Data processing method and device, storage medium and electronic equipment

Abstract

The application discloses a data processing method and device, a storage medium and an electronic device. When the electronic device is in an encryption mode, if an authorized process of a virtualization framework obtains target encrypted data, the authorized process obtains a target key of the target encrypted data from the virtualization framework, wherein the virtualization framework comprises keys of corresponding encrypted data; and the authorized process decrypts the target encrypted data based on the target key to obtain target decrypted data. The application can ensure the safety of data in the electronic device.

Description

Technical Field

[0001] This application belongs to the field of electronic technology, and in particular relates to a data processing method, apparatus, computer-readable storage medium and electronic device. Background Technology

[0002] Currently, with the advancement of technology and the continuous improvement of living standards, electronic devices such as mobile phones, tablets, and handheld game consoles have become necessities in people's lives. These electronic devices typically store large amounts of data to maintain their normal functions. However, this stored data can sometimes be maliciously used by certain processes within the electronic device. Therefore, it is necessary to prevent such malicious use of data stored on electronic devices to ensure data security. Summary of the Invention

[0003] This application provides a data processing method, apparatus, storage medium, and electronic device that can ensure data security in electronic devices.

[0004] In a first aspect, embodiments of this application provide a data processing method applied to an electronic device, comprising:

[0005] When the electronic device is in encryption mode, if the authorized process of the virtualization framework has been enabled to obtain the target encrypted data, the target key of the target encrypted data is obtained from the virtualization framework through the authorized process, wherein the virtualization framework includes the key of the corresponding encrypted data.

[0006] The authorized process decrypts the target encrypted data based on the target key to obtain the target decrypted data.

[0007] Secondly, embodiments of this application provide a data processing apparatus applied to an electronic device, comprising:

[0008] A key acquisition unit is used to, when the electronic device is in encryption mode, if the authorized process of the virtualization framework has been enabled to acquire the target encrypted data, then the authorized process acquires the target encrypted data from the virtualization framework through the authorized process, wherein the virtualization framework includes the key of the corresponding encrypted data;

[0009] The data decryption unit is used to decrypt the target encrypted data based on the target key through the authorization process to obtain the target decrypted data.

[0010] Thirdly, embodiments of this application provide a computer-readable storage medium storing a computer program thereon, which, when executed on a computer, causes the computer to perform the data processing method provided in embodiments of this application.

[0011] Fourthly, embodiments of this application also provide an electronic device, including a memory and a processor, wherein the processor executes the data processing method provided in embodiments of this application by calling a computer program stored in the memory.

[0012] In this embodiment, when the electronic device is in encryption mode, if an authorized process with an enabled virtualization framework obtains the target encrypted data, the authorized process retrieves the target key of the target encrypted data from the virtualization framework, where the virtualization framework includes the key for the corresponding encrypted data. The authorized process then decrypts the target encrypted data based on the target key to obtain the target decrypted data. Thus, when the electronic device is in encryption mode, only authorized processes with an enabled virtualization framework can obtain the key from the virtualization framework to decrypt the encrypted data and obtain the decrypted data. Unauthorized processes can only obtain the encrypted data and cannot obtain the corresponding decrypted data, thereby preventing unauthorized processes from maliciously using the data and ensuring data security in the electronic device. Attached Figure Description

[0013] The technical solution and its beneficial effects will become apparent from the following detailed description of specific embodiments of this application, in conjunction with the accompanying drawings.

[0014] Figure 1 This is a flowchart illustrating the data processing method provided in the embodiments of this application.

[0015] Figure 2 This is a schematic diagram of a scenario for the data processing method provided in the embodiments of this application.

[0016] Figure 3 This is a schematic diagram of the structure of the data processing device provided in the embodiments of this application.

[0017] Figure 4 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0018] It should be noted that the terms "first," "second," and "third," etc., used in this application are used to distinguish different objects, not to describe a specific order. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or modules is not limited to the listed steps or modules, but some embodiments also include steps or modules not listed, or some embodiments also include other steps or modules inherent to these processes, methods, products, or devices.

[0019] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0020] This application provides a data processing method, a data processing apparatus, a storage medium, and an electronic device. The entity executing the data processing method can be the data processing apparatus provided in this application, or an electronic device integrating the data processing apparatus, wherein the data processing apparatus can be implemented in hardware or software. The electronic device can be a smartphone, tablet computer, PDA, laptop computer, or other device equipped with a processor and possessing data processing capabilities.

