Data encryption method, data decryption method, related device, equipment and storage medium

Abstract

The invention discloses a data encryption method, a data decryption method, a related device, equipment and a storage medium, and the data encryption method comprises the steps: sequentially and temporarily storing each segment of plaintext data of streaming voice generated by a voice application in a first cache space in a non-secure world in a system architecture of electronic equipment; performing data polling in the first cache space to sequentially extract each segment of plaintext data to a safe world in the system architecture; encrypting the plaintext data based on an encryption module in the secure world to obtain ciphertext data, and returning the ciphertext data to a second cache space of the non-secure world; and performing data polling in the second cache space so as to sequentially extract each section of ciphertext data into the first association space of the voice application. According to the scheme, the real-time performance and safety of data encryption can be improved, especially for streaming voice.

Description

Technical Field

[0001] The present application relates to the technical field of data encryption and decryption, and in particular to a data encryption and decryption method and related devices, equipment and storage media. Background Art

[0002] With the continuous development of information security technology, data encryption has become a key means of protecting user privacy and sensitive data. For example, voice data often contains sensitive information such as personal privacy and commercial secrets. Especially in offline device environments, reliable data encryption solutions are even more necessary.

[0003] However, existing encryption technologies often struggle to meet the encryption requirements of streaming voice, often suffering from issues such as a lack of real-time data encryption and vulnerability to attacks. Therefore, improving the real-time performance and security of data encryption, especially for streaming voice, has become a pressing issue. Summary of the Invention

[0004] The main technical problem solved by this application is to provide a data encryption and decryption method and related devices, equipment and storage media, which can improve the real-time performance and security of data encryption, especially for streaming voice.

[0005] In order to solve the above technical problems, the first aspect of the present application provides a data encryption method, including: in a non-secure world in the system architecture of an electronic device, temporarily storing each segment of plaintext data of the streaming voice generated by the voice application in a first cache space in sequence; performing data polling in the first cache space to extract each segment of plaintext data in sequence to the secure world in the system architecture; encrypting the plaintext data based on the encryption module in the secure world to obtain ciphertext data, and returning the ciphertext data to a second cache space in the non-secure world; performing data polling in the second cache space to extract each segment of ciphertext data in sequence to the first associated space of the voice application.

[0006] In order to solve the above technical problems, the second aspect of the present application provides a data decryption method, including: in the non-secure world in the system architecture of the electronic device, extracting the plaintext data of each segment of streaming voice generated by the voice application in sequence, and transferring the encrypted data after encryption operation to the secure world in the system architecture; wherein the ciphertext data is obtained by the data encryption method in the above-mentioned first aspect; decrypting the ciphertext data based on the decryption module in the secure world to obtain the decrypted data of the ciphertext data, and returning the decrypted data to the second association space of the voice application.

[0007] In order to solve the above technical problems, the third aspect of the present application provides a data encryption device, including: a segmented temporary storage module, a first polling module, an encryption cache module and a second polling module. The segmented temporary storage module is used to temporarily store each segment of streaming voice generated by the voice application in the first cache space in the non-secure world in the system architecture of the electronic device; the first polling module is used to perform data polling in the first cache space to extract each segment of plaintext data in turn to the secure world in the system architecture; the encryption cache module is used to encrypt the plaintext data based on the encryption module in the secure world to obtain ciphertext data, and return the ciphertext data to the second cache space in the non-secure world; the second polling module is used to perform data polling in the second cache space to extract each segment of ciphertext data in turn to the first associated space of the voice application.

[0008] In order to solve the above technical problems, the fourth aspect of the present application provides a data decryption device, including: a segmented extraction module and a decryption storage module. The segmented extraction module is used to extract the plaintext data of each segment of streaming voice generated by the voice application in the non-secure world in the system architecture of the electronic device, and then transfer the encrypted data to the secure world in the system architecture after encryption operation; wherein the ciphertext data is obtained by the data encryption device in the above third aspect; the decryption storage module is used to decrypt the ciphertext data based on the decryption module in the secure world, obtain the decrypted data of the ciphertext data, and return the decrypted data to the second associated space of the voice application.

[0009] In order to solve the above technical problems, the fifth aspect of this application provides an electronic device, which at least includes a memory and a processor coupled to each other, wherein the memory at least stores program instructions, and the processor is used to execute the program instructions to implement the data encryption method in the above first aspect, or the data decryption method in the above second aspect.

[0010] In order to solve the above technical problems, the sixth aspect of this application provides a computer-readable storage medium, which stores program instructions that can be executed by a processor, and the program instructions are used to implement the data encryption method of the first aspect above, or the data decryption method of the second aspect above.

[0011] The above scheme temporarily stores each segment of plaintext data of the streaming voice generated by the voice application in the first cache space in the non-secure area of the system architecture of the electronic device in turn, and performs data polling in the first cache space to extract each segment of plaintext data in turn to the secure world in the system architecture, thereby encrypting the plaintext data based on the encryption module in the secure world to obtain ciphertext data, and returning the ciphertext data to the second cache space of the non-secure world, and then performing data polling in the second cache space to extract each segment of ciphertext data in turn to the first associated space of the voice application. Therefore, on the one hand, by temporarily storing the streaming voice in segments and performing data polling, A series of operations, such as polling, sequentially extract each segment of plaintext data to the Secure World, enabling real-time processing of streaming voice while preparing for data encryption. After encryption is complete, the ciphertext data is returned to the second cache space, and data polling is performed within the second cache space. This enables real-time processing of streaming voice even after encryption is complete. This improves the real-time nature of data encryption, particularly for streaming voice. Furthermore, since each segment of plaintext data is sequentially extracted to the Secure World during data encryption for encryption by the encryption module within the Secure World, this helps minimize the security risk of attacks during the encryption process. This improves the real-time nature and security of data encryption, particularly for streaming voice. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 This is a flow chart of an embodiment of the data encryption method of the present application; Figure 2a This is a schematic diagram of the framework of an embodiment of the electronic device system architecture of the present application; Figure 2b This is a schematic diagram of a framework of an embodiment of segmented storage in the present application, taking a non-secure world including a recording application and a transcription application as an example; Figure 2c This is a process diagram of an embodiment of the data encryption method of the present application; Figure 3 This is a flow chart of an embodiment of the data decryption method of the present application; Figure 4 This is a process diagram of an embodiment of the data decryption method of the present application; Figure 5 This is a schematic diagram of the framework of an embodiment of the data encryption device of the present application; Figure 6 This is a schematic diagram of the framework of an embodiment of the data decryption device of the present application; Figure 7 This is a schematic diagram of the framework of an embodiment of the electronic device of the present application; Figure 8 It is a schematic diagram of a framework of an embodiment of the computer-readable storage medium of the present application. DETAILED DESCRIPTION

