Data processing method and device, storage medium and electronic equipment

Abstract

The invention discloses a data processing method and device, a storage medium and electronic equipment. When the electronic equipment is in an encryption mode, if an authorization process of a virtualization framework is started to obtain target encrypted data, a target secret key of the target encrypted data is obtained from the virtualization framework through the authorization process, and the virtualization framework comprises a secret key of the corresponding encrypted data; and decrypting the target encrypted data based on the target secret key through the authorization process to obtain target decrypted data. The data security in the electronic equipment can be ensured.

Description

Technical Field

[0001] The present application belongs to the field of electronic technology, and in particular, relates to a data processing method, device, computer-readable storage medium and electronic device. Background Art

[0002] At present, with the advancement of science and technology and the improvement of living standards, electronic devices such as mobile phones, tablet computers and handheld game consoles have become necessities in people's lives. Electronic devices usually store a large amount of data to maintain the normal functions of electronic devices. However, the data stored in electronic devices may sometimes be maliciously used by certain processes in the electronic devices. Therefore, it is necessary to prevent certain data stored in electronic devices from being maliciously used by certain processes in the electronic devices to ensure the data security in the electronic devices. Summary of the invention

[0003] The embodiments of the present application provide a data processing method, device, storage medium and electronic device, which can ensure the data security in the electronic device.

[0004] In a first aspect, an embodiment of the present application provides a data processing method, which is applied to an electronic device, including:

[0005] When the electronic device is in encryption mode, if the authorization process of the enabled virtualization framework obtains the target encrypted data, obtaining the target key of the target encrypted data from the virtualization framework through the authorization process, wherein the virtualization framework includes the key of the corresponding encrypted data;

[0006] The target encrypted data is decrypted based on the target secret key through the authorization process to obtain target decrypted data.

[0007] In a second aspect, an embodiment of the present application provides a data processing device, applied to an electronic device, including:

[0008] a key acquisition unit, configured to, when the electronic device is in an encryption mode, acquire a target key of the target encrypted data from the virtualization framework through the authorization process if the authorization process of the enabled virtualization framework acquires the target encrypted data, wherein the virtualization framework includes a key of the corresponding encrypted data;

[0009] A data decryption unit is used to decrypt the target encrypted data based on the target secret key through the authorization process to obtain target decrypted data.

[0010] In a third aspect, an embodiment of the present application provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed on a computer, the computer executes the data processing method provided by the embodiment of the present application.

[0011] In a fourth aspect, an embodiment of the present application further provides an electronic device, comprising a memory and a processor, wherein the processor is used to execute the data processing method provided in the embodiment of the present application by calling a computer program stored in the memory.

[0012] In an embodiment of the present application, when the electronic device is in encryption mode, if the authorized process of the virtualization framework is enabled to obtain target encrypted data, the target key of the target encrypted data is obtained from the virtualization framework through the authorized process, wherein the virtualization framework includes the key of the corresponding encrypted data; the target encrypted data is decrypted by the authorized process based on the target key to obtain target decrypted data. Therefore, when the electronic device is in encryption mode, only when the authorized process of the virtualization framework is enabled to obtain the encrypted data can the key be obtained from the virtualization framework to decrypt the encrypted data to obtain the decrypted data, while the unauthorized process can only obtain the encrypted data but cannot obtain the corresponding decrypted data, thereby preventing the unauthorized process from maliciously using the data, thereby ensuring the data security in the electronic device. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] The technical solution and beneficial effects of the present application will be made apparent by describing in detail the specific implementation methods of the present application in conjunction with the accompanying drawings.

[0014] Figure 1 It is a flowchart of the data processing method provided in the embodiment of the present application.

[0015] Figure 2 It is a scenario diagram of the data processing method provided in an embodiment of the present application.

[0016] Figure 3 It is a structural diagram of a data processing device provided in an embodiment of the present application.

[0017] Figure 4 It is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0018] It should be noted that the terms "first", "second" and "third" in this application are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or modules is not limited to the listed steps or modules, but some embodiments also include steps or modules that are not listed, or some embodiments also include other steps or modules inherent to these processes, methods, products or devices.