[0021] Please see Figure 1 , Figure 1 This is a flowchart illustrating a data processing method provided in an embodiment of this application. This data processing method is applied to an electronic device, such as an Android device supporting the Android Virtualization Framework (AVF). The process may include:

[0022] In 101, when the electronic device is in encrypted mode, if the authorized process of the virtualization framework has been enabled and obtains the target encrypted data, the authorized process obtains the target key of the target encrypted data from the virtualization framework, wherein the virtualization framework includes the key of the corresponding encrypted data.

[0023] The following explanation uses an Android device as an example to illustrate the data processing method provided in the embodiments of this application.

[0024] Android devices are electronic devices that use the Android operating system, including smartphones, tablets, watches, and other smart devices that use the Android operating system. The Android operating system is a free and open-source mobile operating system based on the Linux kernel (excluding GNU components), primarily used in mobile devices such as smartphones, tablets, televisions, digital cameras, game consoles, and smartwatches.

[0025] The virtualization framework can include the Android Virtualization Framework. The Android Virtualization Framework provides a secure and private execution environment for executing code. It is well-suited for security-oriented use cases that require a higher level of security, or even formally validated isolation guarantees, than those offered by the Android application sandbox.

[0026] Android devices can respond to user mode switching commands to switch from encrypted mode to unencrypted mode, or vice versa. For example, when an Android device is in encrypted mode and receives a mode switching command, it will switch from encrypted mode to unencrypted mode in response to the command; conversely, when an Android device is in unencrypted mode and receives a mode switching command, it will switch from unencrypted mode to encrypted mode in response to the command.

[0027] Before Android devices leave the factory, manufacturers typically configure authorized and unauthorized processes. For example, some processes are designated as authorized processes, while others are designated as unauthorized processes. When an Android device is in encrypted mode, unauthorized processes can only access either encrypted or unencrypted data, while authorized processes can access both unencrypted and decrypted data corresponding to encrypted data.

[0028] Specifically, when an Android device switches to encrypted mode, the authorization process enables the Android virtualization framework and encrypts the corresponding data using a key within the Android virtualization framework to obtain encrypted data. The authorization process that enables the virtualization framework is the one with the virtualization framework enabled.

[0029] After encrypting the corresponding data using a key within the Android virtualization framework, the encrypted data's identifier and corresponding key can be stored together within the Android virtualization framework. The identifier uniquely identifies the encrypted data. The key is used to decrypt or encrypt the encrypted data to obtain the encrypted data itself.

[0030] For example, if an authorized process with the Android virtualization framework enabled obtains target encrypted data, the authorized process can obtain the identification information of the target encrypted data. Then, the authorized process can determine the matching identification information from the identification information stored in the Android virtualization framework that matches the identification information of the target encrypted data, and determine the key associated with the matching identification information stored in the Android virtualization framework as the target key for the target encrypted data.

[0031] For example, suppose the identification information and keys associated with the storage in the Android virtualization framework are identification information M1 and its associated key key1, identification information M2 and its associated key key2, identification information M3 and its associated key key3, identification information M4 and its associated key key4, and identification information M5 and its associated key key5. If the identification information of the target encrypted data is M2, then the target key can be determined to be key key2; if the identification information of the target encrypted data is M3, then the target key can be determined to be key key3; and if the identification information of the target encrypted data is M5, then the target key can be determined to be key key5.

[0032] In step 102, the authorized process decrypts the target encrypted data based on the target key to obtain the target decrypted data.

[0033] For example, once the authorization process obtains the target key, it can decrypt the target encrypted data based on the target key to obtain the target decrypted data, which is the original data. Thus, the authorization process can use the original data normally.

[0034] Unauthorized processes, lacking the ability to enable the Android virtualization framework, cannot encrypt or decrypt data. Therefore, they can only obtain either encrypted or unencrypted data. Since they can only access encrypted data and not the corresponding decrypted data (the original data), they cannot use it properly. This protects the original data from malicious use by unauthorized processes, ensuring data security on electronic devices.

