App data protection method and device, terminal and storage medium

Abstract

The invention discloses an app data protection method and device, a terminal and a storage medium, and the method comprises the steps: obtaining app login information, generating a database local path and a database secret key based on a user ID and a device ID, judging whether a database file of an app exists in the database local path, and when the database file exists, executing the app login information; reading the database file by using the database secret key to run the app, when the database file does not exist, creating the database file and encrypting the database file by using the database secret key, after the database file is successfully created, creating an empty database file at a default database storage position of the app, and storing the empty database file in the app; a database local path and a database key are generated by using a user ID and a device ID, data can be protected from two levels of a data storage path and data encryption, an empty database file is created at a default database storage position, and an effect of confusing audiovisual of hackers can be achieved.

Description

Technical Field

[0001] The present invention relates to the technical field of app data protection, and in particular to a method, device, terminal and storage medium for protecting app data. Background Art

[0002] In today's digital age, privacy protection for application users has become a vital link, and the Cyberspace Administration of China has attached unprecedented importance to this. However, the openness of Android phones and Windows systems also provides opportunities for hackers and malware, which puts forward more stringent requirements on the security protection capabilities of application developers. Although SQLite databases are usually encrypted through the open source framework SQLCipher to enhance security, a significant weakness is that once hackers determine the package name of the application, they can easily locate the fixed path where the database is stored (such as data / data / application package name / databases / xxxx.db). This predictability allows hackers to process database files in batches and use brute force methods to not only obtain sensitive information in them, but also tamper with data, causing abnormal operation of the application, and the application itself is often difficult to detect. Therefore, how to provide comprehensive and effective protection for application data has always been a major technical challenge facing developers. Summary of the invention

[0003] The technical problem to be solved by the present invention is how to provide effective protection for application data.

[0004] In order to solve the above technical problems, the first aspect of the present invention discloses a method for protecting app data, the method comprising:

[0005] Obtain app login information, wherein the login information includes at least a user ID and a device ID;

[0006] Generate a database local path and a database key based on the user ID and the device ID;

[0007] Determine whether the database file of the app exists in the local path of the database;

[0008] When the database file exists, read the database file using the database key to run the app;

[0009] When the database file does not exist, creating the database file and encrypting the database file using the database key;

[0010] After the database file is successfully created, an empty database file is created in the default database storage location of the app.

[0011] A second aspect of the present invention discloses a device for protecting app data, the device comprising:

[0012] An acquisition module, used to acquire app login information, wherein the login information at least includes a user ID and a device ID;

[0013] A generating module, used for generating a database local path and a database key based on the user ID and the device ID;

[0014] A judgment module, used to judge whether there is a database file of the app in the local path of the database;

[0015] A reading module, used for reading the database file using the database key to run the app when the database file exists;

[0016] A creation module, used for creating the database file and encrypting the database file using the database key when the database file does not exist;

[0017] The creation module is also used to create an empty database file in the default database storage location of the app after the database file is successfully created.

[0018] A third aspect of the present invention discloses an app data protection terminal, the terminal comprising:

[0019] A memory storing executable program code;

[0020] a processor coupled to the memory;

[0021] The processor calls the executable program code stored in the memory to execute part or all of the steps in the app data protection method disclosed in the first aspect of the present invention.

[0022] The fourth aspect of the present invention discloses a computer storage medium, which stores computer instructions. When the computer instructions are called, they are used to execute some or all of the steps in the app data protection method disclosed in the first aspect of the present invention.

[0023] Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

[0024] In an embodiment of the present invention, app login information is obtained, a database local path and a database key are generated based on a user ID and a device ID, and it is determined whether a database file of the app exists in the database local path. When the database file exists, the database file is read using the database key to run the app. When the database file does not exist, a database file is created and the database file is encrypted using the database key. After the database file is successfully created, an empty database file is created in the default database storage location of the app. The database local path and the database key are generated using the user ID and the device ID. Data can be protected from two levels: the data storage path and the data encryption. An empty database file is also created in the default database storage location, which can confuse hackers and further strengthen data protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0026] Figure 1 It is a flowchart of a method for protecting app data disclosed in an embodiment of the present invention;

