File processing method and device and electronic equipment

Abstract

The invention discloses a file processing method and device and electronic equipment, and belongs to the technical field of the electronic equipment, and the method comprises the steps that the electronic equipment obtains an SIM secret key from a subscriber identity module SIM card in the electronic equipment, and the SIM secret key is a secret key stored in the SIM card; the electronic equipment decrypts the storage space based on the SIM key, the storage space comprises at least one file key, and each file key corresponds to one file; and under the condition that the first file is detected, the electronic equipment decrypts the first file based on a first file key in the at least one file key.

Description

Technical Field

[0001] The present application belongs to the technical field of electronic equipment, and specifically relates to a file processing method, device and electronic equipment. Background Art

[0002] At present, in order to protect the security of user personal information in electronic devices, electronic devices can encrypt stored file data so that the encrypted file data can be unlocked and accessed only when the user enters a correct unlock password. Then, when the user needs to delete certain file data stored in the electronic device, the electronic device can format the storage device to delete the file data stored in the electronic device.

[0003] However, in the above method, when the electronic device encrypts the stored file data, if the unlock password set by the user is relatively simple or scenario-specific, the unlock password may be easily cracked, resulting in failure to effectively protect the security of the user's personal information. In addition, after the storage device is formatted, the system only deletes the location mark of the data, but does not actually erase the data content, so other users can recover the deleted data through professional data recovery tools. As a result, the security of the electronic device's processing of files is poor. Summary of the invention

[0004] The purpose of the embodiments of the present application is to provide a file processing method, device and electronic device, which can improve the security of file processing by electronic devices.

[0005] In a first aspect, an embodiment of the present application provides a file processing method, which includes: an electronic device obtains a SIM key from a subscriber identity module (Subscriber Identity Module, SIM) card in the electronic device, where the SIM key is a key stored in the SIM card; the electronic device decrypts a storage space based on the SIM key, where the storage space includes at least one file key, and each file key corresponds to a file; when a first file is detected, the electronic device decrypts the first file based on a first file key among the at least one file key.

[0006] In a second aspect, an embodiment of the present application provides a file processing device, which includes: an acquisition module and a decryption module; the acquisition module is used to obtain a SIM key from a SIM card in an electronic device, and the SIM key is a key stored in the SIM card; the decryption module is used to decrypt a storage space based on the SIM key obtained by the acquisition module, and the storage space includes at least one file key, and each file key corresponds to a file; and when a first file is detected, the electronic device decrypts the first file based on a first file key among the at least one file key.

[0007] In a third aspect, an embodiment of the present application provides an electronic device, which includes a processor and a memory, wherein the memory stores programs or instructions that can be run on the processor, and when the program or instructions are executed by the processor, the steps of the method described in the first aspect are implemented.

[0008] In a fourth aspect, an embodiment of the present application provides a readable storage medium, on which a program or instruction is stored, and when the program or instruction is executed by a processor, the steps of the method described in the first aspect are implemented.

[0009] In a fifth aspect, an embodiment of the present application provides a chip, comprising a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run a program or instruction to implement the method described in the first aspect.

[0010] In a sixth aspect, an embodiment of the present application provides a computer program / program product, which is stored in a storage medium and is executed by at least one processor to implement the method described in the first aspect.

[0011] In an embodiment of the present application, an electronic device obtains a SIM key from a SIM card of the electronic device to decrypt a storage space based on the obtained SIM key, wherein the storage space includes at least one file key, and each file key corresponds to a file. Then, when a first file is detected, the electronic device decrypts the first file based on the first file key in at least one file key. In this solution, since the electronic device needs to obtain the SIM key from the SIM card during the process of decrypting the storage space, it can be understood that the decryption process of the storage space is bound to the SIM card in the electronic device. Therefore, compared with the existing encryption process of the storage space, additional encryption can be performed through the SIM key without adding any hardware to the electronic device. Furthermore, if there is no SIM card in the electronic device, file processing operations cannot be performed on the files in the storage space, so that the security of the electronic device's file processing can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 This is one of the flowcharts of a decryption storage space provided in an embodiment of the present application;

[0013] Figure 2 This is one of the flowcharts of a file processing method provided in an embodiment of the present application;

[0014] Figure 3 This is the second flowchart of a file processing method provided in an embodiment of the present application;

[0015] Figure 4 This is the third flowchart of a file processing method provided in an embodiment of the present application;

[0016] Figure 5 This is a fourth flowchart of a file processing method provided in an embodiment of the present application;

[0017] Figure 6 This is the second flowchart of a decryption storage space provided by an embodiment of the present application;

[0018] Figure 7 is a structural schematic diagram of a file processing device provided in an embodiment of the present application;

[0019] Figure 8 This is one of the hardware structure diagrams of an electronic device provided in an embodiment of the present application;

[0020] Fig. 9 This is the second schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0021] The following will be combined with the drawings in the embodiments of the present application to clearly describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments in the present application belong to the scope of protection of this application.

[0022] The terms "first", "second", etc. in the specification of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are usually a class, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0023] The terms "at least one (item)", "at least one of" and the like in the specification of the present application refer to any one, any two or a combination of more than two of the objects included therein. For example, at least one (item) of a, b, and c can be represented by: "a", "b", "c", "a and b", "a and c", "b and c" and "a, b and c", where a, b, and c can be single or multiple. Similarly, "at least two (items)" refers to two or more, and its meaning is similar to that of "at least one (item)".

[0024] The following is an explanation of the professional terms involved in the embodiments of the present application:

[0025] File-Based Encryption (FBE) is a data protection mechanism in the Android system, which is mainly used to provide more fine-grained data encryption on device storage to protect the security of files and data.

[0026] Credential Encrypted (CE) storage space, which can be referred to as CE space for short, is the default storage location. The electronic device can only use or call the content stored in the CE space after the user unlocks the electronic device.

[0027] Device Encrypted (DE) storage space, referred to as DE space for short. Electronic devices can use the contents stored in DE space in Direct Boot Mode and after the user unlocks the device. Unlike CE space, DE space is designed to provide higher data security. Even when the device is not unlocked, some applications can access data in DE storage space after adaptation.

[0028] Synthetic Password: A randomly generated key when an Android-based electronic device is turned on for the first time. It is encrypted and protected by the user password and a Keystore key and stored in the normal file system.