[0013] The following describes the embodiments of the present application in detail with reference to the accompanying drawings.

[0014] In the following description, for the purpose of explanation rather than limitation, specific details such as specific system structures, interfaces, and technologies are provided to facilitate a thorough understanding of the present application.

[0015] The terms "system" and "network" are often used interchangeably in this document. The term "and / or" is simply a description of an association between related objects, indicating that three possible relationships exist. For example, "A and / or B" can mean: A exists alone, A and B exist simultaneously, or B exists alone. Furthermore, the fragment " / " generally indicates that the related objects are in an "or" relationship. Furthermore, "multiple" in this document refers to two or more than two.

[0016] See also Figure 1 , Figure 1 This is a flow chart of an embodiment of the data encryption method of the present application. Specifically, it may include the following steps: Step S11: In the non-secure world of the system architecture of the electronic device, each segment of plaintext data of the streaming voice generated by the voice application is temporarily stored in a first buffer space in sequence.

[0017] In one implementation scenario, electronic devices may include, but are not limited to, voice recorders, mobile phones, smart watches, tablet computers, office notebooks, learning machines, and other electronic products. The specific types of electronic devices are not limited here. For example, the electronic device may be integrated with a microphone to enable itself to collect streaming voice; or, the electronic device may be integrated with a communication circuit (such as Bluetooth, etc.) to communicate with other devices that can collect streaming voice and receive streaming voice from other devices; or, the above two situations may be combined, that is, the electronic device may be integrated with a microphone to enable itself to collect streaming voice, and may also be integrated with a communication circuit to communicate with other devices that can collect streaming voice and receive streaming voice from other devices. Of course, the above examples are only a few possible examples in actual application, and the specific structure of the electronic device is not limited here.

[0018] In an implementation scenario, take the introduction of Trust Zone into electronic equipment as an example. Please refer to Figure 2a , Figure 2a This is a schematic diagram of the framework of an embodiment of the electronic device system architecture of this application. Figure 2aAs shown, the system architecture is divided vertically into two worlds: the Secure World and the Non-Secure World, and horizontally into four Exception Levels (ELs), from EL0 to EL3. Each level has different privileges and uses. EL0 represents the user level, EL1 represents the operating system kernel level, EL2 represents the hypervisor level, and EL3 represents the security monitoring level. In the Non-Secure World (EL0), the CA library represents a library used by applications developed in the Non-Secure World, providing an interface for communication with applications in the Secure World. In the Secure World (EL0), the TA library represents a library used to develop Trusted Applications (TAs), providing a series of security service interfaces such as secure storage, encryption and decryption, and key management. Furthermore, in the Secure World (EL0), SM4 is a symmetric block cipher algorithm, meaning that encryption and decryption use the same key, while MD5 represents a cryptographic hash function. In both the Non-Secure World and the Secure World (EL1), the Trusty Driver represents the driver for the Trusty Operating System (Trust OS). In the Non-Secure World (EL2), U-Boot and UEFI represent two different boot loaders. In the Secure World's EL3, the TOS Dispatcher represents the Trusty operating system's task scheduler, primarily responsible for managing and coordinating the execution of tasks within the TrustZone security domain. Trust Firmware is open-source secure firmware. The Platform Initialization Firmware (SBL) runs after the Primary Boot Loader (PBL) and before the operating system or other major applications. It primarily performs hardware initialization, security feature configuration, loading the operating system or applications, performing self-tests and diagnostics, and updating firmware or software components. The Boot Rom (PBL) is the first code executed after the chip is powered on and is typically stored in the chip's read-only memory area. The above is an example of a possible system architecture for an electronic device using the Trust Zone. For more detailed information, please refer to the Trust Zone technical details. Other possible scenarios will not be listed here.

[0019] In one implementation scenario, the voice application may be specifically configured based on the device type of the electronic device. For example, if the electronic device is a voice recorder, the voice application may include, but is not limited to, a recording application; or, if the electronic device is a translator, the voice application may include, but is not limited to, a translation application; or, if the electronic device is an office notebook, the voice application may include, but is not limited to, a note-taking application. Other possible scenarios are not listed here one by one.

[0020] In one implementation scenario, the plaintext data segments of streaming voice generated by voice applications can be stored in unbounded queues based on compare and swap (CAS), ensuring secure and orderly concurrent calls. Furthermore, streaming voice can be segmented into 64KB segments to reduce the number of Trust Zone calls when introducing a Trust Zone, improving encryption and decryption performance. Of course, streaming voice can be segmented into other sizes, not limited to 64KB. The specific segment size is not specified here.

