Data access method, electronic equipment and chip system

Abstract

The invention provides a data access method, electronic equipment and a chip system, and relates to the technical field of data security, the method is applied to a data access scene of a subsystem application in a main system, a third-party application can be installed and run in the subsystem application, and the third-party application can access user data in a memory. When the third-party application accesses the user data in the memory, the secret key plaintext is obtained through the security secret key, and then the ciphertext of the user data stored in the memory is decrypted through the secret key plaintext to generate plaintext data of the user data. In the generation process of the security key, the DE key is generated after the security password provided by the security chip is used for encrypting the DE key, and the level of the security chip is higher than that of the main chip, so that the security of subsystem application access data in the main system can be improved.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to a data access method, electronic device and chip system. Background Art

[0002] Electronic devices have more and more functions, and people are becoming more and more dependent on them. When people use electronic devices, a lot of user data will be generated. In order to protect user privacy, many electronic devices provide subsystems in addition to the main system, which can serve as the user's privacy space.

[0003] At present, some subsystems exist in the form of applications, and can also be isolated from the data of the main system. Moreover, after the subsystem application is turned on, other applications that are the same as those of the main system (for example, instant messaging applications, video applications, etc.) can be installed and run in the subsystem application. However, since the subsystem exists in the form of an application, there is no lock screen password, which results in low security of user data in the subsystem. Summary of the invention

[0004] The present application provides a data access method, an electronic device and a chip system, which can improve the security of user data in a subsystem.

[0005] In order to achieve the above objectives, this application adopts the following technical solutions:

[0006] In a first aspect, the present application provides a data access method, which is applied to an electronic device including a main chip, a security chip and a memory, wherein the main chip includes a main system and a first TEE system, the main system includes a subsystem application, a system kernel and a control module of the memory, the subsystem application is installed with a first application, the system kernel stores a security key, and the memory stores ciphertext data of the first data, the method comprising:

[0007] After receiving the access request for the first data, the first application sends the access request to the system kernel;

[0008] After receiving the access request, the system kernel sends the security key to the first TEE system and sends the access request to the control module of the memory, wherein the security key is generated by encrypting the DE key by the first TEE system based on the security password, and the security password is generated by the security chip;

[0009] After receiving the security key, the first TEE system obtains a key plaintext based on the security key, and sends the key plaintext to the control module of the memory;

[0010] After receiving the access request sent by the system kernel and the key plaintext sent by the first TEE system, the control module of the memory generates plaintext data of the first data based on the key plaintext and the ciphertext data of the first data stored in the memory;

[0011] The control module of the memory sends the plaintext data of the first data to the system kernel;

[0012] After receiving the plaintext data of the first data, the system kernel sends the plaintext data of the first data to the first application.

[0013] In this application, a security password is generated by a security chip, and then the DE key is encrypted based on the security password to generate a security password. When there is a data access request, the master key of the user data in the encrypted storage space can be decrypted based on the security password. Therefore, it can be used in a subsystem where a lock screen password cannot be set and only the DE key is available to improve the security of the subsystem.

[0014] As an implementation of the first aspect, before the first application receives the access request for the first data, the method further includes:

[0015] The main system installs the subsystem application in the main system;

[0016] After the main system installs the subsystem application, the main system starts the subsystem application for the first time;

[0017] After the subsystem is started, installing the first application in the subsystem;

[0018] The subsystem starts the first application.

[0019] The subsystem in this application is an application in the main system space and running in the application layer of the main system. However, other applications can be installed and run in the subsystem. Therefore, this subsystem running in the application layer of the main system can save system resources and reduce the power consumption of the main system.

[0020] As an implementation of the first aspect, during the first startup of the subsystem application by the main system, the method further includes:

[0021] The subsystem application obtains a security password from the security chip;

[0022] The subsystem application sends the security password to the first TEE system;

[0023] After receiving the security password, the first TEE system encrypts the DE key stored in the first TEE based on the security password to generate a security key;

[0024] The first TEE system sends the security key to the system kernel;

[0025] After receiving the security key, the system kernel stores the security key in the system kernel.

[0026] In this application, the security password is generated by the security chip, which has higher security, and then the security password is sent to the first TEE system to encrypt the DE key, and the security level of the obtained security key is also higher. Therefore, the security of the user data of the subsystem can be improved.

[0027] As an implementation of the first aspect, the first TEE system obtaining the key plaintext based on the security key includes:

[0028] The first TEE system obtains the DE key based on the security password and the security key;

[0029] The first TEE system generates the key plaintext according to the DE key.

[0030] As the first TEE system that generates a security password, when there is data access, it can reversely generate a DE key based on the security password and the security key, and then generate a key plaintext for decrypting user data based on the DE key.

[0031] As an implementation of the first aspect, the main chip also includes a second TEE system, and the subsystem application obtains a security password from the security chip including:

[0032] The subsystem application sends a request for obtaining the security password to the second TEE system;

[0033] After receiving the acquisition request, the second TEE system sends the acquisition request for the security password to the security chip;

[0034] After receiving the acquisition request, the security chip generates the security password based on the acquisition request;

[0035] The security chip sends the security password to the second TEE system;

[0036] After receiving the security password, the second TEE system sends it to the subsystem application;

[0037] The subsystem application receives the security password.

[0038] In order to adapt to the communication and information interaction with the security chip, this application also sets up a second TEE system, which is modified without changing the original first TEE system.

[0039] As an implementation of the first aspect, before the second TEE system sends the request for obtaining the security password to the security chip, the method further includes:

[0040] The second TEE system performs a ROOT detection on the electronic device to determine that the electronic device is not ROOTed.

[0041] Since electronic devices are vulnerable to attacks after being ROOTed, in order to further improve security, the security password can only be obtained when it is not ROOTed.

[0042] As an implementation of the first aspect, the control module of the memory generates plaintext data of the first data based on the key plaintext and ciphertext data of the first data stored in the memory, including:

[0043] The control module of the memory acquires the ciphertext data of the first data from the memory based on the access request of the first data;

[0044] The control module of the memory decrypts the ciphertext data of the first data based on the key plaintext to generate the plaintext data of the first data.

[0045] As an implementation manner of the first aspect, the first TEE system and the second TEE system are the same TEE system.

[0046] In this application, the first TEE system is usually an execution environment that comes with the main chip platform and is at a higher level than the operating system. The second TEE system is an execution environment that is self-developed for adapting the various functions provided by the electronic device and is at a higher level than the operating system. These two execution environments can also exist as different modules in one execution environment.

[0047] In a second aspect, an electronic device is provided, comprising a main chip and a security chip, wherein the main chip and the security chip are used to run a computer program stored in a memory to implement any method of the first aspect of the present application.

[0048] In a third aspect, a chip system is provided, including a main chip, wherein the main chip is coupled to a memory, and the main chip executes a computer program stored in the memory to implement any method of the first aspect of the present application.

[0049] In a fourth aspect, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by one or more processors, the method of any one of the first aspects of the present application is implemented.

[0050] In a fifth aspect, an embodiment of the present application provides a computer program product, which, when executed on a device, enables the device to execute any one of the methods in the first aspect of the present application.

[0051] It can be understood that the beneficial effects of the second to fifth aspects mentioned above can be found in the relevant description of the first aspect mentioned above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 A schematic diagram of a hardware structure of an electronic device provided in an embodiment of the present application;

[0053] Figure 2 A schematic diagram of a process for generating and installing a DE key when an electronic device is powered on for the first time provided in an embodiment of the present application;

[0054] Figure 3 A flowchart of a data access method without a lock screen password provided in an embodiment of the present application;

[0055] Figure 4 A schematic diagram of a process for generating and installing a CE key when setting a lock screen password provided in an embodiment of the present application;

[0056] Figure 5 A flowchart of a data access method when there is a lock screen password provided in an embodiment of the present application;

[0057] Figure 6 A schematic diagram of a process for generating and installing a security key for a subsystem provided in an embodiment of the present application;

[0058] Figure 7 A schematic diagram of a process flow of a security key-based method provided in an embodiment of the present application;

[0059] Figure 8 A timing diagram for starting a secondary system provided in an embodiment of the present application;

[0060] Fig. 9 A timing diagram of a starter system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0061] In the following description, specific details such as specific system structures and technologies are provided for illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application can also be implemented in other embodiments without these specific details.