[0027] Figure 2 It is a schematic diagram of the app-side operation flow of the app data protection method disclosed in an embodiment of the present invention;

[0028] Figure 3 It is a schematic diagram of the interaction process between the app side and the server side of the app data protection method disclosed in an embodiment of the present invention;

[0029] Figure 4 It is a schematic diagram of a database monitoring process of the method for protecting app data disclosed in an embodiment of the present invention;

[0030] Figure 5 It is a structural schematic diagram of an app data protection device disclosed in an embodiment of the present invention;

[0031] Figure 6 It is a structural schematic diagram of an app data protection terminal disclosed in an embodiment of the present invention;

[0032] Figure 7 It is a structural schematic diagram of a computer storage medium disclosed in an embodiment of the present invention. DETAILED DESCRIPTION

[0033] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0034] The terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish different objects rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, device, product or end including a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units that are not listed, or may optionally include other steps or units inherent to these processes, methods, products or ends.

[0035] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present invention. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0036] The present invention discloses a protection method, device, terminal and storage medium for app data, which obtains app login information, generates a database local path and a database key based on a user ID and a device ID, determines whether there is a database file of the app in the database local path, and when the database file exists, uses the database key to read the database file to run the app, and when the database file does not exist, creates a database file and encrypts the database file using the database key. After the database file is successfully created, an empty database file is created in the default database storage location of the app, and a database local path and a database key are generated using the user ID and the device ID. The data can be protected from two levels: the data storage path and the data encryption. An empty database file is also created in the default database storage location, which can confuse hackers and further strengthen the protection of data. The following are detailed descriptions.

[0037] Embodiment 1

[0038] See also Figure 1 , Figure 1 FIG. 1 is a flow chart of a method for protecting app data disclosed in an embodiment of the present invention. Figure 1As shown, the protection method of the app data may include the following operations:

[0039] 101. Obtain app login information, wherein the login information at least includes a user ID and a device ID.

[0040] 102. Generate a database local path and a database key based on the user ID and the device ID.

[0041] 103. Determine whether the database file of the app exists in the local database path.

[0042] 104. When the database file exists, use the database key to read the database file to run the app.

[0043] 105. When the database file does not exist, create the database file and encrypt the database file using the database key.

[0044] 106. After the database file is successfully created, create an empty database file in the default database storage location of the app.

[0045] In an optional embodiment, the generating a database local path and a database key based on the user ID and the device ID includes:

[0046] Determine a transcoded string based on the device ID;

[0047] Based on the transcoded character string, obfuscation calculation and md5 calculation are performed on the user ID and the device ID to obtain a database local path and a database key.

[0048] In an optional embodiment, the local path of the database is expressed as: app private directory ----> MD5 folder after user ID obfuscation ----> MD5 folder after device ID obfuscation ----> encrypted database file.

[0049] In an optional embodiment, the database key is: the MD5 value of the string "user ID obfuscation_device ID obfuscation_MD5 of app signature file key_app signature file md5 value".

[0050] In an optional embodiment, determining the transcoded string based on the device ID includes:

[0051] The server queries whether a corresponding transcoded string already exists for the device ID;

[0052] If it exists, the transcoded string existing on the server is determined as the transcoded string corresponding to the device ID;

[0053] If it does not exist, the transcoding string generation logic is called to generate a transcoding string corresponding to the device ID.

[0054] In an optional embodiment, the method further includes:

[0055] Monitoring the operation method of the database file;

[0056] When monitoring the addition, deletion, modification and database upgrade methods of the database file, the md5 value of the database file is calculated and the new md5 value is stored;

[0057] When the adding, deleting, modifying, checking and database upgrading methods of the database file are monitored, the updating time of the database file is recorded and stored.

[0058] In an optional embodiment, the method further includes:

[0059] When the app login is successful, determine whether the md5 value of the database file matches the stored md5 value;

[0060] If they do not match, log out of the account and return to the login interface;

[0061] If they match, determining whether the access time of the database file matches the stored update time;

[0062] If they do not match, log out of the account and return to the login interface;

[0063] If they match, the business functions of the app will be executed normally.