[0029] User Token: A lock screen password set by the user, such as a PIN code. This password is used for user identity authentication.

[0030] Keystore Key: A key generated through the Android Keystore interface, which is protected by the root of trust (RoT) to ensure secure storage and management of the key.

[0031] Root of Trust Key (RoT Key): Serves as the root of trust for electronic devices and protects data bound to the device.

[0032] FBE Key: Derived from the synthetic key and used to protect the user's FBE master key.

[0033] FBE Master Key: A file key used to protect each file in the CE space. Only by holding the FBE Master Key can the data in the CE space be unlocked.

[0034] The file processing method provided in the embodiment of the present application is described in detail below through specific embodiments and their application scenarios in conjunction with the accompanying drawings.

[0035] In the related art, when a user needs to delete certain file data stored in an electronic device, the electronic device can delete the file data stored in the electronic device by performing storage device formatting, full disk overwriting, or physical deletion of the key.

[0036] Among them, storage device formatting can make data inaccessible by clearing data indexes. When a user chooses to format a device, the electronic device's system only deletes the location mark of the data without actually erasing the data content. In other words, the deleted data still exists on the storage medium. With the advancement of recovery technology, deleted data may be recovered through professional data recovery tools, which increases the potential risk of data leakage. Especially when users involve personal privacy or important financial information, storage device formatting is particularly unsafe. Therefore, this method has certain risks when handling sensitive information.

[0037] Full disk overwrite can write random data to the storage medium multiple times, thereby overwriting the original data to ensure that the original data to be deleted is completely deleted. Full disk overwrite is an effective physical data erasure technology that can theoretically achieve 100% irrecoverable data. However, although full disk overwrite can ensure that data is completely deleted, its operation is time-consuming, especially when dealing with electronic devices with large-capacity storage, which may take tens of minutes or more. In addition, frequent overwrite operations may affect the life of the storage medium, especially when using technologies such as flash memory, excessive writing may cause device performance to deteriorate.

[0038] Physical deletion of keys can utilize encryption technology to encrypt data and store the keys in a specific partition. When deleting, these keys are physically deleted, making the encrypted data unrecoverable. Although physical deletion of keys theoretically provides the highest data security, its applicability is limited by the hardware support of the storage device of the electronic device. This means that users may face compatibility issues when choosing this method, and it cannot be implemented on all devices, resulting in poor universal applicability of this technology.

[0039] Therefore, in order to enhance the security of user data, the prior art can encrypt the data of the electronic device when it is stored based on FBE technology, and only when the user enters the correct unlock password can the data be unlocked and accessed. In an Android device with FBE function enabled, each user has two storage locations available for applications: CE space and DE space.

[0040] Among them, since the data in the CE space can only be used after the user unlocks the device, it usually contains the user's privacy information, such as personal information, photos and other sensitive data; since the DE space can be used in direct boot mode and after the user unlocks the device, it usually stores data that is unlocked by default after the device is turned on, such as system files.

[0041] Currently, the decryption process of file data stored in the CE storage space depends on the decryption of the synthetic key. Figure 1 As shown, first, the electronic device can obtain the user password and the keystore key to perform secondary decryption on the synthetic key. Among them, the user password can be understood as the lock screen password set by the electronic device by default or actively set by the user; the keystore key is a key generated through the Android Keystore interface and is protected by the root of trust (RoT) key to ensure the secure storage and management of the key.

[0042] Secondly, after the electronic device obtains the synthetic key after secondary decryption, the electronic device can derive the FBE key based on the synthetic key. Then, the electronic device can unlock the FBE master key through the FBE key, thereby unlocking the data in the CE space through the unlocked FBE master key. Furthermore, the user can manage the file data stored in the CE space through the electronic device.

[0043] However, if the user chooses a simple or common password (such as "1234" or "password"), then even if the data is technically encrypted, security will still be threatened. Attackers may easily obtain these weak passwords through brute force or social engineering, thereby bypassing encryption protection and directly accessing the user's data. At the same time, FBE will trigger a penalty mechanism after the user enters the wrong password multiple times, such as extending the lock time or locking the account. Although this mechanism is designed to increase the difficulty of cracking and improve data security, the penalty mechanism itself also has certain limitations. Attackers may use simple scripts or tools to automatically try various passwords, or even exploit system vulnerabilities or design flaws to bypass this mechanism.

[0044] The file processing method provided in the embodiment of the present application can be applied to the scenario of encrypting or decrypting file data stored in the Android system. For example, the user needs to trigger the electronic device to unlock the stored file data to perform file processing on the files stored in the electronic device. For example, viewing pictures, videos, documents and other files of the electronic device; or deleting the data of the electronic device.

[0045] In the file processing method, device and electronic device provided in the embodiment of the present application, the electronic device obtains a SIM key from the SIM card of the electronic device to decrypt the storage space based on the obtained SIM key, and the storage space includes at least one file key, each file key corresponds to a file. Then, when the first file is detected, the electronic device decrypts the first file based on the first file key in the at least one file key. In this scheme, since the electronic device needs to obtain the SIM key from the SIM card in the process of decrypting the storage space, it can be understood that the decryption process of the storage space is bound to the SIM card in the electronic device. Therefore, compared with the existing encryption process of the storage space, additional encryption can be performed by the SIM key without adding any hardware to the electronic device. Furthermore, if there is no SIM card in the electronic device, the file processing operation cannot be performed on the files in the storage space, so that the security of the electronic device for file processing can be improved.

[0046] The execution subject of the file processing method provided in the embodiment of the present application is a file processing device, which can be an electronic device, or a functional module or entity in an electronic device, and the embodiment of the present application does not limit this. The following will take an electronic device as an example to exemplarily illustrate the file processing method provided in the embodiment of the present application.

[0047] The present application embodiment provides a file processing method. Figure 2 FIG. 1 is a flowchart of a file processing method provided by an embodiment of the present application. Figure 2As shown, the file processing method provided in the embodiment of the present application may include the following steps 201 to 203.

[0048] Step 201: The electronic device obtains a SIM key from a SIM card in the electronic device.

[0049] In the embodiment of the present application, the above-mentioned SIM key is a key stored in the SIM card.

[0050] In some embodiments of the present application, when the electronic device includes a SIM card and the electronic device is in a SIM card encryption mode, the electronic device can obtain a SIM key from the SIM card.

[0051] In some embodiments of the present application, the encryption mode of the electronic device may include: a secondary encryption mode and a SIM card encryption mode.