[0019] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0020] The embodiments of the present application provide a data processing method, a data processing device, a storage medium, and an electronic device. The execution subject of the data processing method may be the data processing device provided in the embodiments of the present application, or an electronic device integrating the data processing device, wherein the data processing device may be implemented in hardware or software. Among them, the electronic device may be a device such as a smart phone, a tablet computer, a PDA, a laptop computer, etc. that is equipped with a processor and has data processing capabilities.

[0021] See also Figure 1 , Figure 1 : is a flow chart of a data processing method provided in an embodiment of the present application. The data processing method is applied to an electronic device, such as an Android device supporting an Android virtualization framework (Android Virtualization Framework, AVF). The process may include:

[0022] In 101, when the electronic device is in encryption mode, if the authorization process of the enabled virtualization framework obtains the target encrypted data, the target key of the target encrypted data is obtained from the virtualization framework through the authorization process, wherein the virtualization framework includes the key of the corresponding encrypted data.

[0023] The data processing method provided in the embodiment of the present application will be explained below by taking an Android device as an example.

[0024] Among them, Android devices are electronic devices that use the Android operating system, including mobile phones, tablets, watches and other smart devices that use the Android operating system. The Android operating system is a free and open source mobile operating system based on the Linux kernel (excluding GNU components), mainly used in mobile devices such as smartphones, tablets, TVs, digital cameras, game consoles, smart watches, etc.

[0025] Among them, the virtualization framework may include the Android virtualization framework. The Android virtualization framework provides a secure and private execution environment to execute code. The Android virtualization framework is well suited for security-oriented use cases that require a higher level of security than that provided by the Android application sandbox, or even formally verified isolation guarantees.

[0026] The Android device can respond to the user's mode switching operation to switch the Android device from the encrypted mode to the non-encrypted mode, or from the non-encrypted mode to the encrypted mode. For example, when the Android device is in the encrypted mode, if a mode switching operation is received, the Android device is switched from the encrypted mode to the non-encrypted mode in response to the mode switching operation; when the Android device is in the non-encrypted mode, if a mode switching operation is received, the Android device is switched from the non-encrypted mode to the encrypted mode in response to the mode switching operation.

[0027] Before Android devices leave the factory, device manufacturers usually set up authorized and unauthorized processes. For example, some processes are set as authorized processes and others are set as unauthorized processes. When an Android device is in encryption mode, unauthorized processes can only obtain encrypted data or unencrypted data, while authorized processes can obtain not only unencrypted data but also the decrypted data corresponding to encrypted data.

[0028] Specifically, when the Android device switches to encryption mode, the authorization process will enable the Android virtualization framework and encrypt the corresponding data using the secret key in the Android virtualization framework to obtain encrypted data. The authorization process after enabling the virtualization framework is the authorization process that has enabled the virtualization framework.

[0029] When the corresponding data is encrypted by the secret key in the Android virtualization framework and the encrypted data is obtained, the identification information of the encrypted data and the secret key corresponding to the encrypted data can also be associated and stored in the Android virtualization framework. Among them, the identification information of the encrypted data is used to uniquely represent the encrypted data. The secret key corresponding to a certain encrypted data is used to decrypt the encrypted data or encrypt the corresponding data to obtain the encrypted data.

[0030] For example, if the authorization process of the enabled Android virtualization framework obtains the target encrypted data, the authorization process can obtain the identification information of the target encrypted data. Then, the authorization process can determine the matching identification information that matches the identification information of the target encrypted data from the identification information stored in the Android virtualization framework, and determine the secret key associated with the matching identification information stored in the Android virtualization framework as the target secret key of the target encrypted data.

[0031] For example, assuming that the identification information and keys associated and stored in the Android virtualization framework are identification information M1 and its associated key key1, identification information M2 and its associated key key2, identification information M3 and its associated key key3, identification information M4 and its associated key key4, identification information M5 and its associated key key5, if the identification information of the target encrypted data is M2, then it can be determined that the target key is key key2; if the identification information of the target encrypted data is M3, then it can be determined that the target key is key key3; if the identification information of the target encrypted data is M5, then it can be determined that the target key is key key5.

[0032] In 102, the target encrypted data is decrypted based on the target secret key through the authorization process to obtain the target decrypted data.