[0062] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or combinations thereof.

[0063] It should also be understood that in the embodiments of the present application, "one or more" refers to one, two or more than two; "and / or" describes the association relationship of associated objects, indicating that three relationships may exist; for example, A and / or B may represent: A exists alone, A and B exist at the same time, and B exists alone, where A and B may be singular or plural. The character " / " generally indicates that the associated objects before and after are in an "or" relationship.

[0064] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", "fourth", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0065] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0066] A data access method provided in an embodiment of the present application can be applied in an electronic device to improve the security of user data in the electronic device, and the electronic device can be a tablet computer, a mobile phone, a wearable device, a laptop computer, an ultra-mobile personal computer (UMPC), a netbook, a personal digital assistant (PDA), etc. The embodiment of the present application does not limit the specific type of the electronic device.

[0067] Figure 1The schematic diagram of the structure of an electronic device is shown. The electronic device 100 may include a processor 110, an external memory interface 120, an internal memory 121, a universal serial bus (USB) interface 130, a charging management module 140, a power management module 141, a battery 142, an antenna 1, an antenna 2, a mobile communication module 150, a wireless communication module 160, an audio module 170, a speaker 170A, a receiver 170B, a microphone 170C, an earphone interface 170D, a sensor module 180, a button 190, a motor 191, a camera 193, a display screen 194, and a subscriber identification module (SIM) card interface 195, etc. Among them, the sensor module 180 may include a pressure sensor 180A, a touch sensor 180K, an ambient light sensor 180L, etc.

[0068] It is to be understood that the structure illustrated in the embodiment of the present application does not constitute a specific limitation on the electronic device 100. In other embodiments of the present application, the electronic device 100 may include more or fewer components than shown in the figure, or combine some components, or split some components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0069] The processor 110 may include one or more processing units, for example: the processor 110 may include an application processor (application processor, AP), a modem processor, a graphics processor (graphics processing unit, GPU), an image signal processor (image signal processor, ISP), a controller, a memory, a video codec, a digital signal processor (digital signal processor, DSP), a coprocessor (sensor coprocessor, SCP), a baseband processor, and / or a neural-network processing unit (neural-network processing unit, NPU), etc. Among them, different processing units can be independent devices or integrated in one or more processors. For example, the processor 110 is used to execute the data access method in the embodiment of the present application.

[0070] The controller may be the nerve center and command center of the electronic device 100. The controller may generate an operation control signal according to the instruction operation code and the timing signal to complete the control of fetching and executing instructions.

[0071] The processor 110 may also be provided with a memory for storing instructions and data. In some embodiments, the memory in the processor 110 is a cache memory. The memory may store instructions or data that the processor 110 has just used or cyclically used. If the processor 110 needs to use the instruction or data again, it may be directly called from the memory. This avoids repeated access, reduces the waiting time of the processor 110, and thus improves the efficiency of the system.

[0072] The processor may be a main chip, or may include a main chip and a security chip.

[0073] The USB interface 130 is an interface that complies with USB standard specifications, and may specifically be a Mini USB interface, a Micro USB interface, a USB Type C interface, etc. The USB interface 130 may be used to connect a charger to charge the electronic device 100, and may also be used to transmit data between the electronic device 100 and a peripheral device.

[0074] It is understandable that the interface connection relationship between the modules illustrated in the embodiment of the present application is only a schematic illustration and does not constitute a structural limitation on the electronic device 100. In other embodiments of the present application, the electronic device 100 may also adopt different interface connection methods in the above embodiments, or a combination of multiple interface connection methods.

[0075] The external memory interface 120 can be used to connect an external memory card, such as a Micro SD card, to expand the storage capacity of the electronic device 100. The external memory card communicates with the processor 110 through the external memory interface 120 to implement a data storage function, such as storing music, video and other files in the external memory card.

[0076] The internal memory 121 can be used to store computer executable program codes, and the executable program codes include instructions. The processor 110 executes various functional applications and data processing of the electronic device 100 by running the instructions stored in the internal memory 121. The internal memory 121 may include a program storage area and a data storage area. Among them, the program storage area can store an operating system and an application required for at least one function (such as a sound playback function, an image playback function, etc.).

[0077] In addition, the internal memory 121 may include a high-speed random access memory and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, a universal flash storage (UFS), etc.

[0078] The charging management module 140 is used to receive charging input from a charger. The charger may be a wireless charger or a wired charger. In some wired charging embodiments, the charging management module 140 may receive charging input from the wired charger through the USB interface 130 .

[0079] The power management module 141 is used to connect the battery 142, the charging management module 140 and the processor 110. The power management module 141 receives input from the battery 142 and / or the charging management module 140 to power the processor 110, the internal memory 121, the external memory, the display screen 194, the camera 193, and the wireless communication module 160.

[0080] In some other embodiments, the power management module 141 may also be disposed in the processor 110. In some other embodiments, the power management module 141 and the charging management module 140 may also be disposed in the same device.

[0081] The wireless communication function of the electronic device 100 can be implemented through the antenna 1, the antenna 2, the mobile communication module 150, the wireless communication module 160, the modem processor and the baseband processor.

[0082] Antenna 1 and antenna 2 are used to transmit and receive electromagnetic wave signals. Each antenna in electronic device 100 can be used to cover a single or multiple communication frequency bands. Different antennas can also be reused to improve the utilization of antennas. For example, antenna 1 can be reused as a diversity antenna for a wireless local area network. In some other embodiments, the antenna can be used in combination with a tuning switch.

[0083] The mobile communication module 150 can provide solutions for wireless communications including 2G / 3G / 4G / 5G, etc., applied to the electronic device 100. The mobile communication module 150 may include at least one filter, a switch, a power amplifier, a low noise amplifier (LNA), etc. The mobile communication module 150 can receive electromagnetic waves from the antenna 1, and filter, amplify, etc. the received electromagnetic waves, and transmit them to the modulation and demodulation processor for demodulation. The mobile communication module 150 can also amplify the signal modulated by the modulation and demodulation processor, and convert it into electromagnetic waves for radiation through the antenna 1.

[0084] The wireless communication module 160 can provide wireless communication solutions including wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) networks), bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), infrared (IR), etc., which are applied to the electronic device 100. The wireless communication module 160 can be one or more devices integrating at least one communication processing module. The wireless communication module 160 receives electromagnetic waves via the antenna 2, modulates the frequency of the electromagnetic wave signal and performs filtering, and sends the processed signal to the processor 110. The wireless communication module 160 can also receive the signal to be sent from the processor 110, modulate the frequency of it, amplify it, and convert it into electromagnetic waves for radiation through the antenna 2.

[0085] In some embodiments, antenna 1 of electronic device 100 is coupled to mobile communication module 150, and antenna 2 is coupled to wireless communication module 160, so that electronic device 100 can communicate with the network and other devices through wireless communication technology.

[0086] The electronic device 100 can implement audio functions such as music playing and recording through the audio module 170, the speaker 170A, the receiver 170B, the microphone 170C, the headphone jack 170D, and the application processor.

[0087] The audio module 170 is used to convert digital audio signals into analog audio signals for output, and is also used to convert analog audio inputs into digital audio signals. The audio module 170 can also be used to encode and decode audio signals. In some embodiments, the audio module 170 can be arranged in the processor 110, or some functional modules of the audio module 170 can be arranged in the processor 110.