[0035] In this embodiment, when the electronic device is in encrypted mode, if an authorized process with an enabled virtualization framework obtains the target encrypted data, the authorized process retrieves the target key of the target encrypted data from the virtualization framework, where the virtualization framework includes the key for the corresponding encrypted data. The authorized process then decrypts the target encrypted data based on the target key to obtain the decrypted target data. Thus, when the electronic device is in encrypted mode, only authorized processes with an enabled virtualization framework can obtain the key from the virtualization framework to decrypt the encrypted data and obtain the decrypted data. Unauthorized processes can only obtain the encrypted data and cannot obtain the corresponding decrypted data, thereby preventing unauthorized processes from maliciously using the data and ensuring the data security of the electronic device.

[0036] In an optional embodiment, the virtualization framework includes a management module that obtains the target key for the target encrypted data from the virtualization framework through an authorization process, including:

[0037] The target key for the target encrypted data is obtained from the virtualization framework through the authorized process control and management module.

[0038] The Android virtualization framework includes a management module, which provides the authorization process with the keys in the Android virtualization framework.

[0039] For example, if an authorized process with the Android virtualization framework enabled obtains target encrypted data, it can acquire the identification information of the target encrypted data and generate key acquisition information, which is then sent to the control module. This key acquisition information carries the identification information of the target encrypted data and indicates the target key for acquiring it. Upon receiving the key acquisition information, the control module can extract the identification information of the target encrypted data from this information and determine a matching identification information from the identification information stored in the Android virtualization framework. The key associated with this matching identification information stored in the Android virtualization framework is then identified as the target key for the target encrypted data. The control module can then acquire this target key and send it to the authorized process, thereby enabling the authorized process to obtain the target key for the target encrypted data.

[0040] In an optional embodiment, when the electronic device is in encrypted mode, if the authorized process of the virtualization framework has obtained the target encrypted data, before obtaining the target key of the target encrypted data from the virtualization framework through the authorized process, the method further includes:

[0041] In response to a mode switching operation, the electronic device is switched from unencrypted mode to encrypted mode.

[0042] The mode switching operation can be triggered by the user.

[0043] For example, an Android device can provide a visual interface with a mode-to-switch button. When the Android device is in unencrypted mode, if the user clicks the mode-to-switch button, the Android device receives a mode-to-switch request. In response to this request, the Android device can switch from unencrypted mode to encrypted mode. Similarly, if the user clicks the mode-to-switch button again, the Android device receives another mode-to-switch request. In response to this second request, the Android device can switch from encrypted mode back to unencrypted mode. In other words, based on the user's click on the mode-to-switch button, the Android device can switch between unencrypted and encrypted modes.

[0044] For example, an Android device can also have a physical button for mode switching. When the Android device is in unencrypted mode, if the user presses this physical button, the Android device receives a mode switching operation. In response to this operation, the Android device can switch from unencrypted mode to encrypted mode. Similarly, if the user presses the physical button again, the Android device receives another mode switching operation. In response to this second operation, the Android device can switch from encrypted mode back to unencrypted mode. In other words, based on the user's press of this physical button, the Android device can switch between unencrypted and encrypted modes.

[0045] In an optional embodiment, switching an electronic device from an unencrypted mode to an encrypted mode in response to a mode switching operation includes:

[0046] In response to a mode switching operation, the state of the mode switching module located in the virtual machine monitor is switched from the state corresponding to the unencrypted mode to the state corresponding to the encrypted mode, so as to switch the electronic device from the unencrypted mode to the encrypted mode.

[0047] The virtual machine monitor (VMM), also known as Hyper, includes end-to-end functions such as planning, deploying, managing, and optimizing virtual infrastructure.

[0048] For example, a mode switching module can be set up in the virtual machine monitor of an Android device. This mode switching module has two states: one for encrypted mode and the other for encrypted mode. By switching the states of this mode switching module, the mode of the Android device can be switched.

[0049] For example, an Android device can provide a visual interface with a mode switching button. When the Android device is in unencrypted mode, if the user clicks the mode switching button, the Android device receives a mode switching operation. In response to this operation, the Android device can switch the state of the mode switching module in the virtual machine monitor from the state corresponding to unencrypted mode to the state corresponding to encrypted mode, thus switching the Android device from unencrypted mode to encrypted mode. Understandably, if the user clicks the mode switching button again, the Android device receives another mode switching operation. In response to this second operation, the Android device can switch the state of the mode switching module in the virtual machine monitor from the state corresponding to encrypted mode to the state corresponding to unencrypted mode, thus switching the Android device from encrypted mode to unencrypted mode.

