier user0003 can be saved in the association table.

[0155] Relationship table

[0156]

[0157] For example, when there is no free storage space in the first storage space, if the encrypted first key key21 is migrated to the backup module, the storage location of the encrypted first key key21 in the backup module is 0x100-0x101, and the association table can be updated as follows:

[0158] Relationship table

[0159]

[0160] Although the user identifiers corresponding to accounts of different applications may overlap, the application identifier and the user identifier can be uniquely matched to the first key by combining them.

[0161] Corresponding to an implementation mode in which an electronic device is deployed with one application, the first key acquisition request may include a user identifier.

[0162] Corresponding to an implementation mode in which a plurality of applications are deployed on the electronic device, the first key acquisition request may include an application identifier and a user identifier.

[0163] Step S208: searching the first storage space and the third storage space for the first key corresponding to the identifier; the third storage space is used to store the data obtained from the backup module.

[0164] In this embodiment, when a key acquisition request is received, the corresponding key can be first searched in the first storage space. If the key is not found in the first storage space, it can be searched in the backup module. If the key is found in the backup module, the encrypted key can be read from the backup module and decrypted based on the target key in the second storage space, and the decrypted key can be saved in the third storage space.

[0165] When the first key acquisition request of the first application is received, the third storage space may store the key previously read from the backup module, or the third storage space may be empty. However, since the first storage space and the third storage space may both store the key, in response to the first key acquisition request of the first application, the first key corresponding to the identifier may be searched in the first storage space and the third storage space.

[0166] Corresponding to the first storage method mentioned above, you can directly search the first storage space and the third storage space to see whether there is an identifier that matches the identifier in the first key acquisition request (that is, the user identifier; or, the application identifier and the user identifier). If so, the first key in the storage location where the matching identifier is located needs to be returned to the first application.

[0167] Corresponding to the second storage method mentioned above, you can first search the association table for a storage location corresponding to the identifier in the first key acquisition request (i.e., user identifier; or, application identifier and user identifier), and the first key in the storage location found is the first key that needs to be returned to the first application.

[0168] Step S209: If the first key corresponding to the identifier is found in the first storage space and the third storage space, the first key is returned to the first application.

[0169] Step S210: If the first key corresponding to the identifier is not found in the first storage space and the third storage space, the encrypted first data is obtained from the backup module based on the identifier.

[0170] Corresponding to the first storage method mentioned above, you can directly search in the backup module whether there is an identifier that matches the identifier in the first key acquisition request (i.e., user identifier; or, application identifier and user identifier). If so, the encrypted first data in the storage location where the matching identifier is located is the data that needs to be read.

[0171] Corresponding to the second storage method mentioned above, you can first search the association table for the storage location in the backup module corresponding to the identifier in the first key acquisition request (i.e., user identifier; or, application identifier and user identifier), and the encrypted first data in the storage location in the backup module found is the data that needs to be read.

[0172] Step S211: decrypt the encrypted first data based on the target key to obtain the first data.

[0173] Step S212: Return the first key included in the first data to the first application.

[0174] In this embodiment, in response to a first key acquisition request sent by a first application, an identifier is acquired from the first key acquisition request; the identifier includes at least one of a user identifier and an application identifier;

[0175] searching the first storage space and the third storage space for a first key corresponding to the identifier; the third storage space is used to store data obtained from the backup module;

[0176] If a first key corresponding to the identifier is found in the first storage space and the third storage space, the first key is returned to the first application;

[0177] In this embodiment, by using the target key in the security hardware module to encrypt the second data, the security of the second data can be improved. Migrating the encrypted second data to the backup module can effectively expand the available storage space, so that more keys can be securely stored.

[0178] When the first application needs to use the first key, if the first key corresponding to the identifier is not found in the first storage space and the third storage space, after obtaining the encrypted first data from the backup module, the encrypted first data can be decrypted based on the target key to obtain the first data, and the first key contained in the first data is returned to the first application, ensuring that the first application can obtain the first key at any time when needed to decrypt user data local to the electronic device.