[0021] In one implementation scenario, the non-secure world may also contain at least one non-voice application with encryption requirements in addition to the voice application. For example, the non-secure world may also contain a transcription application (i.e., for recognizing voice into text). Figure 2b , Figure 2b This is a schematic diagram of a framework for a segmented storage embodiment of the present application, taking the non-secure world including the recording application and the transcription application as an example. Figure 2b As shown, in this scenario, in the non-secure world, a segmented lock can also be used to concurrently temporarily store the plaintext data of various applications in the first cache space, including voice applications and non-voice applications. It should be noted that solid arrows indicate the data flow of plaintext data, and dashed arrows indicate the data flow of ciphertext data. Furthermore, JNI stands for Java Native Interface, which leverages the security features and underlying hardware functionality of the Trust Zone while maintaining the convenience and portability of the Java language. Calib.so is a shared library file (.so is the extension for shared files in Linux). For more details, please refer to the Trust Zone technical details and will not be elaborated here. With the above approach, if the non-secure world also contains at least one non-voice application with encryption requirements in addition to the voice application, the segmented lock can be used in the non-secure world to concurrently temporarily store the plaintext data of various applications in the first cache space, including voice applications and non-voice applications. This can maximize the ability to support concurrency between tasks without impacting each other's performance.

[0022] In one implementation scenario, when the file format of the streaming voice includes header information, the header information may be retained before the plaintext data of each segment of the streaming voice generated by the voice application is temporarily stored in the first cache space in sequence. It should be noted that in this case, the plaintext data can be extracted in segments from the portion other than the header information of the streaming voice, and the header information is used to combine the two after the ciphertext data is decrypted by the decryption module in the secure world to obtain the decrypted data of the ciphertext data, so as to obtain a playable audio file. For details, please refer to the relevant description in the data decryption method embodiment below, which will not be repeated here. For example, taking the streaming voice as a ".wav" file as an example, the header information of the streaming voice can be retained in the non-secure world first, and only the data portion other than the header information can be temporarily stored in segments. Of course, the above example is only one possible example in actual application, and other possible situations will not be given examples one by one here. In the above method, when the file format of the streaming voice includes header information, before temporarily storing the plaintext data of each segment of the streaming voice generated by the voice application in the first cache space in sequence, the header information is first retained, and the plaintext data is extracted in segments from the portion of the streaming voice outside the header information. The header information is used to combine the two after the ciphertext data is decrypted by the decryption module in the secure world to obtain the decrypted data of the ciphertext data, so as to obtain a playable audio file. The header information reservation mechanism can ensure the compatibility and integrity of the file as soon as possible.

[0023] Step S12: Perform data polling in the first cache space to sequentially extract each segment of plaintext data to the secure world in the system architecture.

[0024] In one implementation scenario, as a possible implementation, data polling can be performed in the first cache space based on a first-in, first-out principle to sequentially extract each segment of plaintext data into the secure world of the system architecture. In other words, plaintext data temporarily stored in the first cache space will be extracted from the first cache space and transferred to the secure world first.

[0025] In another implementation scenario, distinct from the aforementioned embodiment, as another possible implementation, during the data polling process, to minimize the risk of data loss, the current progress of the encryption module processing the plaintext data already extracted to the secure world can be monitored. Based on the current progress, a determination can be made as to whether to extract the next plaintext data from the first cache space to the secure world. For example, the current progress can include a textual description generally indicating the encryption progress, such as "Starting encryption," "Encrypting," or "Ending encryption." Alternatively, the current progress can include a numerical description quantifying the encryption progress, such as 1%, 50%, or 100%. The specific representation of the current progress is not limited herein. Furthermore, upon detecting that the current progress meets a preset condition, a determination can be made to extract the next plaintext data from the first cache space to the secure world. For example, when the current progress is represented by the aforementioned example textual description, the preset condition may include, but is not limited to, the current progress being "Ending encryption." Alternatively, when the current progress is represented by the aforementioned example numerical description, the preset condition may include, but is not limited to, the current progress being "100%. Of course, the above example is merely one possible example in actual application, and the specific setting of the preset condition is not limited herein.

[0026] Step S13: Encrypt the plaintext data based on the encryption module in the secure world to obtain ciphertext data, and return the ciphertext data to the second cache space in the non-secure world.

[0027] In one implementation scenario, the encryption module's algorithm key can be generated during initialization of the electronic device using the device identifier (e.g., serial number, International Mobile Equipment Identity, etc.) and the product password. For example, a function such as the MD5 one-way hash algorithm can be used to process the device identifier and product password to generate the encryption module's algorithm key, ensuring data security and preventing tampering. Furthermore, the function entry password can be encrypted using the one-way hash function HMACSHA256, using the device's unique identifier (SN) (serial number) + IMEI (International Mobile Equipment Identity) as the salt. This ensures a unique password for each device, making it impossible to reverse decrypt the password. It should be noted that in cryptography, a salt is a technical method used to enhance password security. It is typically a randomly generated string that is hashed together with the user's password, ensuring that the same password has different hash values in different user accounts, thereby increasing the difficulty of password cracking. The following describes the "one device, one password" approach through a password security solution. For example, during the setup process, the encryption and decryption password / security answer and the device identification (such as SN+IMEI) are encrypted using the one-way hash function HMACSHA256 to obtain a ciphertext and store it in the database. During the verification process, the ciphertext can be retrieved from the database, and the encryption and decryption password / security answer and the device identification (such as SN+IMEI) are encrypted using the one-way hash function HMACSHA256 to obtain another ciphertext, which can be combined with the above two ciphertexts for ciphertext verification.

[0028] In one implementation scenario, using the Trust Zone as an example, the encryption and decryption modules can be located in the Secure World. This hardware-based data encryption and decryption, compared to pure software encryption and decryption, fully leverages the advantages of hardware acceleration and further minimizes attacks, reducing the risk of data compromise. Furthermore, to enhance the scalability of encryption and decryption, the encryption module can be configured as a plug-in in the Secure World; similarly, the decryption module can also be configured as a plug-in in the Secure World.

[0029] In one implementation scenario, the first cache space and the second cache space of the non-secure world may be the same cache space; or, in order to temporarily store plaintext data and ciphertext data separately in the non-secure world, the first cache space and the second cache space may also be different cache spaces, which is not limited here.