[0050] For example, an Android device can also have a physical button for mode switching. When the Android device is in unencrypted mode, if the user presses this physical button, the Android device receives a mode switching operation. In response to this operation, the Android device can switch the state of the mode switching module in the virtual machine monitor from the state corresponding to unencrypted mode to the state corresponding to encrypted mode, thus switching the Android device from unencrypted mode to encrypted mode. Understandably, if the user presses the physical button again, the Android device receives another mode switching operation. In response to this second operation, the Android device can switch the state of the mode switching module in the virtual machine monitor from the state corresponding to encrypted mode to the state corresponding to unencrypted mode, thus switching the Android device from encrypted mode to unencrypted mode.

[0051] Since the environment at exception levels for unprivileged execution (EL0) is controlled by ROOT (root permissions for Android / Linux), setting the mode switching module in a virtual machine monitor with permissions higher than EL0 can prevent it from being controlled by ROOT.

[0052] In an optional embodiment, switching an electronic device from an unencrypted mode to an encrypted mode in response to a mode switching operation includes:

[0053] In response to a mode switching operation, the state of the mode switching module located in the trusted execution environment is switched from the state corresponding to the unencrypted mode to the state corresponding to the encrypted mode, so as to switch the electronic device from the unencrypted mode to the encrypted mode.

[0054] A trusted execution environment (TEE) is a secure area built on a computing platform using hardware and software methods. It ensures the confidentiality and integrity of code and data loaded within this secure area. Its goal is to ensure a task executes as expected, guaranteeing the confidentiality and integrity of its initial state as well as its runtime state.

[0055] For example, a mode switching module can be set up in the trusted execution environment of an Android device. This mode switching module includes two states: a state corresponding to the encrypted mode and a state corresponding to the encrypted mode. By switching the state of this mode switching module, the mode of the Android device can be switched.

[0056] For example, an Android device can provide a visual interface with a mode switching button. When the Android device is in unencrypted mode, if the user clicks the mode switching button, the Android device receives a mode switching operation. In response to this operation, the Android device can switch the state of the mode switching module located in the trusted execution environment from the state corresponding to unencrypted mode to the state corresponding to encrypted mode, thus switching the Android device from unencrypted mode to encrypted mode. Understandably, if the user clicks the mode switching button again, the Android device receives another mode switching operation. In response to this second operation, the Android device can switch the state of the mode switching module located in the trusted execution environment from the state corresponding to encrypted mode to the state corresponding to unencrypted mode, thus switching the Android device from encrypted mode to unencrypted mode.

[0057] For example, an Android device can also have a physical button for mode switching. When the Android device is in unencrypted mode, if the user presses this physical button, the Android device receives a mode switching operation. In response to this operation, the Android device can switch the state of the mode switching module located in the trusted execution environment from the state corresponding to unencrypted mode to the state corresponding to encrypted mode, thus switching the Android device from unencrypted mode to encrypted mode. Understandably, if the user presses the physical button again, the Android device receives another mode switching operation. In response to this second operation, the Android device can switch the state of the mode switching module located in the trusted execution environment from the state corresponding to encrypted mode to the state corresponding to unencrypted mode, thus switching the Android device from encrypted mode to unencrypted mode.

[0058] Since the exception levels for unprivileged execution (EL0) environment is controlled by ROOT (root permissions for Android / Linux), setting the mode switching module in a trusted environment with permissions higher than EL0 can prevent it from being controlled by ROOT.

[0059] In an optional embodiment, after switching the electronic device from an unencrypted mode to an encrypted mode in response to a mode switching operation, the method further includes:

[0060] Enable the virtualization framework through the authorization process;

[0061] The authorization process responds to the data encryption operation and determines the data to be encrypted as instructed by the data encryption operation.

[0062] The authorization process obtains the key from the virtualization framework to encrypt the data to be encrypted, thus obtaining the encrypted data.

[0063] For example, when an Android device is switched from unencrypted mode to encrypted mode, the authorization process in the Android device can enable the Android virtualization framework to encrypt and decrypt the corresponding data.

