Method and system for encrypting and isolating storage data of credential mobile terminal

Abstract

The invention relates to a method and system for encrypting and isolating storage data of a credential mobile terminal, and belongs to the technical field of information. The method comprises the following steps: encrypting and partitioning the whole storage area, and setting an access strategy according to user permission; when a user requests to access, executing multi-factor authentication containing a password and an external hardware certificate, and adding biological characteristic authentication; after the authentication is passed, an encryption key is taken from the domestic security chip; and encrypting and decrypting data by using the secret key, and opening corresponding partition access according to authority. The system comprises a storage partition module, an identity authentication module, a key management module, an encryption and decryption module and an authority control module and is used for executing the method. The method also comprises the steps of equipment startup trusted boot and firmware upgrade verification, is based on a custom curing system, and is compatible with Android 10 +. The problems of poor hardware controllability and positioning security risk of the creative mobile terminal are solved, and full-link data security protection is realized.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of information technology, and particularly relates to a method and system for mobile terminal storage data encryption and isolation of Xinyuan. BACKGROUND

[0002] With the rapid development of mobile Internet technology, Xinyuan mobile terminal devices (such as domestically produced self-controllable mobile phones and tablets, etc.) are increasingly widely used in key industries, but the current Xinyuan mobile terminal still has the following outstanding problems in data storage and security protection: Lack of core hardware self-controllability: the core chips and components of Xinyuan mobile terminal rely heavily on imported materials from abroad, not only exist the risk of supply chain disruption, but also may cause data to be illegally stolen due to hardware backdoors, hidden interfaces, etc., which cannot meet the requirements of "self-controllable" hardware security in key areas.

[0003] Significant positioning security risk: the positioning function of the existing Xinyuan mobile terminal is still mainly based on GPS positioning system, and the GPS system is dominated by foreign countries, which may cause problems such as tampering, shielding of positioning signals or data interception in special scenarios, and cannot guarantee the authenticity and security of positioning data, making it difficult to meet the positioning needs of government affairs, national defense and other fields.

[0004] System compatibility and ecological defects: the software ecology of the nationalization operating system (such as Kylin mobile OS, Hongmeng domestic adaptation version) has not been perfected, the interface protocol adaptation types are few, and the compatibility of third-party software (such as office software, industry-specific applications) is poor, which leads to the fact that Xinyuan mobile terminal cannot quickly replace traditional Android and iOS devices, hindering the large-scale landing of Xinyuan industry.

[0005] Operating system and data security vulnerabilities: most Xinyuan mobile terminals are based on open source Android system for secondary development, and the open source architecture leads to frequent system vulnerabilities and lack of deep security solidification mechanism; at the same time, the existing data encryption relies on software level implementation, and the key storage in system memory is easy to be cracked, and the local storage of private data and sensitive data (such as government files, financial transaction records) on the terminal faces the risk of being stolen after the terminal is lost. SUMMARY

[0006] The present application provides a method and system for mobile terminal storage data encryption and isolation of Xinyuan, which solves the key technical problems of lack of core hardware self-controllability, positioning security risk, poor system compatibility, untrusted operating system and weak data storage and transmission security protection of the existing Xinyuan mobile terminal, and provides a set of full-link storage data encryption and isolation technology covering "hardware-system-data-transmission-authentication".

[0007] In order to achieve the above purpose, the present application realizes the following technical scheme: A method for encrypting and isolating storage data of a mobile terminal, comprising the following steps: Full-disk encryption partitioning is performed on the storage area of the mobile terminal device, and access control policies of each partition are set according to user permissions; When a user requests to access the storage data, multi-factor identity authentication is performed, which includes user password authentication and external hardware identity certificate authentication; After the multi-factor identity authentication is passed, the stored encryption key is obtained from the secure chip of the mobile terminal device; The encryption key is used to decrypt or encrypt the requested storage data; According to the user permissions, the user is allowed to access the data of the corresponding partition.

[0008] Further, when the mobile terminal device starts, a secure and trusted boot is performed, and the system is checked level by level based on domestic chips and trusted computing modules to ensure the integrity of the operating system startup process; The level-by-level checking process includes: first verifying the digital signature of the boot loader, and loading the boot program after confirming that it is correct; Then, the integrity hash value of the operating system kernel image is checked through the boot program to ensure that the kernel has not been tampered with; Finally, the key service modules of the system are measured for trustworthiness to form a complete trust chain from hardware to software, ensuring the integrity of the operating system startup process, and triggering local alarms and reporting abnormal logs to the management platform when the startup is abnormal.

[0009] Further, it also includes a secure and trusted upgrade step: when upgrading the firmware, the firmware package is checked to identify whether the firmware package has been tampered with to ensure the reliability of the upgrade process; When upgrading the firmware, the management end first generates a firmware description file containing signature information, firmware version number, and verification timestamp by digitally signing the firmware package using the SM2 algorithm; After the mobile terminal receives the firmware package and the description file, it first verifies the integrity of the description file, and then calls the SM2 signature verification algorithm built-in the secure chip to verify the signature of the firmware package; If the signature verification fails, the firmware package is discarded directly and tampering events are recorded; if the signature verification passes, the SHA-256 hash value of the firmware package is further calculated and compared with the pre-stored hash value in the description file to identify whether the firmware package has been tampered with through double verification; The breakpoint resume mechanism is used in the upgrade process to avoid upgrade failure caused by network interruption, and after the upgrade is completed, the device is automatically restarted and the trusted boot verification is performed to ensure the reliability of the upgrade process.

[0010] Further, the external hardware identity certificate includes at least one of a USB key, a smart card, or a biometric identification device. The USB key needs to support the national secret SM4 algorithm to encrypt the storage of user identity information, and after being inserted into the device, the USB key establishes encrypted communication with the security chip through the USB HID protocol, and outputs the identity certificate only after verification; the smart card adopts a contact or non-contact communication mode, and stores the key in the built-in security element. A dynamic token is generated each time the authentication is performed and is transmitted through an encrypted channel; the biometric identification device needs to have a live detection function, and the biometric template collected is stored in the security chip after being encrypted by the SM4 algorithm to avoid leakage of the template data.

[0011] Further, the security chip is a domestic security chip, which stores a root key and a derived key for system encryption and data encryption. The security chip is a domestic security chip, which stores a root key and a derived key for system encryption and data encryption. The root key is generated by a built-in true random number generator when the chip is powered on, and is permanently fixed in a non-erasable area of the chip and is only used to derive a secondary key. The derived key is divided into a system encryption key, a data encryption key, and an authentication key according to the purpose. Each type of derived key is generated by an SM4 key derivation function and is dynamically derived from the root key only when needed. The derived key is immediately cleared in the memory after use, and is used for system encryption and data encryption. The derived key also supports key backup and recovery functions. The backup process uses a hardware encryption channel for transmission to prevent leakage of the backup key.