[0033] For example, after the authorization process obtains the target secret key, the authorization process can decrypt the target encrypted data based on the target secret key to obtain the target decrypted data, that is, the original data, so that the authorization process can use the original data normally.

[0034] Since unauthorized processes do not have the ability to enable the Android virtualization framework, they cannot enable the Android virtualization framework, and thus cannot encrypt or decrypt the corresponding data. Therefore, unauthorized processes can only obtain encrypted data or unencrypted data. Since unauthorized processes can only obtain encrypted data and cannot obtain the corresponding decrypted data, that is, the original data, they cannot use the original data normally, thereby protecting the corresponding original data from being maliciously used by unauthorized processes and ensuring data security in electronic devices.

[0035] In this embodiment, when the electronic device is in encryption mode, if the authorized process with the virtualization framework enabled obtains the target encrypted data, the target key of the target encrypted data is obtained from the virtualization framework through the authorized process, wherein the virtualization framework includes the key of the corresponding encrypted data; the target encrypted data is decrypted based on the target key by the authorized process to obtain the target decrypted data. Therefore, when the electronic device is in encryption mode, only when the authorized process with the virtualization framework enabled obtains the encrypted data can the key be obtained from the virtualization framework to decrypt the encrypted data to obtain the decrypted data, while the unauthorized process can only obtain the encrypted data but cannot obtain the corresponding decrypted data, thereby preventing the unauthorized process from maliciously using the data, thereby ensuring the data security in the electronic device.

[0036] In an optional embodiment, the virtualization framework includes a management and control module, which obtains a target key of target encrypted data from the virtualization framework through an authorization process, including:

[0037] The target key of the target encrypted data is obtained from the virtualization framework through the authorized process control management module.

[0038] The Android virtualization framework includes a management and control module, which is used to provide a secret key in the Android virtualization framework to the authorization process.

[0039] For example, if the authorization process of the enabled Android virtualization framework obtains the target encrypted data, the authorization process can obtain the identification information of the target encrypted data, and generate key acquisition information and send it to the control module. Among them, the key acquisition information carries the identification information of the target encrypted data, and the key acquisition information is used to indicate the target key for obtaining the target encrypted data. After the control module receives the key acquisition information, it can obtain the identification information of the target encrypted data from the key acquisition information, and determine the matching identification information that matches the identification information of the target encrypted data from the identification information stored in the Android virtualization framework, and determine the key associated with the matching identification information stored in the Android virtualization framework as the target key of the target encrypted data. Then, the control module can obtain the target key and send the target key to the authorization process, so that the authorization process obtains the target key of the target encrypted data.

[0040] In an optional embodiment, when the electronic device is in encryption mode, if the authorization process of the virtualization framework is enabled to obtain the target encrypted data, before obtaining the target key of the target encrypted data from the virtualization framework through the authorization process, the method further includes:

[0041] In response to the mode switching operation, the electronic device is switched from a non-encryption mode to an encryption mode.

[0042] The mode switching operation may be triggered by a user.

[0043] For example, an Android device may provide a visual interface in which a mode switching button is provided. When the Android device is in non-encrypted mode, if the user clicks the mode switching button, the Android device receives the mode switching operation. In response to the mode switching operation, the Android device may switch the Android device from non-encrypted mode to encrypted mode. It is understandable that if the user clicks the mode switching button again, the Android device receives the mode switching operation again. In response to the mode switching operation received again, the Android device may switch the Android device from encrypted mode to non-encrypted mode. In other words, based on the user's click operation on the mode switching button, the Android device may switch between non-encrypted mode and encrypted mode.

[0044] For another example, a physical button for mode switching may be set on the Android device. When the Android device is in non-encrypted mode, if the user presses the physical button, the Android device receives the mode switching operation. In response to the mode switching operation, the Android device can switch the Android device from non-encrypted mode to encrypted mode. It is understandable that if the user presses the physical button again, the Android device receives the mode switching operation again. In response to the mode switching operation received again, the Android device can switch the Android device from encrypted mode to non-encrypted mode. In other words, based on the user's pressing operation on the physical button, the Android device can switch between non-encrypted mode and encrypted mode.