[0064] On Android devices, a visual interface can be displayed where users can select the data they wish to encrypt, triggering an encryption operation on the authorization process. In response to this encryption operation, the authorization process identifies the data as the one specified in the operation. Subsequently, the authorization process retrieves a key from the Android virtualization framework to encrypt the data, obtaining the encrypted data. The authorization process can also associate and store the identifier of the encrypted data with its corresponding key within the Android virtualization framework. Later, if the authorization process needs to decrypt the encrypted data, it can retrieve the corresponding key from the Android virtualization framework based on the identifier of the encrypted data to decrypt it.

[0065] In an optional embodiment, if an authorized process with an enabled virtualization framework obtains the target encrypted data, the authorized process retrieves the target key of the target encrypted data from the virtualization framework, including:

[0066] The relevant data is obtained from the device driver through the authorization process;

[0067] If the corresponding data is target encrypted data, the target key for the target encrypted data is obtained from the virtualization framework through the authorization process.

[0068] Understandably, users can also choose to encrypt the driver data output by the device driver, thus initiating an encryption operation in the authorization process. In response to this encryption operation, the authorization process can determine that the driver data is the data to be encrypted as instructed by the encryption operation. Subsequently, the authorization process can obtain a key from the Android virtualization framework to encrypt the data, obtaining the encrypted data. The authorization process can also associate and store the identifier information of the encrypted data with the corresponding key in the Android virtualization framework. Later, if the authorization process obtains corresponding data from the device driver's data output channel, it can check whether the data is the target encrypted data. If the data is the target encrypted data, the authorization process can obtain the corresponding target key from the Android virtualization framework based on the key of the target encrypted data to decrypt the target encrypted data.

[0069] Please see Figure 2 , Figure 2This is a schematic diagram of a scenario for the data processing method provided in the embodiments of this application.

[0070] Taking an Android device that supports AVF as an example, when the Android device is in unencrypted mode, the data in the Android device is unencrypted raw data. Therefore, both authorized and unauthorized processes can access the device driver in a normal way to obtain the unencrypted raw data output by the device driver through the device driver's data output channel.

[0071] If a user does not want certain data from the device driver to be accessed by unauthorized processes, the user can perform a mode switching operation on the Android device. The Android device then receives this user-triggered mode switching operation. In response to this operation, the Android device can switch the state of the mode switching module (switch) located in the virtual machine monitor / trusted execution environment from the state corresponding to the unencrypted mode to the state corresponding to the encrypted mode, thereby switching the Android device from unencrypted mode to encrypted mode.

[0072] After switching an Android device from unencrypted to encrypted mode, the authorized process on the Android device can enable the Android Virtualization Framework (AVF). Users can select data they don't want unauthorized processes to access as the data to be encrypted, and the Android device will then receive the data encryption operation. The Android device can respond to the data encryption operation through the authorized process, obtaining the key from the AVF's management module to encrypt the data. If the authorized process obtains encrypted data from the device driver, it can decrypt the encrypted data using the key obtained from the AVF's management module, obtaining the decrypted data, i.e., the original data, which the authorized process can then use normally. If the unauthorized process obtains encrypted data from the device driver, it cannot obtain the key and therefore cannot decrypt the encrypted data, thus failing to obtain the original data and cannot use it normally.

[0073] If a user subsequently wants certain data from the device driver to be accessible to unauthorized processes, the user can perform a mode switching operation on the Android device. The Android device will then receive this user-triggered mode switching operation. In response to this operation, the Android device can switch the state of the mode switching module (switch) located in the virtual machine monitor / trusted execution environment from the state corresponding to the encrypted mode to the state corresponding to the unencrypted mode, thus switching the Android device from encrypted mode to unencrypted mode. When the Android device is in unencrypted mode, the device driver data is unencrypted raw data. Therefore, both authorized and unauthorized processes can access the device driver normally to obtain the unencrypted raw data output by the device driver through the data output channel.

[0074] Please see Figure 3 , Figure 3 This is a schematic diagram of the structure of a data processing apparatus provided in an embodiment of this application. The data processing apparatus 200 is applied to an electronic device and includes a key acquisition unit 201 and a data decryption unit 202.

[0075] The key acquisition unit 201 is used to, when the electronic device is in encryption mode, if the authorized process of the virtualization framework has been enabled to acquire the target encrypted data, then obtain the target key of the target encrypted data from the virtualization framework through the authorized process, wherein the virtualization framework includes the key of the corresponding encrypted data.

