Processing method and device of electronic equipment, electronic equipment and storage medium

Abstract

The invention discloses a processing method and device of electronic equipment, the electronic equipment and a storage medium, and the method comprises the steps: obtaining at least one first secret key from at least one storage space of the electronic equipment in response to an encryption trigger event, and carrying out the identity feature authentication of at least one piece of identity feature data of a user, generating at least one second key; generating an encryption key based on the at least one first key and the at least one second key; based on the encryption key, encrypting local user data of the electronic equipment to obtain encrypted user data; the encrypted user data is used to cause an application of the electronic device to locally process in response to a user input to the application.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a processing method and device for an electronic device, an electronic device, and a storage medium. Background Art

[0002] With the continuous development of the Internet, users pay more and more attention to the data security of electronic devices. Therefore, how to protect the data of electronic devices has become a problem. Summary of the invention

[0003] The technical solution of this application is as follows:

[0004] The first aspect of the present application provides a processing method for an electronic device, comprising:

[0005] In response to an encryption trigger event, obtaining at least one first key from at least one storage space of the electronic device, and performing identity feature authentication on at least one identity feature data of a user to generate at least one second key;

[0006] generating an encryption key based on the at least one first key and the at least one second key;

[0007] Based on the encryption key, the local user data of the electronic device is encrypted to obtain encrypted user data; the encrypted user data is used to enable the application of the electronic device to perform local processing to respond to the user's input to the application.

[0008] At least one identity feature data of the user is obtained in at least one of the following ways:

[0009] Get the user ID and password entered by the user;

[0010] The user's biometrics are collected based on the biometrics collection device.

[0011] The at least one identity feature data is authenticated by at least one of the following methods:

[0012] authenticating the user identification and the password based on an account management server outside the electronic device;

[0013] The biometric feature is identified based on the biometric feature collection device.

[0014] Obtaining at least one first key from at least one storage space of an electronic device includes:

[0015] Acquire a first key stored in a security hardware module from a security hardware module of the electronic device, and / or acquire a first key stored in a target storage module from a target storage module of the electronic device, wherein the first key stored in the security hardware module is different from the first key stored in the target storage module;

[0016] The first key stored in the security hardware module is a first key generated by the security hardware module in response to a key generation request, and the first key stored in the target storage module is a first key generated by the application in response to a key generation request.

[0017] Generating an encryption key based on the at least one first key and the at least one second key includes at least one of the following:

[0018] Concatenate the at least one first key and the at least one second key in a set order to obtain an encryption key;

[0019] According to the authentication order of the at least one identity feature data, the at least one first key and the at least one second key are concatenated to obtain an encryption key;

[0020] Based on the at least one first key and the at least one second key, determine the input information of the data protection module of the operating system; input the input information to the data protection module so that the data protection module generates an encryption key based on the input information and the user authentication information of the operating system.

[0021] Determining input information of a data protection module of the operating system based on the at least one first key and the at least one second key includes any one of the following:

[0022] concatenating the at least one first key and the at least one second key, and using the concatenated key as input information of a data protection module of the operating system;

[0023] concatenating the at least one first key and the at least one second key to obtain a concatenated key;

[0024] The concatenated key is encrypted and used as input information of a data protection module of the operating system.

[0025] Generate at least one second key, including any of the following:

[0026] receiving an authentication result of the account management server authenticating the user identifier and the password, and generating at least one second key based on the authentication result;

[0027] A key generated by the account management server when the user identifier and the password pass identity authentication is received, and the received key is used as a second key.

[0028] Another aspect of the present application provides a processing method for an electronic device, comprising:

[0029] In response to the input information, obtaining at least one first key from at least one storage space of the electronic device, and performing identity feature authentication on at least one identity feature data of the user to generate at least one second key;

[0030] generating a decryption key based on the at least one first key and the at least one second key;

[0031] Decrypting the encrypted user data based on the decryption key to obtain local user data of the electronic device;

[0032] The input information is locally processed based on the local user data of the electronic device, so that the processed information corresponds to the local user data of the electronic device.

[0033] A third aspect of the present application provides a processing device, including:

[0034] an acquisition and generation module, configured to obtain at least one first key from at least one storage space of the electronic device in response to an encryption trigger event, and to perform identity feature authentication on at least one identity feature data of a user to generate at least one second key;

[0035] an encryption key generation module, configured to generate an encryption key based on the at least one first key and the at least one second key;

[0036] The encryption module is used to encrypt the local user data of the electronic device based on the encryption key to obtain encrypted user data; the encrypted user data is used to enable the application of the electronic device to perform local processing in response to the user's input to the application.

[0037] A fourth aspect of the present application provides an electronic device, including:

[0038] The security hardware module is used to store a first key generated by the security hardware module in response to the key generation request;

[0039] An identity feature collection device is used to collect identity feature data of a user and identify the identity feature data;

[0040] A target storage module, configured to store a first key generated by the application in response to the key generation request;

[0041] The processor is used to obtain at least one first key from the security hardware module and / or the target storage module, and obtain at least one second key obtained after identifying the identity feature data, and generate an encryption key based on the at least one first key and the at least one second key, and encrypt local user data of the electronic device based on the encryption key to obtain encrypted user data; the encrypted user data is used to enable the application to perform local processing in response to the user's input to the application. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale.

[0043] Figure 1 A flowchart of a processing method for an electronic device provided in Example 1 of the present application;

[0044] Figure 2 A schematic diagram of an implementation scenario of a processing method for an electronic device provided in this application;

[0045] Figure 3 A schematic diagram of another implementation scenario of a processing method for an electronic device provided in the present application;

[0046] Figure 4 A schematic diagram of another implementation scenario of a processing method for an electronic device provided in the present application;

[0047] Figure 5 A schematic diagram of another implementation scenario of a processing method for an electronic device provided in the present application;

[0048] Figure 6 A schematic diagram of another implementation scenario of a processing method for an electronic device provided in the present application;

[0049] Figure 7 A flowchart of a processing method for an electronic device provided in Example 7 of the present application;

[0050] Figure 8 A schematic diagram of the structure of a processing device provided in this application. DETAILED DESCRIPTION

[0051] The following describes the embodiments of the present application in conjunction with the drawings in the embodiments of the present application. The terms used in the implementation method section of the present application are only used to explain the specific embodiments of the present application, and are not intended to limit the present application.