[0088] The speaker 170A, also called a "speaker", is used to convert an audio electrical signal into a sound signal. The electronic device 100 can listen to music or listen to a hands-free call through the speaker 170A.

[0089] The receiver 170B, also called a "earpiece", is used to convert audio electrical signals into sound signals. When the electronic device 100 receives a call or voice message, the voice can be received by placing the receiver 170B close to the human ear.

[0090] Microphone 170C, also called "microphone" or "microphone", is used to convert sound signals into electrical signals. When making a call or sending a voice message, the user can make a sound by approaching the microphone 170C with his mouth to input the sound signal into the microphone 170C. The electronic device 100 can be provided with at least one microphone 170C. In other embodiments, the electronic device 100 can be provided with two microphones 170C, which can not only monitor voice information but also realize noise reduction function. In other embodiments, the electronic device 100 can also be provided with three, four or more microphones 170C to realize the collection of sound signals, noise reduction, identification of sound sources, realization of directional recording functions, etc. The headphone jack 170D is used to connect wired headphones. The headphone jack 170D can be a USB interface 130, or it can be a 3.5mm open mobile terminal platform (OMTP) standard interface, or a cellular telecommunications industry association of the USA (CTIA) standard interface.

[0091] The pressure sensor 180A is used to sense the pressure signal and can convert the pressure signal into an electrical signal. In some embodiments, the pressure sensor 180A can be set on the display screen 194. There are many types of pressure sensors 180A, such as resistive pressure sensors, inductive pressure sensors, capacitive pressure sensors, etc. A capacitive pressure sensor can be a parallel plate including at least two conductive materials. When a force acts on the pressure sensor 180A, the capacitance between the electrodes changes. The electronic device 100 determines the intensity of the pressure based on the change in capacitance. When a touch operation acts on the display screen 194, the electronic device 100 detects the intensity of the touch operation based on the pressure sensor 180A. The electronic device 100 can also calculate the position of the touch based on the detection signal of the pressure sensor 180A.

[0092] The touch sensor 180K is also called a "touch panel". The touch sensor 180K can be set on the display screen 194, and the touch sensor 180K and the display screen 194 form a touch screen, also called a "touch screen". The touch sensor 180K is used to detect touch operations acting on or near it. The touch sensor can pass the detected touch operation to the application processor to determine the type of touch event. Visual output related to the touch operation can be provided through the display screen 194. In other embodiments, the touch sensor 180K can also be set on the surface of the electronic device 100, which is different from the position of the display screen 194.

[0093] The ambient light sensor 180L is used to sense the ambient light brightness. The electronic device 100 can adaptively adjust the brightness of the display screen 194 according to the perceived ambient light brightness. The ambient light sensor 180L can also be used to automatically adjust the white balance when taking pictures. The ambient light sensor 180L can also cooperate with the proximity light sensor 180G to detect whether the electronic device 100 is in a pocket to prevent accidental touches.

[0094] The key 190 includes a power key, a volume key, etc. The key 190 may be a mechanical key or a touch key. The electronic device 100 may receive key input and generate key signal input related to user settings and function control of the electronic device 100.

[0095] Motor 191 can generate vibration prompts. Motor 191 can be used for incoming call vibration prompts, and can also be used for touch vibration feedback.

[0096] The electronic device 100 implements the display function through a GPU, a display screen 194, and an application processor. The GPU is a microprocessor for image processing, which connects the display screen 194 and the application processor. The GPU is used to perform mathematical and geometric calculations for graphics rendering. The processor 110 may include one or more GPUs that execute program instructions to generate or change display information.

[0097] The display screen 194 is used to display images, videos, etc. The display screen 194 includes a display panel. The display panel can be a liquid crystal display (LCD), an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode or an active-matrix organic light-emitting diode (AMOLED), a flexible light-emitting diode (FLED), Miniled, MicroLed, Micro-OLED, a quantum dot light-emitting diode (QLED), etc. In some embodiments, the electronic device 100 may include 1 or N display screens 194, where N is a positive integer greater than 1.

[0098] The camera 193 is used to capture still images or videos. The object generates an optical image through the lens and projects it onto the photosensitive element. The photosensitive element can be a charge coupled device (CCD) or a complementary metal-oxide-semiconductor (CMOS) phototransistor. The photosensitive element converts the optical signal into an electrical signal, and then passes the electrical signal to the ISP to be converted into a digital image signal. The ISP outputs the digital image signal to the DSP for processing. The DSP converts the digital image signal into an image signal in a standard RGB, YUV or other format. In some embodiments, the electronic device 100 may include 1 or N cameras 193, where N is a positive integer greater than 1.

[0099] The SIM card interface 195 is used to connect a SIM card. The SIM card can be connected to and separated from the electronic device 100 by inserting it into the SIM card interface 195 or pulling it out from the SIM card interface 195. The electronic device 100 can support 1 or N SIM card interfaces, where N is a positive integer greater than 1. The SIM card interface 195 can support Nano SIM cards, Micro SIM cards, SIM cards, and the like. Multiple cards can be inserted into the same SIM card interface 195 at the same time. The types of the multiple cards can be the same or different. The SIM card interface 195 can also be compatible with different types of SIM cards. The SIM card interface 195 can also be compatible with external memory cards. The electronic device 100 interacts with the network through the SIM card to implement functions such as calls and data communications. In some embodiments, the electronic device 100 uses an eSIM, i.e., an embedded SIM card. The eSIM card can be embedded in the electronic device 100 and cannot be separated from the electronic device 100.

[0100] The embodiments of the present application do not particularly limit the specific structure of the execution subject of a data access method, as long as the code of a data access method of the embodiments of the present application can be run to communicate according to a data access method provided by the embodiments of the present application. For example, the execution subject of a data access method provided by the embodiments of the present application can be a functional module in an electronic device that can call and execute a program, or a communication device used in an electronic device, such as a main chip, or a chip module composed of a main chip and a security chip.

[0101] Currently, many electronic devices support rich execution environment (REE) and trusted execution environment (TEE).

[0102] The REE execution environment is usually used to run a general-purpose operating system, such as the Android system. The operating system provides basic functions and computing resources for installed applications. The REE execution environment can provide system security. However, due to the large size of the system, it is difficult to conduct comprehensive security inspections and certifications. Therefore, the REE execution environment is an open environment that is relatively vulnerable to attacks. In the embodiments of the present application, the REE execution environment can be equivalent to an operating system or a main system.

[0103] The TEE execution environment is a secure area on the central processor (main chip) used for digital rights management, mobile payment, and sensitive data protection. Sensitive data is processed in this secure area, thus being protected from software attacks from the REE execution environment. Typically, some key data can be stored in the TEE execution environment.

[0104] In order to improve the security of data in electronic devices, electronic devices can provide device encryption functions.

[0105] Reference Figure 2 , which is a schematic diagram of a process for generating and installing a DE key when the electronic device provided in an embodiment of the present application is powered on for the first time.

[0106] Typically, when an electronic device is turned on for the first time after leaving the factory (or turned on for the first time after restoring the factory settings), the electronic device will generate a master key for memory encryption. The user data stored in the memory of the electronic device is the data encrypted by the master key (the ciphertext data of the user data); the encrypted data stored in the memory can only be decrypted by the master key to obtain the decrypted data (the plaintext data of the user data). The electronic device will encrypt the master key according to the unique identification of the electronic device (for example, the device serial number) to obtain the DE key (Device Encryption master key) related to the hardware of the electronic device. The DE key is generated by KeyMasterTA in the TEE execution environment and stored in the system kernel.

[0107] Reference Figure 2 As shown, a user layer, a kernel layer and a hardware layer are set in the main system of the main chip. In the embodiment of the present application, there is also a TEE execution environment (which can be recorded as a first TEE execution environment or a first TEE system) provided by the main chip.