[0064] Figure 2 It is a schematic diagram of the app-side operation flow of the app data protection method disclosed in an embodiment of the present invention.

[0065] like Figure 2 As shown, after the App logs in successfully, the login information contains the uid, which is pieced together with the uid and device information into the local path of the database. The local path of the database is: app private directory ----> MD5 folder after user ID obfuscation ----> MD5 folder after device ID obfuscation ----> encrypted database file.

[0066] The database key is generated using the user ID (uid) returned by the login information. The method of generating the database key is: user ID obfuscation_device ID obfuscation_MD5 of app signature file key_app signature file md5 value, and the string is then md5-converted; the database key is mainly used to encrypt the database file.

[0067] The existence of the database file is determined through the above-mentioned local database path. If it does not exist, the database file is created and the database file is encrypted by the above-mentioned encryption key; if the database file exists, the database is read by the database key, if successful, the business function is executed normally, if it fails, it returns to the login interface, reports the log to the server and adds it to the blacklist; adding to the blacklist can prohibit the device or user from logging in permanently.

[0068] When the database is created successfully, an empty database file is created in the private directory (the default database storage location) with the file name: application name.db; this is used to confuse hackers.

[0069] In the embodiment of the present invention, the database storage path and the key generation method both adopt a dynamic solution. The paths for different user IDs or different device IDs are different. Moreover, the user ID and device ID are relatively sensitive data. Such data will be obfuscated and then converted to MD5, rather than a single MD5.

[0070] In the embodiment of the present invention, the logic of the dynamic storage path of the database is: app private directory ----> MD5 folder after user ID obfuscation ----> MD5 folder after device ID obfuscation ----> encrypted database file.

[0071] In the embodiment of the present invention, the key generation method is: user ID obfuscation_device ID obfuscation_MD5 of app signature file key_app signature file md5 value, and the total MD5 value of the string.

[0072] In the embodiment of the present invention, the logic of generating the transcoded string of the user ID and the device ID is, for example: the transcoded string returned by the server is poklmnjiuhbqazxswdecfvrgtb58!@#$%*18, the English letter type in the user ID and the device ID intercepts the 0th to 25th bits in the transcoded string, the length is 26 bits, the English letter a corresponds to p, b corresponds to o, and so on; the digital type in the user ID and the device ID intercepts the 26th to 35th bits in the transcoded string, the length is 10 bits, 0 corresponds to 5, 1 corresponds to 8, and so on.

[0073] Figure 3 It is a schematic diagram of the interaction process between the app side and the server side of the app data protection method disclosed in an embodiment of the present invention.

[0074] like Figure 3As shown, when the App logs in, the login parameters include: App version number, device ID, App signature file keyMD5 value, App signature file MD5 value, account / password / SMS verification code (general parameters), device model, and device system version. Call the Http method to request the login interface. When the server receives the login parameters and verifies them, the server queries the transcoded string in the data based on the device ID to see if it exists. If it does, it returns the transcoded string, account information (including uid), and login status to the app. If it does not exist, the server calls the logic for generating the transcoded string. The transcoded string is: abcdefghijklmnopqrstuvwxyz1234567890~! @#$%^&*()_+{}":?><; A 36-bit random transcoded string is generated based on the transcoded string. The device ID and the transcoded string are stored in the data table, and the device ID corresponds to the transcoded string. After the generation, the transcoded string, account information (including uid), and login status are returned to the app.

[0075] In the embodiment of the present invention, the server can dynamically send instructions 902 to the App according to the user ID or device ID, and the App can log out and delete the database according to the instructions. Application scenario: When there are user complaints or feedback or a Trojan horse is detected on the App, the server controls the App to minimize the risk of data leakage.

[0076] Figure 4 It is a schematic diagram of a database monitoring process of the app data protection method disclosed in an embodiment of the present invention.

[0077] like Figure 4 As shown, the App logs in successfully and starts the database monitoring function, which includes database addition, deletion, modification, and database upgrade methods. When these functions are executed, the md5 value of the database file will be calculated and stored in the XML file:<db_md5> 1894358945869< / db_md5> .

