Application data management method and device, equipment, medium and program product

Abstract

The invention discloses an application data management method and device, equipment, a medium and a program product, and relates to the technical field of computers. The method comprises the following steps: in a process of compiling an application source code, encrypting an original text key according to an encryption strategy corresponding to annotation information to obtain a ciphertext key; after the application source code compilation is finished, compiled codes are obtained; in the process of running the first application based on the compiled code, decrypting the ciphertext key to obtain an original text key; encrypting to-be-encrypted data in the first application based on the original text key to obtain ciphertext data; or decrypting the to-be-decrypted data in the first application based on the original text key to obtain the original text data. Due to the fact that the compiled code replaces the original text key by importing the ciphertext key, the compiled code cannot be obtained through reverse engineering to be analyzed to obtain the original text key, the leakage risk of the original text key is greatly reduced, the encrypted application data cannot be decrypted through the original text key, and the safety of the application data is improved.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to an application data management method, apparatus, device, medium, and program product. Background Technology

[0002] With the widespread use of applications, the security and privacy of data within these applications has become an important issue that cannot be ignored.

[0003] In related technologies, when an application is running, data can be encrypted using an encryption key in the application's runtime code.

[0004] However, the application's runtime code is easily obtained through reverse engineering, which can easily lead to the parsing of the encryption keys stored within, thereby increasing the possibility of application data leakage. Summary of the Invention

[0005] This application provides an application data management method, apparatus, device, medium, and program product, the technical solution of which is as follows:

[0006] On the one hand, an application data management method is provided, the method comprising:

[0007] Obtain the application source code of the first application, wherein the application source code includes a plain text key and annotation information corresponding to the plain text key, the plain text key is used to encrypt or decrypt application data generated during the runtime of the first application, and the annotation information is used to encrypt the plain text key;

[0008] During the compilation of the application source code, the original key is encrypted according to the encryption strategy corresponding to the annotation information to obtain the ciphertext key;

[0009] After the application source code is compiled, the compiled code is obtained. The compiled code is used to import the ciphertext key to replace the plaintext key.

[0010] During the process of running the first application based on the compiled code, the ciphertext key is decrypted to obtain the plaintext key;

[0011] The encrypted data in the first application is obtained by encrypting the data to be encrypted using the original key; or, the original data is obtained by decrypting the data to be decrypted in the first application using the original key.

[0012] On the other hand, an application data management device is provided, the device comprising:

[0013] The acquisition module is used to acquire the application source code of the first application, wherein the application source code includes a plain text key and annotation information corresponding to the plain text key, the plain text key is used to encrypt application data generated during the runtime of the first application, and the annotation information is used to encrypt the plain text key;

[0014] The compilation module is used to encrypt the plaintext key according to the encryption strategy corresponding to the annotation information during the compilation of the application source code, so as to obtain the ciphertext key;

[0015] The compilation module is used to obtain compiled code after the application source code is compiled, and the compiled code is used to import the ciphertext key to replace the plaintext key;

[0016] The runtime module is used to decrypt the ciphertext key to obtain the plaintext key during the process of running the first application based on the compiled code;

[0017] The operating module is further configured to encrypt the data to be encrypted in the first application based on the original key to obtain ciphertext data; or, to decrypt the data to be decrypted in the first application based on the original key to obtain the original data.

[0018] On the other hand, a computer device is provided, the computer device including a processor and a memory, the memory storing at least one instruction, at least one program, code set or instruction set, the at least one instruction, the at least one program, the code set or instruction set being loaded and executed by the processor to implement any of the above-described application data management methods.

[0019] On the other hand, a computer-readable storage medium is provided, wherein at least one instruction, at least one program, code set, or instruction set is stored therein, wherein the at least one instruction, the at least one program, the code set, or the instruction set is loaded and executed by a processor to implement any of the application data management methods described above.

[0020] On the other hand, a computer program product or computer program is provided, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform any of the application data management methods described above.