[0108] The user layer includes an application layer and an application framework layer. There are multiple upper layer applications in the application layer. The embodiment of the present application takes application 1 and a lock screen application in the main system as examples. In actual applications, there may be more applications in the application layer, and of course, there may be no lock screen application.

[0109] In the application framework layer, there are UserManager, StorageManager and VOID. UserManager is a user management class, which is a user management tool that can manage different users on electronic devices, such as the main system (main user). StorageManager is a software or system service that improves data reliability by managing the storage resources of electronic devices. VOID can implement the key process.

[0110] At the kernel level there are Fscrypt and Keyring.

[0111] Fscrypt is a general file system encryption module that supports F2FS / ext4 file systems.

[0112] Keyring can store keys.

[0113] As an example of the process of generating a DE key and storing the DE key in the system kernel:

[0114] When the electronic device is powered on for the first time, the UserManager sends an instruction to the StorageManager to prepare the user storage space.

[0115] After receiving the instruction, StorageManager sends an instruction to VOID to prepare user storage space.

[0116] After receiving the instruction to prepare the user storage space, VOID requests KeyMasterTA in the first TEE execution environment to create a DE key for the storage space.

[0117] KeyMasterTA in the first TEE execution environment creates a master key, and then encrypts the master key based on the unique identifier of the electronic device to generate a DE key.

[0118] After this step, the KeyMasterTA in the first TEE execution environment generates and stores the DE key.

[0119] After VOID obtains the DE key from KeyMasterTA, it saves the DE key in Keyring through Fscrypt.

[0120] At this point, the DE key is saved in the system kernel's Keyring.

[0121] After the DE key is saved in the Keyring, the user may store user data in the memory during the subsequent use of the electronic device. As an example, pictures taken by the user using the camera of the electronic device, files received by the user through the instant messaging application, etc. These user data are all encrypted by the master key maser key when stored in the memory. When the user needs to view this data, the ciphertext data of the user data stored in the memory needs to be decrypted by the master key to generate the plaintext data of the user data, so that the user can view this user data. In addition, when decrypting the ciphertext data of the user data in the memory, the master key used is the key plaintext generated by reversely generating the DE key stored in the Keyring.

[0122] Reference Figure 3 The flowchart shown in the illustrated embodiment is a data access method based on DE key decryption.

[0123] At the kernel level there are F2FS / ext4, Blockcrypto and UFSDriver.

[0124] F2FS (Flash-Friendly File System) and ext4 are both file systems. Blockcrypto is used to transmit access requests to the lower layer and transmit plain text data of user data to the upper layer. UFSDriver is a storage driver of the UFS type.

[0125] Among them, the access request transmitted by the upper-layer application can be received by F2FS / ext4 in the kernel layer, and then transmitted to UFSDriver through Blockcrypto.

[0126] There are also KeyslotManager, UFScrypto and Commoncryptolib at the kernel level.

[0127] Among them, KeyslotManager acts as a key manager bridge between the VFS layer and the storage driver layer in the system kernel, and can transmit keys between the VFS layer and the storage driver.

[0128] UFScrypto can implement a variety of features to provide differentiated solutions for electronic device manufacturers.

[0129] Commoncryptolib is used to communicate with the TZ ICE Driver in the first TEE execution environment.

[0130] UFScrypto can transfer the DE key transmitted to the storage driver layer to the TZ ICE Driver in the first TEE execution environment through Commoncryptolib for decryption to obtain the key plaintext.

[0131] At the hardware layer, there are a UFS control module and a UFS physical memory, in which the ciphertext data of the user data is stored.

[0132] The UFS control module is used to decrypt the ciphertext data of the accessed user data, and of course, is also used to encrypt the plaintext data to be stored in the physical memory before storing it.

[0133] As an example of a data access method based on DE key decryption:

[0134] When a user opens application 1 (for example, a gallery, file management, etc.), and the user opens the gallery to view pictures in the gallery (it can also be when the user opens a file management application to view stored files, or when the user sends data stored in the local memory to a friend through an instant messaging application), application 1 receives a request to access the data. For ease of description, the access data corresponding to this access request can be recorded as data A.

[0135] Application 1 sends the access request to F2FS / ext4 of the system kernel layer.

[0136] After receiving the access request, F2FS / ext4 in the system kernel layer sends messages to the two branches.

[0137] The first branch: F2FS / ext4 transmits the access request to the lower layer, and the access request is transmitted to the HW ICE of the hardware layer through BlockCrypto and UFSDriver; HW ICE, as the control module of the physical memory in the hardware layer, can obtain the ciphertext data of data A pointed to by the access request from the memory (that is, the encrypted data encrypted by the master key).

[0138] The second branch: F2FS / ext4 transmits a decryption request to Fscrypt; after receiving the decryption request, Fscrypt transmits the decryption request to Keyring; after receiving the decryption request, Keyring transmits the stored DE key to the TZ ICEDriver in the first TEE execution environment through KeyslotManager, UFScrypto, and Commoncryptolib. As mentioned above, the DE key is generated by KeyMasterTA in the first TEE execution environment, so the TZ ICE Driver in the first TEE execution environment can decrypt based on the previous encryption process to obtain the master key (key master) before encrypting and generating the DE key, which can also be understood as the key plaintext. The TZ ICEDriver in the first TEE execution environment sends the generated key plaintext to the HW ICE in the control module of the memory.

[0139] After the first branch and the second branch are completed, HW ICE has obtained the ciphertext data of data A corresponding to the access request and the master key for encrypting the plaintext data of the user data; therefore, HW ICE can decrypt the ciphertext data of data A based on the master key to generate the plaintext data of data A (that is, the decrypted data of the user data).

[0140] HW ICE transmits the plaintext data of data A to the upper layer, and then transmits it to application 1 after passing through UFSDriver, BlockCrypto, and F2FS / ext4. The user can view the plaintext data of data A corresponding to the access request through application 1.

[0141] It can be understood from this data access method of DE key decryption that when electronic device A is damaged (for example, it cannot be turned on, but the memory is intact), the memory of electronic device A (for example, memory A) can be removed and installed on another electronic device B for use. The key plaintext obtained by the TEE execution environment of another electronic device B decrypting the DE key on the other electronic device B is the key plaintext B of the other electronic device B, rather than the key plaintext A of the memory A of the electronic device. Therefore, the HW ICE in the memory A cannot decrypt the user data encrypted by the key plaintext A in the memory A through the key plaintext B. Therefore, the security of the user data in the memory can be improved.

[0142] However, with this encryption method, if electronic device A can be used normally but is lost, other users can also turn on electronic device A, and after turning on electronic device A, they can directly access the user data in the memory through the above method, resulting in the security of the user data in the memory still being low.

[0143] Therefore, in order to improve the security of user data in the memory, many electronic devices are set with a lock screen password. The lock screen password is used to open the system corresponding to the lock screen password when the screen is locked. For example, when the main chip of the electronic device only has the main system, the lock screen password is the password for entering the main system when the electronic device is in the locked screen state.

[0144] Reference Figure 4 , which is a flow chart of generating and installing a CE key when setting a lock screen password provided in an embodiment of the present application.

[0145] Typically, a user inputs a lock screen password based on a lock screen password setting interface of a lock screen application, and the electronic device can generate and store a CE key based on the lock screen password input by the user.

[0146] Reference Figure 4 As shown, when the user enters the lock screen password in the lock screen password setting interface of the lock screen application of the electronic device, and each subsequent time the user enters the main system through the lock screen password, the subsequent operations are performed:

[0147] The lock screen application at the application layer transmits the lock screen password entered by the user to KeyMasterTA in the first TEE execution environment through StorageManager and VOID.

[0148] KeyMasterTA in the first TEE execution environment encrypts the DE key based on the lock screen password, generates the CE key, and stores it.