[0052] Among them, the secondary encryption mode is a mode in which the storage space is encrypted by the user password and the keystore key; the SIM card encryption mode is a mode in which the storage space is encrypted by the SIM key, the user password and the keystore key.

[0053] It should be noted that the above user password may be a screen unlocking password, which may include but is not limited to any of the following: a numeric password, an alphanumeric password, a alphanumeric mixed key, a fingerprint password, and a facial image password.

[0054] In some embodiments of the present application, before the electronic device obtains the SIM key from the SIM card, the electronic device may first read the synthesized key in an encrypted state from the file system, and determine the encryption mode of the electronic device through the synthesized key in the encrypted state. Thus, when the electronic device is in the SIM card encryption mode, the SIM key is obtained from the SIM card.

[0055] In some embodiments of the present application, the electronic device may determine the encryption mode of the electronic device based on the suffix name of the read synthetic key.

[0056] It should be noted that the above suffix name may be a suffix name set by default for the electronic device, or may be a suffix name actively set by the user.

[0057] In some embodiments of the present application, if the encryption mode of the electronic device is the secondary encryption mode, the electronic device can decrypt the storage space based on the existing decryption strategy. Wherein, if there is no SIM card inserted in the electronic device, or the electronic device includes a SIM card but the SIM card encryption mode is not activated, the electronic device is in the secondary encryption mode.

[0058] In some embodiments of the present application, the electronic device can obtain the SIM key from the SIM card while the user enters the lock screen password. Alternatively, the electronic device can obtain the SIM key from the SIM card when the user enters the lock screen password and verifies that the lock screen password is correct.

[0059] In some embodiments of the present application, the SIM keys stored in different SIM cards may be different.

[0060] In some embodiments of the present application, when an electronic device includes multiple SIM cards at the same time, the SIM keys obtained by the electronic device may be one or more. Wherein, when there is one SIM key, the one key may be a SIM key stored in a specific SIM card set by the user.

[0061] In some embodiments of the present application, Figure 2 ,like Figure 3 As shown, before the above step 201, the file processing method provided in the embodiment of the present application also includes the following steps 301 and 302.

[0062] Step 301: The electronic device generates a SIM key in the TEE.

[0063] It should be noted that the Trusted Execution Environment (TEE) is an isolated area of ​​memory and CPU, which is isolated from other parts of the CPU using encryption technology to ensure that the code and data loaded in this environment are protected in terms of confidentiality and integrity.

[0064] In this way, due to the characteristics of TEE, such as independence from the operating system, excellent security performance, and simple and easy-to-use interface, electronic devices can generate SIM keys in TEE to ensure the security and integrity of the generated SIM keys. At the same time, TEE also provides functions such as key storage, key update, and key revocation to support the full life cycle management of keys.

[0065] In some embodiments of the present application, the electronic device may generate a SIM key by calling a true random number.

[0066] In some embodiments of the present application, the electronic device can obtain true random numbers through a random number generator. For example, / dev / random and / dev / urandom are two commonly used random number generators.

[0067] Among them, / dev / random is a blocking random number generator, which extracts randomness from the system's entropy pool. When the entropy pool is empty, it blocks the read operation until enough randomness is collected. / dev / urandom is a non-blocking random number generator, which extracts randomness from the entropy pool. If the entropy pool is empty, it uses a pseudo-random number algorithm to generate random numbers. In order to ensure the security of keys generated based on true random numbers, / dev / random or similar high-quality random number generators are usually used to obtain true random numbers.

[0068] In some embodiments of the present application, after the electronic device calls the true random number, the electronic device may generate a SIM key through the following steps A1 to A3.

[0069] Step A1: The electronic device determines the length of the SIM key.

[0070] In some embodiments of the present application, the electronic device may determine the length of the key according to the required encryption algorithm and security requirements. For example, for the Advanced Encryption Standard (AES) encryption algorithm, a 128-bit, 192-bit or 256-bit key is generally used.

[0071] Step A2: The electronic device extracts a true random number of sufficient length based on the called true random number.

[0072] For example, if a 128-bit AES key needs to be generated, a 16-byte (128-bit) true random number needs to be extracted from the random number generator.

[0073] Step A3: The electronic device formats the extracted true random number into a SIM key.

[0074] Exemplarily, for the AES encryption algorithm, the electronic device may directly use the extracted 16-byte true random number as a key, or convert it into a format such as hexadecimal or Base64 for easy storage and transmission.

[0075] In some embodiments of the present application, the timing of generating the SIM key may include but is not limited to any of the following:

[0076] The electronic device detects that a new SIM card is inserted into the electronic device;

[0077] The electronic device includes a SIM card, and the electronic device triggers the electronic device to be in a SIM card encryption mode according to a user input.

[0078] In some embodiments of the present application, the above-mentioned "the electronic device triggers the electronic device to be in SIM card encryption mode based on user input" may be: the user triggers the electronic device to display the setting interface in the system setting application to display at least one setting option; then, the user can trigger the electronic device to display the setting interface related to file encryption, which may include options for setting the file encryption mode, such as a "SIM card encryption mode" option; then, the user can input the "SIM card encryption mode" option to trigger the electronic device to be in SIM card encryption mode.

[0079] Step 302: The electronic device encrypts the SIM key using the RoT key to obtain the encrypted SIM key, and writes the encrypted SIM key into the SIM card.

[0080] It should be noted that the above-mentioned RoT is the foundation and starting point of the entire security system of the electronic device. It is the most trusted component or module in the system of the electronic device. The trust of all other security components and mechanisms originates from it.

[0081] In some embodiments of the present application, the electronic device may encrypt the SIM key using the RoT key in the TEE to obtain the encrypted SIM key.

[0082] In some embodiments of the present application, the above-mentioned RoT key may be one or more keys generated in the RoT hardware module, which are used to encrypt and decrypt other keys.

[0083] In some embodiments of the present application, the electronic device may retrieve the RoT key from the RoT hardware module and use an appropriate encryption algorithm and encryption mode to encrypt the SIM key in the TEE.

[0084] For example, the encryption algorithm may be an AES encryption algorithm; the encryption mode may be a Cipher Block Chaining (CBC) mode or a Galois / Counter Mode (GCM).