[0012] Further, the full-disk encryption partition adopts hardware-level password protection, and the encryption key is generated and managed by the security chip. The full-disk encryption partition adopts hardware-level password protection and is implemented based on the domestic SM4 block cipher algorithm, with a sector-level encryption granularity. The encryption key is generated and managed by the security chip, and the generation process is completely completed inside the chip without passing through the operating system memory. When the partition is divided, the storage area is divided into a public partition, a sensitive partition, and a confidential partition according to the data sensitivity level. Each partition independently generates an encryption key, and the partition key is bound to the user permission. Only the key corresponding to the authorized user can decrypt the data in the partition. The partition locking function is also supported, and the user can manually lock a specified partition. After locking, even if the identity authentication is passed, the user still needs to enter the partition unlock code to access the partition.

[0013] Further, the method is based on a self-defined fixed operating system. The operating system is adapted to rich peripheral interfaces and supports permission control, and is compatible with Android 10 and above systems. Based on the self-defined hardened operating system, the operating system kernel is deeply customized based on the Linux kernel, the core code is hardened and written into the read-only storage area to prevent the kernel from being tampered with; a variety of peripheral interfaces are adapted, including USB3.0, Type-C, HDMI, UART, SPI, and each interface is set with access permission control, only authorized processes can call the interface; a role-based access control model is supported, three types of roles, administrator, ordinary user and visitor, are preset, and different roles correspond to different partition access permissions and operation permissions; Meanwhile, Android 10 and above systems are compatible, and the compatibility is realized by building an Android compatibility layer. The compatibility layer uses a sandbox isolation mechanism, and Android applications run in an independent sandbox and can only access the allocated memory and public partition resources, and cannot directly access sensitive / confidential partitions. In addition, the system calls of the Android system need to be verified by the self-defined kernel to prevent breaking through the permission control through Android vulnerabilities.

[0014] Further, the multi-factor identity authentication further includes biometric authentication, and the biometric type includes at least one of fingerprint, face, and iris; The biometric authentication process, user password authentication, and external hardware identity certificate authentication form a three-factor authentication or a two-factor authentication + biometric enhancement mode; Specifically, the basic authentication mode is password + hardware certificate two-factor authentication, and the user can choose to enable biometric authentication as enhanced verification. After enabling, the user needs to complete password + hardware certificate verification first, and then pass the biometric verification to obtain the key access permission; The biometric template adopts a feature value extraction and encrypted storage mode. The original biometric data is only processed locally, the original data is deleted immediately after the feature value is extracted, the feature value is encrypted by the SM4 algorithm and stored in the secure chip, and only the encrypted feature value is compared during each authentication, without transmitting the original feature data. The biometric template update function is supported, and the user can re-collect the biometric data to update the template. The update process needs to verify the original authentication factor to prevent malicious updates by others.

[0015] Further, the stored data includes file system data, and the file system needs to be accessed through multi-factor identity authentication and secure chip verification; The stored data includes file system data, and the file system needs to be accessed through multi-factor identity authentication and secure chip verification; The stored data further includes database data and cache data, and all types of data need to be included in the encryption and isolation range; the file system needs to be accessed through multi-factor identity authentication and secure chip verification; The specific process is: after a user initiates a file access request, multi-factor identity authentication is triggered first, after the authentication is passed, the file system drive sends a key request to the security chip, and the security chip verifies the legality of the request and then transmits the corresponding file system partition key to the encryption and decryption engine; The encryption and decryption engine performs real-time encryption and decryption on file data based on the partition key, the decrypted data is only temporarily stored in the memory, and the decrypted data in the memory is cleared immediately after the user operation is completed; at the same time, file system operations all generate operation logs, and the logs are stored in a tamper-proof area after being signed by the security chip, for audit tracking; For database data, a transparent data encryption technology is adopted, the database file is automatically encrypted when stored and automatically decrypted when read, and the encryption key is managed by the security chip, and the database process cannot directly obtain the key plaintext.

[0016] A system for data encryption and isolation of a mobile terminal of a signal creation, comprising: A storage partition module is configured to perform full-disk encryption partitioning on a storage area of the mobile terminal device, and set access control policies for each partition according to user permissions; An identity authentication module is connected with the storage partition module, configured to perform multi-factor identity authentication when a user requests to access storage data, and the multi-factor identity authentication includes user password authentication and external hardware identity certificate authentication; A key management module is connected with the identity authentication module, configured to obtain a stored encryption key from a security chip of the mobile terminal device after the multi-factor identity authentication is passed; An encryption and decryption module is connected with the key management module, configured to use the encryption key to perform decryption or encryption operation on the requested access storage data; A permission control module is connected with the encryption and decryption module, configured to allow the user to access data of a corresponding partition according to user permissions.

[0017] As can be seen from the above, the present application solves the problems of insufficient key storage security and lack of hardware-level protection in the prior art by full-disk encryption partitioning combined with multi-factor identity authentication and security chip key management, and has the advantages of improving key storage security, preventing data leakage, and enhancing system security.

[0018] The present application solves the problems of a large number of imported materials from abroad for core chips and components, lack of self-controllability, positioning function still largely dependent on GPS positioning system, and inability to guarantee positioning security; and the current software ecology of a national system, interface protocol adaptation is not rich enough, third-party software compatibility is poor, and the problem of being unable to quickly and excessively compatible is solved. BRIEF DESCRIPTION OF DRAWINGS

[0019] The accompanying drawings, which are incorporated herein and constitute part of the specification, illustrate embodiments consistent with the application and, together with the description, further serve to explain the principles of the application.

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the accompanying drawings needed to be used in the embodiments or prior art description will be briefly introduced as follows. Obviously, for those of ordinary skill in the art, other drawings can also be obtained based on these drawings without any creative effort.

[0021] Figure 1 A schematic diagram of the workflow of the present application; Figure 2 A schematic diagram of the internal structure of the system of the present application.

[0022] Explanation of reference numerals: 10, storage partition module; 20, identity authentication module; 30, key management module; 40, encryption and decryption module; 50, permission control module.

[0023] The object implementation, functional features and advantages of the present application will be further described with reference to the embodiments and the accompanying drawings. DETAILED DESCRIPTION

[0024] The technical solutions in the present application will be described clearly and completely in combination with the accompanying drawings in the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. The components of the present application described and shown in the accompanying drawings can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the claimed present application, but only represents selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without any creative effort are within the scope of protection of the present application.

[0025] It should be noted that: similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. Meanwhile, in the description of the present application, the terms "first", "second", etc. are only used for differentiation, and cannot be understood as indicating or implying relative importance.

[0026] Therefore, as Figure 1 shown, the present embodiment proposes a method for encryption and isolation of storage data of a mobile terminal of the signal creation, comprising the following steps: Step S100: performing full-disk encryption partition on the storage area of the mobile terminal device, and setting access control policies for each partition according to user permissions; Step S101: When a user requests to access the stored data, multi-factor identity authentication is performed, which includes user password authentication and external hardware identity certificate authentication; Step S102: After the multi-factor identity authentication passes, the stored encryption key is obtained from the secure chip of the mobile terminal device; Step S103: The encryption key is used to perform decryption or encryption operation on the stored data requested to be accessed; Step S104: According to the user permission, the user is allowed to access the data in the corresponding partition.