[0045] In an optional embodiment, in response to the mode switching operation, switching the electronic device from the non-encrypted mode to the encrypted mode includes:

[0046] In response to the mode switching operation, the state of the mode switching module in the virtual machine monitor is switched from the state corresponding to the non-encrypted mode to the state corresponding to the encrypted mode, so as to switch the electronic device from the non-encrypted mode to the encrypted mode.

[0047] Among them, the virtual machine monitor (VMM), also known as Hyper, includes end-to-end functions such as planning, deployment, management and optimization of virtual infrastructure.

[0048] For example, a mode switching module can be set in the virtual machine monitor of the Android device. The mode switching module includes two states, namely, a state corresponding to the encryption mode and a state corresponding to the encryption mode. Then, the mode switching of the Android device can be realized by switching the state of the mode switching module.

[0049] For example, the Android device may provide a visual interface in which a mode switching button is provided. When the Android device is in non-encrypted mode, if the user clicks the mode switching button, the Android device receives the mode switching operation. In response to the mode switching operation, the Android device may switch the state of the mode switching module located in the virtual machine monitor from the state corresponding to the non-encrypted mode to the state corresponding to the encrypted mode, so as to switch the Android device from the non-encrypted mode to the encrypted mode. It is understandable that if the user clicks the mode switching button again, the Android device receives the mode switching operation again. In response to the mode switching operation received again, the Android device may switch the state of the mode switching module located in the virtual machine monitor from the state corresponding to the encrypted mode to the state corresponding to the non-encrypted mode, so as to switch the Android device from the encrypted mode to the non-encrypted mode.

[0050] For another example, a physical button for mode switching may be provided on the Android device. When the Android device is in non-encrypted mode, if the user presses the physical button, the Android device receives the mode switching operation. In response to the mode switching operation, the Android device may switch the state of the mode switching module located in the virtual machine monitor from the state corresponding to the non-encrypted mode to the state corresponding to the encrypted mode, so as to switch the Android device from the non-encrypted mode to the encrypted mode. It is understandable that if the user presses the physical button again, the Android device receives the mode switching operation again. In response to the mode switching operation received again, the Android device may switch the state of the mode switching module located in the virtual machine monitor from the state corresponding to the encrypted mode to the state corresponding to the non-encrypted mode, so as to switch the Android device from the encrypted mode to the non-encrypted mode.

[0051] Since the environment of exception levels for unprivileged execution (EL0) is controlled by ROOT (Root Permissions for Android / Linux), setting the mode switching module in a virtual machine monitor with permissions higher than EL0 can avoid being controlled by ROOT.

[0052] In an optional embodiment, in response to the mode switching operation, switching the electronic device from the non-encrypted mode to the encrypted mode includes:

[0053] In response to the mode switching operation, the state of the mode switching module in the trusted execution environment is switched from a state corresponding to the non-encrypted mode to a state corresponding to the encrypted mode, so as to switch the electronic device from the non-encrypted mode to the encrypted mode.

[0054] Among them, the trusted execution environment (TEE) is a secure area built by software and hardware methods on the computing platform, which can ensure that the code and data loaded in the secure area are protected in terms of confidentiality and integrity. Its goal is to ensure that a task is executed as expected, and to ensure the confidentiality and integrity of the initial state, as well as the confidentiality and integrity of the runtime state.

[0055] For example, a mode switching module can be set in the trusted execution environment of the Android device. The mode switching module includes two states, namely, a state corresponding to the encryption mode and a state corresponding to the encrypted mode. Then, the mode switching of the Android device can be realized by switching the state of the mode switching module.

[0056] For example, the Android device may provide a visual interface in which a mode switching button is provided. When the Android device is in non-encrypted mode, if the user clicks the mode switching button, the Android device receives the mode switching operation. In response to the mode switching operation, the Android device may switch the state of the mode switching module located in the trusted execution environment from the state corresponding to the non-encrypted mode to the state corresponding to the encrypted mode, so as to switch the Android device from the non-encrypted mode to the encrypted mode. It is understandable that if the user clicks the mode switching button again, the Android device receives the mode switching operation again. In response to the mode switching operation received again, the Android device may switch the state of the mode switching module located in the trusted execution environment from the state corresponding to the encrypted mode to the state corresponding to the non-encrypted mode, so as to switch the Android device from the encrypted mode to the non-encrypted mode.