[0085] In this way, since the process of using RoT keys to encrypt other keys involves a reinforced hardware module, the encrypted SIM key is protected in a hardware-level security environment, which can reduce the risk of it being cracked or leaked. At the same time, since RoT is a source point that can always be trusted in the encryption system, using RoT keys to encrypt SIM keys can help establish a foundation of trust in the entire ecosystem and ensure the authenticity and integrity of information.

[0086] In some embodiments of the present application, in combination with step 301 and step 302, the above step 201 can be implemented by the following step 201a.

[0087] Step 201a: The electronic device obtains the encrypted SIM key from the SIM card.

[0088] It should be noted that the transmission of the SIM key between the electronic device and the SIM card is similar to the existing method of transmitting keys between different components, and this application will not go into details here.

[0089] In the embodiment of the present application, since the SIM key stored in the SIM card is a key generated in the TEE and encrypted by the RoT key, it can be ensured that the SIM key is generated in a trusted environment, thus preventing external attackers from interfering with the generation of the SIM key. At the same time, since the SIM key is stored in the SIM card, the electronic device can use the pluggable characteristics of the SIM card to provide users with a physically controllable way to obtain the key, which can improve the security of the file data stored in the electronic device.

[0090] Step 202: The electronic device decrypts the storage space based on the SIM key.

[0091] In some embodiments of the present application, the electronic device can decrypt the storage space based on the SIM key, the user password and the keystore key.

[0092] It should be noted that the above-mentioned user password can be a lock screen password actively set by the user, such as a PIN code.

[0093] In some embodiments of the present application, when the electronic device is in different encryption modes, the user can set the same or different passwords for different modes.

[0094] In an embodiment of the present application, the above storage space includes at least one file key.

[0095] In the embodiment of the present application, each file key in the at least one file key corresponds to a file.

[0096] In some embodiments of the present application, the at least one file corresponding to the at least one file key may be a file stored in the CE space of the electronic device.

[0097] In some embodiments of the present application, the electronic device may use the SIM card as a tool similar to a USB shield to implement more identity authentication functions.

[0098] In some embodiments of the present application, Figure 2 ,like Figure 4As shown, in combination with the above steps 301, 302 and 201a, the above step 202 can be specifically implemented through the following steps 202a1 and 202a2.

[0099] Step 202a1: The electronic device decrypts the encrypted SIM key in the TEE to obtain a decrypted SIM key.

[0100] In some embodiments of the present application, since the SIM key obtained by the electronic device from the SIM card is an encrypted key, in order to ensure the security of the key decryption process, the electronic device can decrypt the encrypted SIM key through the RoT key in the TEE to obtain the decrypted SIM key.

[0101] Step 202a2: The electronic device decrypts the storage space based on the decrypted SIM key.

[0102] In some embodiments of the present application, the electronic device may decrypt the storage space based on the decrypted SIM key, user password and keystore key.

[0103] It should be noted that the above decryption method is similar to the method of "decrypting the storage space based on the user password and the keystore key" in the prior art. The decryption method provided in the embodiment of the present application is based on the decrypted SIM key and performs three decryptions, which will not be described in detail in this application.

[0104] In the embodiment of the present application, since the SIM key obtained by the electronic device is encrypted, the electronic device can first perform a decryption process in a secure environment, thereby decrypting the storage space based on the decrypted SIM key. In this way, the security of file management of the electronic device can be further improved through encryption and decryption of the SIM key.

[0105] In some embodiments of the present application, Figure 2 ,like Figure 5 As shown, the above step 202 can be specifically implemented through the following steps 202b1 to 202b4.

[0106] Step 202b1: The electronic device decrypts the synthetic key in the electronic device based on the SIM key.

[0107] In some embodiments of the present application, the electronic device can decrypt the composite key based on the SIM key, the user password and the keystore key.

[0108] Step 202b2: The electronic device derives an FBE key based on the decrypted synthetic key.

[0109] Step 202b3: The electronic device decrypts the FBE master key in the electronic device based on the FBE key.

[0110] Step 202b4: The electronic device decrypts the storage space based on the decrypted FBE master key.

[0111] In some embodiments of the present application, the electronic device may derive an FBE key based on the decrypted synthetic key through a key derivation function (Key Derivation Function).

[0112] Exemplarily, the key derivation function may include but is not limited to any of the following: a password-based key derivation function (Password-Based Key Derivation Function 2, PBKDF2), a simple cryptography (SimpleCryptography, scrypt) function.

[0113] It should be noted that the above method of deriving the FBE key is similar to the derivation method in the prior art, and this application will not elaborate on it here.

[0114] For example, in combination Figure 1 ,like Figure 6 As shown, the electronic device can obtain the SIM key from the SIM card, obtain the keystore key from the keystore, and obtain the user password. Then, the electronic device can decrypt the synthetic key based on the SIM key, the user password and the keystore key to obtain the decrypted synthetic key, so that the electronic device can derive the FBE key through the decrypted synthetic key, and further decrypt the FBE master key through the FBE key, and unlock the at least one file key through the FBE master key.

[0115] It should be noted that the above Figure 6 The dotted box in the figure is only used to indicate that the electronic device in the embodiment of the present application needs to additionally obtain a SIM key from the SIM card to decrypt the synthetic key.

[0116] It should be noted that the above decryption method is similar to the method of "decrypting the synthetic key based on the user password and the user password and the keystore key" in the prior art. The decryption method provided in the embodiment of the present application is based on the decrypted SIM key, and the synthetic key is decrypted three times, which will not be described in detail in this application.

[0117] In some embodiments of the present application, with respect to a SIM card inserted into an electronic device, specific steps from step 202b1 to step 202b4 may be performed during the first screen unlocking process after the user manually turns on the SIM card encryption mode. In the subsequent screen unlocking process, the electronic device may execute an action of obtaining a SIM key from the SIM card, so as to decrypt a synthetic key based on the SIM key, the user password and the keystore key, and then directly obtain the FBE master key stored in the electronic device based on the decrypted synthetic key, and execute subsequent steps.

[0118] In the embodiment of the present application, since the electronic device needs to obtain the SIM key from the SIM card during the process of decrypting the storage space, it can be understood that the decryption process of the storage space is bound to the SIM card in the electronic device. Therefore, compared with the existing encryption process of the storage space, additional encryption can be performed through the SIM key without adding any new hardware in the electronic device. Furthermore, if there is no SIM card in the electronic device, file processing operations cannot be performed on the files in the storage space, so that the security of the electronic device's file processing can be improved.