[0021] The beneficial effects of the technical solutions provided in this application include at least the following:

[0022] During the development of the first application, annotation information is embedded in the application source code. This annotation information marks the original key used for data encryption or decryption. During the compilation of the application source code, the encryption strategy specified in the annotation information is automatically identified, and the original key is encrypted accordingly. This results in compiled code containing the ciphertext key. Because the compiled code replaces the original key with the ciphertext key, it is impossible to obtain the original key through reverse engineering, greatly reducing the risk of original key leakage. Therefore, it is impossible to decrypt the encrypted application data using the original key, thus improving the security of the application data. Furthermore, the automatic encryption of the original key by recognizing annotation information during the compilation of the application source code avoids the tedious steps of manually encrypting the original key, improving the encryption efficiency. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 This is a schematic diagram of a computer system provided in an exemplary embodiment of this application;

[0025] Figure 2 This is a flowchart of an application data management method provided in an exemplary embodiment of this application;

[0026] Figure 3 This is a schematic diagram of compiled application source code provided in an exemplary embodiment of this application;

[0027] Figure 4 This is a schematic diagram illustrating the identification annotation information provided in an exemplary embodiment of this application;

[0028] Figure 5 This is a flowchart of an application data management method provided in another exemplary embodiment of this application;

[0029] Figure 6 This is a schematic diagram illustrating the process of importing a ciphertext key provided in an exemplary embodiment of this application;

[0030] Figure 7 This is a schematic diagram of an encryption process based on a TEE environment provided in an exemplary embodiment of this application;

[0031] Figure 8 This is a flowchart of an application data management method provided in yet another exemplary embodiment of this application;

[0032] Figure 9 This is a flowchart of an application data management method provided in another exemplary embodiment of this application;

[0033] Figure 10 This is a schematic diagram of an application data management method provided in an exemplary embodiment of this application;

[0034] Figure 11 This is a schematic diagram of an application execution environment provided in an exemplary embodiment of this application;

[0035] Figure 12 This is a structural block diagram of an application data management device provided in an exemplary embodiment of this application;

[0036] Figure 13 This is a structural block diagram of a computer device provided in an exemplary embodiment of this application. Detailed Implementation

[0037] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0038] In this application, the terms "first" and "second" are used to distinguish between identical or similar items that have essentially the same function. It should be understood that there is no logical or temporal dependency between "first" and "second", nor is there any limitation on the quantity or execution order.

[0039] It should be noted that this application may display prompt interfaces, pop-ups, or output voice input content before and during the collection of user data. These prompt interfaces, pop-ups, or voice input content are used to inform the user that their data is being collected. This ensures that the application only begins the steps for collecting user data after receiving confirmation from the user regarding the prompt interface or pop-up; otherwise (i.e., without user confirmation), the steps for collecting user data end, meaning no user data is collected. In other words, all user data collected in this application is collected with the user's consent and authorization, and the collection, use, and processing of related user data must comply with relevant laws, regulations, and standards.

[0040] Figure 1This is a structural block diagram of a computer system provided in an exemplary embodiment of this application. The computer system can be implemented as a system architecture for an application data management method. The computer system includes: a first device 110 and a second device 120.

[0041] The first device 110 can be an electronic device such as a mobile phone, tablet computer, vehicle terminal (vehicle system), or PC (Personal Computer). Optionally, the first device 110 is a device for developing a first application. Illustratively, a software development application is installed on the first device 110, and developers can use the software development application on the first device 110 to develop the first application. This application does not limit the form of the first application, and it includes, but is not limited to, installed Apps (Application Programs), mini-programs, etc., and can also be in the form of a webpage.

[0042] The second device 120 can be an electronic device such as a mobile phone, tablet computer, vehicle terminal (vehicle system), or PC (Personal Computer). Optionally, the second device 120 is a device for running the first application. The first device 110 and the second device 120 can be the same device or different devices. That is, after the first application is developed on the first device 110, the first application can run on the first device 110 or on other devices (i.e., the second device 120).

[0043] In some embodiments, the computer system further includes a server 130.

[0044] Optionally, the first device 110 is connected to the server 130 via a wired or wireless network, and the second device 120 is connected to the server 130 via a wired or wireless network. The server 130 is used to provide backend services for the first device 110 and the second device 120. It is worth noting that the server 130 can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, a cloud server providing basic cloud computing services, or a node in a blockchain system.

[0045] The application data management method provided in this application embodiment can be executed by a computer device, which refers to an electronic device with data computing, processing, and storage capabilities. Figure 1Taking the implementation environment of the scheme shown as an example, the application data management method can be executed by the first device 110 or the second device 120, or the application data management method can be executed interactively by the first device 110 and the second device 120, or the application data management method can be executed interactively by the first device 110 and the server 130, or the application data management method can be executed interactively by the second device 120 and the server 130, or the application data management method can be executed interactively by the first device 110, the second device 120 and the server 130, etc., without limitation here.