[0057] For another example, a physical button for mode switching may be provided on the Android device. When the Android device is in non-encrypted mode, if the user presses the physical button, the Android device receives the mode switching operation. In response to the mode switching operation, the Android device may switch the state of the mode switching module located in the trusted execution environment from the state corresponding to the non-encrypted mode to the state corresponding to the encrypted mode, so as to switch the Android device from the non-encrypted mode to the encrypted mode. It is understandable that if the user presses the physical button again, the Android device receives the mode switching operation again. In response to the mode switching operation received again, the Android device may switch the state of the mode switching module located in the trusted execution environment from the state corresponding to the encrypted mode to the state corresponding to the non-encrypted mode, so as to switch the Android device from the encrypted mode to the non-encrypted mode.

[0058] Since the environment of exception levels for unprivileged execution (EL0) is controlled by ROOT (Root Permissions for Android / Linux), setting the mode switching module in a trusted environment with permissions higher than EL0 can avoid being controlled by ROOT.

[0059] In an optional embodiment, in response to the mode switching operation, after the electronic device is switched from the non-encrypted mode to the encrypted mode, the method further includes:

[0060] Enable virtualization framework through authorization process;

[0061] In response to the data encryption operation, the authorization process determines the data to be encrypted indicated by the data encryption operation;

[0062] The encrypted data is obtained by obtaining the secret key from the virtualization framework through the authorization process.

[0063] For example, when the Android device is switched from a non-encrypted mode to an encrypted mode, the authorization process in the Android device may enable the Android virtualization framework to encrypt and decrypt the corresponding data.

[0064] A visual interface can also be presented on the Android device, and the user can select the data to be encrypted that he wants to encrypt on the visual interface, so that the authorization process receives the data encryption operation. In response to the data encryption operation, the authorization process can determine that the data to be encrypted is the data encrypted by the data encryption operation instruction. Subsequently, the authorization process can obtain the key from the Android virtualization framework to encrypt the data to be encrypted and obtain the encrypted data. The authorization process can also associate the identification information of the encrypted data and the key corresponding to the encrypted data and store them in the Android virtualization framework. If the authorization process needs to decrypt the corresponding encrypted data later, it can obtain the corresponding key from the Android virtualization framework based on the identification information of the encrypted data to decrypt the encrypted data.

[0065] In an optional embodiment, if the authorization process of the enabled virtualization framework obtains the target encrypted data, obtaining the target key of the target encrypted data from the virtualization framework through the authorization process includes:

[0066] Obtain corresponding data from the device driver through the authorization process;

[0067] If the corresponding data is target encrypted data, the target key of the target encrypted data is obtained from the virtualization framework through the authorization process.

[0068] It is understandable that the user can also choose to encrypt the driver data that the device driver will output, so that the authorization process receives the data encryption operation. In response to the data encryption operation, the authorization process can determine that the driver data is the data encrypted by the data encryption operation instruction. Subsequently, the authorization process can obtain the key from the Android virtualization framework to encrypt the data to be encrypted and obtain the encrypted data. The authorization process can also associate the identification information of the encrypted data and the key corresponding to the encrypted data and store them in the Android virtualization framework. If the authorization process subsequently obtains the corresponding data from the data output channel of the device driver, the authorization process can detect whether the data is the target encrypted data. If the data is the target encrypted data, the authorization process can obtain the corresponding target key from the Android virtualization framework based on the key of the target encrypted data to decrypt the target encrypted data.

[0069] See also Figure 2 , Figure 2It is a scenario diagram of the data processing method provided in an embodiment of the present application.

[0070] Taking an Android device that supports AVF as an example, when the Android device is in non-encrypted mode, the data in the Android device is unencrypted original data. Therefore, both authorized processes and unauthorized processes can access the device driver in a normal way to obtain the unencrypted original data output by the device driver through the data output channel of the device driver.

[0071] If the user does not want certain data of the device driver to be obtained by unauthorized processes, the user can perform a mode switching operation on the Android device, so that the Android device receives the mode switching operation triggered by the user. In response to the mode switching operation, the Android device can switch the state of the mode switching module (switch) located in the virtual machine monitor / trusted execution environment from the state corresponding to the non-encrypted mode to the state corresponding to the encrypted mode, so as to switch the Android device from the non-encrypted mode to the encrypted mode.