[0052] The embodiments of the present application are described below in conjunction with the accompanying drawings. Those skilled in the art will appreciate that, with the development of technology and the emergence of new scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0053] The terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and need not be used to describe a specific order or sequential order. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances, which is only to describe the distinction mode adopted by the objects of the same attributes when describing in the embodiments of the present application. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, so that the process, method, system, product or equipment comprising a series of units need not be limited to those units, but may include other units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0054] At present, generative artificial intelligence (generative AI) applications on personal computers (PCs) generally provide services based on cloud computing power. The user data required by generative AI applications needs to be uploaded to the cloud, and generative AI applications process based on the user data in the cloud. However, in the process of uploading user data to the cloud, user data is easily intercepted or eavesdropped, and the security of user data is poor.

[0055] In order to improve the security of user data, this application proposes to deploy generative AI applications locally on electronic devices. Generative AI applications locally on electronic devices can generate user-customized content based on user data, thereby achieving the goal of not uploading user data to the cloud. This can improve the security of user data to a certain extent and eliminate users' security concerns about their personal data.

[0056] However, user data used by generative AI applications is generally obtained in the following way: user data from multiple locations of the PC (such as word documents, PPT documents, Excel documents, etc. in different locations) are collected and organized into a designated folder (wherein, the user may collect and organize user data from multiple locations of the PC into a designated folder; or, the generative AI application may collect and organize user data from multiple locations of the PC into a designated folder), and then, through the Embedding technology, the user data in the designated folder is generated into user data (such as structured relational data and structured vector data) that can be used by the generative AI application, so that the user data becomes part of the generative AI application. This method makes user data more centralized. If the generative AI application is maliciously copied by someone, the user data will be lost. In order to protect user data, the keys of each account of the generative AI application can be managed through the security hardware module of the electronic device, and the user data corresponding to each account can be encrypted using the keys of each account. However, these solutions still rely on the security of the operating system. For example, if an attacker obtains all privileged permissions of the operating system, the attacker may obtain the same resources and context as the local generated AI application of the electronic device, including the authentication information communicated with the security hardware module, to obtain the key stored in the security hardware module, resulting in the leakage of user data. Therefore, this application proposes a processing method for an electronic device to enhance the security of encrypting user data locally in the electronic device.

[0057] The present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0058] Reference Figure 1 , is a flow chart of a processing method for an electronic device provided in Example 1 of the present application. The method can be applied to electronic devices. The present application does not limit the product type of the electronic device. For example, Figure 1 As shown, the method may include but is not limited to the following steps:

[0059] Step S101: In response to an encryption triggering event, at least one first key is obtained from at least one storage space of an electronic device, and identity feature authentication is performed on at least one identity feature data of a user to generate at least one second key.

[0060] During the user data generation or update phase, an encryption trigger event can be generated. For example, whenever a user creates new user data or updates user data in an application (such as Xiaotian / AI now), the application can automatically trigger the encryption process. Alternatively, the user can also manually trigger an encryption event through the application interface (such as the application interface of Xiaotian / AI now) to instruct the application to encrypt the user data.

[0061] In this embodiment, at least one first key of an application of the electronic device may be stored in advance in at least one storage space locally in the electronic device. The management module of at least one storage space may save the correspondence between the at least one first key and the authentication information corresponding to the application in an association table. The authentication information corresponding to the application may be used to protect the transmission of the first key.

[0062] If at least one first key includes multiple keys, the authentication information corresponding to the application may include one key for authenticating the acquisition request of each of the multiple first keys. Alternatively, the authentication information corresponding to the application may include multiple keys, and the authentication information corresponding to each application is used to authenticate the acquisition request of each first key.

[0063] For example, an application of the electronic device may send a key acquisition request to a management module of at least one storage space in response to an encryption trigger event, and the key acquisition request includes authentication information. Accordingly, the management module of at least one storage space may compare the authentication information corresponding to the application in the association table with the authentication information in the key acquisition request to see if they are consistent, and if they are consistent, at least one first key in the at least one storage space may be returned to the application.

[0064] The authentication information corresponding to the application may be at least one of a user ID, a password, and identity feature data.

[0065] In this embodiment, at least one identity feature data of the user can be obtained at the same time, and at least one second key can be generated by performing identity feature authentication on the at least one identity feature data.

[0066] In the implementation mode where the authentication information corresponding to the application is identity feature data, the at least one identity feature data acquired in this step may be consistent with or inconsistent with the authentication information corresponding to the application. For example, the authentication information corresponding to the application may include: fingerprint features, and the at least one identity feature data acquired in this step may include: facial features. Alternatively, the authentication information corresponding to at least one first key may include: facial features, and the at least one identity feature data acquired in this step may include: facial features.

[0067] Even if the attacker obtains the authentication information corresponding to the application (such as facial features) through some means (such as attacking the operating system), the attacker still cannot directly use the authentication information corresponding to the application to collect the user's identity feature data in real time. This is because real-time collection usually requires the user's active participation (such as bringing the face close to the camera for recognition), which is beyond the control of the attacker. In addition, even if the attacker can simulate the user's identity feature data (such as deceiving the local face recognition system of the electronic device through photos or videos), the electronic device can prevent such deception through liveness detection technology.

[0068] In this embodiment, at least one second key may be generated based on at least one identity feature data authenticated by the identity feature; or, at least one second key may be generated based on setting data.

[0069] Step S102: Generate an encryption key based on at least one first key and at least one second key.

[0070] In this embodiment, at least one first key and at least one second key may be combined and the combined key may be used as an encryption key. Alternatively, at least one first key and at least one second key may be operated to obtain an encryption key.

[0071] In this embodiment, if the attacker does not obtain the permission of the operating system, the at least one first key cannot be obtained, and the attacker cannot collect the identity feature data of the user in real time, and cannot generate the at least one second key. Therefore, without the at least one first key and the at least one second key, the attacker cannot generate the encryption key.

[0072] Even if the attacker obtains the permission of the operating system, and obtains at least one first key by obtaining the authentication information corresponding to the application, the attacker still cannot collect the user's identity feature data in real time using the authentication information corresponding to the application. Therefore, even if the attacker obtains at least one first key, he cannot generate at least one second key, and further cannot generate an encryption key.

[0073] Step S103: Encrypt the local user data of the electronic device based on the encryption key to obtain encrypted user data; the encrypted user data is used to enable the application of the electronic device to perform local processing to respond to the user's input to the application.

[0074] Applications of electronic devices may include but are not limited to: intelligent assistants, creative applications that support text generation, image generation, editing, etc., game applications, and educational applications. These applications can call local large models and personal knowledge graph data services for local data analysis and processing (PKG Service). The user interface of the application of the electronic device can be used for interaction between the application and the user, for example, the application can obtain user input through the user interface.

[0075] It is understandable that the application of the electronic device can be processed locally based on the local computing resources of the electronic device.