[0046] The following description uses the first device 110 executing the application data management method as an example to illustrate the application data management method provided in this application embodiment.

[0047] As an illustration, a developer can use the software development application in the first device 110 to develop a first application and obtain the application source code of the first application. The application source code of the first application may contain a key variable for encrypting application data. This key variable is used to store the original key and has corresponding annotation information, such as "@protected".

[0048] After obtaining the application source code of the first application, the application source code of the first application can be compiled on the first device 110 using a compilation tool. During the compilation process, the annotation information in the application source code will be scanned. When the annotation information is scanned, the encryption policy corresponding to the annotation information is found. The plain text key in the key variable corresponding to the annotation information is encrypted using the encryption policy (for example, if the encryption policy indicates that the plain text key is encrypted using the first public key, then the first public key is obtained to encrypt the plain text key), and the ciphertext key is obtained. Thus, the plain text key stored in the key variable is replaced with the ciphertext key.

[0049] After compilation, compiled code is obtained, which can be used to import the encrypted key into the first device. For example, when loading a first application on the first device 110 based on the compiled code, the encrypted key can be imported into the trusted storage unit in the first device 110 through the compiled code. The trusted storage unit can be implemented as a storage unit in the Trusted Execution Environment (TEE) of the first device. The TEE is an area on the central processing unit (CPU) of the first device 110, providing an isolated environment for applications running within it to protect applications and data from attacks by other software. Optionally, a first private key, corresponding to the aforementioned first public key, is stored in the trusted storage unit and used to decrypt the encrypted key. After receiving the encrypted key, the trusted storage unit uses the first private key to decrypt the encrypted key to obtain the original key.

[0050] After the first application is successfully loaded into the first device 110, it can be run on the first device 110. During the operation of the first application, various types of application data will be generated, such as session data and log data, which include some data that needs to be encrypted or decrypted. The data to be encrypted or decrypted is imported into the trusted execution environment. When the trusted execution environment receives the data to be encrypted, it encrypts it using the original key (e.g., public key) corresponding to the data to be encrypted. When the trusted execution environment receives the data to be decrypted, it decrypts it using the original key (e.g., public key) corresponding to the data to be decrypted.

[0051] In other embodiments, after the first device 110 obtains the compiled code, it can send the compiled code to the second device 120, which loads and runs the first application based on the compiled code. The process of running the first application and encrypting or decrypting application data in the second device 120 can be referred to the process of running the first application and encrypting or decrypting application data in the first device 110, which will not be repeated here.

[0052] In the above embodiments, by adding annotation information to the application source code, the original key can be automatically encrypted during the source code compilation process. This replaces the original key with a ciphertext key when the compiled code is imported into the device. Therefore, reverse engineering of the compiled code can only parse the ciphertext key, not the original key, and thus cannot decrypt the encrypted application data, greatly reducing the risk of application data leakage. Furthermore, during application runtime, the encryption or decryption process of application data is performed in the TEE, ensuring that the ciphertext key and the data used to decrypt the ciphertext key are not leaked, thereby further reducing the risk of application data leakage.

[0053] The following describes the process of the application data management method provided in this application.

[0054] Figure 2 This application provides a flowchart of an exemplary embodiment of an application data management method. The method is executed by a computer device, which may be... Figure 1 The first device shown includes steps 210 to 250.

[0055] Step 210: Obtain the application source code of the first application.

[0056] In illustrative purposes, the first application can be various types of software applications, including website applications (e.g., online forums, search engines, etc.), mobile applications (e.g., game applications, instant messaging applications, news applications, map applications, etc.), service applications (e.g., web servers, database servers, etc.), etc., and this application embodiment does not limit them.

[0057] Optionally, the application source code of the first application refers to code written in a target programming language, wherein the target programming language includes, but is not limited to, at least one of C, C++, Python, Java, etc.

[0058] To illustrate, developers write application source code on the first device using a suitable target programming language according to project requirements. After completion, the application source code is stored in a local code repository on the first device or a remote code repository on a server. When the application source code needs to be used on the first device, it can be obtained from the local code repository or the remote code repository.

[0059] The application source code includes the original key and the corresponding annotation information.