[0119] Step 203: When the first file is detected, the electronic device decrypts the first file based on a first file key among the at least one file key.

[0120] In some embodiments of the present application, the at least one file key corresponds to a file key corresponding to a file stored in the CE space of the electronic device.

[0121] In some embodiments of the present application, each file key in the at least one file key corresponds to a file.

[0122] In some embodiments of the present application, the above-mentioned first file corresponds to the first file key.

[0123] It is understandable that a first file can only be decrypted using the first file key corresponding to the first file, so that the uniqueness and security of the file content can be guaranteed.

[0124] In some embodiments of the present application, the file type of the first file may include but is not limited to any of the following: document, picture, video, audio.

[0125] In some embodiments of the present application, the above-mentioned “detecting the first file” can be understood as when the user needs to view, edit or delete the first file, it is detected that the user has input the first file and the first file needs to be processed.

[0126] In some embodiments of the present application, the above input may be a click input, a long press input, or other feasible input on the first file.

[0127] In some embodiments of the present application, when a first file is detected, the electronic device can determine a first file key corresponding to the first file from at least one file key based on the file information of the first file, and decrypt the first file based on the first file key, so that the user can trigger the electronic device to perform file processing such as displaying, editing or deleting the decrypted first file.

[0128] In some embodiments of the present application, the above-mentioned file information may include but is not limited to at least one of the following: file name, file storage path, file tag, and file remarks.

[0129] It should be noted that the file processing method provided in the embodiment of the present application is generally applicable to electronic devices including SIM cards and is not limited by the type of storage medium. Regardless of whether the electronic device supports physical level deletion, the physical level data deletion function can be provided to the user.

[0130] Furthermore, for electronic devices that have been sold, they can be updated with software to support the file management method provided in the embodiments of the present application.

[0131] In the file processing method provided in the embodiment of the present application, the electronic device obtains a SIM key from the SIM card of the electronic device to decrypt the storage space based on the obtained SIM key, and the storage space includes at least one file key, and each file key corresponds to a file. Then, when the first file is detected, the electronic device decrypts the first file based on the first file key in the at least one file key. In this scheme, since the electronic device needs to obtain the SIM key from the SIM card in the process of decrypting the storage space, it can be understood that the decryption process of the storage space is bound to the SIM card in the electronic device. Therefore, compared with the existing encryption process of the storage space, additional encryption can be performed by the SIM key without adding any hardware to the electronic device. Furthermore, if there is no SIM card in the electronic device, the file processing operation cannot be performed on the files in the storage space, so that the security of the electronic device for file processing can be improved.

[0132] In some embodiments of the present application, before the above step 201, the file processing method provided by the embodiment of the present application also includes the following step 401.

[0133] Step 401: The electronic device encrypts the synthetic key in the electronic device based on the SIM key.

[0134] In the embodiment of the present application, the above-mentioned synthetic key is used to derive the FBE key, the FBE key is used to encrypt the FBE master key, and the FBE master key encrypts the storage space.

[0135] In some embodiments of the present application, the above-mentioned synthetic key can be a key randomly generated by the electronic device when it is first powered on after leaving the factory. Therefore, the electronic device can derive the FBE key based on the synthetic key and store the FBE key in the storage space of the electronic device. Therefore, after the subsequent electronic device obtains the synthetic key, it can directly obtain the pre-derived FBE key through the storage space.

[0136] In some embodiments of the present application, the electronic device may encrypt a composite key in the electronic device based on a SIM key, a user password, and a keystore key.

[0137] In some embodiments of the present application, the electronic device may generate a SIM key to encrypt the synthetic key in the electronic device when the user manually triggers the electronic device to start the SIM card encryption mode.

[0138] In some embodiments of the present application, if the electronic device is in a secondary encryption mode in which the composite key is encrypted by the user password and the keystore key before starting the SIM card confidentiality mode, then when the user triggers the electronic device to start the SIM key encryption, the electronic device can first display a prompt window or interface to prompt the user to enter the screen unlocking password (i.e., the user password), and then the electronic device can perform identity authentication based on the screen unlocking password entered by the user, and the electronic device can encrypt the composite key in the secondary encryption based on the user password and the keystore key, and save the decryption result to the normal file system. Furthermore, the electronic device can update the prompt information displayed in the promotion window or interface to prompt the user to set a screen unlocking password for the SIM card encryption mode, so that the electronic device can encrypt the composite key according to the screen unlocking password, SIM key and keystore key corresponding to the SIM card encryption mode to obtain the encrypted composite key corresponding to the SIM card encryption mode.

[0139] It should be noted that the screen unlocking password corresponding to the secondary encryption mode and the screen unlocking password corresponding to the SIM card encryption mode can be the same or different. The specific password setting can be determined according to the user's personal needs, and this application does not limit it here.

[0140] In the embodiment of the present application, the above-mentioned storage space is used to store a file key, and the above-mentioned file key is used to encrypt a file.

[0141] In some embodiments of the present application, the above storage space may include at least one file key.

[0142] In some embodiments of the present application, the at least one file key may be a file key corresponding to a file stored in the CE space of the electronic device.

[0143] In the embodiment of the present application, the electronic device can encrypt the synthetic key in the electronic device based on the SIM key, so that the storage space is bound to the SIM card in the electronic device. Therefore, compared with the existing encryption process of the storage space, additional encryption can be performed by the SIM key without adding any hardware to the electronic device. In this way, the security of subsequent file processing of files in the electronic device can be improved.

[0144] In some embodiments of the present application, in combination with the above step 401, the file processing method provided by the embodiment of the present application also includes the following steps 501 and 502.

[0145] Step 501: The electronic device encrypts a first file based on a first file key.

[0146] Step 502: The electronic device stores the first file key in a storage space.

[0147] In some embodiments of the present application, the first file may be any file stored in the CE space of the electronic device.

[0148] In some embodiments of the present application, when the electronic device detects that a new file has been added to the storage space, the electronic device can generate a file key for the new file and encrypt the new file using the file key. In this way, all files in the electronic device CE space can have corresponding file keys.

[0149] In some embodiments of the present application, the newly added file detected by the electronic device may be a file obtained by downloading, or may be a file newly created by the user triggering a file editing software.