[0027] Specifically, the rapid development of mobile Internet technology promotes the application of mobile terminal devices of the national security industry in key industries, but data storage security still faces problems such as insufficient hardware self-controllability and easy cracking of software encryption. The existing devices rely on foreign chips, which have supply chain risks, and software-level encryption causes the key to be easily stolen from memory, and sensitive data is threatened by leakage after the terminal is lost. When a certain government agency uses domestic tablets to process confidential files, the encrypted files were cracked by force due to the loss of the device, which exposed the defects of traditional encryption schemes in key management and hardware protection.

[0028] In order to solve the above problems, the researchers observed that the combination of hardware-level encryption and permission control can improve the protection level.

[0029] First, it is analyzed that the root cause of key leakage is the exposure of storage media, and then the key is independently stored in the secure chip.

[0030] Then it is found that a single authentication method is easy to be attacked, and a hardware certificate needs to be introduced to strengthen identity verification.

[0031] Finally, a solution is formed to realize data closed-loop protection by taking a domestic secure chip as a trust root, triggering key calling through multi-factor authentication, and combining partition permission control.

[0032] Therefore, the present application proposes to perform full-disk encryption partitioning on the storage area of the mobile terminal device and set an access control strategy according to the user permission, when the user requests to access the data, multi-factor authentication including user password and external hardware identity certificate is performed, after the authentication passes, the encryption key is obtained from the secure chip to perform data encryption and decryption operation, and finally the corresponding partition access permission is opened according to the permission.

[0033] The full-disk encryption partition refers to dividing the storage space into multiple logical units and implementing hardware-level encryption, which can be implemented by using a disk encryption technology based on a domestic cryptographic algorithm, and the access path of an unauthorized area is blocked through physical isolation. The multi-factor identity authentication refers to combining two or more independent verification elements, which can be implemented by using a password and USB key cooperative verification mechanism, and the risk of being imitated by a single authentication mode is eliminated. The security chip refers to an independent hardware module with a cryptographic operation and key storage function, which can be implemented by using a security processor certified by the State Cryptography Administration, and the key generation and calling process is ensured not to be affected by system layer vulnerabilities.

[0034] Specifically, the storage area is divided into isolated data spaces after being encrypted, and each partition is bound to specific user permissions. When a user initiates an access request, the user needs to input a preset password and insert a bound hardware key device. After verification, the security chip transmits the pre-stored encryption key to the encryption and decryption engine, and only processes the data of the target partition. After the access ends, the key copy in the memory is immediately cleared, and the user's operation range is limited according to the permission policy, for example, only the contents of a specified folder can be read, but copying or modifying operations cannot be performed.

[0035] Compared with the prior art, the traditional scheme relies on software encryption, which causes the key to be exposed in the system memory, while the present scheme protects the key throughout its life cycle through a security chip. The prior art uses single password authentication, which is vulnerable to brute force attacks, while the present scheme implements two-factor authentication through a hardware credential. The existing encryption system does not establish a partition isolation mechanism, while the present scheme implements fine-grained control of data access through a permission policy.

[0036] Through the above technical scheme, the present application effectively prevents the risk of key theft by malicious programs, ensures the hardware autonomous controllability of encryption operations, blocks the possibility of unauthorized access to data partitions, and even if the password is cracked, the hardware key cannot be obtained in the device loss scenario, thereby ensuring the security of sensitive data.

[0037] The present application further proposes to perform a secure and trusted boot when a mobile terminal device starts, and to perform a step-by-step verification of the system based on a domestic chip and a trusted computing module, thereby ensuring the integrity of the operating system startup process.

[0038] The secure and trusted boot refers to a mechanism for verifying the integrity of a boot program and a kernel image during the device startup phase by a trusted computing module, which can be implemented by using a phased verification mechanism to verify whether the code and components of each link are tampered with during the startup process, thereby forming a trust chain transmission mechanism.

[0039] The domestic chip refers to a processor chip independently researched and developed by China, and can be implemented based on a domestic instruction set architecture. By replacing imported chips, the hardware backdoor risk is eliminated, and the hardware level is ensured to be controllable.

[0040] The trusted computing module refers to a hardware module integrating a cryptographic algorithm and a trusted measurement function, and can be implemented by a trusted platform module conforming to the national cryptographic standard. The trusted computing module is used to generate and store a trusted root key, and to perform cryptographic verification on key components in the startup process.

[0041] The step-by-step verification refers to a process of verifying the bootloader and the operating system kernel in stages according to the startup flow sequence. The verification can be implemented by a hash value comparison or a digital signature verification method to ensure that the code in each stage is integrity-verified before loading.

[0042] Specifically, when the mobile device starts, the domestic chip initializes the hardware environment and loads the trusted computing module. The trusted computing module reads the bootloader from the storage medium, performs digital signature verification on the bootloader using the pre-stored trusted root key, and transfers control to the bootloader after verification. Before loading the operating system kernel, the bootloader calls the trusted computing module again to calculate the hash value of the kernel image, compares the calculation result with the pre-stored trusted measurement value, and if they are consistent, continues to execute the subsequent startup process. In this process, if the verification result of any stage does not meet the expectation, the trusted computing module will interrupt the startup process and trigger the alarm mechanism to prevent potential malicious code from being loaded into the memory.

[0043] Further, when the mobile device starts, a secure and trusted boot is performed, and the system is verified by the domestic chip (such as a processor chip based on the Fengyun and Kunpeng self-developed architectures) and the trusted computing module (conforming to GB / T 29829-2013 “Information Security Technology Trusted Computing Cryptographic Support Platform Function and Interface Specification”) in stages. The verification process includes: verifying the digital signature of the bootloader first, and loading the bootloader after confirming that it is correct; then verifying the integrity hash value of the operating system kernel image through the bootloader to ensure that the kernel has not been tampered with; finally, performing trusted measurement on the key service modules of the system to form a complete trust chain from hardware to software, ensuring the integrity of the operating system startup process, and triggering local alarm and reporting abnormal logs to the management platform when the startup is abnormal.

[0044] Compared with the prior art, the traditional mobile terminal device usually adopts imported chips and is not integrated with a trusted computing module, and lacks a hardware-level trusted verification mechanism in the system startup process, so that the boot program or kernel cannot be detected in time when it is tampered with. The scheme cooperates the domestic chip and the trusted computing module to build a trusted verification chain from hardware to software in the startup stage, which not only avoids the hardware backdoor risk that may exist in the imported chip, but also ensures the integrity of each startup component through the cryptography verification mechanism.

[0045] Through the above technical scheme, the present application solves the system startup integrity risk of the mobile terminal device due to the lack of core hardware self-controllability, prevents the hardware backdoor or hidden interface from illegally tampering with the system in the startup stage, ensures that the operating system is in a trusted state from the beginning of loading, and blocks the attack path of implanting malicious code by exploiting startup vulnerabilities.

[0046] The present application further proposes a secure and trusted upgrade step, which verifies the firmware package when upgrading the firmware, identifies whether the firmware package is tampered with, and ensures the reliability of the upgrade process.