[0179] In this embodiment, the processing method is introduced from the application loading stage, for example, Fig.12 As shown, after the generative AI application loads the application (PKG Load), it can ask the mainboard whether it supports the security hardware module (which can be expressed as TAC); the mainboard can determine whether the TAC exists, and if so, feedback to the generative AI application that the TAC exists; the generative AI application sends a key acquisition request to the TAC; if not, feedback to the generative AI application that the TAC does not exist, and the generative AI application can obtain the key previously generated by the generative AI application by calling DPAPI, and use the key to decrypt the encrypted user data;

[0180] The TAC responds to the key acquisition request sent by the generative AI application and obtains an identifier from the key acquisition request;

[0181] Searching for a first key corresponding to the identifier in the first storage space and the third storage space;

[0182] If present, the first key is returned to the generative AI application; the generative AI application may decrypt the encrypted user data based on the first key;

[0183] If it does not exist, obtain the target key from the second storage space;

[0184] Retrieving the encrypted first data from the backup module based on the identifier;

[0185] Decrypting the encrypted first data based on the target key to obtain the first data;

[0186] Returning a first key included in the first data to the generative AI application;

[0187] The generative AI application decrypts the encrypted user data based on the first key to obtain the user data local to the electronic device.

[0188] As another optional embodiment of the present application, refer to Fig.13 , is a flow chart of a processing method of an electronic device provided in Example 4 of the present application, such as Fig.13 As shown, the method may include but is not limited to the following steps:

[0189] Step S301: In response to a key generation request sent by a first application of an electronic device, first data is obtained; the first data includes a first key, and the first key is used to encrypt local user data of the electronic device.

[0190] Step S302: If the available value of the first storage space of the security hardware module does not meet the first preset threshold, determine a first target storage space from the first storage space; the first target storage space stores second data.

[0191] Step S303: Acquire the target key from the second storage space of the security hardware module.

[0192] Step S304: Encrypt the second data based on the target key to obtain encrypted second data.

[0193] Step S305: Migrate the encrypted second data to a backup module; the backup module is a local module of the electronic device other than the security hardware module.

[0194] Step S306: Save the first data in the first target storage space, where the first data includes a first key.

[0195] Step S307: In response to the first key acquisition request sent by the first application, an identifier is acquired from the first key acquisition request. The identifier includes at least one of a user identifier and an application identifier.

[0196] Step S308: searching the first storage space and the third storage space for the first key corresponding to the identifier; the third storage space is used to store the data obtained from the backup module.

[0197] Step S309: If the first key corresponding to the identifier is found in the first storage space and the third storage space, the first key is returned to the first application.

[0198] Step S310: If the first key corresponding to the identifier is not found in the first storage space and the third storage space, the encrypted first data is obtained from the backup module based on the identifier.

[0199] Step S311: decrypt the encrypted first data based on the target key to obtain the first data.

[0200] Step S312: Return the first key included in the first data to the first application.

[0201] The detailed process of steps S301-S312 can refer to the relevant introduction of steps S201-S212 in Example 3, which will not be repeated here.

[0202] Step S313: If the third storage space is not empty, overwrite the data in the third storage space with the first data.

[0203] The third storage space may be a portion of the designated storage space allocated by the security hardware module. The address of the third storage space and the address of the first storage space may be continuous. For example, Fig.14 As shown, the size of the storage space allocated by the security hardware module for storing the first key is 8K Bytes, the address of the first storage space may be 0x00-0x06, the address of the second storage space may be 0x07-0x08, and the address of the third storage space may be 0x06-0x07.

[0204] In this embodiment, the address of the third storage space and the address of the first storage space may be continuous. Storing the key in continuous address space may simplify data movement and processing logic, and achieve efficient access to the key.

[0205] Step S314: If the third storage space is empty, save the first data in the third storage space.