[0149] After VOID obtains the CE key from KeyMasterTA, it saves the CE key in Keyring through Fscrypt.

[0150] At this point, the CE key is saved in the system kernel's Keyring.

[0151] After the CE key is saved in the Keyring, the user may store user data in the memory and may access the user data stored in the memory during the subsequent use of the electronic device. The data stored in the memory is still stored after being encrypted by the master key, that is, regardless of whether there is a lock screen password or not, the user data stored in the memory is encrypted by the master key. However, when there is no lock screen password, the master key is obtained by decrypting according to the DE key. When there is a lock screen password, the DE key is decrypted according to the CE key, and then the master key is decrypted by the DE key. Since there is a lock screen password, the CE key must first be decrypted with the lock screen password to obtain the DE key, and then the DE key is decrypted to obtain the master key. Compared with the data access method of the DE key without a lock screen password, data security is improved, and the process of reversely generating the DE key from the CE key requires the lock screen password parameters. Therefore, even if the user's electronic device is lost, there is an extra layer of lock screen password protection, which improves data security.

[0152] Reference Figure 5 The flowchart shown in the illustrated embodiment is a data access method based on CE key decryption.

[0153] When a user opens application 1 (for example, a gallery, file management, etc.), and the user opens the gallery to view pictures in the gallery (it can also be when the user opens a file management application to view stored files, or when the user sends data stored in the local memory to a friend through an instant messaging application), application 1 receives a request to access the data. For ease of description, the access data corresponding to this access request can be recorded as data A.

[0154] Application 1 sends the access request to F2FS / ext4 of the system kernel layer.

[0155] After receiving the access request, F2FS / ext4 in the system kernel layer sends messages to the two branches.

[0156] The first branch: F2FS / ext4 transmits the access request to the lower layer, and the access request is transmitted to the HW ICE of the hardware layer through BlockCrypto and UFSDriver; HW ICE, as the control module of the physical memory in the hardware layer, can obtain the ciphertext data of data A pointed to by the access request from the memory (that is, the encrypted data encrypted by the master key).

[0157] The second branch: F2FS / ext4 transmits a decryption request to Fscrypt; after receiving the decryption request, Fscrypt transmits the decryption request to Keyring; after receiving the decryption request, Keyring transmits the stored CE key to the TZ ICEDriver in the first TEE execution environment through KeyslotManager, UFScrypto, and Commoncryptolib. As mentioned above, the CE key is generated by KeyMasterTA in the first TEE execution environment, so the TZ ICE Driver in the first TEE execution environment can decrypt based on the previous encryption process, so as to obtain the DE key before the encryption and generation of the CE key according to the lock screen password. As mentioned above, the DE key is also generated in the first TEE execution environment, so the TZICE Driver can also generate the master key (key master), that is, the key plaintext, according to the DE key. The TZ ICE Driver in the first TEE execution environment sends the generated key plaintext to the HW ICE in the control module of the memory.

[0158] After the first branch and the second branch are completed, HW ICE has obtained the ciphertext data of data A corresponding to the access request and the master key for encrypting the plaintext data of the user data; therefore, HW ICE can decrypt the ciphertext data of data A based on the master key to generate the plaintext data of data A (that is, the decrypted data of the user data).

[0159] HW ICE transmits the plaintext data of data A to the upper layer, and after passing through UFSDriver, BlockCrypto, and F2FS / ext4, it can be transmitted to application 1. The user can view the plaintext data of data A corresponding to the access request through application 1.

[0160] It can be understood from this data access method that the data access method corresponding to the CE key with a lock screen password set further improves the security of the data in the memory compared to the data access method corresponding to the DE key without a lock screen password.

[0161] Usually, the setting of the lock screen password is related to the operating system in the electronic device. For example, when the electronic device stores a main system (corresponding to the main user) and a sub-system (corresponding to another user or sub-user), the sub-system is a set of privacy systems, so the main system and the sub-system are isolated. The main system sets a lock screen password, and the sub-system can also set a lock screen password. In this way, the corresponding system can be entered through the respective lock screen passwords, thereby improving the security of the data in the respective corresponding systems. For example, when the user knows the lock screen password of the main system but does not know the lock screen password of the sub-system, he can only enter the main system.

[0162] In addition, the DE key of the main system and the DE key of the sub-system are the same, however, the CE keys of the two systems are different. Therefore, in the main system, the DE key is obtained based on the lock screen password and CE key of the main system, and in the subsystem, the DE key is obtained based on the lock screen password and CE key of the subsystem. Therefore, the main system and the sub-system cannot access the user data of each other.

[0163] An embodiment of the present application provides a subsystem, which is a subsystem application installed in the storage space of the main system. That is, the subsystem application is in the application layer of the main system, and the operation of the subsystem application needs to rely on the support of the main system. Therefore, the subsystem is a privacy space within the main system, but the subsystem exists in the form of an application. The subsystem has an independent storage space, and the data in the storage space is also encrypted based on the master key. Although the subsystem application can set a login password, the corresponding lock screen password cannot be set. When the main system has a lock screen password and the subsystem cannot set a lock screen password, it is equivalent to that the user data corresponding to the subsystem is actually protected by a DE key with a lower security level. Therefore, the security of user data in the storage space of the subsystem is low.

[0164] In view of this, the embodiments of the present application provide a more secure data access method for subsystem applications.

[0165] Reference Figure 6 , is a flow chart of generating and installing security keys based on a security chip according to an embodiment of the present application. The electronic device also includes a security chip. Another TEE execution environment is also set in the main chip. The other TEE execution environment is recorded as a second TEE execution environment.

[0166] Of course, in actual applications, the two TEE execution environments can also be merged into the same TEE execution environment, and the embodiments of the present application do not limit this.

[0167] A secure processing unit (SPU) is a device that can independently generate keys. It has an independent processor and storage unit inside that can store keys and provide encryption and security authentication services for electronic devices.

[0168] The security chip can communicate with the main chip (central processing unit) of the electronic device, and the main chip can store sensitive information in the security chip with a higher security level.

[0169] Based on the above description, it can be understood that the main chip of the electronic device is provided with a REE execution environment, a first TEE execution environment and a second TEE execution environment, and the electronic device is also provided with a security chip.

[0170] The REE execution environment runs a general operating system of the electronic device, for example, the main system: Android operating system (android).

[0171] The main chip also supports the first TEE execution environment to further improve the security of the electronic device. For example, the key can be protected.

[0172] The main chip also supports a second TEE execution environment to establish a communication connection with the security chip through the second TEE execution environment, thereby achieving a higher level of protection for the electronic device by the security chip.

[0173] The second TEE execution environment includes a HUKS TA and a ROOT detection TA. The HUKS TA is used to trigger the ROOT detection TA to perform a ROOT detection on the electronic device to determine whether the electronic device has been ROOTed.

[0174] The security chip is provided with a secure storage Applet, which can generate a secure password.

[0175] At present, the security level of the security chip is higher than the security level of the TEE execution environment (the first TEE execution environment and the second TEE execution environment), and the security level of the TEE execution environment is higher than the security level of the REE execution environment.

[0176] In the specific implementation of the embodiment of the present application, after the login password is set for the first time when the subsystem is created and after the login password is entered each time the subsystem is opened subsequently, the login password may be verified first. After the login password verification is successful, the subsystem application applies for a security password from the HUKS TA in the second TEE execution environment.

[0177] After receiving the application request, HUKS TA detects the electronic device through ROOT detection TA.

[0178] When it is determined that the electronic device is not ROOTed, HUKS TA requests a security password from the secure storage APPlet in the security chip.

[0179] When it is determined that the electronic device has been ROOTed, HUKS TA no longer requests the security password from the secure storage APPlet in the security chip.