[0072] After switching the Android device from non-encrypted mode to encrypted mode, the authorized process in the Android device can enable the Android Virtualization Framework (AVF). The user can select the data that he does not want to be obtained by the unauthorized process as the data to be encrypted, so that the Android device receives the data encryption operation. The Android device can respond to the data encryption operation through the authorized process, obtain the key from the AVF through the control module in the AVF to encrypt the data to be encrypted, and obtain the encrypted data. If the corresponding data obtained by the authorized process from the device driver is encrypted data, the authorized process can obtain the key of the encrypted data from the AVF through the control module in the AVF to decrypt the encrypted data, and obtain the decrypted data, that is, the original data, so that the authorized process can use the original data normally. If the corresponding data obtained by the unauthorized process from the device driver is encrypted data, since the unauthorized process cannot obtain the key of the encrypted data, it cannot decrypt the encrypted data, that is, it cannot obtain the original data, and then the unauthorized process cannot use the original data normally.

[0073] If the user subsequently wants certain data of the device driver to be accessible to unauthorized processes, the user can perform a mode switching operation on the Android device, so that the Android device receives the mode switching operation triggered by the user. In response to the mode switching operation, the Android device can switch the state of the mode switching module (switch) located in the virtual machine monitor / trusted execution environment from the state corresponding to the encryption mode to the state corresponding to the non-encryption mode, so as to switch the Android device from the encryption mode to the non-encryption mode. When the Android device is in the non-encryption mode, the data of the device driver is the unencrypted original data, so both the authorized process and the unauthorized process can access the device driver in a normal way to obtain the unencrypted original data output by the device driver through the data output channel.

[0074] See also Figure 3 , Figure 3 The data processing device 200 is applied to an electronic device, and includes a key acquisition unit 201 and a data decryption unit 202 .

[0075] The key acquisition unit 201 is used to obtain the target key of the target encrypted data from the virtualization framework through the authorization process when the electronic device is in encryption mode, if the authorization process of the enabled virtualization framework obtains the target encrypted data, wherein the virtualization framework includes the key of the corresponding encrypted data.

[0076] The data decryption unit 202 is used to decrypt the target encrypted data based on the target secret key through the authorization process to obtain target decrypted data.

[0077] In an optional embodiment, the virtualization framework includes a management and control module, and the key acquisition unit 301 can be used to: control the management and control module to obtain the target key of the target encrypted data from the virtualization framework through the authorization process.

[0078] In an optional embodiment, the data processing device 200 may further include a mode switching unit, which may be configured to: in response to a mode switching operation, switch the electronic device from a non-encrypted mode to an encrypted mode.

[0079] In an optional embodiment, the mode switching unit can be used to: in response to a mode switching operation, switch the state of a mode switching module located in the virtual machine monitor from a state corresponding to a non-encrypted mode to a state corresponding to an encrypted mode, so as to switch the electronic device from a non-encrypted mode to an encrypted mode.

[0080] In an optional embodiment, the mode switching unit can be used to: in response to a mode switching operation, switch the state of a mode switching module located in a trusted execution environment from a state corresponding to a non-encrypted mode to a state corresponding to an encrypted mode, so as to switch the electronic device from a non-encrypted mode to an encrypted mode.

[0081] In an optional embodiment, the data processing device 200 may also include a data encryption unit, which can be used to: enable the virtualization framework through an authorization process; respond to the data encryption operation through the authorization process to determine the data to be encrypted indicated by the data encryption operation; obtain a key from the virtualization framework through the authorization process to encrypt the data to be encrypted to obtain encrypted data.

[0082] In an optional embodiment, the key acquisition unit 201 can be used to: obtain corresponding data from the device driver through the authorization process; if the corresponding data is target encrypted data, obtain the target key of the target encrypted data from the virtualization framework through the authorization process.

[0083] An embodiment of the present application provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed on a computer, the computer executes the data processing method provided in the embodiment.

[0084] An embodiment of the present application also provides an electronic device, including a memory and a processor, wherein the processor is used to execute the data processing method provided in the present embodiment by calling a computer program stored in the memory.