[0076] The data decryption unit 202 is used to decrypt the target encrypted data based on the target key through the authorization process to obtain the target decrypted data.

[0077] In an optional embodiment, the virtualization framework includes a management module and a key acquisition unit 201, which can be used to: control the management module to acquire the target key of the target encrypted data from the virtualization framework through the authorization process.

[0078] In an optional embodiment, the data processing device 200 may further include a mode switching unit, which may be used to switch the electronic device from an unencrypted mode to an encrypted mode in response to a mode switching operation.

[0079] In an optional embodiment, the mode switching unit may be used to: in response to a mode switching operation, switch the state of the mode switching module located in the virtual machine monitor from the state corresponding to the unencrypted mode to the state corresponding to the encrypted mode, so as to switch the electronic device from the unencrypted mode to the encrypted mode.

[0080] In an optional embodiment, the mode switching unit may be used to: in response to a mode switching operation, switch the state of the mode switching module located in the trusted execution environment from the state corresponding to the unencrypted mode to the state corresponding to the encrypted mode, so as to switch the electronic device from the unencrypted mode to the encrypted mode.

[0081] In an optional embodiment, the data processing apparatus 200 may further include a data encryption unit, which may be used to: enable a virtualization framework through an authorization process; determine, in response to a data encryption operation, the data to be encrypted as indicated by the data encryption operation through the authorization process; and encrypt the data to be encrypted by obtaining a key from the virtualization framework through the authorization process to obtain encrypted data.

[0082] In an optional embodiment, the key acquisition unit 201 can be used to: acquire corresponding data from the device driver through the authorization process; if the corresponding data is target encrypted data, acquire the target key of the target encrypted data from the virtualization framework through the authorization process.

[0083] This application provides a computer-readable storage medium storing a computer program thereon, which, when executed on a computer, causes the computer to perform the data processing method provided in this embodiment.

[0084] This application also provides an electronic device, including a memory and a processor, wherein the processor executes the data processing method provided in this embodiment by calling a computer program stored in the memory.

[0085] For example, the aforementioned electronic device could be a mobile terminal such as a tablet or smartphone. See also... Figure 4 , Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0086] The electronic device 300 may include components such as a processor 301 and a memory 302. Those skilled in the art will understand that... Figure 4 The electronic device structure shown does not constitute a limitation on the electronic device and may include more or fewer components than shown, or combine certain components, or have different component arrangements. For example, electronic device 300 may also include a screen.

[0087] The processor 301 is the control center of the electronic device. It connects various parts of the electronic device through various interfaces and lines. By running or executing the application program stored in the memory 302 and calling the data stored in the memory 302, it performs various functions of the electronic device and processes data, thereby monitoring the electronic device as a whole.

[0088] Memory 302 can be used to store applications and data. The applications stored in memory 302 contain executable code. Applications can be composed of various functional modules. Processor 301 executes various functional applications and data processing by running the applications stored in memory 302.

[0089] In this embodiment, the processor 301 in the electronic device loads the executable code corresponding to the processes of one or more applications into the memory 302 according to the following instructions, and the processor 301 runs the applications stored in the memory 302, thereby achieving:

[0090] When the electronic device is in encryption mode, if the authorized process of the virtualization framework has been enabled to obtain the target encrypted data, the target key of the target encrypted data is obtained from the virtualization framework through the authorized process, wherein the virtualization framework includes the key of the corresponding encrypted data.

[0091] The authorized process decrypts the target encrypted data based on the target key to obtain the target decrypted data.

[0092] In an optional embodiment, the virtualization framework includes a management module. When the processor 301 executes the process of obtaining the target key of the target encrypted data from the virtualization framework through the authorization process, it may execute the following: controlling the management module to obtain the target key of the target encrypted data from the virtualization framework through the authorization process.

[0093] In an optional embodiment, before the processor 301 executes the statement that when the electronic device is in encrypted mode, if the authorized process of the virtualization framework has obtained the target encrypted data, the authorized process obtains the target key of the target encrypted data from the virtualization framework, the processor 301 may also execute: in response to a mode switching operation, switch the electronic device from unencrypted mode to encrypted mode.