[0150] In an embodiment of the present application, the electronic device can encrypt the stored files, store the file key used for encryption in a designated storage space, and protect at least one file key in the storage space based on key encryption. In this way, the risk of file leakage can be reduced through multiple keys, and the security of the electronic device can be improved.

[0151] In some embodiments of the present application, the file processing method provided in the embodiments of the present application also includes the following steps 601 and 602.

[0152] Step 601: The electronic device receives a first input from a user.

[0153] In the embodiment of the present application, the first input is an input for unbinding the electronic device from the SIM card.

[0154] In some embodiments of the present application, the first input may be a click input of a setting option of a SIM card encryption mode by a user, or may be a selection input of an encryption mode of an electronic device by a user.

[0155] Exemplarily, the user can trigger the electronic device to display a setting interface in a system setting application to display at least one setting option; then, the user can trigger the electronic device to display a setting interface related to file encryption, which may include options for setting the file encryption mode, such as a "SIM card encryption mode" option; then, the user can input the "SIM card encryption mode" option to trigger the electronic device to switch from the SIM card encryption mode to the secondary confidentiality mode.

[0156] Step 602: The electronic device unbinds the electronic device from the SIM card in response to the first input, and restores the initial encryption of the storage space based on the SIM key.

[0157] In some embodiments of the present application, the above-mentioned “unbinding the electronic device from the SIM card” may be understood as: the file protection of the files stored in the electronic device has nothing to do with the SIM card.

[0158] In some embodiments of the present application, the above-mentioned “initial encryption” can be understood as an encryption form corresponding to the secondary encryption mode.

[0159] In some embodiments of the present application, the above-mentioned “restoring the initial encryption of the storage space” can be understood as: the electronic device is restored from the SIM card encryption mode to the secondary encryption mode.

[0160] In some embodiments of the present application, the electronic device may display a prompt window or interface to prompt the user to enter the screen-unlocking password corresponding to the SIM card encryption mode, to decrypt the encrypted synthetic key based on the screen-unlocking password, SIM key and keystore key corresponding to the SIM card encryption mode, and save the decrypted result to the normal file system. Then, the electronic device may update the prompt information displayed in the promotion window or interface to prompt the user to set a screen-unlocking password for the secondary encryption mode, to encrypt the synthetic key based on the screen-unlocking password and keystore key entered by the user, and obtain the synthetic key corresponding to the secondary encryption mode.

[0161] In an embodiment of the present application, the electronic device can be untied from the SIM card based on the user's input. Therefore, when the user accesses files stored in the electronic device, the SIM card does not need to be involved. In this way, the file protection problem of the electronic device that does not include a SIM card can be solved, and the flexibility and diversity of the electronic device in protecting stored files can be improved.

[0162] In some embodiments of the present application, the file processing method provided by the embodiments of the present application also includes the following step 701.

[0163] Step 701: When the electronic device cannot detect the SIM card, the electronic device displays a prompt message.

[0164] In some embodiments of the present application, when a user wants to resell or discard an electronic device, the user can actively remove the SIM card in the electronic device so that the electronic device cannot detect the SIM card.

[0165] In some embodiments of the present application, when the electronic device is in a SIM card encryption mode and cannot detect the SIM card, the electronic device cannot obtain the SIM key in the SIM card, and thus, the electronic device cannot decrypt the storage space.

[0166] In the embodiment of the present application, the above prompt information is used to prompt the electronic device to be restored to factory settings.

[0167] In some embodiments of the present application, the electronic device may display a floating window to display prompt information.

[0168] Exemplarily, the prompt message may be: “SIM card cannot be detected, please confirm whether to clear data”.

[0169] In some embodiments of the present application, the floating window may include at least one button so that the electronic device can be aware of the user's needs.

[0170] For example, the floating window may include an "OK" button and a "Cancel" button. The "OK" button may indicate that the user requires the electronic device to immediately perform a cleanup operation, so the electronic device may directly perform the cleanup operation according to the user's input; the "Cancel" button may indicate that the user does not require the electronic device to perform a cleanup operation for the time being.

[0171] In some embodiments of the present application, since the electronic device cannot access the storage space interface, the files stored in the electronic device cannot be accessed, so the user can trigger the electronic device to perform a clearing operation such as restoring factory settings to ensure that the device is restored to a usable state but without user data.

[0172] In the embodiment of the present application, since the storage space of the electronic device is bound to the SIM card, when the user needs to resell or discard the electronic device, the user can pull out the SIM card so that the electronic device cannot perform file processing operations on the files in the storage space, thereby completely deleting the data of the electronic device. In this way, through the simple and intuitive operation of pulling out the SIM card, the user's operation complexity is significantly reduced, and the data can be ensured to be completely deleted at the physical level, thereby effectively preventing potential data leakage risks, making the electronic device more efficient in protecting the stored file data, and improving the security of the electronic device in file processing.

[0173] It should be noted that the above-mentioned method embodiments, or various possible implementation methods in each method embodiment, can be executed separately, or, under the premise that there is no contradiction, can also be executed in combination with each other. The specific implementation can be determined according to actual usage requirements, and the embodiments of the present application do not limit this.

[0174] It should be noted that the file processing method provided in the embodiment of the present application can be executed by a file processing device. In the embodiment of the present application, the file processing device provided in the embodiment of the present application is described by taking the file processing method executed by the file processing device as an example.

[0175] Figure 7 A possible structural diagram of a file processing device involved in an embodiment of the present application is shown. Figure 7 As shown, the file processing device 70 may include: an acquisition module 71 and a decryption module 72;

[0176] The acquisition module 71 is used to acquire a SIM key from a user identity module SIM card in an electronic device, where the SIM key is a key stored in the SIM card;

[0177] The decryption module 72 is used to decrypt the storage space based on the SIM key obtained by the acquisition module 71, where the storage space includes at least one file key, each file key corresponding to a file; and when a first file is detected, the first file is decrypted based on the first file key in the at least one file key.

[0178] In one possible implementation, the file processing device 70 provided in the embodiment of the present application also includes: a generation module and an encryption module; the generation module is used to generate a SIM key in a trusted execution environment TEE before obtaining the SIM key from a SIM card in an electronic device; the encryption module is used to encrypt the SIM key generated by the generation module through the trusted root RoT key to obtain the encrypted SIM key, and write the encrypted SIM key to the SIM card; the acquisition module 71 is specifically used to obtain the encrypted SIM key from the SIM card.