[0060] The original key is used to encrypt or decrypt application data generated during the runtime of the first application. For example, when writing the application source code, the developer adds a first original key, which is used to encrypt the application data generated by the first application; the developer also adds a second original key, which is used to decrypt the application data generated by the first application.

[0061] Optionally, the original key can be implemented as key data obtained based on a symmetric encryption algorithm. Illustratively, in a symmetric encryption algorithm, the same key is used for encryption and decryption. This means that if a certain key is used to encrypt data, then the same key can also be used to decrypt the data. This encryption method is usually very fast in terms of encryption and decryption speed, thereby improving the encryption efficiency of application data.

[0062] Alternatively, the plaintext key can be implemented as public or private key data obtained based on an asymmetric encryption algorithm. Illustratively, in an asymmetric encryption algorithm, a pair of keys is used: a public key and a private key. The public key is public and can be used to encrypt data, while the private key is kept secret and used to decrypt data encrypted by the public key. In this embodiment, when the first application runs, the plaintext key (public key) can be used to encrypt application data to obtain ciphertext data. When it is necessary to decrypt the application data, the private key corresponding to the plaintext key can be used to decrypt the ciphertext. Optionally, the private key corresponding to the plaintext key can be stored in the TEE of the device running the first application, or stored on the blockchain to ensure the security of the private key. When the first application runs, the plaintext key (private key) can also be used to decrypt application data to obtain the plaintext data.

[0063] The annotation information corresponding to the original key is used to encrypt the original key. Optionally, the annotation information refers to information in the application source code that can be recognized by the compilation tool. Illustratively, the annotation information is additional information added to the application source code. The annotation information can be read and processed by the compilation tool. The annotation information itself does not directly affect the execution of the application source code, but it can be queried and used to achieve related functions. For example, in this application, the annotation information is used to implement the encryption function of the original key. When the target programming language is Java, the syntax of the annotation information begins with the @ symbol, followed by the name of the annotation, such as "@protected", "@pro", etc.

[0064] In some embodiments, the application source code of the first application includes a key variable, which is used to store the original key, wherein the key variable corresponds to annotation information.

[0065] As an illustration, when developers write source code, they can define key variables in the source code and assign values ​​to them, that is, assign the plain text key to the key variable. For example: private pkKEY = "123456", where pkKEY is the key variable and "123456" is the plain text key.

[0066] Step 220: During the compilation of the application source code, the original key is encrypted according to the encryption strategy corresponding to the annotation information to obtain the ciphertext key.

[0067] In some embodiments, after obtaining the application source code of the first application, the first device may compile the application source code of the first application on the first device. Compiling the application source code refers to the process of converting the application source code into machine code or intermediate code.

[0068] Optionally, during the compilation of the application source code, the annotation information in the application source code is identified, and the encryption strategy corresponding to the annotation information is determined based on the annotation information.

[0069] In a schematic manner, the application source code is subjected to lexical analysis, syntax analysis, and semantic analysis by a compilation tool to obtain an annotation abstract syntax tree. The annotation abstract syntax tree adds nodes representing annotation information to the standard abstract syntax tree structure. These nodes are used to encrypt the plaintext key to obtain the ciphertext key. The process of generating the annotation abstract syntax tree can be regarded as the process of identifying annotation information in the application source code and determining the corresponding encryption strategy based on the annotation information.

[0070] Optionally, after the first device identifies the annotation information, it can search the strategy list based on the annotation information. The strategy list includes multiple candidate strategies, each of which corresponds to a type of annotation information. The candidate strategy corresponding to the annotation information is obtained from the strategy list as the encryption strategy.

[0071] The encryption strategy corresponding to the annotation information is used to indicate the method of encrypting the original key.

[0072] In some embodiments, after determining the encryption strategy corresponding to the annotation information, encrypted data is obtained according to the encryption strategy corresponding to the annotation information; the original key is encrypted with the encrypted data to obtain the ciphertext key.

[0073] The encrypted data is the data used to encrypt the original key.

[0074] Optionally, different encryption strategies correspond to different encrypted data, wherein the encrypted data includes at least one of first key data, verification information, etc. The first key data is used to encrypt the original key, and the verification information is used to initiate the decryption process of the ciphertext key if the verification is successful.

[0075] The above encryption strategy includes at least one of the following strategies:

[0076] (1) The encryption strategy indicates that the original key is encrypted with the first key data corresponding to the annotation information to obtain the ciphertext key.