[0078] In the embodiment of the present invention, the App logs in successfully, starts the database monitoring function, and monitors the database addition, deletion, modification, and database upgrade methods. When the function is monitored, the latest time value is updated to the XML file:<db_update_time> 1729482621< / db_update_time> .

[0079] In the embodiment of the present invention, when the App logs in successfully, the first verification logic is: determine whether the MD5 value of the database file is equal to the MD5 value stored in the XML file. If it is equal, the business function is executed normally. If it is not equal, the account is cancelled and the return value login interface is reported, and the log is reported to the server to add it to the blacklist; the second verification logic is: determine whether the database file access time is consistent with the time recorded in the XML file. If it is consistent, the business function is executed normally. If it is inconsistent, the account is cancelled and the return value login interface is reported, and the log is reported to the server to add it to the blacklist.

[0080] The method for protecting app data disclosed in the embodiment of the present invention has the following advantages:

[0081] 1. Generate a database disguise file. A database file with a default path will be generated. This database file is an empty database file, which makes hackers think that the app will not store data in the database.

[0082] 2. The database encryption key is dynamically generated by using the formula of "user ID obfuscation_device ID obfuscation_app signature file key MD5_app signature file md5 value" and then MD5;

[0083] 3. The database file path is dynamically generated using the formula of app private directory / MD5 folder after user ID obfuscation / MD5 folder after device ID obfuscation / encrypted database file;

[0084] 4. Database file protection mechanism, the program monitors the database access time check and the database file MD5 check, double check protection;

[0085] 5. The database file supports the server to issue instructions for deletion. Instructions can be issued according to user ID or device ID to protect data in time and reduce the risk of information data leakage;

[0086] 6. The user ID and device ID data are transcoded twice. The folder name is not a single user ID and device ID for MD5, but is transcoded through the string transcoding mechanism and then used as the folder name after MD5, which increases the difficulty of cracking;

[0087] 7. The device ID / user ID server controls the blacklist mechanism, which temporarily prohibits the at-risk device or user from logging into the app and allowing it to be used again after the risk is eliminated.

[0088] It can be seen that implementation Figure 1The described method for protecting app data obtains app login information, generates a database local path and a database key based on a user ID and a device ID, determines whether a database file of the app exists in the database local path, and when the database file exists, uses the database key to read the database file to run the app; when the database file does not exist, creates a database file and encrypts the database file using the database key; after the database file is successfully created, creates an empty database file in the default database storage location of the app, generates a database local path and a database key using the user ID and the device ID, can protect data from two levels: data storage path and data encryption, and also creates an empty database file in the default database storage location, which can confuse hackers and further strengthen data protection.

[0089] Embodiment 2

[0090] See also Figure 5 , Figure 5 Schematic diagram of a device for protecting app data disclosed in an embodiment of the present invention. Figure 5 As shown, the protection device of the app data may include:

[0091] The acquisition module 501 is used to acquire app login information, wherein the login information at least includes a user ID and a device ID;

[0092] A generating module 502, configured to generate a database local path and a database key based on the user ID and the device ID;

[0093] A determination module 503 is used to determine whether the database file of the app exists in the local path of the database;

[0094] A reading module 504, configured to read the database file using the database key to run the app when the database file exists;

[0095] A creation module 505, used for creating the database file and encrypting the database file using the database key when the database file does not exist;

[0096] The creation module 505 is also used to create an empty database file in the default database storage location of the app after the database file is successfully created.

[0097] For the specific description of the above-mentioned app data protection device, reference can be made to the specific description of the above-mentioned app data protection method, which will not be repeated here.

[0098] Embodiment 3

[0099] See also Figure 6 , Figure 6 Schematic diagram of the structure of an app data protection terminal disclosed in an embodiment of the present invention. Figure 6 As shown, the protection terminal of the app data may include:

[0100] A memory 601 storing executable program codes;

[0101] a processor 602 coupled to the memory 601;

[0102] The processor 602 calls the executable program code stored in the memory 601 to execute the steps in the method for protecting app data disclosed in the first embodiment of the present invention.