[0030] Step S14: performing data polling in the second cache space to sequentially extract each segment of ciphertext data into the first association space of the voice application.

[0031] In one implementation scenario, as a possible implementation method, data polling can be performed in the second cache space based on the first-in-first-out principle to extract each segment of ciphertext data into the first associated space in turn. That is to say, the ciphertext data temporarily stored in the second cache space will be first extracted from the second cache space to the first associated space. It should be noted that the first associated space of the voice application may include but is not limited to a dedicated storage space in an electronic device for storing voice application-related data. Of course, as mentioned above, there is at least one non-voice application with encryption requirements in addition to the voice application in the non-secure world. For the ciphertext data of the non-voice application, a similar method can be used to extract each segment of ciphertext data of different non-voice applications into the first associated space of the corresponding non-voice application in turn.

[0032] In another implementation scenario, different from the aforementioned implementation, as another possible implementation, the ciphertext data can be polled in the second cache space as data to be written to disk, and the processing progress of the data to be written to disk can be monitored. The processing progress is written to disk or not written to disk. When the processing progress is written to disk, it indicates that the data to be written to disk has been extracted into the first associated space. Correspondingly, when the processing progress is not written to disk, it indicates that the data to be written to disk has not been extracted into the first associated space. On this basis, in response to monitoring that the processing progress of the data to be written to disk is written to disk, the step of polling the ciphertext data in the second cache space as data to be written to disk can be returned to, and this cycle is iterated until all ciphertext data have been written to disk. The above method helps to reduce the risk of data loss in the data polling process as soon as possible by monitoring the processing progress of the ciphertext data as data to be written to disk during the data polling process and continuing to poll if it is not monitored that it has been written to disk.

[0033] In a specific implementation scenario, the data to be written to the disk can be specifically thrown to the communication interface between the second cache space and the first associated space, and the communication interface can be configured with a backpressure strategy. It should be noted that backpressure is to adapt to the consumption rate by limiting the production rate of the data flow in asynchronous data flow processing, so that the producer will not generate too much data flow, thereby ensuring the real-time consumption of the consumer. Different from configuring a backpressure strategy at the communication interface, in the absence of backpressure control, the data producer will not consider the processing capacity of the data consumer and will continue to generate data, which may eventually lead to data overflow or data loss.

[0034] In a specific implementation scenario, in response to monitoring that the processing progress of the data to be written to disk is not yet written to disk, the process can return to the step of monitoring the processing progress of the data to be written to disk. In other words, when monitoring that the processing progress of the data to be written to disk is not yet written to disk, it means that the data to be written to disk has not yet been completely extracted into the first associated space. At this time, the process can continue to wait and monitor the processing progress of the data to be written to disk until monitoring that the data to be written to disk has been written to disk. At this time, the process can continue to poll the next ciphertext data in the second cache space.

[0035] In a specific implementation scenario, the above-mentioned polling process for encrypted data can be developed using, for example, Kotlin + coroutines, and the interface callback can be modified with suspend. Of course, the above example is only one possible development example of the above-mentioned polling process for encrypted data, and other possible scenarios will not be given one by one here.

[0036] In an implementation scenario, please refer to Figure 2c , Figure 2c This is a process diagram of an embodiment of the data encryption method of this application. Figure 2c As shown, the non-secure world can be equipped with an encryption service, which includes a scheduler, a cache queue, and a priority scheduler. Before sequentially storing each plaintext data segment of streaming voice generated by a voice application in the first cache space, a signaling session for data encryption can be established to implement the aforementioned process in the disclosed embodiments during this session. Furthermore, if the electronic device is initialized for the first time, the relevant application in the non-secure world can first send information such as the device identification to the scheduler, which then transmits the information to the encryption module in the secure world, which then generates an algorithm key based on the information. The specific process can be found in the aforementioned description and will not be repeated here. After establishing the signaling session for data encryption, the scheduler can sequentially add each plaintext data segment to the cache queue. The priority scheduler can then poll the cache queue to extract each plaintext data segment in turn and send it to the encryption module in the secure world. The ciphertext data is then returned to the cache queue. The scheduler can then poll the cache queue to extract each ciphertext data segment in turn and store it in the first associated space. The signaling session can then be terminated and the cache queue released.

[0037] The above scheme temporarily stores each segment of plaintext data of the streaming voice generated by the voice application in the first cache space in the non-secure area of the system architecture of the electronic device in turn, and performs data polling in the first cache space to extract each segment of plaintext data in turn to the secure world in the system architecture, thereby encrypting the plaintext data based on the encryption module in the secure world to obtain ciphertext data, and returning the ciphertext data to the second cache space of the non-secure world, and then performing data polling in the second cache space to extract each segment of ciphertext data in turn to the first associated space of the voice application. Therefore, on the one hand, by temporarily storing the streaming voice in segments and performing data polling, A series of operations, such as polling, sequentially extract each segment of plaintext data to the Secure World, enabling real-time processing of streaming voice while preparing for data encryption. After encryption is complete, the ciphertext data is returned to the second cache space, and data polling is performed within the second cache space. This enables real-time processing of streaming voice even after encryption is complete. This improves the real-time nature of data encryption, particularly for streaming voice. Furthermore, since each segment of plaintext data is sequentially extracted to the Secure World during data encryption for encryption by the encryption module within the Secure World, this helps minimize the security risk of attacks during the encryption process. This improves the real-time nature and security of data encryption, particularly for streaming voice.

[0038] See also Figure 3 , Figure 3 This is a flow chart of an embodiment of the data decryption method of the present application. Specifically, it may include the following steps: Step S31: In the non-secure world of the system architecture of the electronic device, the plaintext data of each segment of the streaming voice generated by the voice application is sequentially extracted and the encrypted data is transferred to the secure world of the system architecture after encryption operation.