[0094] In an optional embodiment, when the processor 301 executes the mode switching operation to switch the electronic device from unencrypted mode to encrypted mode, it may perform the following: in response to the mode switching operation, switch the state of the mode switching module located in the virtual machine monitor from the state corresponding to the unencrypted mode to the state corresponding to the encrypted mode, so as to switch the electronic device from unencrypted mode to encrypted mode.

[0095] In an optional embodiment, when the processor 301 executes the mode switching operation to switch the electronic device from unencrypted mode to encrypted mode, it may perform the following: in response to the mode switching operation, switch the state of the mode switching module located in the trusted execution environment from the state corresponding to the unencrypted mode to the state corresponding to the encrypted mode, so as to switch the electronic device from unencrypted mode to encrypted mode.

[0096] In an optional embodiment, after the processor 301 performs the mode switching operation to switch the electronic device from unencrypted mode to encrypted mode, it may further perform the following: enabling the virtualization framework through an authorization process; determining the data to be encrypted as indicated by the data encryption operation through the authorization process in response to the data encryption operation; and encrypting the data to be encrypted by obtaining a key from the virtualization framework through the authorization process to obtain encrypted data.

[0097] In an optional embodiment, when the processor 301 executes the step of obtaining the target key of the target encrypted data from the virtualization framework through the authorization process if the authorized process of the virtualization framework has obtained the target encrypted data, it may perform the following: obtaining corresponding data from the device driver through the authorization process; and if the corresponding data is the target encrypted data, obtaining the target key of the target encrypted data from the virtualization framework through the authorization process.

[0098] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the detailed description of the data processing method above, which will not be repeated here.

[0099] The data processing device provided in this application embodiment belongs to the same concept as the data processing method in the above embodiment. Any method provided in the data processing method embodiment can be run on the data processing device. For details of its implementation process, please refer to the data processing method embodiment, which will not be repeated here.

[0100] It should be noted that, for the data processing method of the embodiments of this application, those skilled in the art will understand that all or part of the process of the data processing method of the embodiments of this application can be implemented by a computer program controlling related hardware. The computer program can be stored in a computer-readable storage medium, such as a memory, and executed by at least one processor. During execution, it can include the process of the embodiments of the data processing method. The computer-readable storage medium can be a magnetic disk, optical disk, read-only memory (ROM), random access memory (RAM), etc.

[0101] It is understood that in the specific implementation of this application, user information, such as application usage behavior data, logs and other related data, is involved. When the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0102] For the data processing apparatus of this application embodiment, its functional modules can be integrated into a single processing chip, or each module can exist physically separately, or two or more modules can be integrated into a single module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk.

[0103] The data processing method, apparatus, storage medium, and electronic device provided in the embodiments of this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A data processing method applied to electronic devices, characterized in that, A mode switching module is set in the virtual machine monitor or trusted execution environment of the electronic device; the switching module includes the state corresponding to the encrypted mode and the state corresponding to the unencrypted mode; when the electronic device switches to the encrypted mode, the authorization process will enable the virtualization framework and encrypt the corresponding data with the key in the virtualization framework to obtain encrypted data; The method involves associating and storing the identifier information of the encrypted data with the corresponding key within a virtualization framework; the method includes: When the electronic device is in encryption mode, if an authorized process with an enabled virtualization framework obtains the target encrypted data, the authorized process retrieves the target key of the target encrypted data from the virtualization framework. This includes: if the authorized process with an enabled virtualization framework obtains the target encrypted data from the device driver, the authorized process obtains the identification information of the target encrypted data and generates key retrieval information, which is then sent to the control module; after receiving the key retrieval information, the control module retrieves the identification information of the target encrypted data from the key retrieval information, determines the matching identification information that matches the identification information of the target encrypted data from the identification information stored in the virtualization framework, and determines the key associated with the matching identification information stored in the virtualization framework as the target key of the target encrypted data; the control module retrieves the target key and sends the target key to the authorized process; wherein, the virtualization framework includes the key of the corresponding encrypted data; The target encrypted data is decrypted by the authorized process based on the target key to obtain the target decrypted data; If it is desired that the data can be obtained by unauthorized processes in the future, the state of the mode switching module located in the virtual machine monitor or trusted execution environment will be switched from the state corresponding to the encrypted mode to the state corresponding to the unencrypted mode. The unauthorized process will then access the device driver in a normal manner to obtain the unencrypted original data output by the device driver through the data output channel.