[0076] In this embodiment, by responding to an encryption trigger event, obtaining at least one first key from at least one storage space of the electronic device, collecting at least one identity feature data of the user, generating at least one second key if at least one identity feature data passes the identity feature authentication, and generating an encryption key based on at least one first key and at least one second key, the security of the encryption process can be improved, making it difficult for an attacker to crack the encryption even if he obtains part of the information. In addition, by collecting at least one identity feature data of the user as the basis for generating the second key, the complexity of key generation and the strength of user identity verification are increased. Even if an attacker obtains the authentication information corresponding to the application by obtaining the permission of the operating system, he cannot collect the user's identity feature data in real time, and thus cannot generate the second key and the encryption key, making it impossible for the attacker to crack the encryption, which can enhance the security of encrypting user data locally in the electronic device.

[0077] As another optional embodiment of the present application, a processing method of an electronic device is provided in Embodiment 2 of the present application. This embodiment is mainly an implementation method of a method for obtaining at least one identity feature data of a user in Embodiment 1. The at least one identity feature data of a user can be obtained in at least one of the following ways:

[0078] Step S11: Obtain the user ID and password input by the user.

[0079] In this embodiment, in response to an encryption trigger event, the application of the electronic device may pop up an identity authentication interaction interface, and the user may enter a user ID and password in the identity authentication interaction interface. The identity authentication interaction interface is different from the login interface of the application. However, the user ID and password entered in the login interface and the identity authentication interaction interface may be consistent or inconsistent.

[0080] Even if an attacker obtains the permission of the operating system, if there is no attack method to capture sensitive information in real time, the attacker cannot obtain the user ID and password entered by the user when the user enters the user ID and password through the identity feature authentication interactive interface.

[0081] The user ID and password entered by the user may be authenticated.

[0082] Step S12: Collect the user's biometrics based on the biometrics collection device.

[0083] In this embodiment, in response to an encryption trigger event, an application of the electronic device may send a collection request to the biometric collection device, and accordingly, the biometric collection device may collect the user's biometrics.

[0084] The collected user's biometrics can be authenticated.

[0085] The biometric feature collection device may include but is not limited to: at least one of a fingerprint reader and a camera. The fingerprint reader can collect the user's fingerprint features. The camera can collect the user's facial features and iris features.

[0086] In this embodiment, if at least one of the user identification and password and the biometric feature input by the user passes the identity feature authentication, at least one second key can be generated. For example, assuming that the attacker has obtained the permission of the operating system, but has not deployed an attack method to capture sensitive information in real time, the user identification and password entered by the user during the identity feature authentication process are safe. Because the attacker cannot obtain this sensitive information in real time, it cannot pass the first line of defense of identity feature authentication.

[0087] Even if an attacker not only gains access to the operating system but also deploys an attack vector capable of capturing sensitive information in real time, attempting to steal that information as the user enters their user ID and password, the attacker still faces a second line of defense: biometric authentication.

[0088] Since biometric features (such as fingerprints, facial recognition, etc.) are difficult to copy and change in real time, even if an attacker obtains the user ID and password, they cannot collect the user's biometric data in real time. Therefore, even in a real-time capture environment, the attacker cannot pass the complete identity feature authentication process and cannot generate the second key.

[0089] In this embodiment, by combining multiple factors such as user identification, password and biometrics, a multi-level security protection system can be constructed to increase the difficulty for attackers to bypass identity authentication to obtain the second key and enhance the security of encrypting user data locally on the electronic device.

[0090] As another optional embodiment of the present application, a processing method of an electronic device provided in Embodiment 3 of the present application is mainly an implementation method of identity feature authentication of at least one identity feature data in Embodiment 2. The at least one identity feature data can be, but is not limited to, identity feature authentication in at least one of the following ways:

[0091] Step S21: authenticating the user ID and password based on an account management server outside the electronic device.

[0092] The account management server can be used to specifically manage and verify user account information. The account management server can store account information of various applications of the electronic device, such as user identification and password.

[0093] The application of the electronic device can send the user identification and password entered by the user to the account management server, and the account management server will compare the received user identification and password with the user information corresponding to the application stored by it to verify whether the user identification sent by the application exists and whether the password is correct, and obtain the authentication result.

[0094] The account management server may return the authentication result to the application of the electronic device. Alternatively, the account management server may generate a key when the user ID and password pass the identity authentication, and return the generated key to the application of the electronic device.

[0095] In this embodiment, the account management server generally has higher security and protection capabilities, and can resist various network attacks and intrusions. The reliability of identity authentication and the security of the second key generation can be guaranteed by performing identity authentication through the account management server.

[0096] Step S22: Identify the biometrics based on the biometrics collection device.

[0097] In step S22, the biometric collection device may compare the collected biometrics with a pre-stored biometric template. If the similarity between the biometrics exceeds a preset threshold, the biometric collection device may determine that the collected biometrics passes the identity feature authentication and obtain an identification result.

[0098] The biometric feature acquisition device may return the recognition result to the application of the electronic device. Alternatively, the biometric feature acquisition device may also return the recognition result and the authenticated biometric feature to the application of the electronic device.

[0099] Corresponding to step S21, generating at least one second key may include but is not limited to any of the following:

[0100] S31. Receive an authentication result of an account management server performing identity authentication on a user identifier and a password, and generate at least one second key based on the authentication result.

[0101] If the authentication result indicates that the identity feature authentication is passed, the application of the electronic device can generate a second key.

[0102] S32: Receive a key generated by the account management server when the user ID and password pass identity authentication, and use the received key as a second key.

[0103] After receiving the identification result, the application of the electronic device can generate a second key according to the set generation rule if the identification result is authenticated.

[0104] Corresponding to step S22, generating at least one second key may include but is not limited to any of the following:

[0105] Step S33: If the recognition result is that the identity feature authentication is passed, a second key is generated according to the setting data.

[0106] Step S34: If the recognition result is that the identity feature authentication is passed, a second key is generated based on the authenticated biometric feature.

[0107] Generating a second key based on the authenticated biometric feature may include but is not limited to at least one of the following:

[0108] Step S341: Perform hash processing on the authenticated biometric feature to obtain a hash value uniquely corresponding to the authenticated biometric feature.

[0109] Step S342: Perform key derivation processing on the hash value to obtain at least one key, and select one of the at least one keys as the second key.

[0110] In this embodiment, the biometrics collected by the biometric collection device are more difficult to copy or forge than traditional user names and passwords. Therefore, by identifying the biometrics through the biometric collection device, the security of identity authentication can be enhanced and the security of the second key generation can be ensured.