[0179] In a possible implementation, the decryption module 72 is specifically configured to decrypt the encrypted SIM key in the TEE to obtain the decrypted SIM key; and decrypt the storage space based on the decrypted SIM key.

[0180] In a possible implementation, the decryption module 72 is specifically used to: decrypt the synthetic key in the electronic device based on the SIM key; derive the file-level encryption FBE key based on the decrypted synthetic key; decrypt the FBE master key in the electronic device based on the FBE key; and decrypt the storage space based on the decrypted FBE master key.

[0181] In one possible implementation, the file processing device 70 provided in the embodiment of the present application also includes: an encryption module; an encryption module for encrypting a synthetic key in the electronic device based on a SIM key; wherein the synthetic key is used to derive an FBE key, the FBE key is used to encrypt an FBE master key, the FBE master key encrypts a storage space, and the storage space is used to store file keys.

[0182] In a possible implementation, the file processing device 70 provided in the embodiment of the present application also includes: a storage module; an encryption module, which is also used to encrypt the first file based on the first file key; and a storage module, which is used to store the first file key in the storage space.

[0183] In one possible implementation, the file processing device 70 provided in the embodiment of the present application also includes: a receiving module and a processing module; the receiving module is used to receive a first input from the user, the first input is an input for unbinding the electronic device from the SIM card; the processing module is used to respond to the first input, unbind the electronic device from the SIM card, and restore the initial encryption of the storage space based on the SIM key.

[0184] In a possible implementation, the file processing device 70 provided in the embodiment of the present application also includes: a display module; a display module, which is used to display a prompt message when the electronic device cannot detect the SIM card, and the prompt message is used to prompt the electronic device to restore the factory settings.

[0185] In the file processing device provided in the embodiment of the present application, since the file processing device needs to obtain the SIM key from the SIM card during the process of decrypting the storage space, it can be understood that the decryption process of the storage space is bound to the SIM card in the file processing device. Therefore, compared with the existing encryption process of the storage space, additional encryption can be performed through the SIM key without adding any hardware to the file processing device. Furthermore, if there is no SIM card in the file processing device, file processing operations cannot be performed on the files in the storage space, so that the security of the file processing by the file processing device can be improved.

[0186] The file processing device in the embodiment of the present application can be an electronic device, or a component in the electronic device, such as an integrated circuit or a chip. The electronic device can be a terminal, or other devices other than a terminal. Exemplarily, the electronic device can be a mobile phone, a tablet computer, a laptop computer, a PDA, a vehicle-mounted electronic device, a mobile Internet device (Mobile Internet Device, MID), an augmented reality (augmented reality, AR) / virtual reality (virtual reality, VR) device, a robot, a wearable device, an ultra-mobile personal computer (ultra-mobile personal computer, UMPC), a netbook or a personal digital assistant (personal digital assistant, PDA), etc., and can also be a server, a network attached storage (Network Attached Storage, NAS), a personal computer (personal computer, PC), a television (television, TV), a teller machine or a self-service machine, etc., which is not specifically limited in the embodiment of the present application.

[0187] The file processing device in the embodiment of the present application may be a device having an operating system. The operating system may be an Android operating system, an iOS operating system, or other possible operating systems, which are not specifically limited in the embodiment of the present application.

[0188] The file processing device provided in the embodiment of the present application can implement each process implemented in the above method embodiment, and will not be described again here to avoid repetition.

[0189] Alternatively, if Figure 8As shown, an embodiment of the present application further provides an electronic device 90, including a processor 91 and a memory 92, wherein the memory 92 stores programs or instructions that can be executed on the processor 91, and when the program or instructions are executed by the processor 91, the various steps of the above-mentioned file processing method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, they are not described here.

[0190] It should be noted that the electronic devices in the embodiments of the present application include the mobile electronic devices and non-mobile electronic devices mentioned above.

[0191] Fig. 9 A schematic diagram of the hardware structure of an electronic device to implement an embodiment of the present application.

[0192] The electronic device 100 includes but is not limited to components such as a radio frequency unit 101, a network module 102, an audio output unit 103, an input unit 104, a sensor 105, a display unit 106, a user input unit 107, an interface unit 108, a memory 109, and a processor 110.

[0193] Those skilled in the art will appreciate that the electronic device 100 may also include a power source (such as a battery) for supplying power to various components, and the power source may be logically connected to the processor 110 through a power management system, thereby implementing functions such as managing charging, discharging, and power consumption management through the power management system. Fig. 9 The electronic device structure shown in the figure does not constitute a limitation on the electronic device. The electronic device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently, which will not be described in detail here.

[0194] Among them, the processor 110 is used to obtain a SIM key from a user identity module SIM card in the electronic device, where the SIM key is a key stored in the SIM card; and based on the SIM key, decrypt the storage space, where the storage space includes at least one file key, each file key corresponds to a file; and when a first file is detected, decrypt the first file based on a first file key in at least one file key.

[0195] Optionally, the processor 110 is also used to generate a SIM key in a trusted execution environment TEE before obtaining the SIM key from a SIM card in an electronic device; and encrypt the SIM key by using a trusted root RoT key to obtain an encrypted SIM key, and write the encrypted SIM key into the SIM card; the processor 110 is specifically used to obtain the encrypted SIM key from the SIM card.

[0196] Optionally, the processor 110 is specifically configured to decrypt the encrypted SIM key in the TEE to obtain a decrypted SIM key; and decrypt the storage space based on the decrypted SIM key.

[0197] Optionally, the processor 110 is specifically used to decrypt a synthetic key in the electronic device based on the SIM key; and derive a file-level encryption FBE key based on the decrypted synthetic key; and decrypt the FBE master key in the electronic device based on the FBE key; and decrypt the storage space based on the decrypted FBE master key.

[0198] Optionally, the processor 110 is further used to encrypt a synthetic key in the electronic device based on the SIM key; wherein the synthetic key is used to derive an FBE key, the FBE key is used to encrypt an FBE master key, the FBE master key encrypts a storage space, and the storage space is used to store file keys.

[0199] Optionally, the processor 110 is further configured to encrypt the first file based on the first file key; and store the first file key in the storage space.

[0200] Optionally, the user input unit 107 is used to receive a first input from the user, where the first input is an input for unbinding the electronic device from the SIM card; the processor 110 is also used to unbind the electronic device from the SIM card in response to the first input, and restore the initial encryption of the storage space based on the SIM key.