[0180] After receiving the application request for the security password, the security chip generates a security password and sends the security password to the HUKS TA in the second TEE execution environment in the main chip. After receiving the security password, the HUKS TA sends the security password to the subsystem application.

[0181] As an upper-layer application, the subsystem application executes a process after receiving the security password, which is similar to the process executed by the lock screen application in the above embodiment after receiving the lock screen password corresponding to the sub-system.

[0182] The subsystem application at the application layer transmits the received security password to the KeyMasterTA in the first TEE execution environment through StorageManager and VOID.

[0183] KeyMasterTA in the first TEE execution environment encrypts the DE key based on the security password, generates a security key, and stores it.

[0184] After VOID obtains the security key from KeyMasterTA, it saves the security key in Keyring through Fscrypt.

[0185] At this point, the security key is stored in the system kernel's Keyring.

[0186] After the security key is saved in the Keyring, the user may store the user data corresponding to the subsystem application in the storage area corresponding to the subsystem during the subsequent use of the electronic device, and may also access the user data corresponding to the subsystem stored in the memory. The data stored in the memory is still stored after being encrypted by the master key, that is, regardless of whether there is a lock screen password or not, the user data stored in the memory is encrypted by the master key. However, in the subsystem, when there is no lock screen password, the master key is obtained by decrypting according to the DE key. When the security password of this application is set, the DE key is decrypted according to the security password and the security key, and then the master key is decrypted by the DE key. Since there is a security password, the security key must first be decrypted by the security password to obtain the DE key, and then the DE key must be decrypted to obtain the master key. Compared with the data access method of the DE key without a lock screen password and a security password, data security is improved.

[0187] Reference Figure 7 The flowchart shown in the illustrated embodiment is a data access method based on a security key.

[0188] When a user opens application 2 (for example, a gallery or file management application in a subsystem application), and the user opens the gallery to view pictures in the gallery (or opens a file management application to view stored files, or sends data stored in the local memory to a friend through an instant messaging application), application 2 receives a request to access the data. For ease of description, the access data corresponding to this access request may be recorded as data B.

[0189] Application 2 sends an access request to F2FS / ext4 in the system kernel layer.

[0190] After receiving the access request, F2FS / ext4 in the system kernel layer sends messages to the two branches.

[0191] The first branch: F2FS / ext4 transmits the access request to the lower layer, and the access request is transmitted to the HW ICE of the hardware layer through BlockCrypto and UFSDriver; HW ICE, as the control module of the physical memory in the hardware layer, can obtain the ciphertext data of the data B pointed to by the access request (that is, the encrypted data encrypted by the master key) from the user data area of ​​the memory subsystem.

[0192] The second branch: F2FS / ext4 transmits a decryption request to Fscrypt; after receiving the decryption request, Fscrypt transmits the decryption request to Keyring; after receiving the decryption request, Keyring transmits the stored security key to the TZ ICEDriver in the first TEE execution environment through KeyslotManager, UFScrypto, and Commoncryptolib. As mentioned above, the security key is generated by KeyMasterTA in the first TEE execution environment, so the TZ ICE Driver in the first TEE execution environment can decrypt based on the previous encryption process, so as to obtain the DE key before the encryption and generation of the security key according to the security password. As mentioned above, the DE key is also generated in the first TEE execution environment, so the TZ ICE Driver can also generate the master key (key master), that is, the key plaintext, according to the DE key. The TZ ICE Driver in the first TEE execution environment sends the generated key plaintext to the HW ICE in the control module of the memory.

[0193] After the first branch and the second branch are completed, HW ICE has obtained the ciphertext data of data B corresponding to the access request and the master key for encrypting the plaintext data of the user data; therefore, HW ICE can decrypt the ciphertext data of data B based on the master key to generate the plaintext data of data B (that is, the decrypted data of the user data).

[0194] HW ICE transmits the plaintext data of data B to the upper layer, and after passing through UFSDriver, BlockCrypto, and F2FS / ext4, it can be transmitted to application 2. The user can view the plaintext data of data B corresponding to the access request through application 2.

[0195] Through this data access method, it can be understood that the data access method corresponding to the security key with a security password set further improves the security of the data in the memory compared to the data access method corresponding to the DE key without a lock screen password and a security password. Therefore, the embodiment of the present application can be applied to a subsystem where a lock screen password cannot be set to improve the security of the user data of the subsystem.

[0196] As another embodiment of the present application, the data access method is applied to an electronic device including a main chip, a security chip and a memory, wherein the main chip includes a main system and a first TEE system, the main system includes a subsystem application, a system kernel and a control module of the memory, the subsystem application is installed with a first application, the system kernel stores a security key, and the memory stores ciphertext data of the first data, and the method includes:

[0197] After receiving the access request for the first data, the first application sends the access request to the system kernel;

[0198] After receiving the access request, the system kernel sends the security key to the first TEE system and sends the access request to the control module of the memory, wherein the security key is generated by encrypting the DE key by the first TEE system based on the security password, and the security password is generated by the security chip;

[0199] After receiving the security key, the first TEE system obtains a key plaintext based on the security key, and sends the key plaintext to the control module of the memory;

[0200] After receiving the access request sent by the system kernel and the key plaintext sent by the first TEE system, the control module of the memory generates plaintext data of the first data based on the key plaintext and the ciphertext data of the first data stored in the memory;

[0201] The control module of the memory sends the plaintext data of the first data to the system kernel;

[0202] After receiving the plaintext data of the first data, the system kernel sends the plaintext data of the first data to the first application.

[0203] In the embodiment of the present application, the first TEE system is the first TEE execution environment in the above embodiment; the first application can be application 2 in the above embodiment. The first data can also be user data in the subsystem.

[0204] As another embodiment of the present application, before the first application receives the access request for the first data, the method further includes:

[0205] The main system installs the subsystem application in the main system.

[0206] After installing the subsystem application, the main system starts the subsystem application for the first time.

[0207] After the subsystem is started, the first application is installed in the subsystem.

[0208] The subsystem starts the first application.

[0209] As another embodiment of the present application, during the first startup of the subsystem application by the main system, the method further includes:

[0210] The subsystem application obtains a security password from the security chip.

[0211] The subsystem application sends the security password to the first TEE system.

[0212] After receiving the security password, the first TEE system encrypts the DE key stored in the first TEE based on the security password to generate a security key.

[0213] The first TEE system sends the security key to the system kernel.

[0214] After receiving the security key, the system kernel stores the security key in the system kernel.

[0215] As another embodiment of the present application, the first TEE system obtains the key plaintext based on the security key, including:

[0216] The first TEE system obtains the DE key based on the security password and the security key.

[0217] The first TEE system generates the key plaintext according to the DE key.

[0218] As another embodiment of the present application, the main chip further includes a second TEE system, and the subsystem application obtains a security password from the security chip including:

[0219] The subsystem application sends a request to obtain the security password to the second TEE system.

[0220] After receiving the acquisition request, the second TEE system sends a request for acquiring the security password to the security chip.

[0221] After receiving the acquisition request, the security chip generates the security password based on the acquisition request.

[0222] The security chip sends the security password to the second TEE system.

[0223] After receiving the security password, the second TEE system sends it to the subsystem application.

[0224] The subsystem application receives the security password.

[0225] The second TEE system is the second TEE execution environment in the above embodiment.

[0226] As another embodiment of the present application, before the second TEE system sends the request for obtaining the security password to the security chip, the method further includes:

[0227] The second TEE system performs a ROOT detection on the electronic device to determine that the electronic device is not ROOTed.

[0228] ROOT detection is used to determine whether an electronic device has been flashed and other users have obtained administrator privileges.

[0229] As another embodiment of the present application, the control module of the memory generates plaintext data of the first data based on the key plaintext and the ciphertext data of the first data stored in the memory, including:

[0230] The control module of the memory obtains the ciphertext data of the first data from the memory based on the access request of the first data.