[0077] The first key data can be either key data obtained based on a symmetric encryption algorithm or public key data obtained based on an asymmetric encryption algorithm; there is no limitation here.

[0078] Optionally, the encrypted data includes first key data. After determining the encryption strategy corresponding to the annotation information, the first key data is obtained according to the encryption strategy corresponding to the annotation information. The original key is encrypted using the first key data to obtain the ciphertext key.

[0079] (2) The encryption strategy indicates that the ciphertext key is obtained by encrypting the original key with the first key data corresponding to the annotation information and the verification information.

[0080] The verification information includes at least one of the following: signature information, token information, etc.

[0081] Optionally, the encrypted data includes first key data and verification information. After determining the encryption strategy corresponding to the annotation information, the first key data and verification information are obtained according to the encryption strategy corresponding to the annotation information. The original key is encrypted using the first key data to obtain the first ciphertext segment. The verification information and the first ciphertext segment are concatenated to obtain the ciphertext key.

[0082] Taking encrypted data including first key data and signature information as an example, the original key is encrypted using the first key data to obtain the first ciphertext segment; the signature information and the first ciphertext segment are then concatenated to obtain the ciphertext key. Illustratively, the signature information can be implemented as a digital signature for the first application. The digital signature is a unique digital code generated by processing the application documents related to the first application using algorithms; this digital code is the digital signature. The signature information is used to verify the integrity of the first application. Only after verifying the integrity of the first application (i.e., that it has not been tampered with) will the ciphertext key be decrypted to obtain the original key.

[0083] Taking encrypted data including first key data and token information as an example, the original key is encrypted using the first key data to obtain the first ciphertext segment; the token information and the first ciphertext segment are then concatenated to obtain the ciphertext key. For illustration, the token information includes an account identifier with encryption permissions. The token information is used to verify whether the account currently requesting encryption has the necessary permissions. Only if the account requesting encryption has the necessary permissions will the ciphertext key be decrypted to obtain the original key.

[0084] The account identifier included in the token information can be implemented as a digital identifier corresponding to biometric features such as fingerprints or voiceprints. This identifier is used to verify whether the digital identifier corresponding to the biometric features such as fingerprints or voiceprints currently entered by the account requesting encryption is consistent with the digital identifier stored in the token information. If the verification is consistent, it is determined that the account requesting encryption has encryption privileges, and only then will the ciphertext key be decrypted to obtain the original key.

[0085] It should be noted that the examples of encryption strategies corresponding to the annotation information above are merely illustrative and are not intended to be limiting. For example, the original key can be encrypted using the first key data to obtain the ciphertext key; when decrypting the ciphertext key, a verification code is sent to the device currently requesting encryption, and a verification code input interface is displayed on the first device. When the verification code entered by the user matches the verification code sent to the device currently requesting encryption, the verification is confirmed to be successful, and the ciphertext key is decrypted to obtain the original key.

[0086] In some embodiments, during the compilation of application source code, annotation information in the application source code is identified; encryption code is obtained according to the encryption strategy corresponding to the annotation information; the encryption code is called to perform the encryption process of the original key to obtain the key ciphertext.

[0087] In illustrative terms, the encryption code is used to encrypt the original key according to the encryption policy. Taking the encryption policy indicating that the original key is encrypted with the first key data corresponding to the annotation information to obtain the ciphertext key as an example, the encryption code is used to encrypt the original key with the first key data to obtain the ciphertext key, and then use the ciphertext key to replace the original key, for example: replacing the original key stored in the key variable with the ciphertext key.

[0088] Optionally, the encrypted code is a piece of code automatically generated based on the encrypted data and plaintext key corresponding to the encryption strategy; or the encrypted code is generated based on a pre-written code template, which includes encrypted data variables and plaintext variables. The encrypted data corresponding to the obtained encryption strategy is assigned to the encrypted data variables, and the obtained plaintext key is assigned to the plaintext variables to obtain the encrypted code.

[0089] Step 230: After the application source code is compiled, the compiled code is obtained.

[0090] To illustrate, after the application source code is compiled, the compiled code is obtained. This compiled code can be machine code, which is a computer program code composed of binary instructions and is a language that a computer can directly execute; or the compiled code can be intermediate code, such as bytecode, which needs to be converted into machine code by a just-in-time (JIT) compiler during execution.