[0047] The secure and trusted upgrade step refers to the process of integrity verification of the firmware package, which can be implemented by using hash verification or digital signature verification, and is used to confirm that the firmware package has not been illegally modified before upgrading. The verification of the firmware package refers to calculating the content of the firmware package by using a preset verification algorithm, which can be implemented by using the SHA-256 hash algorithm or the digital signature mechanism based on domestic cryptographic algorithms, and is used to generate the integrity characteristic value of the firmware package and compare it with the reference value provided by the trusted source. Identifying whether the firmware package is tampered with refers to judging whether the firmware package is consistent with the original version according to the verification result, which can be implemented by using a verification value matching logic module, and is used to terminate the upgrade process when the hash value or signature verification fails. Ensuring the reliability of the upgrade process refers to establishing a linkage mechanism of trusted firmware package source and controllable upgrade execution, which can be implemented by binding the verification result and the upgrade operation permission, and is used to allow writing to the storage partition only after the verification is passed.

[0048] Specifically, in the firmware upgrade process, the system first obtains the firmware package file to be upgraded, and calls the preset hash algorithm module to calculate the hash value. The hash value is transmitted to the verification determination module and compared with the reference hash value pre-stored in the security chip. If they are consistent, it is determined that the firmware package has not been tampered with, and the upgrade program continues to execute; if they are not consistent, an abnormal processing mechanism is triggered, the upgrade operation is terminated, and an alarm log is generated. In the verification process, the execution of the hash algorithm and the storage of the reference value are both completed in the security chip, avoiding interference by external malicious code. The upgrade program can only write the firmware package to the non-volatile memory of the device after completing the integrity verification.

[0049] Further, when performing firmware upgrade, first, the management end performs digital signature on the firmware package by the national secret SM2 algorithm, generates a firmware description file containing signature information, firmware version number and check timestamp; after the mobile end receives the firmware package and the description file, the integrity of the description file is verified first, and then the SM2 signature verification algorithm built in the security chip is called to verify the signature of the firmware package; if the signature verification fails, the firmware package is discarded directly and tampering event is recorded; If the signature verification passes, the SHA-256 hash value of the firmware package is further calculated, and compared with the preset hash value in the description file, so that whether the firmware package is tampered is identified through double check; in the upgrade process, the breakpoint resume transmission mechanism is adopted to avoid upgrade failure caused by network interruption, and after the upgrade is completed, automatic restart and execution of the start trusted check are performed to ensure the reliability of the upgrade process.

[0050] Compared with the prior art, the traditional firmware upgrade scheme usually only relies on transmission channel encryption, and cannot prevent the risk that the firmware package is implanted with malicious code in the storage stage or upstream of the transmission link. However, the scheme can actively detect whether the firmware package is tampered before the upgrade is executed, so as to block the illegal firmware carrying backdoor or vulnerability from being loaded to the device. In addition, the cooperative working mode of the check algorithm and the security chip enhances the security of the check process itself, and prevents the attacker from forging the check result.

[0051] Through the above technical scheme, the tampered firmware package can be effectively identified and intercepted, and the malicious code is prevented from being implanted into the system through the upgrade process. The scheme ensures that only the firmware version that has passed the integrity verification can be written into the device, prevents the system security risk caused by untrusted firmware source, and improves the active defense capability of the mobile end of the national security mobile terminal in the firmware upgrade link.

[0052] The application further proposes that the external hardware identity certificate includes at least one of a USB key, a smart card or a biological feature recognition device.

[0053] The USB key refers to a physical storage device with encryption function, which can be realized in the form of a U disk with a built-in encryption chip, and data interaction is performed with the mobile terminal device through the USB interface. The digital certificate or key information stored in the USB key is transmitted only when the USB key is physically connected. The smart card refers to a card embedded with an integrated circuit chip, which can be realized in the form of a contact or non-contact chip card, and communication is established with the mobile terminal device through a special card reader. The built-in security element of the smart card can perform encryption operation and store sensitive data. The biological feature recognition device refers to a hardware device for collecting and verifying biological features, which can be realized by a fingerprint sensor, an iris scanner or a face recognition camera, and the uniqueness and authenticity of the biological features are ensured through the living body detection technology.

[0054] Wherein, the USB key needs to support the national secret SM4 algorithm to encrypt the user identity information, and after being inserted into the device, the USB key establishes encrypted communication with the security chip through the USB HID protocol, and outputs the identity certificate only after verification; the smart card adopts a contact or non-contact (such as NFC) communication mode, and a security element (SE) is built-in to store the key, and a dynamic token is generated every time the authentication is performed and is transmitted through an encrypted channel; the biometric identification device needs to have a live detection function (such as a fingerprint identification device adopting a capacitive sensor + skin texture detection, and a facial recognition device adopting a 3D structured light + infrared live body judgment), and the biometric feature template collected is stored in the security chip after being encrypted by the SM4 algorithm, so as to avoid the leakage of the template data.

[0055] Specifically, when the user requests to access the stored data, the system requires to verify the user password and the external hardware identity certificate at the same time. For example, the user needs to insert the USB key or the smart card, and completes the live fingerprint collection through the fingerprint sensor. An encrypted communication channel is established between the mobile terminal device and the hardware certificate, and whether the digital certificate or the biometric feature template stored in the certificate matches the preset information is verified. After the verification, the security chip releases the encryption key for data decryption, and at this time, the user can only access the partition matched with the permission. Since the hardware certificate is independent of the mobile terminal storage system and has the physical isolation characteristic, the attacker cannot obtain the authentication information through the software vulnerability or the memory cracking.

[0056] Compared with the prior art, the traditional scheme only relies on the user password for identity authentication, and there is a risk that the password is cracked by brute force or phishing attack, and the key is stored in the system memory and is easy to be extracted. The scheme forces the introduction of the hardware certificate, and the authentication elements are dispersed to the physical device and the biometric feature, so that the attacker needs to break through the three lines of defense of the password, the hardware carrier and the biometric feature at the same time, and the difficulty of illegal access is significantly improved.

[0057] Through the above technical scheme, the key leakage problem caused by the single authentication mode is effectively solved, the physical non-replicability of the hardware carrier and the uniqueness of the biometric feature are utilized, so that even if the password is stolen, the attacker still cannot bypass the external hardware verification link, and thus a multiple protection mechanism is established at the data access entrance, and the possibility of illegal decryption of sensitive data is reduced.

[0058] The application further proposes that the security chip is a domestic security chip, and stores a root key and a derived key, which are used for system encryption and data encryption.

[0059] The domestic security chip refers to a hardware security module developed based on domestic self-developed technical specifications, and can be specifically implemented by using a physical chip integrating a cryptographic algorithm engine, and the key generation and storage functions are implemented through a hardware circuit to avoid exposing the key to the operating system memory space. The root key refers to a basic key generated by a physical random source inside the security chip, and the initial seed value can be generated through a true random number generator to derive a sub-key required for subsequent encryption. The derived key refers to a secondary encryption key generated based on the root key through a key expansion algorithm, and the key derivation function of the national SM4 algorithm can be used to implement a hierarchical key management system. System encryption refers to hardware-level protection implemented on the mobile terminal operating system kernel and running environment, and the system partition can be fully encrypted through the security chip. Data encryption refers to the encryption operation implemented on the specific content such as user-stored documents and databases, and the file data can be encrypted through the security chip by calling the national SM2 algorithm.