[0039] In the embodiment of the present disclosure, the ciphertext data is obtained by the process steps in the above-mentioned data encryption method embodiment. For details, please refer to the above-mentioned data encryption method embodiment, which will not be repeated here.

[0040] In one implementation scenario, as described in the aforementioned disclosed embodiment, plaintext data is extracted in segments from parts other than the header information of the streaming voice, and the header information is retained in the non-secure world. Then, when extracting data sequentially, the header information retained during the encryption process can be skipped.

[0041] In one implementation scenario, fixed characters can be configured between each segment of ciphertext data as instrumentation information. It should be noted that these fixed characters can be distinguished from the characters in the ciphertext data as much as possible. For example, the fixed characters can be special characters other than literal characters. Based on this, when extracting ciphertext data sequentially, the instrumentation information can be read, and the extracted ciphertext data can be submitted to the secure world for decryption. For example, when a Trust Zone is introduced, the decryption operation can be submitted to the Trust Zone hardware for execution.

[0042] Step S32: decrypt the ciphertext data based on the decryption module in the secure world to obtain decrypted data of the ciphertext data, and return the decrypted data to the second association space of the voice application.

[0043] In one implementation scenario, in the secure world, the decryption module can decrypt the ciphertext data to obtain the decrypted data of the ciphertext data, and return the decrypted data to the second associated space of the voice application. It should be noted that, similar to the aforementioned encryption module, the algorithm key of the decryption module is generated by the device identification and product password of the electronic device when the electronic device is initialized. For details, please refer to the relevant description of the algorithm key in the aforementioned public embodiment, which will not be repeated here. In addition, the second associated space and the first associated space in the aforementioned public embodiment can be the same storage space, or the second associated space and the first associated space in the aforementioned public embodiment can also be different storage spaces, which is not limited here.

[0044] In one implementation scenario, similar to the encryption module in the aforementioned disclosed embodiment, the decryption module can also be configured as a plug-in in the secure world to improve scalability. For example, different algorithms can be dynamically replaced, such as AES, SM4, etc., and there is no limitation on the algorithm type.

[0045] In one implementation scenario, as described above, plaintext data can be extracted from segments outside of the streaming audio header information, and the header information can be retained in the non-secure world. In this scenario, after returning the decrypted data to the second association space of the voice application, the decrypted data can be combined with the header information to generate a playable audio file. This special format file processing mechanism ensures the playability of the audio file after encryption and decryption operations.

[0046] In an implementation scenario, please refer to Figure 4 , Figure 4 This is a process diagram of an embodiment of the data decryption method of this application. Figure 4As shown, the non-secure world can be equipped with an encryption service, and the encryption service includes a scheduling manager, a cache queue and a priority scheduler. The voice application can first submit each segment of ciphertext data to the scheduling manager, and the scheduling manager submits it to the priority scheduler for processing. The priority scheduler sends a decryption request to the encryption and decryption module in the secure world, so that the decryption module performs data decryption on it, and then returns the decrypted data to the scheduling manager, and the scheduling manager still returns it to the voice application. After the decryption is completed, the voice application can deregister, and the scheduling manager will feedback the deregistration request to the encryption and decryption module to release system resources.

[0047] In the above scheme, the non-secure world within the electronic device's system architecture sequentially extracts each segment of plaintext data from the voice application's streaming audio, encrypts it, and transfers the encrypted data to the secure world within the system architecture. The encrypted data is obtained using the process steps described in the data encryption method embodiment. The decryption module in the secure world then decrypts the ciphertext data to obtain decrypted data, which is then returned to the second associated space of the voice application. Therefore, since the ciphertext data is obtained using the process steps described in the data encryption method embodiment, the real-time and security of data encryption can be improved, particularly for streaming audio. Similarly, during decryption, the ciphertext data is also extracted to the secure world for decryption by the decryption module within the secure world, helping to minimize the security risk of attacks during the decryption process. This improves the real-time performance of data encryption and the security of both data encryption and decryption, particularly for streaming audio.

[0048] See also Figure 5 , Figure 5 The data encryption device 50 is a schematic diagram of a framework of an embodiment of the present invention. The data encryption device 50 includes: a segmented temporary storage module 51, a first polling module 52, an encryption cache module 53, and a second polling module 54. The segmented temporary storage module 51 is used to sequentially store each segment of plaintext data of the streaming voice generated by the voice application in a first cache space in the non-secure world of the system architecture of the electronic device; the first polling module 52 is used to perform data polling in the first cache space to sequentially extract each segment of plaintext data to the secure world in the system architecture; the encryption cache module 53 is used to encrypt the plaintext data based on the encryption module in the secure world to obtain ciphertext data, and return the ciphertext data to the second cache space in the non-secure world; and the second polling module 54 is used to perform data polling in the second cache space to sequentially extract each segment of ciphertext data to the first associated space of the voice application.

[0049] In the above scheme, the data encryption device 50 temporarily stores each segment of plaintext data of the streaming voice generated by the voice application in the first cache space in the non-secure area of the system architecture of the electronic device in sequence, and performs data polling in the first cache space to extract each segment of plaintext data in sequence to the secure world in the system architecture, thereby encrypting the plaintext data based on the encryption module in the secure world to obtain ciphertext data, and returning the ciphertext data to the second cache space in the non-secure world, and then performing data polling in the second cache space to extract each segment of ciphertext data in sequence to the first associated space of the voice application. Therefore, on the one hand, by temporarily storing the streaming voice in segments, A series of operations, such as storage and data polling, sequentially extract each segment of plaintext data to the Secure World. This enables real-time processing of streaming voice while preparing for data encryption. After encryption is complete, the ciphertext data is returned to the second cache space, and data polling is performed within the second cache space. This enables real-time processing of streaming voice after encryption is complete. This improves the real-time nature of data encryption, particularly for streaming voice. Furthermore, since each segment of plaintext data is sequentially extracted to the Secure World during data encryption for encryption by the encryption module within the Secure World, this helps minimize the security risk of attacks during the encryption process. This improves the real-time nature and security of data encryption, particularly for streaming voice.