[0111] As another optional embodiment of the present application, a processing method of an electronic device is provided in Embodiment 4 of the present application. This embodiment is mainly an implementation method of obtaining at least one first key from at least one storage space of the electronic device in Embodiment 1. Obtaining at least one first key from at least one storage space of the electronic device may include but is not limited to the following steps:

[0112] Step S1011, obtaining a first key stored in a security hardware module from a security hardware module of the electronic device, and / or obtaining a first key stored in a target storage module from a target storage module of the electronic device, wherein the first key stored in the security hardware module is different from the first key stored in the target storage module.

[0113] The first key stored in the security hardware module is a first key generated by the security hardware module in response to a key generation request, and the first key stored in the target storage module is a first key generated by the application in response to the key generation request.

[0114] The application can send the same key generation request to the security hardware module and the target storage module, or send different key generation requests. For example, in the key generation stage, the application can call the local large model and personal knowledge graph data service to randomly generate password p (that is, an implementation method of the authentication information corresponding to the application). The application can send a key generation request to the security hardware module and / or the target storage module. The key generation request can include a user identifier and a password p corresponding to the user identifier. The security hardware module and / or the target storage module responds to the key generation request and generates a first key corresponding to the user identifier and password p and an identifier of the first key. The security hardware module and / or the target storage module returns the identifier of the first key to the application.

[0115] Alternatively, in the key generation phase, the application can call the local big model and personal knowledge graph data service to randomly generate password p (i.e., an implementation method of the authentication information corresponding to the application), and the application can send a key generation request to the security hardware module, which can include a user identifier and a password p corresponding to the user identifier. The security hardware module responds to the key generation request and generates a first key corresponding to the user identifier and password p and an identifier of the first key. The security hardware module returns the identifier of the first key to the application. Also, the application can send a key generation request to the target storage module, which can include a user identifier. The target storage module responds to the key generation request and generates a first key corresponding to the user identifier and an identifier of the first key. The target storage module returns the identifier of the first key to the application.

[0116] During the user data generation or update phase, the application may send a key acquisition request to the security hardware module and / or the target storage module. The key acquisition requests sent to the security hardware module and the target storage module may be the same or different. For example, the key acquisition request sent to the security hardware module and the target storage module may include the identifier of the first key and password p. The security hardware module and the target storage module respond to the key acquisition request and return the first key corresponding to the identifier of the first key in the security hardware module and the target storage module when comparing the password p stored in the storage space of the security hardware module and the target storage module and the password p in the key acquisition request and finding that they are consistent.

[0117] Alternatively, the key acquisition request sent to the security hardware module may include the identifier of the first key and password p. The security hardware module responds to the key acquisition request and, when comparing the password p stored in the storage space of the security hardware module and the password p in the key acquisition request, returns the first key corresponding to the identifier of the first key in the security hardware module. Also, the key acquisition request sent to the target storage module may include the identifier of the first key and the user identifier. The target storage module responds to the key acquisition request and, when comparing the user identifier stored in the storage space of the target storage module and the user identifier in the key acquisition request, returns the first key corresponding to the identifier of the first key in the target storage module.

[0118] For another example, during the key generation phase, the application can call the local large model and personal knowledge graph data service to generate a first key pair (i.e., key pair (a, A)) based on ECDH encryption. The application can send a key generation request to the security hardware module and / or the target storage module. The key generation request includes a user identifier and a first public key A corresponding to the user identifier. The security hardware module and / or the target storage module can respond to the key generation request, generate a first key and an identifier of the first key, generate a second key pair (i.e., key pair (b, B)) based on ECDH encryption, and generate a shared key bA (i.e., an implementation method of the authentication information corresponding to the application) of the security hardware module and / or the target storage module based on the first public key A and the second private key b. The security hardware module and / or the target storage module returns the identifier of the first key and the second public key B to the application;

[0119] During the user data generation or update stage, the application can send a key acquisition request to the security hardware module and / or the target storage module. The key acquisition request may include an identifier of the first key. The identifier of the first key responds to the key acquisition request, and the first key is encrypted based on the shared key bA in the identifier of the first key corresponding to the identifier of the first key in the key acquisition request to obtain the encrypted first key, and the encrypted first key is sent to the application; the application can obtain the shared key aB based on the second public key B and the first private key a, and decrypt the encrypted first key based on the shared key aB to obtain the first key.

[0120] After obtaining the encrypted user data, during the application loading phase, the application may send a key acquisition request to the security hardware module and / or the target storage module. The key acquisition request may include an identifier of the first key. The security hardware module and / or the target storage module responds to the key acquisition request, encrypts the first key based on the shared key bA in the security hardware module and / or the target storage module corresponding to the identifier of the first key in the key acquisition request, obtains the encrypted first key, and sends the encrypted first key to the application; the application may obtain the shared key aB based on the second public key B and the first private key a, decrypts the encrypted first key based on the shared key aB, and obtains the first key.

[0121] Among them, in the key pair (a, A), a is the first private key, A is the first public key, and A=aG.

[0122] In the key pair (b, B), b is the second private key, B is the second public key, and B=bG.

[0123] Shared key bA=baG, shared key aB=abG, that is, shared key bA=shared key aB.

[0124] In this embodiment, the security hardware module of the electronic device may be a chip with an encryption engine. The chip with the encryption engine may generate a first key based on an encryption algorithm. For example, the security hardware module of the electronic device may be an LA1 chip or a security hardware module. The LA1 chip may generate a first key based on SHA (Secure Hash Algorithm) (the key length may be 256 bits); or, the LA1 chip may generate a first key based on AES (the key length may be 128 bits); or, the LA1 chip may generate a first key based on RSA (the key length may be 2048 bits).

[0125] The security hardware module can generate a first key based on SHA-1, SHA-224, SHA-256, SHA-384 or SHA-512 (the key length can be 160 bits, 224 bits, 256 bits, 384 bits or 512 bits respectively); or, the security hardware module can generate a first key based on AES (the key length can be 128 bits, 192 bits or 256 bits); or, the security hardware module can generate a first key based on RSA (the key length can be 1024 bits, 2048 bits, 3072 bits or 4096 bits); or, the security hardware module can generate a first key based on ECC (the key length can be 192 bits or 256 bits).

[0126] In this embodiment, the processing method of the electronic device is described in combination with the security hardware module, the target storage module, the biometric collection device and the account management server included in the electronic device. Figure 2 As shown, the CPU of the electronic device executes the code of the generative AI application, and in response to an encryption trigger event, obtains the first key Keyshard1 from the security hardware module and the first key Key shard4 from the target storage module, and the first key Key shard4 is stored in the storage space of the generative AI application.