[0060] The security chip is a domestic security chip (such as Huada Electronics, Guomin Technology, etc. conforming to the national second-level and above authentication chip), adopts a physical tamper-proof design (with voltage attack, frequency attack, laser attack detection and protection functions), stores root keys and derived keys; the root key is generated by the built-in true random number generator (TRNG) when the chip is powered on, and is permanently fixed in the non-erasable area of the chip, and is only used to derive secondary keys; the derived keys are divided into system encryption keys (used for operating system partition encryption), data encryption keys (used for user data encryption), and authentication keys (used for identity verification), and various derived keys are generated through the SM4 key derivation function (KDF), and are dynamically derived from the root key only when needed, and are cleared in the memory immediately after use, and are used for system encryption and data encryption, and support key backup and recovery functions, and the backup process uses a hardware encryption channel for transmission to prevent backup key leakage.

[0061] Specifically, in the initialization stage of the mobile terminal device, the domestic security chip generates a root key through the built-in true random number generator, and the key is permanently stored in the tamper-proof storage area of the chip. When system encryption is needed, the security chip generates a first layer derived key based on the root key, and performs a hardware-level encryption operation on the operating system partition. When the user accesses the data, the security chip generates a second layer derived key based on the root key, and performs a decryption operation on the specific file accessed by the user. All key generation and encryption and decryption operations are completed in the physically isolated environment of the security chip, and the operating system cannot directly access the key plaintext.

[0062] Compared with the prior art, the traditional scheme relies on software to realize key storage, and the key plaintext exists in the system memory, which has the risk of being stolen by malicious programs. The scheme realizes the physical isolation storage of the key through the hardware chip, and even if the operating system is attacked, the key content cannot be obtained. The prior art adopts a single key system, and key leakage will lead to the loss of all data, while the scheme realizes the layered key architecture, and the root key and the derived key form logical isolation, and the leakage of a single derived key will not affect the security of other encrypted data.

[0063] Through the above technical scheme, the application solves the problem of insecure key storage in software encryption scheme, realizes the physical isolation protection of the key through the hardware chip, and prevents key leakage caused by operating system vulnerabilities. The layered key system reduces the risk of key leakage, and even if a single derived key is cracked, the root key can still guarantee the overall security of the system. The double implementation of system encryption and data encryption forms a defense in depth, and an encryption barrier is established at the operating system layer and the user data layer to effectively resist attack behaviors against different levels.

[0064] The application further proposes that the full-disk encryption partition adopts hardware-level password protection, and the encryption key is generated and managed by a security chip.

[0065] The hardware-level password protection refers to realizing data encryption and decryption operations through the password operation capability of the physical chip, and specifically, a built-in password algorithm engine of a domestic security chip can be used to realize the feature, which resists reverse attacks against the software layer through the hardware isolation mechanism. The encryption key is generated and managed by the security chip, which means that the generation, storage and calling process of the key are completed in the independent security chip, and specifically, the key can be generated by using the SM4 or SM2 national cryptographic algorithm and protected by the anti-tampering storage area of the security chip, which avoids exposing the key to the operating system memory space through physical isolation.

[0066] The full-disk encryption partition adopts hardware-level password protection, which is realized based on the domestic SM4 block cipher algorithm, and the encryption granularity is sector-level (each 512 bytes or 4096 bytes is an encryption unit); the encryption key is generated and managed by the security chip, and the generation process is completely completed in the chip and does not pass through the operating system memory; when the partition is divided, the storage area is divided into a public partition (storing non-sensitive data such as ordinary application installation files), a sensitive partition (storing general sensitive data such as office documents), and a confidential partition (storing highly sensitive data such as government confidential files) according to the data sensitivity level, the encryption keys of the partitions are independently generated, and the partition keys are bound to the user permissions, and only the key of the authorized user can decrypt the data of the partition; at the same time, the partition locking function is supported, and the user can manually lock the specified partition, and after the partition is locked, the user needs to additionally input the partition unlocking code to access even if the identity authentication is passed.

[0067] Specifically, when the mobile terminal device is full-disk encryption partitioned, the security chip generates an encryption key based on a hardware password engine, and stores the key in an anti-tampering area inside the chip. In the data reading and writing process, the security chip directly calls the key to perform encryption or decryption operations, and the key is always in a hardware protection state. Since the key generation and operation process does not pass through the operating system memory, attackers cannot obtain the key content through software vulnerabilities or memory scanning, thereby blocking the theft of the key.

[0068] Compared with the prior art, the traditional signal creation mobile terminal relies on software encryption technology, the key is stored in the system memory and the operation process is exposed to the software layer, which has the risk of being stolen or cracked by malicious programs. The scheme sinks the encryption process to the physical chip through hardware-level password protection, and combines the key life cycle management of the security chip to realize hardware isolation of key generation, storage and calling, forming a physical level protection barrier.

[0069] Through the above technical scheme, the application solves the problem that the software encryption key is easy to be cracked, prevents key leakage due to terminal loss or system vulnerabilities, and ensures that the stored data is in a hardware-level protection state throughout the life cycle.

[0070] The application further proposes a method based on a self-defined hardened operating system, which is adapted to rich peripheral interfaces and supports permission control, and is compatible with Android 10 and above systems.

[0071] Based on the self-defined hardened operating system, the Linux kernel is deeply customized, the core code (such as process management, memory management, and file system driver) is hardened, and is written into a read-only storage area (such as the RPMB partition of eMMC) to prevent the kernel from being tampered with. Rich peripheral interfaces are adapted, including USB3.0, Type-C (supporting PD charging and data transmission separation), HDMI (supporting video output encryption), UART (only authorized debugging permissions are opened), and SPI (used to connect encryption chips and other peripherals), and each interface is set with access permission control, and only authorized processes can call the interface. The role-based access control (RBAC) model is supported, and three types of roles, i.e. administrator, ordinary user, and visitor, are preset, different roles correspond to different partition access permissions and operation permissions (such as administrators can create / delete partitions, ordinary users can only read / write authorized partitions, and visitors can only access public partitions). At the same time, it is compatible with Android 10 and above systems, and is realized by building an Android compatible layer, the sandbox isolation mechanism is used, the Android application runs in an independent sandbox, can only access the allocated memory and public partition resources, and cannot directly access sensitive / confidential partitions, and the system call of the Android system needs to pass through the security check of the self-defined kernel to prevent breaking through the permission control through Android vulnerabilities.

[0072] The self-defined hardened operating system refers to a secure hardening of a system kernel and a driver layer through a code hardening technology, and can be specifically implemented by using a code signature verification and a module loading locking mechanism, and is used to eliminate potential vulnerabilities of an open source system architecture. The adaptation of rich peripheral interfaces refers to built-in multiple standard interface protocol stacks of the operating system, and can be specifically implemented by integrating USB-PD, MIPI-CSI, SPI and other interface driver modules, and is used to expand the hardware compatibility range. The permission control refers to setting an access control list at the kernel level, and can be specifically implemented by using a role-based access control model, and is used to realize fine management and control of data access. The compatibility with Android 10 and above systems refers to constructing a runtime environment compatible with an ART virtual machine, and can be specifically implemented by transplanting an Android framework layer interface and optimizing a resource scheduling mechanism, and is used to support the running of mainstream applications.