[0050] In some disclosed embodiments, the second polling module 54 includes a ciphertext polling submodule for polling ciphertext data in the second cache space as data to be written to disk; the second polling module 54 includes a progress monitoring submodule for monitoring the processing progress of the data to be written to disk; wherein, the processing progress is written to disk or not written to disk, and when the processing progress is written to disk, it indicates that the data to be written to disk has been extracted into the first associated space; the second polling module 54 includes a first return submodule for returning to the step of polling the ciphertext data in the second cache space as data to be written to disk in response to monitoring that the processing progress of the data to be written to disk is written to disk.

[0051] In some disclosed embodiments, the data to be written to the disk is thrown to the communication interface between the second cache space and the first association space, and the communication interface is configured with a back pressure strategy.

[0052] In some disclosed embodiments, the second polling module 54 includes a second return submodule for returning to the step of monitoring the processing progress of the data to be written to disk in response to monitoring that the processing progress of the data to be written to disk is not written to disk.

[0053] In some disclosed embodiments, the non-secure world also has at least one non-voice application with encryption requirements in addition to the voice application. The segmented temporary storage module 51 is specifically used to use a segmented lock to concurrently temporarily store the plaintext data of each application in the first cache space in the non-secure world; wherein each application includes a voice application and a non-voice application.

[0054] In some disclosed embodiments, the data encryption device 50 includes an information retention module for retaining the header information before temporarily storing each segment of plaintext data of the streaming voice generated by the voice application in the first cache space in sequence when the file format of the streaming voice includes header information; wherein the plaintext data is extracted in segments from the portion outside the header information of the streaming voice, and the header information is used to combine the two after the ciphertext data is decrypted by the decryption module in the secure world to obtain the decrypted data of the ciphertext data, so as to obtain a playable audio file.

[0055] In some disclosed embodiments, the non-secure world is provided with an encryption service, and the encryption service includes a scheduling manager, a cache queue and a priority scheduler. The data encryption device 50 includes a session creation module for creating a signaling session for data encryption; the segmented temporary storage module 51 is specifically used to add each segment of plaintext data to the cache queue in sequence through the scheduling manager; the first polling module 52 is specifically used to perform data polling in the cache queue through the priority scheduler to extract each segment of plaintext data in sequence to the encryption module in the secure world; the encryption cache module 53 is specifically used to return ciphertext data to the cache queue; the second polling module 54 is specifically used to perform data polling in the cache queue through the scheduling manager to extract each segment of ciphertext data in sequence to the first associated space; the data encryption device 50 includes a cancellation and release module for canceling the signaling session and releasing the cache space.

[0056] In some disclosed embodiments, the encryption module is configured as a plug-in in the secure world; and / or, the algorithm key of the encryption module is generated by the device identification and product password of the electronic device when the electronic device is initialized.

[0057] See also Figure 6 , Figure 6 The schematic diagram of the data decryption device of the present application is a schematic diagram of the framework of an embodiment of the data decryption device. The data decryption device 60 includes a segment extraction module 61 and a decryption storage module 62. The segment extraction module 61 is used to sequentially extract each segment of plaintext data of the streaming voice generated by the voice application in the non-secure world of the electronic device's system architecture, and then encrypt the ciphertext data into the secure world of the system architecture. The ciphertext data is obtained by the data encryption device in the above-mentioned data encryption device embodiment. The decryption storage module 62 is used to decrypt the ciphertext data based on the decryption module in the secure world, obtain the decrypted data of the ciphertext data, and return the decrypted data to the second association space of the voice application.

[0058] In the above scheme, the data decryption device 60, located in the non-secure world of the electronic device's system architecture, sequentially extracts each segment of plaintext data from the voice application's streaming audio, encrypts it, and then transfers the encrypted data to the secure world of the system architecture. The encrypted data is obtained by the data encryption device in the above-described data encryption device embodiment. The decryption module in the secure world then decrypts the ciphertext data to obtain decrypted data, which is then returned to the second association space of the voice application. Therefore, since the ciphertext data is obtained by the data encryption device in the above-described data encryption device embodiment, the real-time and security of data encryption can be improved, particularly for streaming audio. Furthermore, similar to encryption, the ciphertext data is also extracted to the secure world during decryption for decryption by the decryption module in the secure world, helping to minimize the security risk of attacks during the decryption process. Therefore, the real-time performance of data encryption and the security of data encryption and decryption can be improved, particularly for streaming audio.

[0059] In some disclosed embodiments, plaintext data is extracted in segments outside the header information of the streaming voice, and the header information is retained in the non-secure world. The data decryption device 60 also includes a data combining module, which is used to combine the decrypted data based on the header information after returning the decrypted data to the second associated space of the voice application to obtain a playable audio file.

[0060] In some disclosed embodiments, the decryption module is configured as a plug-in in the secure world; and / or, the algorithm key of the decryption module is generated by the device identification and product password of the electronic device when the electronic device is initialized.

[0061] See also Figure 7 , Figure 7 It is a schematic diagram of the framework of an embodiment of an electronic device of the present application. The electronic device 70 includes at least a memory 71 and a processor 72 coupled to each other, the memory 71 at least stores program instructions, and the processor 72 is used to execute the program instructions to implement the steps in any of the above-mentioned data encryption method embodiments, or to implement the steps in any of the above-mentioned data decryption method embodiments. For details, please refer to the aforementioned disclosed embodiments, which will not be repeated here. It should be noted that the electronic device 70 may include but is not limited to devices such as a voice recorder, a translator, a learning machine, an office book, a headset, a mouse, a smart large screen, etc., and the specific type of the electronic device 70 is not limited here.