[0127] The generative AI application collects biometrics based on the biometric collection device. The biometric collection device identifies the biometrics and can return the identification result to the generative AI application. If the identification result indicates that the authentication is passed, the generative AI application can generate a second key Key shard3;

[0128] The generative AI application can obtain the user ID and password input by the user, and send the user ID and password input by the user to the account management server. The account management server can authenticate the user ID and password and return the authentication result to the generative AI application. If the authentication result is passed, the generative AI application can generate a second key Keyshard2. The generative AI application can generate an encryption key based on the first key Key shard1, the second key Key shard2, the second key Keyshard3 and the first key Key shard4.

[0129] The generative AI application can encrypt user data local to the electronic device based on the encryption key to obtain encrypted user data.

[0130] When the generative AI application needs it, the decryption key can be determined to decrypt the encrypted user data.

[0131] In this embodiment, by obtaining a first key from a security hardware module of an electronic device, the first key at the hardware level of the security hardware module can be used to generate an encryption key together with a second key, thereby improving the security of the encryption key. For example, application a local to PC A obtains a first key from security hardware module A of PC A, generates an encryption key based on the first key and the generated second key, and encrypts user data local to PC A based on the encryption key to obtain encrypted user data. If a user maliciously copies application a to PC B, the encrypted user data is also copied to PC B. Since PC B does not have security hardware module A, application a cannot obtain the first key in PC B, and thus cannot generate a decryption key, and cannot decrypt the encrypted user data, so that the user data of PC A is not leaked.

[0132] Furthermore, even on PC A, if an attacker successfully breaks into the operating system and tries to obtain user data, the attacker still cannot easily decrypt the data. This is because even if the attacker can obtain the first key from the secure hardware module A, they cannot collect the user's identity feature data in real time (which is required to generate the second key), so they still cannot generate the correct encryption key and cannot decrypt the user data.

[0133] Even if an attacker attacks the operating system on PC A and obtains the first key from the security hardware module, the attacker cannot collect the user's identity feature data in real time, cannot generate the second key, and cannot generate an encryption key, so user data cannot be leaked.

[0134] As another optional embodiment of the present application, a processing method of an electronic device is provided in Embodiment 5 of the present application. This embodiment is mainly an implementation of step S102 in Embodiment 1. Step S102 may include but is not limited to at least one of the following:

[0135] Step S1021: Concatenate at least one first key and at least one second key in a set order to obtain an encryption key.

[0136] The setting order can be set as needed and is not limited in this application. For example, at least one first key includes: a first key Key shard1 obtained from a security hardware module, a first key Keyshard4 obtained from a target storage module, and at least one second key includes: a second key Keyshard2 generated based on the authentication result of an account management server and a second key Key shard3 generated based on the recognition result of a biometric collection device. The setting order can be to first use Key shard1 provided by the security hardware module, followed by Keyshard2 generated based on the account management server, then Key shard3 generated based on the biometric collection device, and finally Keyshard4 provided by the target storage module. In this order, Key shard1, Key shard2, Key shard3 and Key shard4 are spliced ​​in sequence to generate an encryption key.

[0137] Alternatively, the setting order may be to first use Key shard1 provided by the security hardware module, followed by Key shard4 provided by the target storage module, then Key shard2 generated based on the account management server, and finally Key shard3 generated based on the biometric collection device. In this order, Key shard1, Key shard4, Key shard2, and Key shard3 are sequentially spliced ​​to generate an encryption key.

[0138] Step S1021 may include but is not limited to:

[0139] Step S10211: Concatenate at least one first key and at least one second key in a set order to obtain a concatenated key.

[0140] Step S10212: Hash the concatenated keys to obtain a hash value.

[0141] Step S10213: perform key derivation processing on the hash value to obtain an encryption key.

[0142] Step S1022: Concatenate at least one first key and at least one second key according to the authentication order of at least one identity feature data to obtain an encryption key.

[0143] In this embodiment, the authentication order of at least one identity feature data can affect the splicing order of each second key in at least one second key, the splicing order of at least one first key can be before or after at least one second key, and the splicing order of each first key in at least one first key is relatively fixed.

[0144] For example, if at least one first key may include: a first key Keyshard1 obtained from a security hardware module, a first key Key shard4 obtained from a target storage module, at least one second key may include: a second key Key shard2 generated based on the authentication result of an account management server and a second key Key shard3 generated based on the identification result of a biometric collection device. If the authentication order of at least one identity feature data is: firstly identify the biometric based on the biometric collection device, and then authenticate the user ID and password input by the user based on the account management server, then Key shard3, Key shard2, Key shard1 and Key shard4 are concatenated in sequence to obtain an encryption key. Alternatively, if the authentication order of at least one identity feature data is: firstly authenticate the user ID and password input by the user based on the account management server, and then identify the biometric based on the biometric collection device, then Key shard2, Key shard3, Key shard1 and Key shard4 are concatenated in sequence to obtain an encryption key.

[0145] Step S1022 may include but is not limited to:

[0146] Step S10221: Concatenate at least one first key and at least one second key according to the authentication order of at least one identity feature data to obtain a concatenated key.

[0147] Step S10222: Hash the concatenated keys to obtain a hash value.

[0148] Step S10223: Perform key derivation processing on the hash value to obtain an encryption key.

[0149] In this embodiment, the generation process of the encryption key is closely related to the authentication order of the identity feature data, so that even if an attacker obtains all the first keys and the second keys, it is difficult to determine the correct splicing order, thereby enhancing the security of the encryption process.

[0150] Step S1023: determine input information of a data protection module of the operating system based on at least one first key and at least one second key; input the input information to the data protection module so that the data protection module generates an encryption key based on the input information and user authentication information of the operating system.

[0151] In this embodiment, the data protection module can use the user ID and password of the operating system as the user authentication information of the operating system. The data protection module can also generate the user authentication information of the operating system (such as the key of the operating system) based on the user ID and password of the operating system. The user authentication information of the operating system can be managed by the operating system.

[0152] The data protection module may include but is not limited to: DPAPI (Data Protection API) encryption and decryption function module. Figure 3 As shown, if at least one first key may include: a first key Key shard1 obtained from a security hardware module, at least one second key may include: a second key Key shard2 generated based on an authentication result of an account management server and a second key Key shard3 generated based on an identification result of a biometric feature collection device. Based on Key shard1, Key shard2 and Key shard3, the input entropy of the DPAPI encryption and decryption function module may be determined, and the input entropy may be input to the DPAPI encryption and decryption function module, so that the DPAPI encryption and decryption function module generates an encryption key based on the input entropy and user authentication information of the operating system.