[0091] Taking the compiled code implementation as bytecode as an example, after compiling the application source code with a compilation tool to obtain the annotation abstract syntax tree, the compilation tool converts the annotation abstract syntax tree into bytecode.

[0092] The compiled code is used to import the ciphertext key to replace the original key; that is, during the compilation of the application source code, the original key is converted into a ciphertext key.

[0093] Optionally, the original key is stored in a key variable. After the application source code is compiled, the value of the key variable in the compiled code is converted from the original key to the ciphertext key. For illustration, after the application source code is compiled, the name and type of the key variable are included in the generated compiled code; the value of the key variable (i.e., the ciphertext key) can be included in the compiled code or stored in the first application's configuration file, database, or other location. Executing the compiled code retrieves the ciphertext key.

[0094] Step 240: During the process of running the first application based on the compiled code, the ciphertext key is decrypted to obtain the plaintext key.

[0095] In some embodiments, during the execution of the first application based on the compiled code, decrypted data is obtained; the ciphertext key is decrypted using the decrypted data to obtain the original key.

[0096] The decryption data is the data used to decrypt the ciphertext key.

[0097] Optionally, the encrypted data and decrypted data corresponding to the encryption strategy are corresponding, with different encryption strategies corresponding to different decrypted data. The encrypted data includes at least one of the following: second key data, data to be verified, etc. The second key data is used to decrypt the ciphertext key, and the verification information is used to verify the data to be verified.

[0098] The methods for obtaining the plaintext key from the decryption ciphertext key include at least one of the following methods:

[0099] (1) The encryption strategy indicates that the original key is encrypted with the first key data corresponding to the annotation information to obtain the ciphertext key.

[0100] Optionally, the decrypted data includes second key data, which is obtained during the execution of the first application based on the compiled code; the ciphertext key is decrypted based on the second key data to obtain the original key.

[0101] The second key data can be key data obtained based on a symmetric encryption algorithm (in which case the first key data and the second key data are the same), or it can be private key data obtained based on an asymmetric encryption algorithm (in which case the first key data and the second key data are different). There is no limitation here.

[0102] (2) The encryption strategy indicates that the ciphertext key is obtained by encrypting the original key with the first key data corresponding to the annotation information and the verification information.

[0103] Optionally, the decrypted data includes second key data and data to be verified. During the process of running the first application based on the compiled code, the second key data and data to be verified are obtained; the data to be verified is verified based on the verification information in the ciphertext key; if the data to be verified is verified, the first ciphertext segment in the ciphertext key is decrypted based on the second key data to obtain the original key.

[0104] The data to be verified includes at least one of the following: context information of the first application used to verify signature information, identification information used to verify token information, etc., without limitation.

[0105] Taking the example of decrypting data including second key data and context information of the first application, during the execution of the first application based on the compiled code, the signature information in the ciphertext key is verified based on the context information of the first application. If the context information of the first application is verified, the first ciphertext segment in the ciphertext key is decrypted based on the second key data to obtain the original key. Illustratively, if the signature information is the application digest of the encrypted first application, then the data used to decrypt the signature information and the currently obtained context information of the first application are acquired. The integrity of the first application can be verified by checking whether the application digest of the first application in the context information is consistent with the decrypted signature information. If they are consistent, the first application is determined to be intact (i.e., not tampered with), and the original key is obtained by decrypting the ciphertext key.

[0106] Taking the example of decrypted data including second key data and identification information used to verify token information, during the execution of the first application based on the compiled code, the token information's identification information is verified based on the token information in the ciphertext key. If the token information's identification information is verified successfully, the first ciphertext segment in the ciphertext key is decrypted based on the second key data to obtain the original key. For illustration, if the token information includes an account identifier with encryption permissions, then the token information's identification information is the account identifier corresponding to the logged-in account on the device running the first application, etc. It can be checked whether the account identifier corresponding to the logged-in account on the device belongs to the token information. If it does, it is determined that the account currently requesting encryption has encryption permissions, and the ciphertext key is decrypted to obtain the original key.

[0107] It should be noted that the above examples of methods for obtaining the plaintext key by decrypting the ciphertext key are merely illustrative and are not intended to be limiting.

[0108] In some embodiments, before running the first application based on the compiled code, the first application is loaded based on the compiled code, and the encrypted key is imported into the target storage unit. Illustratively, the compiled code includes import code, which is executed when the first application is loaded, thereby importing the encrypted key into the target storage unit of the first device.