[0073] Specifically, the operating system kernel is modularly packaged through a code hardening technology, the core driver and the security component are written into a read-only storage area, and unauthorized code injection behavior is prevented. Multiple types of peripheral protocol stacks are integrated in the interface adaptation layer, and communication interaction with different hardware devices is realized through a standardized interface conversion module, for example, a private communication protocol of a domestic encryption chip is converted into a standard SPI interface signal. A permission control engine is constructed in the system service layer, and hardware resource access permissions are dynamically assigned based on process identity, and the permission verification mechanism is triggered when an application program calls a peripheral interface. At the same time, an Android compatibility layer technology is adopted, and a native Android application is seamlessly run in the customized system by redirecting system call interfaces, for example, a hardware acceleration interface of an Android media framework is mapped to a domestic GPU driver module.

[0074] Compared with the prior art, the traditional scheme relies on the open source Android system for secondary development, and system vulnerability repair lags behind and cannot eliminate architectural defects, while the scheme realizes active protection of the system bottom layer through kernel layer code hardening. The types of peripheral interface adaptation in the prior art are limited, resulting in poor hardware compatibility, and the scheme extends the access capability of special hardware such as domestic encryption chips and biometric modules by integrating standardized protocol stacks. The existing compatible scheme only supports a specific Android version, resulting in a fragmented application ecosystem, and the scheme realizes seamless migration of cross-version applications by constructing a dynamically adaptive runtime environment.

[0075] Through the above technical scheme, the application solves the problem of imperfect software ecosystem caused by poor compatibility of the operating system, realizes simultaneous access of domestic encryption peripherals and mainstream applications, eliminates the risk of data leakage caused by vulnerabilities of the open source system architecture, blocks illegal access behavior through kernel-level permission control, constructs a runtime environment compatible with multiple versions of Android applications, and reduces the ecological migration cost when a domestic security device replaces a traditional terminal.

[0076] The multi-factor identity authentication further includes biometric feature-based authentication.

[0077] The biometric feature type includes at least one of a fingerprint, a face, and an iris; the biometric feature authentication process forms a "three-factor authentication" or a "two-factor authentication + biometric feature enhancement" mode with user password authentication and external hardware identity certificate authentication, and specifically: the basic authentication mode is "password + hardware certificate" two-factor authentication, the user can select to start biometric feature authentication as enhanced verification, after starting, the "password + hardware certificate" verification needs to be completed first, and then the biometric feature verification can be passed to obtain the key access permission; the biometric feature template adopts a feature value extraction and encrypted storage mode, the original biometric feature data collected is only processed locally, the original data is deleted immediately after the feature value is extracted, the feature value is stored in a secure chip after being encrypted by an SM4 algorithm, only the encrypted feature value is compared each time authentication is performed, and the original feature data is not transmitted; the biometric feature template update function is supported, the user can re-collect the biometric feature to update the template, and the original authentication factor needs to be verified in the update process to prevent malicious update by others.

[0078] The biometric feature authentication refers to a way of identity verification by collecting physiological features of a user, and can be implemented by using fingerprint recognition, iris recognition, or face recognition. The biometric feature has uniqueness and non-replicability, and can effectively prevent the risk of theft or forgery of a traditional authentication factor. The live body detection technology is used to ensure that the biometric feature comes from a real human body rather than a replica, and can be implemented by using infrared live body detection or 3D structured light. The live body detection can block static image or model deception attacks and improve the security of the authentication process.

[0079] Specifically, when the user requests to access the encrypted partition, the password input, the external hardware certificate verification, and the biometric feature collection need to be completed in sequence. For example, before the mobile terminal device calls the secure chip, the system collects the facial features of the user through the camera and compares them with the pre-stored template. If the biometric feature matching fails, the access request is rejected, even if the password and the hardware certificate have passed the verification. Since the biometric feature is bound to the physiological features of the user, an attacker cannot bypass the authentication link by stealing the password or duplicating the hardware token. The secure chip releases the encryption key only after all authentication factors are verified, thereby forming multiple protections for the key storage and use, and avoiding the risk of data leakage due to failure of a single authentication factor.

[0080] Compared with the prior art, the traditional signal creation mobile terminal only relies on passwords and hardware tokens for identity verification, and there is a hidden danger of illegal access due to loss or cracking of the credentials. The present scheme introduces a biometric authentication layer, expands the identity verification from two factors to three factors, and uses the non-replicability of biometrics to fill the security gap of traditional authentication methods. In the prior art, key storage relies on software encryption, which is vulnerable to memory cracking attacks. The present scheme uses forced multi-factor authentication in conjunction with a secure chip to ensure that the encryption key is only released after the biometric verification is passed, thereby blocking unauthorized decryption behavior from the root.

[0081] Through the above technical solution, the present application can prevent illegal access to the encrypted partition through biometric authentication when the user password is leaked or the external hardware credential is lost. For example, when the device is lost and the attacker obtains the password and hardware token, the secure chip will still lock the encryption key because the live biometric feature cannot be verified, preventing the stored data from being decrypted and stolen. At the same time, the combination of biometric authentication and hardware-level secure chips avoids the vulnerability of software-level key storage, ensuring the reliable execution of data encryption and access control policies.

[0082] The present application further proposes that the stored data includes file system data (such as data in EXT4, F2FS file system format), and that multi-factor identity authentication and secure chip verification are required when accessing the file system.

[0083] The stored data also includes database data (such as SQLite, MySQL database files) and cache data (such as application running cache, browser cache), and all types of data need to be included in the encryption and isolation range; multi-factor identity authentication and secure chip verification are required when accessing the file system; The specific process is as follows: after the user initiates a file access request, multi-factor identity authentication is triggered first, and after the authentication is passed, the file system driver sends a key request to the secure chip. The secure chip verifies the legality of the request (confirms that the request comes from an authorized process) and then transmits the corresponding file system partition key to the encryption and decryption engine. The encryption and decryption engine performs real-time encryption and decryption of file data based on the partition key, and the decrypted data is only temporarily stored in memory. The decrypted data in the memory is immediately cleared after the user's operation is completed. At the same time, file system operations (such as creating, modifying, and deleting files) will generate operation logs, which are stored in an unalterable area after being signed by the secure chip, for audit tracking. For database data, the Transparent Data Encryption (TDE) technology is used, and the database file is automatically encrypted when stored and automatically decrypted when read. The encryption key is managed by the secure chip, and the database process cannot directly obtain the key plaintext.

[0084] Among them, file system data refers to a data organization form with a directory hierarchy, which can be implemented using EXT4 or F2FS file system formats. This feature is used to clearly protect the core carrier of structured data stored in mobile devices.

[0085] Multi-factor authentication refers to an identity verification mechanism that combines two or more independent verification elements. Specifically, it can be implemented using a combination of user password and USB key authentication. This feature is used to block the risk of unauthorized access caused by the cracking of a single authentication method.