[0153] Or, if Figure 4As shown, if at least one first key may include: a first key Key shard1 obtained from a security hardware module, a first key Key shard4 obtained from a target storage module, and at least one second key may include: a second key Key shard2 generated based on an authentication result of an account management server and a second key Key shard3 generated based on an identification result of a biometric feature collection device. Based on Key shard1, Key shard2, Key shard3, and Key shard4, the input entropy of the DPAPI encryption and decryption function module may be determined, and the input entropy may be input to the DPAPI encryption and decryption function module, so that the DPAPI encryption and decryption function module generates an encryption key based on the input entropy and user authentication information of the operating system.

[0154] In this embodiment, when the data protection module of the operating system is used, the input information and the user authentication information of the operating system can be combined to generate a stronger encryption key. Even if an attacker can obtain the encrypted data, he needs to have both the correct user authentication information of the operating system and the input information to decrypt it, which can improve the security of user data.

[0155] As another optional embodiment of the present application, a processing method of an electronic device is provided in Embodiment 6 of the present application. This embodiment is mainly an implementation of step S1023 in Embodiment 5. Step S1023 may include but is not limited to any of the following:

[0156] Step S10231: concatenate at least one first key and at least one second key, and use the concatenated key as input information of a data protection module of the operating system.

[0157] Step S10232: concatenate at least one first key and at least one second key to obtain a concatenated key.

[0158] Step S10233: encrypt the concatenated key and use the encrypted key as input information of the data protection module of the operating system.

[0159] The encryption algorithm used to encrypt the concatenated key can be set as needed and is not limited in this application. For example, encrypting the concatenated key may include but is not limited to: performing hash processing on the concatenated key to obtain a hash value; or encrypting the concatenated key based on a symmetric key or an asymmetric key.

[0160] For example, Figure 5As shown, if at least one first key may include: a first key Key shard1 obtained from a security hardware module, at least one second key may include: a second key Key shard2 generated based on the authentication result of the account management server and a second key Key shard3 generated based on the recognition result of the biometric feature collection device. Key shard1, Key shard2 and Key shard3 may be concatenated to obtain a concatenated key, and the concatenated key may be hashed using a SHA-256 hash algorithm to obtain a hash value, and the hash value is used as the input entropy of the DPAPI encryption and decryption function module, and the input entropy is input to the DPAPI encryption and decryption function module, so that the DPAPI encryption and decryption function module generates an encryption key based on the input entropy and the user authentication information of the operating system.

[0161] like Figure 6 As shown, if at least one first key may include: a first key Key shard1 obtained from a security hardware module, a first key Key shard4 obtained from a target storage module of an application, at least one second key may include: a second key Key shard2 generated based on an authentication result of an account management server and a second key Key shard3 generated based on an identification result of a biometric feature acquisition device. Key shard1, Key shard2, Key shard3 and Key shard4 may be concatenated to obtain a concatenated key, and the concatenated key may be hashed using a SHA-256 hash algorithm to obtain a hash value, and the hash value is used as the input entropy of the DPAPI encryption and decryption function module, and the input entropy is input to the DPAPI encryption and decryption function module, so that the DPAPI encryption and decryption function module generates an encryption key based on the input entropy and the user authentication information of the operating system.

[0162] In this embodiment, at least one first key and at least one second key are concatenated to obtain a concatenated key, and the concatenated key is encrypted. The encrypted key is used as the input entropy of the data protection module of the operating system, which can ensure the confidentiality of the input entropy. When the data protection module of the operating system is used, the input information and the user authentication information of the operating system can be combined to generate a stronger encryption key. Even if the attacker can obtain the encrypted data, it is necessary to have the correct user authentication information and input information of the operating system at the same time to decrypt it, which can improve the security of user data. Even if the attacker obtains the input information by some means, due to the complexity and strength of the encryption algorithm used to obtain the input information, it is still difficult for the attacker to crack the original concatenated key. Therefore, even in the most unfavorable situation, user data can still be effectively protected.

[0163] As another optional embodiment of the present application, refer to Figure 7 , is a flow chart of a processing method of an electronic device provided in Example 7 of the present application, such as Figure 7 As shown, the method may include but is not limited to the following steps:

[0164] Step S201: In response to input information, at least one first key is obtained from at least one storage space of the electronic device, and identity feature authentication is performed on at least one identity feature data of the user to generate at least one second key.

[0165] In this application, there is no restriction on the type of input information. For example, the input information may be text information, voice information, picture information, or, if the application is a generative AI application, the input information may be a prompt word, and a prompt word extracted from the input information.

[0166] For the detailed process of this step, please refer to the relevant introduction about encryption in the above embodiment, which will not be repeated here.

[0167] Step S202: Generate a decryption key based on at least one first key and at least one second key.

[0168] For the detailed process of this step, please refer to the relevant introduction about encryption in the above embodiment, which will not be repeated here.

[0169] Step S203: decrypt the encrypted user data based on the decryption key to obtain the local user data of the electronic device.

[0170] Step S204: locally process the input information based on the local user data of the electronic device, so that the processed information corresponds to the local user data of the electronic device.

[0171] In this embodiment, in the scenario where the application is deployed locally on the electronic device, the local user data of the electronic device is encrypted and stored locally on the electronic device. On this basis, at least one first key can be obtained from at least one storage space of the electronic device in response to the input information, and at least one identity feature data can be authenticated to generate at least one second key. Based on the at least one first key and the at least one second key, a decryption key is generated. The encrypted user data of the local electronic device is decrypted based on the decryption key to obtain the local user data of the electronic device. The input information is locally processed based on the local user data of the electronic device so that the processed information corresponds to the local user data of the electronic device, which can better meet the user needs and improve the user experience. For example, corresponding to the implementation method of the generative AI application, the callable local model can include a callable large model (such as a Wenshengwen model, a Wenshengtu model, a voice model, a game model, etc.), and these models all use local user data to perform local data processing.

[0172] Generative AI applications may include but are not limited to: generative AI applications for office scenarios, generative AI applications for game scenarios, or generative AI applications for educational scenarios, etc.

[0173] For example, a personal knowledge graph data service for a generative AI application in an office scenario can obtain at least one first key and generate at least one second key, generate an encryption key based on at least one first key and at least one second key, and encrypt the first user data in the first designated folder of the electronic device based on the encryption key to obtain the encrypted first user data. The first user data in the first designated folder can be structured relational data and structured vector data determined based on user data such as word documents, PPT documents, Excel documents, and pictures collected and sorted from multiple locations of the electronic device.

[0174] When the first user data in the first designated file is encrypted, if the user enters the prompt word "Help me search for a Word document introducing Border Collies", the personal knowledge graph data service for generative AI applications in office scenarios can obtain at least one first key and generate at least one second key, generate a decryption key based on the at least one first key and the at least one second key, decrypt the first user data encrypted in the first designated folder based on the decryption key to obtain the first user data, search for a Word document introducing Border Collies in the first user data, and output the searched Word document introducing Border Collies.