[0206] In this embodiment, after obtaining the encrypted first data from the backup module and decrypting the encrypted first data based on the target key, the first data can be stored in the third storage space, so that when a new key acquisition request is received later, the first storage space and the third storage space of the security hardware module can be searched first. If the key is found, the key is returned to the first application, which can improve the efficiency of the first application in obtaining the key. Fig.15 As shown, when a key generation request is received from the first application A11 corresponding to the user identifier user0003, if there is no free storage space in the first storage space, and the first key key13 can be encrypted, the encrypted first key key13 can be migrated to the backup module, and the storage location of the encrypted first key key13 in the backup module is 0x100-0x101.

[0207] If a key acquisition request is subsequently received from the first application A11 corresponding to the user identifier user0003, and there is no key corresponding to the user identifier user0003 in the first storage space and the third storage space, the encrypted first key key13 can be obtained from the backup module based on the user identifier user0003. After decrypting the encrypted first key key13 based on the target key in the second storage space, the first key key13 can be returned to the first application A11 and saved in the third storage space.

[0208] If the first application A11 subsequently receives a key acquisition request corresponding to the user identifier user0003, the first key key13 can be found in the third storage space based on the user identifier user0003, and the first key key13 can be returned to the first application A11.

[0209] As another optional embodiment of the present application, a processing method of an electronic device provided in Embodiment 5 of the present application may include but is not limited to the following steps:

[0210] Step S401: In response to a key generation request sent by a first application of an electronic device, first data is obtained; the first data includes a first key, and the first key is used to encrypt local user data of the electronic device.

[0211] Step S402: If the available value of the first storage space of the security hardware module does not meet the first preset threshold, determine a first target storage space from the first storage space; the first target storage space stores second data.

[0212] The detailed process of steps S401-S402 can refer to the relevant introduction of steps S101-S102 in Example 1, which will not be repeated here.

[0213] Step S403: Acquire the target key from the second storage space of the security hardware module.

[0214] Step S404: Encrypt the second data based on the target key to obtain encrypted second data.

[0215] Step S405: Migrate the encrypted second data to a backup module; the backup module is a local module of the electronic device other than the security hardware module.

[0216] The detailed process of steps S403-S405 can refer to the relevant introduction of steps S1031-S1033 in Example 2, which will not be repeated here.

[0217] Step S406: Save the first data in the first target storage space, where the first data includes a first key.

[0218] The detailed process of step S406 can refer to the relevant introduction of step S104 in embodiment 1, which will not be repeated here.

[0219] Step S407: If the available value of the backup module does not meet the second preset threshold, the second data meeting the first preset condition is deleted from the first storage space, and / or the encrypted second data meeting the second preset condition is deleted from the backup module.

[0220] The second preset threshold can be set as needed and is not limited in this application. For example, the second preset threshold can be 1K Bytes. If the available value of the backup module is 0 Bytes, that is, there is no free storage space in the backup module, the second data that meets the preset condition can be deleted from the first storage space, and the data encrypted after the second data that meets the preset condition is deleted from the backup module.

[0221] The second data satisfying the first preset condition may include but is not limited to:

[0222] The second data indicates that the duration of non-use is greater than a preset duration or the number of uses is less than a preset number of times.

[0223] The encrypted second data satisfying the second preset condition may include but is not limited to:

[0224] The encrypted second data is not used for a duration greater than a preset time period or is used less than a preset number of times.

[0225] In this embodiment, if the available value of the backup module does not meet the second preset threshold, it means that the storage space of the two-level secure storage composed of the secure hardware module and the backup module has become tight, which may affect the secure storage of data. In order to deal with this situation, the corresponding data can be deleted from the secure hardware module and / or the backup module to release storage space and ensure the stability of storage and the accessibility of data.

[0226] Step S408: If the available value of the backup module does not meet the second preset threshold, delete the second data that meets the first preset condition from the first storage space, and / or migrate the encrypted second data that meets the second preset condition in the backup module to the backup device associated with the security hardware module; the backup device is different from the electronic device.