[0062] Specifically, the processor 72 is used to control itself and the memory 71 to implement the steps of any of the above-mentioned data encryption method embodiments, or the steps of any of the above-mentioned data decryption method embodiments. The processor 72 may also be referred to as a CPU (Central Processing Unit). The processor 72 may be an integrated circuit chip with signal processing capabilities. The processor 72 may also be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component. The general-purpose processor may be a microprocessor, or the processor may be any conventional processor. In addition, the processor 72 may be implemented by an integrated circuit chip.

[0063] In the above scheme, the electronic device 70 temporarily stores each segment of plaintext data of the streaming voice generated by the voice application in the first cache space in the non-secure area of its system architecture in sequence, performs data polling in the first cache space, and sequentially extracts each segment of plaintext data to the secure world in the system architecture, thereby encrypting the plaintext data based on the encryption module in the secure world to obtain ciphertext data, and returns the ciphertext data to the second cache space of the non-secure world, and then performs data polling in the second cache space to sequentially extract each segment of ciphertext data to the first associated space of the voice application. Therefore, on the one hand, by performing a series of operations such as segmented temporary storage and data polling on the streaming voice to sequentially extract each segment of plaintext data to the secure world, it is possible to prepare for data encryption. The system can process streaming voice in real time, and after completing data encryption, it returns the ciphertext data to the second cache space, and performs data polling in the second cache space. This allows real-time processing of streaming voice after data encryption is completed, and therefore, in particular for streaming voice, can improve the real-time nature of data encryption. On the other hand, since each segment of plaintext data is sequentially extracted to the secure world during data encryption and encrypted by the encryption module in the secure world, it helps to minimize the security risk of attacks during the encryption process. On the other hand, similar to encryption, during decryption, the ciphertext data is also extracted to the secure world and decrypted by the decryption module in the secure world, which helps to minimize the security risk of attacks during the decryption process. Therefore, it can improve the real-time nature of data encryption and the security of data encryption and decryption, especially for streaming voice.

[0064] See also Figure 8 , Figure 8Schematic diagram of a computer-readable storage medium embodiment of the present application. The computer-readable storage medium 80 stores program instructions 81 executable by a processor, the program instructions 81 being used to implement the steps of any of the aforementioned data encryption method embodiments or the steps of any of the aforementioned data decryption method embodiments.

[0065] In the above scheme, the computer-readable storage medium 80 controls the non-secure area in the system architecture of the electronic device, and temporarily stores each segment of plaintext data of the streaming voice generated by the voice application in the first cache space in sequence, performs data polling in the first cache space, and sequentially extracts each segment of plaintext data to the secure world in the system architecture, thereby encrypting the plaintext data based on the encryption module in the secure world to obtain ciphertext data, and returns the ciphertext data to the second cache space in the non-secure world, and then performs data polling in the second cache space to sequentially extract each segment of ciphertext data to the first associated space of the voice application. Therefore, on the one hand, by performing a series of operations such as segmented temporary storage and data polling on the streaming voice to sequentially extract each segment of plaintext data to the secure world, it is possible to Real-time processing of streaming voice is achieved during data encryption preparation, and after encryption is complete, ciphertext data is returned to the second cache space, and data polling is performed in the second cache space. This allows real-time processing of streaming voice after encryption is complete, thereby improving the real-time performance of data encryption, particularly for streaming voice. Furthermore, since each segment of plaintext data is sequentially extracted to the secure world during data encryption for encryption by the encryption module within the secure world, this helps minimize the security risk of attacks during the encryption process. Similarly, during decryption, ciphertext data is also extracted to the secure world for decryption by the decryption module within the secure world, helping minimize the security risk of attacks during the decryption process. Therefore, the real-time performance of data encryption and the security of data encryption and decryption are improved, particularly for streaming voice.

[0066] In some embodiments, the functions or modules included in the device provided by the embodiments of the present disclosure can be used to execute the method described in the above method embodiments. The specific implementation can refer to the description of the above method embodiments. For the sake of brevity, it will not be repeated here.

[0067] The above description of the various embodiments tends to emphasize the differences between the various embodiments. The same or similar aspects can be referenced with each other and will not be repeated herein for the sake of brevity.

[0068] In the several embodiments provided in this application, it should be understood that the disclosed methods and devices can be implemented in other ways. For example, the device implementation methods described above are only schematic. For example, the division of modules or units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0069] Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0070] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0071] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the existing technology, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) or a processor to execute all or part of the steps of the various implementation methods of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, and other media that can store program code.

[0072] If the technical solution of this application involves personal information, the product that applies the technical solution of this application has clearly informed the personal information processing rules and obtained the individual's voluntary consent before processing personal information. If the technical solution of this application involves sensitive personal information, the product that applies the technical solution of this application has obtained the individual's separate consent before processing sensitive personal information, and at the same time meets the "explicit consent" requirement. For example, on personal information collection devices such as cameras, a clear and prominent sign is set to inform that the personal information collection scope has been entered and personal information will be collected. If the individual voluntarily enters the collection scope, it is deemed that they agree to the collection of their personal information; or on the personal information processing device, when the personal information processing rules are notified by obvious signs / information, the individual's authorization is obtained through pop-up information or by asking the individual to upload their personal information; among which, the personal information processing rules may include information such as the personal information processor, the purpose of personal information processing, the processing method, and the type of personal information processed.

Claims

1. A data encryption method, characterized in that: include: In a non-secure world of a system architecture of an electronic device, each segment of plaintext data of a streaming voice generated by a voice application is temporarily stored in a first buffer space in sequence; Performing data polling in the first cache space to sequentially extract each segment of the plaintext data to the secure world in the system architecture; Encrypting the plaintext data based on the encryption module in the secure world to obtain ciphertext data, and returning the ciphertext data to the second cache space in the non-secure world; Data polling is performed in the second cache space to sequentially extract each segment of the ciphertext data into the first association space of the voice application.