[0175] Alternatively, if the user enters the prompt word "generate a photo of a dog", the personal knowledge graph data service of the generative AI application for office scenarios can obtain at least one first key and generate at least one second key, generate a decryption key based on at least one first key and at least one second key, and decrypt the first user data encrypted in the first designated folder based on the decryption key to obtain the first user data. Next, the generative AI application for office scenarios can call the local text graph model to perform personalized reasoning on the first user data and determine that there are multiple pictures of Border Collies in the first user data; based on this, the local text graph model can correct the prompt word "generate a photo of a dog" to "generate a picture of a Border Collie" to match the prompt word with the user's needs. The local text graph model can generate a picture of a Border Collie based on the new prompt word "generate a picture of a Border Collie".

[0176] Alternatively, if the user enters the prompt word "Help me generate a Word document introducing dogs", the personal knowledge graph data service of the generative AI application for office scenarios can obtain at least one first key and generate at least one second key, generate a decryption key based on at least one first key and at least one second key, and decrypt the first user data encrypted in the first designated folder based on the decryption key to obtain the first user data. Next, the generative AI application for office scenarios can call the local text graph model to perform personalized reasoning on the first user data, and determine that there are multiple pictures of Border Collies in the first user data; based on this, the local text graph model can correct the prompt word "Help me generate a Word document introducing dogs" to "Help me generate a Word document introducing Border Collies". The generative AI application for office scenarios can call the local text graph model to generate a Word document about the introduction of Border Collies based on the new prompt word "Help me generate a Word document introducing Border Collies".

[0177] For example, a personal knowledge graph data service for a generative AI application for a game scenario can obtain at least one first key and generate at least one second key, generate an encryption key based on the at least one first key and the at least one second key, and encrypt the second user data in the second designated folder of the electronic device based on the encryption key to obtain the encrypted second user data. The second user data in the second designated folder can be structured relational data and structured vector data determined based on game data collected and sorted from multiple games of the electronic device.

[0178] In the case where the second user data in the second designated file is encrypted, if the user enters the prompt "Share my game highlights with friend A" in the social software, the social software can input the prompt "Share my game highlights with friend A" to the generative AI application for the game scene, and the personal knowledge graph data service of the generative AI application for the game scene can obtain at least one first key and generate at least one second key, generate a decryption key based on at least one first key and at least one second key, and decrypt the encrypted second user data based on the decryption key to obtain the second user data. Then, the generative AI application for the game scene can call the local text graph model or the local game model based on the second user data to generate a video recording the game highlights.

[0179] For another example, a personal knowledge graph data service of a generative AI application for an educational scenario can obtain at least one first key and generate at least one second key, generate an encryption key based on the at least one first key and the at least one second key, and encrypt the third user data in the third designated folder of the electronic device based on the encryption key to obtain the encrypted third user data. The third user data in the third designated folder can be structured relational data and structured vector data determined based on wrong question data collected and sorted from multiple locations of the electronic device.

[0180] In the case where the third user data in the third designated file is encrypted, if the user inputs the prompt word "generate a mental arithmetic problem card" to the generative AI application for educational scenarios, the personal knowledge graph data service of the generative AI application for educational scenarios can obtain at least one first key and generate at least one second key, generate a decryption key based on at least one first key and at least one second key, and decrypt the encrypted third user data based on the decryption key to obtain the third user data. Then, the generative AI application for educational scenarios can call the local text model to perform personalized reasoning on the third user data, determine the mental arithmetic problems that are prone to errors, and generate a mental arithmetic problem card based on the mental arithmetic problems that are prone to errors.

[0181] The application uses a local large model, which can not only complete work tasks in an offline state, but also more conveniently integrate with the local knowledge base to generate more personalized works based on the user's style. At the same time, there is no need to transmit data to the cloud for processing, which greatly reduces the cost of use and response time, and provides users with reliable and secure personal data and privacy protection.

[0182] Next, the processing device provided in the present application is introduced. The processing device introduced below and the processing method of the electronic device introduced above can be referenced to each other.

[0183] Reference Figure 8The processing device may include: an acquisition and generation module 100, an encryption key generation 200 and an encryption module 300.

[0184] The acquisition and generation module 100 is used to obtain at least one first key from at least one storage space of the electronic device in response to an encryption trigger event, and to perform identity feature authentication on at least one identity feature data of the user to generate at least one second key.

[0185] The encryption key generation module 200 is used to generate an encryption key based on the at least one first key and the at least one second key.

[0186] The encryption module 300 is used to encrypt the local user data of the electronic device based on the encryption key to obtain encrypted user data; the encrypted user data is used to enable the application of the electronic device to perform local processing in response to the user's input to the application.

[0187] The at least one identity feature data of the user may be obtained in at least one of the following ways:

[0188] Get the user ID and password entered by the user;

[0189] The user's biometrics are collected based on the biometrics collection device.

[0190] The at least one identity feature data may be authenticated by at least one of the following methods:

[0191] authenticating the user identification and the password based on an account management server outside the electronic device;

[0192] The biometric feature is identified based on the biometric feature collection device.

[0193] The obtaining module 100 obtains at least one first key from at least one storage space of the electronic device, which may include:

[0194] Acquire a first key stored in a security hardware module from a security hardware module of the electronic device, and / or acquire a first key stored in a target storage module from a target storage module of the electronic device, wherein the first key stored in the security hardware module is different from the first key stored in the target storage module;

[0195] The first key stored in the security hardware module is a first key generated by the security hardware module in response to a key generation request, and the first key stored in the target storage module is a first key generated by the application in response to a key generation request.

[0196] The encryption key generation module 200 generates an encryption key based on the at least one first key and the at least one second key, which may include at least one of the following:

[0197] Concatenate the at least one first key and the at least one second key in a set order to obtain an encryption key;

[0198] According to the authentication order of the at least one identity feature data, the at least one first key and the at least one second key are concatenated to obtain an encryption key;

[0199] Based on the at least one first key and the at least one second key, determine the input information of the data protection module of the operating system; input the input information to the data protection module so that the data protection module generates an encryption key based on the input information and the user authentication information of the operating system.

[0200] The encryption key generation module 200 determines the input information of the data protection module of the operating system based on the at least one first key and the at least one second key, which may include any one of the following:

[0201] concatenating the at least one first key and the at least one second key, and using the concatenated key as input information of a data protection module of the operating system;

[0202] concatenating the at least one first key and the at least one second key to obtain a concatenated key;

[0203] The concatenated key is encrypted and used as input information of a data protection module of the operating system.