[0231] The control module of the memory decrypts the ciphertext data of the first data based on the key plaintext to generate the plaintext data of the first data.

[0232] As another embodiment of the present application, the first TEE system and the second TEE system are the same TEE system.

[0233] As mentioned above, the subsystem provided in the embodiment of the present application is different from the subsystem in the current dual system. In the current dual system, the main system corresponds to the main user, and the subsystem corresponds to the sub-user. The main system user can use it for daily use, and the sub-system user can use it as a privacy system. During the use of the two systems, the user can only enter the system from the lock screen interface. For example, if the user is currently using system A and wants to switch to system B, the user needs to lock the electronic device and then enter system B through the lock screen password of system B, but cannot directly enter system B when using system A, which makes system switching inconvenient.

[0234] The subsystem in the embodiment of the present application is not a subsystem that is completely parallel to the main system, but a subsystem application running in the application layer of the main system. The subsystem application has the functions of the system. For example, after the subsystem application is turned on, the main interface of the subsystem application can be displayed, and the icons of multiple applications installed in the subsystem application (for example, instant messaging applications, camera applications, and game applications, etc.) can be displayed on the main interface. Of course, the subsystem also has an independent storage space, and the independent storage space of the subsystem can also store user data that cannot be accessed in the main system and can only be accessed after entering the subsystem.

[0235] It can be understood from the above description that the subsystem can realize functions similar to those of the subsystem in the above embodiment, and because the security key is used for decryption, it is safer than the CE key used by the subsystem for decryption. In addition, the subsystem provided in the embodiment of the present application has a more efficient startup method.

[0236] Reference Figure 8 , which is a method for starting the secondary system in the dual system provided in an embodiment of the present application.

[0237] Step A1: The lock screen application receives the password.

[0238] As mentioned above, when entering a secondary system with a similar startup process to the main system, it is necessary to enter through the lock screen interface, that is, the user enters the password on the lock screen password input interface. If the password is the same as the main system lock screen password, the main system is entered; if the password is the same as the secondary system lock screen password, the secondary system is entered.

[0239] Step A2: The lock screen application determines that the received password is consistent with the secondary user password.

[0240] When the received password is consistent with the secondary user password, it is determined to enter the process of starting the secondary system.

[0241] Step B1: The lock screen application sends an instruction to switch the secondary user to UserController.

[0242] Step C1, after receiving the instruction to switch to the secondary user, UserController sends a secondary user data preparation instruction to SystemServiceManager.

[0243] Step C2, after receiving the instruction to prepare the secondary user data, SystemServiceManager performs the preparation work before loading the secondary user's storage space.

[0244] Before actually loading the storage space corresponding to the secondary user, some verification work needs to be done.

[0245] In the embodiment of the present application, the storage space between the secondary system and the primary system and the user data in the storage space are completely isolated, so when entering the secondary system, it is necessary to perform preparation work before loading the storage space of the user data of the secondary system.

[0246] Step D1, UserController loads the desktop.

[0247] In the embodiment of the present application, since the secondary system is a separate system, it is also necessary to load the desktop, wallpaper, etc. when it is turned on.

[0248] Step E1, UserController sends an instruction to call the root container to ActivityTaskManagerService.

[0249] Step E2: After receiving the calling instruction of the root container, ActivityTaskManagerService sets the root container to be empty.

[0250] In the Android operating system, each window and activity is stored in a container. When switching to the secondary system, the root container needs to be emptied again to store the windows and activities of the secondary system.

[0251] Step F1, after the root container is also cleared, UserController sends a broadcast to switch the user to the foreground.

[0252] Step G1, UserController sends a message to SystemServiceManager that the secondary user is starting.

[0253] Step G2: After SystemServiceManager receives the message that the secondary user is starting up, the service of the primary user performs corresponding processing.

[0254] In specific implementation, the service of the main user may be stopped, or the service of the main user may no longer be processed.

[0255] Step G3, UserController sends a message to SystemServiceManager that the secondary user is switching.

[0256] Step G4, after receiving the message that the secondary user is switching, SystemServiceManager starts the services that can be run before unlocking the secondary user.

[0257] In this application, the CE class storage space has not been loaded through the CE key, nor has the DE class storage space been loaded through the DE class key. Therefore, currently, only services that can be run before unlocking in the secondary user can be started. Such services are not related to the unlocking of the system, such as alarm clocks, etc.

[0258] Step H5, UserController starts loading wallpaper.

[0259] It should be noted that step C1, step D1, step E1 and step G1 are executed in parallel and do not have a strict execution order. Usually, H5 is executed later than the above-listed steps.

[0260] Step J1, when the lock screen application determines that the received password is consistent with the secondary user password, it sends an instruction to unlock the secondary user to ActivityManagerService.

[0261] In the embodiment of the present application, when the sub-system is shut down, the key of the sub-system will be destroyed and the storage space corresponding to the sub-system will be unmounted. Therefore, after the sub-system is restarted from the shut down state, it is necessary to restore the CE key of the sub-system first, and then mount the storage space of the sub-system.

[0262] Step J1 and step B1 are parallel execution processes, so there is no strict sequence between the operations after step J1 and the operations after step B1.

[0263] Step J2: After receiving the instruction, ActivityManagerService sends an instruction to unlock the secondary user to UserController.

[0264] Step J3, after receiving the instruction to unlock the secondary user, UserController sends the instruction to unlock the secondary user's storage space to VOID.

[0265] Step J4, after receiving the unlocking instruction of the secondary user storage space, VOID decrypts the CE key and loads the secondary user storage space: CE class storage space and DE class storage space.

[0266] Step J5, VOID sends a message to UserController indicating that the storage space has been loaded.

[0267] It should be noted that the process of loading wallpaper takes a relatively long time and may not be completed until step J5. There is no definite order relationship between the time when the wallpaper is completed in step H5 of the present application embodiment and the execution time of other subsequent steps.

[0268] Step J6, UserController sends information about unlocking the storage space to SystemServiceManager.

[0269] Step J7, after receiving the information, SystemServiceManager starts the service that can be run after unlocking the secondary user.

[0270] Step J8, SystemServiceManager returns the information that the secondary user unlocking is completed to UserController.

[0271] Step J9, UserController receives the information that the secondary user unlocking is completed, and sends a broadcast that the secondary user unlocking is completed.

[0272] Through this process, we can understand that the secondary system is an independent system with independent storage space and independent CE key. During the startup process, it is also necessary to load the desktop, wallpaper, etc. The process is more complicated and the startup time is slower.

[0273] Since the subsystem application provided in the embodiment of the present application runs in the application layer of the main system, it is not necessary to load the desktop, wallpaper, etc. during the startup process, which simplifies the process and can provide the same independent storage space, more secure security keys, etc. In addition, the subsystem provided in the embodiment of the present application can also be directly entered in the main system. For details, please refer to Fig. 9 Description of the illustrated embodiment.

[0274] Step K1, setting the application or desktop to receive a switching operation.

[0275] In the embodiment of the present application, since the subsystem can be used as an application with system functions in the main system, an icon of the subsystem application can be displayed on the desktop of the main system, and the user can enter the subsystem by clicking the icon of the subsystem application. In addition, a virtual button can be set in the setting application to enter the subsystem through the virtual button.

[0276] Step K2, setting the application or desktop to send a sub-user switching instruction to ActivityManagerService.

[0277] Step K3, after receiving the instruction, ActivityManagerService sends an instruction to start the sub-user from the background to UserController.

[0278] It can be understood that the entry methods of the subsystem and the sub-system provided in the embodiments of the present application are completely different.

[0279] Step C1, after receiving the instruction to start the sub-user from the background, UserController sends a sub-user data preparation instruction to SystemServiceManager.