[0227] The backup device can be cloud storage, external hard disk, etc., which is not limited in this application.

[0228] In this embodiment, if the available value of the backup module does not meet the second preset threshold, it means that the storage space of the two-level secure storage composed of the secure hardware module and the backup module has become tight, which may affect the secure storage of data. In order to deal with this situation, the corresponding data can be deleted from the secure hardware module, and / or the storage space of the backup module can be released with the help of the backup device to further expand the storage space to meet the needs of more accounts to encrypt local user data.

[0229] In this embodiment, step S407 and step S408 may be performed alternatively.

[0230] As another optional embodiment of the present application, a processing method of an electronic device is provided in Embodiment 6 of the present application. This embodiment is mainly an implementation method of the target key in Embodiment 2. The target key may include but is not limited to the following:

[0231] In this embodiment, the target key is generated corresponding to the first application of the electronic device and is unique to the first application of the electronic device.

[0232] The target key is generated corresponding to the first application of the electronic device, that is, in this embodiment, target keys can be generated respectively for different applications of the electronic device, so that each application has its own exclusive target key. This means that if the target key of an application is leaked or attacked, the data of other applications are still protected by their respective independent keys, thereby reducing the possibility of risk spread and enhancing storage security.

[0233] In this embodiment, the target key is pre-configured and is not unique to the first application of the electronic device.

[0234] The target key is pre-configured and is not unique to the first application of the electronic device. There is no need to generate and configure keys for each application separately, which can reduce the cost of key generation and management and the resources required for key generation and storage.

[0235] As another optional embodiment of the present application, a processing method of an electronic device is provided in Embodiment 7 of the present application. This embodiment is mainly an implementation method of determining the first target storage space from the first storage space in Embodiment 1. Determining the first target storage space from the first storage space may include but is not limited to:

[0236] A storage space corresponding to data satisfying a third preset condition is determined from the first storage space as a first target storage space.

[0237] The data satisfying the third preset condition may include but is not limited to at least one of the following:

[0238] S21, data showing that the duration of non-use is greater than a preset duration or the number of times of use is less than a preset number of times.

[0239] The preset duration and number of uses can be set accordingly as needed and are not limited in this application.

[0240] S22. Generate data whose time is earlier than a preset time value.

[0241] According to the setting of the preset time value, the data generated earlier than the preset time value may be one, such as the data with the earliest generation time; or the data generated earlier than the preset time value may be a batch of data with an earlier generation time.

[0242] S23. Data with a lower priority than the first application.

[0243] In this embodiment, the priorities of different applications are different from each other, and the storage space corresponding to the data with a higher priority is more stable. For example, the first application is application A11, and the data of application A22 and application A33 are stored in the first storage space. The priority of application A11 is higher than that of application A22, and the priority of application A33 is higher than that of application A11. Then the storage space corresponding to the data of application A22 in the first storage space can be used as the first target storage space.

[0244] In another embodiment, the security hardware module includes key data for a first application and key data for a second application, which can be comprehensively considered based on the priorities of the first application and the second application, as well as the attributes (time / number of times) of the key of the first application and the attributes (time / number of times) of the key of the second application. For example, for applications with lower priority, infrequently used keys among the keys corresponding to the applications will be used as data that meets the third preset condition.

[0245] Next, the processing device of the electronic device provided in the present application is introduced. The processing device of the electronic device introduced below and the processing method of the electronic device introduced above can refer to each other.

[0246] Reference Fig.16 The processing device of the electronic device includes: an obtaining module 100, a determining module 200, a first processing module 300 and a first saving module 400.

[0247] The obtaining module 100 is used to obtain first data in response to a key generation request sent by a first application of the electronic device; the first data includes a first key, and the first key is used to encrypt local user data of the electronic device.