2. The method according to claim 1, characterized in that The polling of data in the second cache space to sequentially extract each segment of the ciphertext data into the first association space of the voice application includes: Polling the ciphertext data in the second cache space as data to be written to disk; monitoring the processing progress of the data to be written to disk; wherein the processing progress is whether the data has been written to disk or not written to disk, and when the processing progress is "written to disk", it indicates that the data to be written to disk has been extracted into the first association space; In response to monitoring that the processing progress of the data to be written to disk is already written to disk, returning to the step of polling the ciphertext data in the second cache space as the step of writing the data to disk.

3. The method according to claim 2, characterized in that The data to be written to the disk is thrown to the communication interface between the second cache space and the first association space, and the communication interface is configured with a back pressure strategy; And / or, the method further includes: in response to monitoring that the processing progress of the data to be written to disk is not written to disk, returning to the step of monitoring the processing progress of the data to be written to disk.

4. The method according to claim 1, wherein The non-secure world further includes at least one non-voice application other than the voice application that has encryption requirements, and the method further includes: In the non-secure world, a segmented lock is used to concurrently temporarily store plaintext data of each application in the first cache space; wherein, each application includes the voice application and the non-voice application.

5. The method according to claim 1, wherein In the case where the file format of the streaming voice includes header information, before sequentially temporarily storing the plaintext data of the streaming voice generated by the voice application in the first buffer space, the method further includes: The header information is retained; wherein the plaintext data is extracted in segments from the portion outside the header information of the streaming voice, and the header information is used to combine the two after the ciphertext data is decrypted by the decryption module in the secure world to obtain the decrypted data of the ciphertext data, so as to obtain a playable audio file.

6. The method according to claim 1, characterized in that The non-secure world is provided with an encryption service, and the encryption service includes a scheduling manager, a cache queue, and a priority scheduler. Before temporarily storing each segment of plaintext data of the streaming voice generated by the voice application in the first cache space in the non-secure world in the system architecture of the electronic device, the method further includes: Create a signaling session for data encryption; The non-secure world in the system architecture of the electronic device temporarily stores each segment of plaintext data of the streaming voice generated by the voice application in the first cache space in sequence, including: Adding each segment of the plaintext data to the cache queue in sequence by the scheduling manager; The performing data polling in the first cache space to sequentially extract each segment of the plaintext data to the secure world in the system architecture includes: Performing data polling in the cache queue by the priority scheduler to sequentially extract each segment of the plaintext data to the encryption module in the secure world; The returning the ciphertext data to the second cache space of the non-secure world includes: Returning the ciphertext data to the cache queue; The polling of data in the second cache space to sequentially extract each segment of the ciphertext data into the first association space of the voice application includes: Performing data polling in the cache queue by the scheduling manager to sequentially extract each segment of the ciphertext data into the first association space; After performing data polling in the second cache space to sequentially extract each segment of the ciphertext data into the first association space of the voice application, the method further includes: The signaling session is cancelled and the cache queue is released.

7. The method according to any one of claims 1 to 6, characterized in that The encryption module is configured in the secure world as a plug-in; And / or, the algorithm key of the encryption module is generated by the device identification and product password of the electronic device when the electronic device is initialized.

8. A data decryption method, characterized in that: include: In a non-secure world within a system architecture of an electronic device, sequentially extracting each segment of plaintext data of a streaming voice generated by a voice application, performing encryption operations thereon, and transferring the encrypted data to a secure world within the system architecture; wherein the encrypted data is obtained by the data encryption method according to any one of claims 1 to 7; The ciphertext data is decrypted based on the decryption module in the secure world to obtain decrypted data of the ciphertext data, and the decrypted data is returned to the second association space of the voice application.

9. The method according to claim 8, characterized in that The plaintext data is extracted in segments from a portion other than header information of the streaming voice, and the header information is retained in the non-secure world. After returning the decrypted data to the second association space of the voice application, the method further includes: Based on the combination of the header information and the decrypted data, a playable audio file is obtained.

10. The method according to claim 8 or 9, characterized in that The decryption module is configured in the secure world as a plug-in; And / or, the algorithm key of the decryption module is generated by the device identification and product password of the electronic device when the electronic device is initialized.

11. A data encryption device, characterized in that: include: A segment temporary storage module is used to temporarily store each segment of plaintext data of the streaming voice generated by the voice application in a first buffer space in a non-secure world in the system architecture of the electronic device; a first polling module, configured to perform data polling in the first cache space to sequentially extract each segment of the plaintext data to the secure world in the system architecture; an encryption cache module, configured to encrypt the plaintext data based on the encryption module in the secure world to obtain ciphertext data, and return the ciphertext data to the second cache space in the non-secure world; The second polling module is used to perform data polling in the second cache space to sequentially extract each segment of the ciphertext data into the first association space of the voice application.

12. A data decryption device, characterized in that: include: a segmented extraction module configured to sequentially extract, from a non-secure world within a system architecture of an electronic device, each segment of plaintext data of a streaming voice generated by a voice application and, after encryption, transfer the encrypted data to a secure world within the system architecture; wherein the encrypted data is obtained by the data encryption device according to claim 11; The decryption storage module is used to decrypt the ciphertext data based on the decryption module in the secure world to obtain decrypted data of the ciphertext data, and return the decrypted data to the second association space of the voice application.

13. An electronic device, characterized in that: The method comprises at least a memory and a processor coupled to each other, wherein the memory stores at least program instructions, and the processor is used to execute the program instructions to implement the data encryption method according to any one of claims 1 to 7, or the data decryption method according to any one of claims 8 to 10.

14. The electronic device according to claim 13, wherein: The electronic device at least includes a voice recorder.

15. A computer-readable storage medium, characterized in that Program instructions that can be executed by a processor are stored, and the program instructions are used to implement the data encryption method described in any one of claims 1 to 7, or the data decryption method described in any one of claims 8 to 10.

Images