[0086] Among them, security chip verification refers to the key storage and operation performed by an independent hardware module. Specifically, the SM4 algorithm built into the domestic security chip can be used to realize key encryption and decryption. This feature is used to realize the physical isolation between the key and the system memory to prevent the key from being leaked in the software layer.

[0087] Specifically, when a user accesses file system data, they must first enter a preset user password and insert external hardware authentication credentials to verify the operator's identity. After successful authentication, the system retrieves an encryption key stored internally in the security chip. This key is generated by the chip hardware and cannot be exported through the software interface. The security chip performs real-time encryption and decryption operations on the file system data. The key retrieval process is entirely completed within the chip, preventing the key from being exposed in the operating system's memory. Through dual hardware-level protection of identity authentication and key management, a complete and trusted chain is formed from the access point to the data processing stage.

[0088] In some specific implementations, file system access permissions can be set to allow only user processes verified by the security chip to perform read and write operations. Unauthorized processes cannot bypass the hardware verification mechanism to obtain decrypted data. For example, in government office scenarios, access to directories involving confidential documents requires mandatory fingerprint recognition and smart card authentication. After successful verification, the security chip decrypts the encrypted files in that directory.

[0089] Compared to existing technologies, traditional solutions rely on software encryption algorithms and store keys in system memory, which poses a risk of key theft by malicious programs. This solution uses a hardware security chip to solidify key storage and encryption / decryption processes, and combines multi-factor authentication to build a physical isolation mechanism between identity verification and key retrieval, effectively eliminating key leakage problems caused by software-layer security vulnerabilities.

[0090] Through the above technical solution, this application solves the risk of data leakage caused by insecure key storage during the access of the file system on the mobile terminal of the domestic innovation application. Through the synergistic effect of hardware-level key management and multi-factor authentication, the security protection of file system data is ensured throughout the entire process of identity verification, key access and encryption / decryption.

[0091] like Figure 2As shown, the application also proposes a system for data encryption and isolation of Xingshi mobile terminal storage, comprising a storage partition module 10, an identity authentication module 20, a key management module 30, an encryption and decryption module 40 and a permission control module 50.

[0092] The storage partition module 10 is used for full-disk encryption partitioning of the storage area of the mobile terminal device and setting access control strategy according to user permissions; The identity authentication module 20 is connected to the storage partition module 10, and is used for performing multi-factor identity authentication including user password authentication and external hardware identity certificate authentication; The key management module 30 is connected to the identity authentication module 20, and is used for obtaining an encryption key from a secure chip after authentication; The encryption and decryption module 40 is connected to the key management module 30, and is used for performing data encryption and decryption operations using the key; The permission control module 50 is connected to the encryption and decryption module 40, and is used for controlling partition data access according to user permissions.

[0093] Among them, the full-disk encryption partitioning refers to dividing the mobile terminal storage space into multiple independent encryption areas, which can be implemented by using hardware-level password protection technology, for example, generating an AES-256 algorithm key by a domestic secure chip to encrypt each partition. This feature prevents unauthorized cross-zone access by physically isolating data of different permissions.

[0094] The external hardware identity certificate refers to a physical authentication device independent of the mobile terminal body, which can be implemented by using a USB key or a smart card, for example, implementing digital signature verification by using the SM2 algorithm. This feature enhances the reliability of identity verification by introducing physical medium authentication.

[0095] The secure chip refers to a special hardware module with key storage and operation functions, which can be implemented by using a domestic TCM trusted password module, for example, protecting the security of the root key by physical tamper-proof design. This feature avoids the risk of software storage leakage by using hardware-level key management.

[0096] Specifically, when the user initiates a data access request, the identity authentication module 20 first triggers a two-factor verification process, requiring the input of a password and the insertion of a hardware certificate. After verification, the key management module 30 calls the preset encryption key from the secure chip, and the encryption and decryption module 40 performs real-time decryption operation on the data of the target partition based on the key. The permission control module 50 allows the user to access only the partition data matching his / her permissions according to the preset access strategy. For example, a normal user permission can only access public partition data, while an administrator permission can access all partitions. The modules realize data flow closed loop through domestic hardware interface, and the encryption operation is completed inside the secure chip, avoiding key exposure in the operating system memory.

[0097] Compared with the prior art, the traditional mobile terminal data encryption scheme relies on software to realize key storage and encryption and decryption operations, and there is a risk that the key will be attacked by memory extraction. The existing identity authentication system usually only uses single password verification, which is vulnerable to brute force cracking or social engineering attacks.

[0098] The application realizes hardware-level key management and encryption operation through a domestic security chip, combines a two-factor authentication mechanism of physical hardware credentials and passwords, and constructs a full-link protection system from identity verification to data access. Compared with the scheme relying on GPS positioning or secondary development of the Android system, the system uses a self-controllable hardware module and a customized permission policy, effectively solving the security hidden danger of external interface and the problem of extensive permission control.

[0099] Through the above technical solution, physical isolation and hardware-level encryption protection of the storage data of the mobile terminal of the national information creation are realized, unauthorized access is prevented through a multi-factor authentication mechanism, and the security of key generation and storage is ensured by using a domestic security chip. The permission control module restricts the user operation range according to a fine-grained policy, avoiding unauthorized access to sensitive data. The system is compatible with domestic operating systems and adapts to various peripheral interfaces, solving the supply chain risk and system compatibility problem caused by the dependence on foreign hardware in the traditional scheme.

[0100] The above is only a specific embodiment of the application, but the protection scope of the application is not limited thereto, and any person skilled in the art can easily think of changes or replacements within the technical range disclosed in the application, which should be covered within the protection scope of the application. Therefore, the protection scope of the application should be subject to the protection scope of the claims.

Claims

1. A method for encrypting and isolating stored data in mobile terminals used in the field of domestic IT innovation, characterized in that, Includes the following steps: The storage area of ​​the mobile device is fully encrypted and partitioned, and access control policies for each partition are set according to user permissions. When a user requests access to stored data, multi-factor authentication is performed, which includes user password authentication and external hardware identity credential authentication. After the multi-factor authentication is successful, the stored encryption key is retrieved from the security chip of the mobile device; Use the encryption key to decrypt or encrypt the requested storage data; Based on user permissions, allow users to access data in the corresponding partition.

2. The method for encrypting and isolating stored data in a mobile terminal for information technology innovation according to claim 1, characterized in that, When the mobile device starts up, a secure and trusted boot process is performed. Based on domestically produced chips and trusted computing modules, the system is verified step by step to ensure the integrity of the operating system boot process. The step-by-step verification process includes: first verifying the digital signature of the bootloader, and then loading the bootloader after confirming that it is correct; The bootloader then verifies the integrity hash value of the operating system kernel image to ensure that the kernel has not been tampered with. Finally, a trust measurement is performed on the critical service modules of the system to form a complete trust chain from hardware to software, ensuring the integrity of the operating system startup process. At the same time, a local alarm is triggered and an exception log is reported to the management platform when a startup exception occurs.