2. The data processing method according to claim 1, characterized in that, The virtualization framework includes a management module, and the step of obtaining the target key for the target encrypted data from the virtualization framework through the authorization process includes: The authorization process controls the management module to obtain the target key for the target encrypted data from the virtualization framework.

3. The data processing method according to claim 1 or 2, characterized in that, When the electronic device is in encryption mode, if the authorized process of the virtualization framework has been enabled to obtain the target encrypted data, before obtaining the target key of the target encrypted data from the virtualization framework through the authorized process, the method further includes: In response to a mode switching operation, the electronic device is switched from unencrypted mode to encrypted mode.

4. The data processing method according to claim 3, characterized in that, The step of switching the electronic device from unencrypted mode to encrypted mode in response to a mode switching operation includes: In response to a mode switching operation, the state of the mode switching module located in the virtual machine monitor is switched from the state corresponding to the unencrypted mode to the state corresponding to the encrypted mode, so as to switch the electronic device from the unencrypted mode to the encrypted mode.

5. The data processing method according to claim 3, characterized in that, The step of switching the electronic device from unencrypted mode to encrypted mode in response to a mode switching operation includes: In response to a mode switching operation, the state of the mode switching module located in the trusted execution environment is switched from the state corresponding to the unencrypted mode to the state corresponding to the encrypted mode, so as to switch the electronic device from the unencrypted mode to the encrypted mode.

6. The data processing method according to claim 3, characterized in that, After switching the electronic device from unencrypted mode to encrypted mode in response to the mode switching operation, the method further includes: Enable the virtualization framework through the authorization process; The authorization process responds to the data encryption operation and determines the data to be encrypted as indicated by the data encryption operation. The authorized process obtains a key from the virtualization framework to encrypt the data to be encrypted, thus obtaining encrypted data.

7. The data processing method according to claim 1, characterized in that, If the authorized process of the virtualization framework obtains the target encrypted data, then the target key of the target encrypted data is obtained from the virtualization framework through the authorized process, including: The authorization process obtains the corresponding data from the device driver. If the corresponding data is target encrypted data, then the target key of the target encrypted data is obtained from the virtualization framework through the authorization process.

8. A data processing device, applied to electronic equipment, characterized in that, A mode switching module is set in the virtual machine monitor or trusted execution environment of the electronic device; the switching module includes the state corresponding to the encrypted mode and the state corresponding to the unencrypted mode; when the electronic device switches to the encrypted mode, the authorization process will enable the virtualization framework and encrypt the corresponding data with the key in the virtualization framework to obtain encrypted data; The identification information of the encrypted data and the corresponding key are associated and stored in the virtualization framework; The device includes: A key acquisition unit is configured to, when the electronic device is in encryption mode, if an authorized process with an enabled virtualization framework acquires target encrypted data, acquire the target key of the target encrypted data from the virtualization framework through the authorized process. This includes: if the authorized process with an enabled virtualization framework acquires the target encrypted data from the device driver, the authorized process acquires the identification information of the target encrypted data and generates key acquisition information, which is then sent to the control module; upon receiving the key acquisition information, the control module acquires the identification information of the target encrypted data from the key acquisition information, determines a matching identification information from the identification information stored in the virtualization framework that matches the identification information of the target encrypted data, and identifies the key associated with the matching identification information stored in the virtualization framework as the target key of the target encrypted data; the control module acquires the target key and sends it to the authorized process; wherein, the virtualization framework includes the key of the corresponding encrypted data. The data decryption unit is used to decrypt the target encrypted data based on the target key through the authorization process to obtain the target decrypted data; The mode switching unit is used to switch the state of the mode switching module located in the virtual machine monitor or trusted execution environment from the state corresponding to the encrypted mode to the state corresponding to the unencrypted mode if the data is subsequently to be obtained by an unauthorized process. The unauthorized process can then access the device driver in a normal manner to obtain the unencrypted original data output by the device driver through the data output channel.

9. A computer-readable storage medium, characterized in that, The storage medium stores a computer program that, when run on a computer, causes the computer to perform the data processing method according to any one of claims 1 to 7.

10. An electronic device, characterized in that, The electronic device includes a processor and a memory, the memory storing a computer program, and the processor executing the data processing method according to any one of claims 1 to 7 by calling the computer program stored in the memory.

Images