[0248] The determination module 200 is used to determine a first target storage space from the first storage space if the available value of the first storage space of the security hardware module does not meet a first preset threshold; the first target storage space stores second data.

[0249] A first processing module 300, configured to process the second data based on the second storage space of the secure hardware module so that the first target storage space can be used to store the first key and other data; the processing includes encrypting the second data;

[0250] The first saving module 400 is used to save the first data in the first target storage space, where the first data includes the first key.

[0251] The first processing module 300 may be specifically used for:

[0252] Acquire a target key from a second storage space of the secure hardware module;

[0253] Encrypting the second data based on the target key to obtain encrypted second data;

[0254] The encrypted second data is migrated to a backup module; the backup module is a local module of the electronic device other than the security hardware module.

[0255] The processing device of the electronic device may further include:

[0256] A first acquisition module, configured to respond to a first key acquisition request sent by a first application and acquire an identifier from the first key acquisition request; the identifier includes at least one of a user identifier and an application identifier;

[0257] A search module, used to search the first key corresponding to the identifier in the first storage space and the third storage space; the third storage space is used to store the data obtained from the backup module;

[0258] A first returning module, configured to return the first key to the first application if a first key corresponding to the identifier is found in the first storage space and the third storage space;

[0259] a second acquisition module, configured to acquire the encrypted first data from the backup module based on the identifier if the first key corresponding to the identifier is not found in the first storage space and the third storage space;

[0260] a decryption module, configured to decrypt the encrypted first data based on the target key to obtain the first data;

[0261] The second returning module is used to return the first key included in the first data to the first application.

[0262] The processing device of the electronic device may further include:

[0263] an overwriting module, configured to overwrite the data in the third storage space with the first data if the third storage space is not empty;

[0264] The second saving module is used to save the first data in the third storage space if the third storage space is empty.

[0265] The processing device of the electronic device may further include:

[0266] a second processing module, configured to delete the second data satisfying the first preset condition from the first storage space if the available value of the backup module does not satisfy the second preset threshold, and / or delete the encrypted second data satisfying the second preset condition from the backup module;

[0267] A third processing module is used to delete the second data that meets the first preset condition from the first storage space if the available value of the backup module does not meet the second preset threshold, and / or migrate the encrypted second data that meets the second preset condition in the backup module to the backup device associated with the security hardware module; the backup device is different from the electronic device.

[0268] The target key may include one of the following:

[0269] The target key is generated corresponding to the first application of the electronic device and is unique to the first application of the electronic device;

[0270] The target key is pre-configured and is not unique to the first application of the electronic device.

[0271] The determination module 200 may be specifically used for:

[0272] A storage space corresponding to data satisfying a third preset condition is determined from the first storage space as a first target storage space.

[0273] In another embodiment of the present application, an electronic device is provided.

[0274] Electronic equipment may include:

[0275] A memory for storing at least one set of instructions;

[0276] The processor is used to call and execute the instruction set in the memory, and execute the processing method of the electronic device introduced in any one of embodiments 1-7 by executing the instruction set.

[0277] In another embodiment of the present application, a storage medium is provided, which carries one or more computer programs. When the one or more computer programs are executed by an electronic device, the electronic device can implement the processing method of the electronic device introduced in any one of embodiments 1-7.

[0278] It should also be noted that the device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed over multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the drawings of the device embodiments provided by the present application, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines.

[0279] Through the description of the above implementation mode, the technicians in the field can clearly understand that the present application can be implemented by means of software plus necessary general hardware, and of course, it can also be implemented by special hardware including special integrated circuits, special CPUs, special memories, special components, etc. In general, all functions completed by computer programs can be easily implemented by corresponding hardware, and the specific hardware structure used to implement the same function can also be various, such as analog circuits, digital circuits or special circuits. However, for the present application, software program implementation is a better implementation mode in more cases. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a readable storage medium, such as a computer floppy disk, a U disk, a mobile hard disk, a ROM, a RAM, a disk or an optical disk, etc., including a number of instructions to enable a computer device (which can be a personal computer, a training device, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0280] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments may be implemented in the form of a computer program product.