[0204] The obtaining and generating module 100 generates at least one second key, which may include any of the following:

[0205] receiving an authentication result of the account management server authenticating the user identifier and the password, and generating at least one second key based on the authentication result;

[0206] A key generated by the account management server when the user identifier and the password pass identity authentication is received, and the received key is used as a second key.

[0207] In another embodiment of the present application, an electronic device is provided, and the electronic device may include:

[0208] The secure hardware module is used to store a first key generated by the secure hardware module in response to a key generation request.

[0209] The identity feature collection device is used to collect the user's identity feature data and identify the identity feature data.

[0210] The identity feature collection device may include: at least one of an account management server and a biometric feature collection device.

[0211] The target storage module is used to store the first key generated by the application in response to the key generation request.

[0212] The processor is used to obtain at least one first key from the security hardware module and / or the target storage module, and obtain at least one second key obtained after identifying the identity feature data, and generate an encryption key based on the at least one first key and the at least one second key, and encrypt local user data of the electronic device based on the encryption key to obtain encrypted user data; the encrypted user data is used to enable the application to perform local processing in response to the user's input to the application.

[0213] In another embodiment of the present application, a storage medium is provided, which carries a computer program. When the computer program is executed by an electronic device, the electronic device can implement the processing method of the electronic device introduced in any one of Examples 1-6 or the processing method of the electronic device introduced in Example 7.

[0214] It should also be noted that the device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed over multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the drawings of the device embodiments provided by the present application, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines.

[0215] Through the description of the above implementation mode, the technicians in the field can clearly understand that the present application can be implemented by means of software plus necessary general hardware, and of course, it can also be implemented by special hardware including special integrated circuits, special CPUs, special memories, special components, etc. In general, all functions completed by computer programs can be easily implemented by corresponding hardware, and the specific hardware structure used to implement the same function can also be various, such as analog circuits, digital circuits or special circuits. However, for the present application, software program implementation is a better implementation mode in more cases. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a readable storage medium, such as a computer floppy disk, a U disk, a mobile hard disk, a ROM, a RAM, a magnetic disk or an optical disk, etc., including a number of instructions to enable a computer device (which can be a personal computer, a training device, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0216] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments may be implemented in the form of a computer program product.

[0217] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website site, a computer, a training device, or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, training device, or data center. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a training device, a data center, etc. that includes one or more available media integrations. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)), etc.

Claims

1. A method for processing an electronic device, comprising: In response to an encryption trigger event, obtaining at least one first key from at least one storage space of the electronic device, and performing identity feature authentication on at least one identity feature data of a user to generate at least one second key; generating an encryption key based on the at least one first key and the at least one second key; Based on the encryption key, the local user data of the electronic device is encrypted to obtain encrypted user data; the encrypted user data is used to enable the application of the electronic device to perform local processing to respond to the user's input to the application.

2. According to the processing method of the electronic device of claim 1, at least one identity feature data of the user is obtained by at least one of the following methods: Get the user ID and password entered by the user; The user's biometrics are collected based on the biometrics collection device.

3. The processing method of the electronic device according to claim 2, wherein the at least one identity feature data is authenticated by at least one of the following methods: authenticating the user identification and the password based on an account management server outside the electronic device; The biometric feature is identified based on the biometric feature collection device.

4. The processing method of the electronic device according to claim 1, obtaining at least one first key from at least one storage space of the electronic device, comprising: Acquire a first key stored in a security hardware module from a security hardware module of the electronic device, and / or acquire a first key stored in a target storage module from a target storage module of the electronic device, wherein the first key stored in the security hardware module is different from the first key stored in the target storage module; The first key stored in the security hardware module is a first key generated by the security hardware module in response to a key generation request, and the first key stored in the target storage module is a first key generated by the application in response to a key generation request.

5. The processing method of the electronic device according to claim 1, generating an encryption key based on the at least one first key and the at least one second key, comprising at least one of the following: Concatenate the at least one first key and the at least one second key in a set order to obtain an encryption key; According to the authentication order of the at least one identity feature data, the at least one first key and the at least one second key are concatenated to obtain an encryption key; Determining input information of a data protection module of the operating system based on the at least one first key and the at least one second key; The input information is input to the data protection module so that the data protection module generates an encryption key based on the input information and user authentication information of the operating system.

6. The processing method of the electronic device according to claim 5, wherein the input information of the data protection module of the operating system is determined based on the at least one first key and the at least one second key, comprising any one of the following: concatenating the at least one first key and the at least one second key, and using the concatenated key as input information of a data protection module of the operating system; concatenating the at least one first key and the at least one second key to obtain a concatenated key; The concatenated key is encrypted and used as input information of a data protection module of the operating system.

7. The processing method of the electronic device according to claim 3, generating at least one second key, comprising any one of the following: receiving an authentication result of the account management server authenticating the user identifier and the password, and generating at least one second key based on the authentication result; A key generated by the account management server when the user identifier and the password pass identity authentication is received, and the received key is used as a second key.

8. A method for processing an electronic device, comprising: In response to the input information, obtaining at least one first key from at least one storage space of the electronic device, and performing identity feature authentication on at least one identity feature data of the user to generate at least one second key; generating a decryption key based on the at least one first key and the at least one second key; Decrypting the encrypted user data based on the decryption key to obtain local user data of the electronic device; The input information is locally processed based on the local user data of the electronic device, so that the processed information corresponds to the local user data of the electronic device.

9. A processing device comprising: an acquisition and generation module, configured to obtain at least one first key from at least one storage space of the electronic device in response to an encryption trigger event, and to perform identity feature authentication on at least one identity feature data of a user to generate at least one second key; an encryption key generation module, configured to generate an encryption key based on the at least one first key and the at least one second key; The encryption module is used to encrypt the local user data of the electronic device based on the encryption key to obtain encrypted user data; the encrypted user data is used to enable the application of the electronic device to perform local processing in response to the user's input to the application.

10. An electronic device, comprising: The security hardware module is used to store a first key generated by the security hardware module in response to the key generation request; An identity feature collection device is used to collect identity feature data of a user and identify the identity feature data; A target storage module, configured to store a first key generated by the application in response to the key generation request; The processor is configured to obtain at least one first key from the security hardware module and / or the target storage module, and obtain at least one second key obtained after identifying the identity feature data, and generate an encryption key based on the at least one first key and the at least one second key, and encrypt local user data of the electronic device based on the encryption key to obtain encrypted user data; The encrypted user data is used to enable the application to perform local processing in response to the user's input to the application.

Images