[0085] For example, the electronic device may be a mobile terminal such as a tablet computer or a smart phone. Figure 4 , Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0086] The electronic device 300 may include components such as a processor 301 and a memory 302. Those skilled in the art will appreciate that Figure 4 The electronic device structure shown in the figure does not constitute a limitation on the electronic device, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently. For example, the electronic device 300 may also include a screen.

[0087] The processor 301 is the control center of the electronic device. It uses various interfaces and lines to connect various parts of the entire electronic device. It executes various functions of the electronic device and processes data by running or executing applications stored in the memory 302 and calling data stored in the memory 302, thereby monitoring the electronic device as a whole.

[0088] The memory 302 may be used to store applications and data. The applications stored in the memory 302 include executable codes. The applications may be composed of various functional modules. The processor 301 executes various functional applications and data processing by running the applications stored in the memory 302.

[0089] In this embodiment, the processor 301 in the electronic device will load the executable code corresponding to the process of one or more application programs into the memory 302 according to the following instructions, and the processor 301 will run the application program stored in the memory 302, thereby achieving:

[0090] When the electronic device is in encryption mode, if the authorization process of the enabled virtualization framework obtains the target encrypted data, obtaining the target key of the target encrypted data from the virtualization framework through the authorization process, wherein the virtualization framework includes the key of the corresponding encrypted data;

[0091] The target encrypted data is decrypted based on the target secret key through the authorization process to obtain target decrypted data.

[0092] In an optional embodiment, the virtualization framework includes a management and control module. When the processor 301 executes the acquisition of the target key of the target encrypted data from the virtualization framework through the authorization process, it can execute: controlling the management and control module to acquire the target key of the target encrypted data from the virtualization framework through the authorization process.

[0093] In an optional embodiment, the processor 301 executes the following: when the electronic device is in encryption mode, if the authorization process of the enabled virtualization framework obtains the target encrypted data, then before obtaining the target key of the target encrypted data from the virtualization framework through the authorization process, it may also execute the following: in response to a mode switching operation, switching the electronic device from a non-encrypted mode to an encrypted mode.

[0094] In an optional embodiment, when the processor 301 executes the operation of switching the electronic device from a non-encrypted mode to an encrypted mode in response to the mode switching operation, it may execute: in response to the mode switching operation, switching the state of a mode switching module located in the virtual machine monitor from a state corresponding to the non-encrypted mode to a state corresponding to the encrypted mode, so as to switch the electronic device from a non-encrypted mode to an encrypted mode.

[0095] In an optional embodiment, when the processor 301 executes the operation in response to the mode switching operation to switch the electronic device from the non-encrypted mode to the encrypted mode, it can execute: in response to the mode switching operation, switching the state of the mode switching module located in the trusted execution environment from the state corresponding to the non-encrypted mode to the state corresponding to the encrypted mode, so as to switch the electronic device from the non-encrypted mode to the encrypted mode.

[0096] In an optional embodiment, after the processor 301 executes the response to the mode switching operation to switch the electronic device from the non-encrypted mode to the encrypted mode, it may also execute: enabling the virtualization framework through an authorization process; responding to the data encryption operation through an authorization process to determine the data to be encrypted indicated by the data encryption operation; obtaining a key from the virtualization framework through an authorization process to encrypt the data to be encrypted to obtain encrypted data.

[0097] In an optional embodiment, when the processor 301 executes the target encrypted data obtained by the authorization process of the enabled virtualization framework, the target key of the target encrypted data is obtained from the virtualization framework through the authorization process. The following can be executed: obtaining corresponding data from the device driver through the authorization process; if the corresponding data is the target encrypted data, obtaining the target key of the target encrypted data from the virtualization framework through the authorization process.

[0098] In the above embodiments, the description of each embodiment has its own focus. For the part that is not described in detail in a certain embodiment, please refer to the detailed description of the data processing method above, and will not be repeated here.

[0099] The data processing device provided in the embodiment of the present application belongs to the same concept as the data processing method in the above embodiment. Any method provided in the data processing method embodiment can be run on the data processing device. The specific implementation process is detailed in the data processing method embodiment and will not be repeated here.