[0281] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website site, a computer, a training device, or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, training device, or data center. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a training device, a data center, etc. that includes one or more available media integrations. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)), etc.

Claims

1. A processing method of an electronic device, wherein the electronic device includes a security hardware module, the method comprising: In response to a key generation request sent by a first application of the electronic device, obtaining first data; The first data includes a first key, and the first key is used to encrypt local user data of the electronic device; If the available value of the first storage space of the secure hardware module does not meet a first preset threshold, determining a first target storage space from the first storage space; The first target storage space stores second data; Processing the second data based on the second storage space of the secure hardware module so that the first target storage space can be used to store the first key; the processing includes encrypting the second data; The first data is stored in the first target storage space, where the first data includes the first key.

2. The processing method of the electronic device according to claim 1, processing the second data based on the second storage space of the security hardware module, comprising: Acquire a target key from a second storage space of the secure hardware module; Encrypting the second data based on the target key to obtain encrypted second data; Migrating the encrypted second data to a backup module; The backup module is a local module of the electronic device except the security hardware module.

3. The electronic device processing method according to claim 2, further comprising: In response to a first key acquisition request sent by a first application, acquiring an identifier from the first key acquisition request; The identification includes at least one of a user identification and an application identification; searching the first storage space and the third storage space for a first key corresponding to the identifier; the third storage space is used to store data obtained from the backup module; If a first key corresponding to the identifier is found in the first storage space and the third storage space, the first key is returned to the first application; If the first key corresponding to the identifier is not found in the first storage space and the third storage space, obtaining the encrypted first data from the backup module based on the identifier; Decrypting the encrypted first data based on the target key to obtain the first data; The first key included in the first data is returned to the first application.

4. The electronic device processing method according to claim 3, further comprising: If the third storage space is not empty, overwriting the data in the third storage space with the first data; If the third storage space is empty, the first data is stored in the third storage space.

5. The method for processing an electronic device according to claim 2, further comprising: If the available value of the backup module does not meet the second preset threshold, deleting the second data that meets the first preset condition from the first storage space, and / or deleting the encrypted second data that meets the second preset condition from the backup module; If the available value of the backup module does not meet the second preset threshold, the second data that meets the first preset condition is deleted from the first storage space, and / or the encrypted second data that meets the second preset condition in the backup module is migrated to the backup device associated with the security hardware module; the backup device is different from the electronic device.

6. The processing method of the electronic device according to claim 2, wherein the target key comprises one of the following: The target key is generated corresponding to the first application of the electronic device and is unique to the first application of the electronic device; The target key is pre-configured and is not unique to the first application of the electronic device.

7. The processing method of the electronic device according to claim 1, determining the first target storage space from the first storage space comprises: A storage space corresponding to data satisfying a third preset condition is determined from the first storage space as a first target storage space.

8. A processing device of an electronic device, comprising: An obtaining module, configured to obtain first data in response to a key generation request sent by a first application of the electronic device; The first data includes a first key, and the first key is used to encrypt local user data of the electronic device; a determination module, configured to determine a first target storage space from the first storage space if the available value of the first storage space of the security hardware module does not meet a first preset threshold; The first target storage space stores second data; A first processing module, configured to process the second data based on the second storage space of the security hardware module, so that the first target storage space can be used to store other data of the first key; The processing includes encrypting the second data; The first saving module is used to save the first data in the first target storage space, where the first data includes the first key.

9. An electronic device, comprising: A memory for storing at least one set of instructions; The processor is used to call and execute the instruction set in the memory, and execute the processing method of the electronic device as described in any one of claims 1 to 7 by executing the instruction set.

10. A storage medium carrying one or more computer programs, which, when executed by an electronic device, enables the electronic device to implement the processing method of the electronic device as claimed in any one of claims 1 to 7.

Images