[0103] Embodiment 4

[0104] An embodiment of the present invention discloses a computer storage medium, which stores computer instructions. When the computer instructions are called, they are used to execute the steps in the app data protection method disclosed in the first embodiment of the present invention.

[0105] The device embodiments described above are only illustrative, wherein the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, i.e., they may be located in one place, or they may be distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those of ordinary skill in the art may understand and implement it without creative work.

[0106] Through the specific description of the above embodiments, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on such an understanding, the above technical solution can be essentially or partly contributed to the prior art in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, and the storage medium includes a read-only memory (ROM), a random access memory (RAM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), a one-time programmable read-only memory (OTPROM), an electronically erasable rewritable read-only memory (EEPROM), a compact disc (CD-ROM) or other optical disc storage, magnetic disk storage, magnetic tape storage, or any other computer-readable medium that can be used to carry or store data.

[0107] Finally, it should be noted that the method, device, terminal and storage medium for protecting app data disclosed in the embodiments of the present invention are only preferred embodiments of the present invention, and are only used to illustrate the technical solution of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features thereof may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for protecting app data, characterized in that: The method comprises: Obtain app login information, wherein the login information includes at least a user ID and a device ID; Generate a database local path and a database key based on the user ID and the device ID; Determine whether the database file of the app exists in the local path of the database; When the database file exists, read the database file using the database key to run the app; When the database file does not exist, creating the database file and encrypting the database file using the database key; After the database file is successfully created, an empty database file is created in the default database storage location of the app.

2. The method for protecting app data according to claim 1, characterized in that: The generating a database local path and a database key based on the user ID and the device ID includes: Determine a transcoded string based on the device ID; Based on the transcoded character string, obfuscation calculation and md5 calculation are performed on the user ID and the device ID to obtain a database local path and a database key.

3. The method for protecting app data according to claim 2, characterized in that: The local path of the database is expressed as: app private directory ----> MD5 folder after user ID obfuscation ----> MD5 folder after device ID obfuscation ----> encrypted database file.

4. The method for protecting app data according to claim 3, characterized in that: The database key is: the MD5 value of the string "user ID obfuscation_device ID obfuscation_app signature file key MD5_app signature file md5 value".

5. The method for protecting app data according to claim 2, characterized in that: The determining the transcoded string based on the device ID includes: The server queries whether a corresponding transcoded string already exists for the device ID; If it exists, the transcoded string existing on the server is determined as the transcoded string corresponding to the device ID; If it does not exist, the transcoding string generation logic is called to generate a transcoding string corresponding to the device ID.

6. The method for protecting app data according to any one of claims 1 to 5, characterized in that: The method further comprises: Monitoring the operation method of the database file; When monitoring the addition, deletion, modification and database upgrade methods of the database file, the md5 value of the database file is calculated and the new md5 value is stored; When the adding, deleting, modifying, checking and database upgrading methods of the database file are monitored, the updating time of the database file is recorded and stored.

7. The method for protecting app data according to claim 6, characterized in that: The method further comprises: When the app login is successful, determine whether the md5 value of the database file matches the stored md5 value; If they do not match, log out of the account and return to the login interface; If they match, determining whether the access time of the database file matches the stored update time; If they do not match, log out of the account and return to the login interface; If they match, the business functions of the app will be executed normally.

8. A device for protecting app data, characterized in that: The device comprises: An acquisition module, used to acquire app login information, wherein the login information at least includes a user ID and a device ID; A generating module, used for generating a database local path and a database key based on the user ID and the device ID; A judgment module, used to judge whether there is a database file of the app in the local path of the database; A reading module, used for reading the database file using the database key to run the app when the database file exists; A creation module, used for creating the database file and encrypting the database file using the database key when the database file does not exist; The creation module is also used to create an empty database file in the default database storage location of the app after the database file is successfully created.

9. A terminal for protecting app data, characterized in that: The terminal comprises: A memory storing executable program code; a processor coupled to the memory; The processor calls the executable program code stored in the memory to execute the app data protection method according to any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method for protecting app data as described in any one of claims 1 to 7 is implemented.

Images