[0100] It should be noted that, for the data processing method of the embodiment of the present application, a person skilled in the art can understand that all or part of the process of implementing the data processing method of the embodiment of the present application can be completed by controlling the relevant hardware through a computer program, and the computer program can be stored in a computer-readable storage medium, such as a memory, and executed by at least one processor, and the execution process may include the process of the embodiment of the data processing method. Among them, the computer-readable storage medium can be a disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), etc.

[0101] It is understandable that in the specific implementation of this application, user information is involved, such as application usage behavior data, logs and other related data. When the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0102] For the data processing device of the embodiment of the present application, each functional module can be integrated into a processing chip, or each module can exist physically separately, or two or more modules can be integrated into one module. The above-mentioned integrated module can be implemented in the form of hardware or in the form of software functional modules. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium, such as a read-only memory, a disk or an optical disk.

[0103] The above is a detailed introduction to a data processing method, device, storage medium and electronic device provided in the embodiments of the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A data processing method, applied to an electronic device, characterized in that: include: When the electronic device is in encryption mode, if the authorization process of the enabled virtualization framework obtains the target encrypted data, obtaining the target key of the target encrypted data from the virtualization framework through the authorization process, wherein the virtualization framework includes the key of the corresponding encrypted data; The target encrypted data is decrypted based on the target secret key through the authorization process to obtain target decrypted data.

2. The data processing method according to claim 1, characterized in that: The virtualization framework includes a management and control module, and the step of obtaining a target key of target encrypted data from the virtualization framework through the authorization process includes: The authorization process controls the management and control module to obtain the target key of the target encrypted data from the virtualization framework.

3. The data processing method according to claim 1 or 2, characterized in that: When the electronic device is in encryption mode, if the authorization process of the enabled virtualization framework obtains the target encrypted data, before obtaining the target key of the target encrypted data from the virtualization framework through the authorization process, the method further includes: In response to the mode switching operation, the electronic device is switched from a non-encrypted mode to an encrypted mode.

4. The data processing method according to claim 3, characterized in that: The step of switching the electronic device from a non-encrypted mode to an encrypted mode in response to the mode switching operation comprises: In response to the mode switching operation, the state of the mode switching module in the virtual machine monitor is switched from the state corresponding to the non-encrypted mode to the state corresponding to the encrypted mode, so as to switch the electronic device from the non-encrypted mode to the encrypted mode.

5. The data processing method according to claim 3, characterized in that: The step of switching the electronic device from a non-encrypted mode to an encrypted mode in response to the mode switching operation comprises: In response to the mode switching operation, the state of the mode switching module in the trusted execution environment is switched from a state corresponding to the non-encrypted mode to a state corresponding to the encrypted mode, so as to switch the electronic device from the non-encrypted mode to the encrypted mode.

6. The data processing method according to claim 3, characterized in that: After the electronic device is switched from a non-encrypted mode to an encrypted mode in response to the mode switching operation, the method further comprises: Enable virtualization framework through authorization process; In response to the data encryption operation, the authorization process determines the data to be encrypted indicated by the data encryption operation; The encrypted data is obtained by obtaining a secret key from the virtualization framework through an authorization process and encrypting the data to be encrypted.

7. The data processing method according to claim 1, characterized in that: If the authorization process of the enabled virtualization framework obtains the target encrypted data, obtaining the target key of the target encrypted data from the virtualization framework through the authorization process includes: Acquiring corresponding data from the device driver through the authorization process; If the corresponding data is target encrypted data, a target key of the target encrypted data is obtained from the virtualization framework through the authorization process.

8. A data processing device, applied to an electronic device, characterized in that: include: a key acquisition unit, configured to, when the electronic device is in an encryption mode, acquire a target key of the target encrypted data from the virtualization framework through the authorization process if the authorization process of the enabled virtualization framework acquires the target encrypted data, wherein the virtualization framework includes a key of the corresponding encrypted data; The data decryption unit is used to decrypt the target encrypted data based on the target secret key through the authorization process to obtain target decrypted data.

9. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed on a computer, the computer executes the data processing method according to any one of claims 1 to 7.

10. An electronic device, characterized in that: The electronic device includes a processor and a memory, wherein a computer program is stored in the memory, and the processor is used to execute the data processing method according to any one of claims 1 to 7 by calling the computer program stored in the memory.

Images