[0201] Optionally, the display unit 106 is used to display a prompt message when the electronic device cannot detect the SIM card, where the prompt message is used to prompt the electronic device to restore factory settings.

[0202] In the electronic device provided in the embodiment of the present application, since the electronic device needs to obtain the SIM key from the SIM card during the process of decrypting the storage space, it can be understood that the decryption process of the storage space is bound to the SIM card in the electronic device. Therefore, compared with the existing encryption process of the storage space, additional encryption can be performed through the SIM key without adding any new hardware in the electronic device. Furthermore, if there is no SIM card in the electronic device, file processing operations cannot be performed on the files in the storage space, so that the security of file processing by the electronic device can be improved.

[0203] The electronic device provided in the embodiment of the present application can implement each process implemented in the above method embodiment and can achieve the same technical effect. To avoid repetition, it will not be described here.

[0204] The beneficial effects of various implementations in this embodiment can be specifically referred to the beneficial effects of the corresponding implementations in the above method embodiment. To avoid repetition, they will not be described again here.

[0205] It should be understood that in the embodiment of the present application, the input unit 104 may include a graphics processor (Graphics Processing Unit, GPU) 1041 and a microphone 1042, and the graphics processor 1041 processes the image data of a static picture or video obtained by an image capture device (such as a camera) in a video capture mode or an image capture mode. The display unit 106 may include a display panel 1061, and the display panel 1061 may be configured in the form of a liquid crystal display, an organic light emitting diode, etc. The user input unit 107 includes a touch panel 1071 and at least one of other input devices 1072. The touch panel 1071 is also called a touch screen. The touch panel 1071 may include two parts: a touch detection device and a touch controller. Other input devices 1072 may include, but are not limited to, a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, and a joystick, which will not be repeated here.

[0206] The memory 109 can be used to store software programs and various data. The memory 109 may mainly include a first storage area for storing programs or instructions and a second storage area for storing data, wherein the first storage area may store an operating system, an application program or instructions required for at least one function (such as a sound playback function, an image playback function, etc.), etc. In addition, the memory 109 may include a volatile memory or a non-volatile memory, or the memory 109 may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), a static random access memory (SRAM), a dynamic random access memory (DRAM), a synchronous dynamic random access memory (SDRAM), a double data rate synchronous dynamic random access memory (DDRSDRAM), an enhanced synchronous dynamic random access memory (ESDRAM), a synchronous link dynamic random access memory (SLDRAM) and a direct memory bus random access memory (DRRAM). The memory 109 in the embodiment of the present application includes but is not limited to these and any other suitable types of memory.

[0207] The processor 110 may include one or more processing units; optionally, the processor 110 integrates an application processor and a modem processor, wherein the application processor mainly processes operations related to an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communication signals, such as a baseband processor. It is understandable that the modem processor may not be integrated into the processor 110.

[0208] An embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the various processes of the above-mentioned method embodiment are implemented and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0209] The processor is the processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory ROM, a random access memory RAM, a magnetic disk or an optical disk.

[0210] An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0211] It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0212] An embodiment of the present application provides a computer program product, which is stored in a storage medium. The program product is executed by at least one processor to implement the various processes of the above-mentioned method embodiment and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0213] It should be noted that, in this article, the terms "comprise", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0214] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, a disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0215] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims

1. A file processing method, characterized in that: The method comprises: The electronic device obtains a SIM key from a subscriber identity module SIM card in the electronic device, where the SIM key is a key stored in the SIM card; The electronic device decrypts the storage space based on the SIM key, the storage space including at least one file key, each file key corresponding to a file; When the first file is detected, the electronic device decrypts the first file based on a first file key among the at least one file key.

2. The method according to claim 1, characterized in that: Before the electronic device obtains the SIM key from the SIM card in the electronic device, the method further includes: The electronic device generates a SIM key in a trusted execution environment TEE; The electronic device encrypts the SIM key by using the trusted root RoT key to obtain the encrypted SIM key, and writes the encrypted SIM key into the SIM card; The electronic device obtains a SIM key from a SIM card in the electronic device, including: The electronic device obtains the encrypted SIM key from the SIM card.

3. The method according to claim 2, characterized in that The electronic device decrypts the storage space based on the SIM key, including: The electronic device decrypts the encrypted SIM key in the TEE to obtain the decrypted SIM key; The electronic device decrypts the storage space based on the decrypted SIM key.

4. The method according to any one of claims 1, characterized in that The electronic device decrypts the storage space based on the SIM key, including: The electronic device decrypts the synthetic key in the electronic device based on the SIM key; The electronic device derives a file-level encryption FBE key based on the decrypted synthetic key; The electronic device decrypts the FBE master key in the electronic device based on the FBE key; The electronic device decrypts the storage space based on the decrypted FBE master key.

5. The method according to claim 1, characterized in that Before the electronic device obtains the SIM key from the SIM card in the electronic device, the method further includes: The electronic device encrypts the synthetic key in the electronic device based on the SIM key; The synthetic key is used to derive the FBE key, the FBE key is used to encrypt the FBE master key, the FBE master key encrypts the storage space, and the storage space is used to store the file key.

6. The method according to claim 5, characterized in that The method further comprises: The electronic device encrypts the first file based on the first file key; The electronic device stores the first file key in the storage space.

7. The method according to claim 1, characterized in that The method further comprises: The electronic device receives a first input from a user, where the first input is an input for unbinding the electronic device from the SIM card; In response to the first input, the electronic device unbinds the electronic device from the SIM card and restores the initial encryption of the storage space based on the SIM key.

8. The method according to claim 1, characterized in that The method further comprises: In the case that the electronic device cannot detect the SIM card, the electronic device displays a prompt message, where the prompt message is used to prompt the electronic device to be restored to factory settings.

9. A file processing device, characterized in that: The file processing device comprises: an acquisition module and a decryption module; The acquisition module is used to acquire a SIM key from a subscriber identity module SIM card in the electronic device, wherein the SIM key is a key stored in the SIM card; The decryption module is used to decrypt the storage space based on the SIM key acquired by the acquisition module, where the storage space includes at least one file key, each file key corresponding to a file; and when a first file is detected, decrypt the first file based on a first file key among the at least one file key.

10. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores a program or instruction that can be run on the processor, and when the program or instruction is executed by the processor, the steps of the file processing method according to any one of claims 1 to 8 are implemented.

Images