[0280] Step C2: After receiving the instruction to prepare the sub-user data, SystemServiceManager performs the preparation work for the sub-user's storage space.

[0281] In the embodiment of the present application, the storage space between the subsystem and the main system and the data in the storage space are completely isolated, so when entering the subsystem, the storage space of the subsystem needs to be prepared.

[0282] The subsystem can be understood as an application with system functions, so there is no need to perform step D1 of loading the desktop. Since the subsystem application runs in the application layer of the main system, there is no need to empty the root container when entering the subsystem. That is, there is no need to perform steps E1 to E2.

[0283] Step F1, UserController sends a broadcast that the user switches to the foreground.

[0284] Step G1, UserController sends a message to SystemServiceManager that the sub-user is being started.

[0285] Step G4, after receiving the message that the sub-user is being started, SystemServiceManager starts the services that can be run before unlocking the sub-user.

[0286] In this application, user data has not yet been decrypted by the CE key, so currently, only services that can be run before unlocking in the secondary user can be started. Such services are not related to unlocking the system, such as alarm clocks.

[0287] Likewise, the method provided in the embodiment of the present application no longer needs to load wallpaper, that is, step E5 does not need to be performed.

[0288] In addition, since the subsystem in this application does not involve a lock screen password, step J1 and step J2 are not executed.

[0289] Step J3, UserController sends an unlock instruction of the sub-user storage space to VOID.

[0290] Step J4, after receiving the unlock instruction of the sub-user storage space, VOID decrypts the security key and loads the sub-user storage space.

[0291] In the embodiment of the present application, as described above, the subsystem uses a security key to achieve decryption of user data during subsequent data access, so in this step, the data decrypted before loading the sub-user's storage space is the security key.

[0292] Step J5, VOID sends a message to UserController indicating that the storage space has been loaded.

[0293] Step J6, UserController sends information about unlocking the storage space to SystemServiceManager.

[0294] Step J7, after receiving the information, SystemServiceManager starts the service that can be run after unlocking in the sub-user.

[0295] Step J8, SystemServiceManager returns the information that the sub-user unlocking is completed to UserController.

[0296] Step J9: UserController receives the information that the sub-user unlocking is completed, and broadcasts that the sub-user unlocking is completed.

[0297] Fig. 9 In the illustrated embodiment, step C1, step G1 and step J3 may be processes executed in parallel, and there is no strict sequence of sequence.

[0298] The subsystem application provided in the embodiment of the present application can provide a main interface, and multiple controls can be displayed in the main interface. The content of the control is the icon of the application installed in the subsystem. The user clicks the control to start the application corresponding to the control, thereby running other applications in the subsystem.

[0299] In addition, the secondary system or subsystem is mainly used to provide the user with another storage space isolated from the main user's storage space to protect the privacy of the user data in the sub-user's storage space; Fig. 9 As shown in the timing diagram, the subsystem of the embodiment of the present application can also provide another storage space isolated from the main user's storage space to protect the privacy of the user data in the sub-user's storage space. Although the subsystem in the embodiment of the present application cannot set a lock screen password, a security chip can be used to provide a security key to provide a higher level of security protection for user data in the subsystem. Figure 8 and Fig. 9 By comparison, it can be understood that the subsystem provided in the embodiment of the present application can achieve the same function as the secondary system on the basis of shortening the startup process and reducing the startup time.

[0300] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0301] The embodiment of the present application further provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments can be implemented.

[0302] The embodiments of the present application also provide a computer program product. When the computer program product is executed on an electronic device, the electronic device can implement the steps in the above-mentioned various method embodiments.

[0303] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may at least include: any entity or device capable of carrying the computer program code to the first device, a recording medium, a computer memory, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), an electric carrier signal, a telecommunication signal, and a software distribution medium. For example, a USB flash drive, a mobile hard disk, a magnetic disk or an optical disk. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electric carrier signals and telecommunication signals.

[0304] The embodiment of the present application also provides a chip system, the chip system includes a processor, the processor is coupled to a memory, and the processor executes a computer program stored in the memory to implement the steps of any method embodiment of the present application. The chip system can be a single chip, or a chip module composed of multiple chips, for example, it can be a main chip, or it can be a chip module composed of a main chip qualified security chip.

[0305] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0306] Those of ordinary skill in the art will appreciate that the units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0307] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A data access method, characterized in that: Applied to an electronic device including a main chip, a security chip and a memory, the main chip including a main system and a first TEE system, the main system including a subsystem application, a system kernel and a control module of the memory, the subsystem application having a first application installed, the system kernel storing a security key, and the memory storing ciphertext data of the first data, the method comprising: After receiving the access request for the first data, the first application sends the access request to the system kernel; After receiving the access request, the system kernel sends the security key to the first TEE system and sends the access request to the control module of the memory, wherein the security key is generated by encrypting the DE key by the first TEE system based on the security password, and the security password is generated by the security chip; After receiving the security key, the first TEE system obtains a key plaintext based on the security key, and sends the key plaintext to the control module of the memory; After receiving the access request sent by the system kernel and the key plaintext sent by the first TEE system, the control module of the memory generates plaintext data of the first data based on the key plaintext and the ciphertext data of the first data stored in the memory; The control module of the memory sends the plaintext data of the first data to the system kernel; After receiving the plaintext data of the first data, the system kernel sends the plaintext data of the first data to the first application.

2. The method according to claim 1, characterized in that Before the first application receives the access request for the first data, the method further includes: The main system installs the subsystem application in the main system; After the main system installs the subsystem application, the main system starts the subsystem application for the first time; After the subsystem is started, installing the first application in the subsystem application; The subsystem starts the first application.

3. The method according to claim 2, characterized in that When the main system starts the subsystem application for the first time, the method further includes: The subsystem application obtains a security password from the security chip; The subsystem application sends the security password to the first TEE system; After receiving the security password, the first TEE system encrypts the DE key stored in the first TEE based on the security password to generate a security key; The first TEE system sends the security key to the system kernel; After receiving the security key, the system kernel stores the security key in the system kernel.

4. The method according to claim 3, characterized in that The first TEE system obtains the key plaintext based on the security key, including: The first TEE system obtains the DE key based on the security password and the security key; The first TEE system generates the key plaintext according to the DE key.

5. The method according to claim 3, characterized in that The main chip also includes a second TEE system, and the subsystem application obtains a security password from the security chip including: The subsystem application sends a request for obtaining the security password to the second TEE system; After receiving the acquisition request, the second TEE system sends the acquisition request for the security password to the security chip; After receiving the acquisition request, the security chip generates the security password based on the acquisition request; The security chip sends the security password to the second TEE system; After receiving the security password, the second TEE system sends it to the subsystem application; The subsystem application receives the security password.

6. The method according to claim 5, characterized in that Before the second TEE system sends the request for obtaining the security password to the security chip, the method further includes: The second TEE system performs a ROOT detection on the electronic device to determine that the electronic device is not ROOTed.

7. The method according to any one of claims 1 to 6, characterized in that: The control module of the memory generates plaintext data of the first data based on the key plaintext and the ciphertext data of the first data stored in the memory, including: The control module of the memory acquires the ciphertext data of the first data from the memory based on the access request of the first data; The control module of the memory decrypts the ciphertext data of the first data based on the key plaintext to generate the plaintext data of the first data.

8. The method according to claim 5 or 6, characterized in that The first TEE system and the second TEE system are the same TEE system.

9. An electronic device, characterized in that: The electronic device comprises a main chip and a security chip, wherein the main chip and the security chip are used to run a computer program stored in a memory, so that the electronic device implements the method according to any one of claims 1 to 8.

10. A chip system, characterized in that: The invention comprises a main chip, wherein the main chip is coupled to a memory, and the main chip executes a computer program stored in the memory to implement the method as claimed in claims 1 to 4, 7 or 8.

Images