3. The method for encrypting and isolating stored data in a mobile terminal for information technology innovation according to claim 1, characterized in that, It also includes a secure and reliable upgrade step: when upgrading firmware, the firmware package is verified to identify whether the firmware package has been tampered with, ensuring the reliability of the upgrade process; When performing a firmware upgrade, the management terminal first digitally signs the firmware package using the national cryptographic SM2 algorithm, generating a firmware description file containing signature information, firmware version number, and verification timestamp. After receiving the firmware package and description file, the mobile terminal first verifies the integrity of the description file, and then calls the SM2 signature verification algorithm built into the security chip to verify the firmware package signature. If the signature verification fails, the firmware package is discarded and the tampering event is recorded; if the signature verification passes, the SHA-256 hash value of the firmware package is further calculated and compared with the hash value preset in the description file. This double verification identifies whether the firmware package has been tampered with. The upgrade process employs a breakpoint resume mechanism to prevent upgrade failures caused by network interruptions. After the upgrade is completed, the system automatically restarts and performs a startup trust verification to ensure the reliability of the upgrade process.

4. The method for encrypting and isolating stored data in a mobile terminal for information technology innovation according to claim 1, characterized in that, The external hardware identity credential includes at least one of a USB key, a smart card, or a biometric identification device. The USB key must support the national cryptographic algorithm SM4 to encrypt and store user identity information. After being inserted into the device, it establishes encrypted communication with the security chip via the USBHID protocol and outputs the identity credential only after successful verification. The smart card adopts contact or contactless communication methods, with a built-in security element to store the key. A dynamic token is generated and transmitted through an encrypted channel each time authentication is performed. The biometric identification device must have a liveness detection function. The collected biometric templates are encrypted with the SM4 algorithm and stored in the security chip to prevent template data leakage.

5. The method for encrypting and isolating stored data in a mobile terminal for information technology innovation according to claim 1, characterized in that, The security chip is a domestically produced security chip that stores a root key and derived keys for system encryption and data encryption. Among them, the security chip is a domestically produced security chip, which adopts a physical anti-tampering design and stores the root key and the derived key; The root key is generated by the built-in true random number generator when the chip is powered on and is permanently stored in the non-erasable area of ​​the chip. It is only used to derive secondary keys. Derived keys are divided into system encryption keys, data encryption keys, and authentication keys according to their uses. Each type of derived key is generated by the SM4 key derivation function and is dynamically derived from the root key only when needed. After use, it is immediately cleared from memory. It is used for system encryption and data encryption and also supports key backup and recovery functions. The backup process uses a hardware encrypted channel for transmission to prevent backup key leakage.

6. The method for encrypting and isolating stored data in a mobile terminal for information technology innovation according to claim 1, characterized in that, The full-disk encrypted partition is protected by hardware-level cryptography, and the encryption key is generated and managed by a security chip. The full-disk encrypted partition employs hardware-level cryptographic protection, based on the domestically developed SM4 block cipher algorithm, with encryption granularity at the sector level. Encryption keys are generated and managed by a security chip, with the generation process entirely within the chip and bypassing the operating system's memory. During partitioning, the storage area is divided into public, sensitive, and confidential partitions based on data sensitivity levels. Each partition generates its own encryption key, and these keys are bound to user permissions, allowing only authorized users to decrypt data in that partition using their corresponding keys. Partition locking is also supported, allowing users to manually lock specific partitions. Once locked, even with authentication, an additional partition unlock code is required for access.

7. The method for encrypting and isolating stored data in a mobile terminal for information technology innovation according to claim 1, characterized in that, The method is based on a custom-defined operating system that adapts to peripheral interfaces and supports permission control, while being compatible with Android 10 and above. Specifically, based on a custom-built operating system, the operating system kernel is a deeply customized version of the Linux kernel, with the core code solidified and written to a read-only storage area to prevent the kernel from being tampered with; it is compatible with a wide range of peripheral interfaces, including USB 3.0, Type-C, HDMI, UART, and SPI, and each interface has access control settings, allowing only authorized processes to call the interface; it supports a role-based access control model, with three preset roles: administrator, ordinary user, and guest, each corresponding to different partition access permissions and operation permissions; It is compatible with Android 10 and above by building an Android compatibility layer. The compatibility layer adopts a sandbox isolation mechanism. Android applications run in an independent sandbox and can only access the allocated memory and public partition resources. They cannot directly access sensitive / confidential partitions. In addition, Android system calls must be verified by a custom kernel to prevent access control from being bypassed through Android vulnerabilities.

8. The method for encrypting and isolating stored data in a mobile terminal for information technology innovation according to claim 1, characterized in that, The multi-factor authentication also includes biometric authentication, where the biometric type includes at least one of fingerprint, face, and iris. Biometric authentication processes, along with user password authentication and external hardware identity credential authentication, form a three-factor authentication or two-factor authentication + biometric enhancement mode. Specifically: The basic authentication mode is two-factor authentication of password + hardware credentials. Users can choose to enable biometric authentication as an enhanced verification. After enabling it, users must first complete the password + hardware credentials verification and then pass the biometric verification to obtain key access rights. The biometric template uses a feature value extraction and encrypted storage method. The collected original biometric data is processed only locally. After the feature value is extracted, the original data is deleted immediately. The feature value is encrypted using the SM4 algorithm and stored in the security chip. Each authentication only compares the encrypted feature value and does not transmit the original feature data. The biometric template update function is supported. Users can re-collect biometrics to update the template. The update process requires verification of the original authentication factor to prevent malicious updates by others.

9. The method for encrypting and isolating stored data in a mobile terminal for information technology innovation according to claim 1, characterized in that, The stored data includes file system data, and access to the file system requires multi-factor authentication and security chip verification. The stored data also includes database data and cached data; all types of data must be encrypted and isolated; access to the file system requires multi-factor authentication and security chip verification. The specific process is as follows: After a user initiates a file access request, multi-factor authentication is triggered first. After successful authentication, the file system driver sends a key request to the security chip. After the security chip verifies the legality of the request, it transmits the corresponding file system partition key to the encryption and decryption engine. The encryption and decryption engine performs real-time encryption and decryption of file data based on the partition key. The decrypted data is only temporarily stored in memory and is immediately cleared from memory after the user completes the operation. At the same time, all file system operations generate operation logs, which are signed by the security chip and stored in an immutable area for auditing and tracing. For database data, transparent data encryption technology is used. Database files are automatically encrypted when stored and automatically decrypted when read. The encryption key is managed by a security chip, and the database process cannot directly obtain the plaintext key.

10. A system for encrypting and isolating stored data in domestically developed mobile terminals, used to execute the method for encrypting and isolating stored data in domestically developed mobile terminals according to any one of claims 1-9, characterized in that, include: The storage partitioning module is used to perform full-disk encryption partitioning of the storage area of ​​mobile devices and set access control policies for each partition according to user permissions. The identity authentication module, connected to the storage partition module, is used to perform multi-factor authentication when a user requests access to stored data. The multi-factor authentication includes user password authentication and external hardware identity credential authentication. The key management module, connected to the identity authentication module, is used to obtain the stored encryption key from the security chip of the mobile device after the multi-factor authentication is passed. An encryption / decryption module, connected to a key management module, is used to decrypt or encrypt the requested storage data using the encryption key. The access control module, connected to the encryption / decryption module, is used to allow users to access data in the corresponding partitions based on their permissions.

Images