[0109] Optionally, the target storage unit can be implemented as a trusted storage unit, a blockchain, a cloud server, etc., without limitation. The trusted storage unit can be implemented as a storage unit in the Trusted Execution Environment (TEE) of the first device.

[0110] Optionally, the target storage unit stores decryption data of the ciphertext key. After the first application is successfully loaded, the first application is run. When the first application is running, the ciphertext key is decrypted using the decryption data stored in the target storage unit to obtain the original key. The data to be encrypted is then encrypted using the original key to obtain the ciphertext data.

[0111] Step 250: Encrypt the data to be encrypted in the first application based on the original key to obtain ciphertext data; or decrypt the data to be decrypted in the first application based on the original key to obtain original data.

[0112] This is illustrative. After obtaining the compiled code, the first application can be run based on it. During the execution of the first application, it generates application data, including user input, program running status, calculation results, log records, etc. These data are not limited here. The application data generated by the first application needs to be properly stored for access when needed. Some application data requires encryption, meaning it needs to be encrypted before storage. Data to be encrypted in the first application includes user passwords, system security data, and geolocation information, etc., which are not limited here. Other application data requires decryption, meaning it needs to be decrypted. Data to be decrypted in the first application includes encrypted communication parameters, etc., which are not limited here.

[0113] Optionally, after obtaining the plaintext key by decrypting the ciphertext key from the decrypted data, if the first device contains data to be encrypted, then the data to be encrypted is encrypted using the plaintext key corresponding to the data to be encrypted, resulting in ciphertext data. The ciphertext data can be directly stored in the target storage unit or stored in other locations, such as the storage unit in the first device that stores application data, a blockchain, a cloud server, etc., without limitation here. If the first device contains data to be decrypted, then the data to be decrypted is decrypted using the plaintext key corresponding to the data to be decrypted, resulting in the plaintext data.

[0114] In summary, the application data management method provided in this application embeds annotation information into the application source code during the development of the first application. This annotation information can mark the original key used for data encryption or decryption. During the compilation of the application source code, the encryption strategy specified in the annotation information is automatically identified, and the original key is encrypted accordingly, resulting in compiled code containing the ciphertext key. Since the compiled code replaces the original key with the imported ciphertext key, it is impossible to obtain the original key through reverse engineering, greatly reducing the risk of original key leakage. Therefore, it is impossible to decrypt the encrypted application data using the original key, thus improving the security of the application data. Furthermore, by automatically encrypting the original key using annotation information during the compilation of the application source code, the tedious steps of manually encrypting the original key are avoided, improving the encryption efficiency of the original key.

[0115] The following example illustrates the process of compiling application source code to obtain annotation information in the application data management method provided in this application embodiment, using the application source code implemented as Java source code and the compiled code as bytecode.

[0116] This is illustrative; please refer to it. Figure 3 It illustrates the compilation process of an application's source code, such as Figure 3 As shown, the application source code 301 is contained in the .java code. The application source code 301 includes a key variable, which stores the original key and has corresponding annotation information.

[0117] When the .java code file is input into the Java compiler (javac), the Java compiler will perform lexical analysis and syntax analysis on the application source code 301 in the .java code file. Lexical analysis is used to convert the character sequence in the .java file into a token sequence, and syntax analysis is used to construct a basic abstract syntax tree from the token sequence according to the syntax rules of the Java language. This basic abstract syntax tree represents the structure of the application source code 301, but in-depth semantic checking has not yet been performed.

[0118] After syntax analysis, the Java compiler identifies annotation information corresponding to the key variable in application source code 301, and uses the Annotation Processing Tool (APT) to scan and process the annotation information, modifying the basic abstract syntax tree to obtain the annotation abstract syntax tree. The annotation abstract syntax tree adds nodes corresponding to the annotation information. That is, the logic corresponding to the annotation abstract syntax tree includes the encryption logic corresponding to the annotation information. This encryption logic instructs the encryption of the plaintext key to obtain the ciphertext key.

[0119] After obtaining the annotation abstract syntax tree (API), the Java compiler performs a thorough semantic check to ensure the code is logically correct. This includes type checking and variable scope checking. Following semantic analysis, the resulting API is 302. API 302 is then converted into bytecode 303 (compiled code) by the bytecode generator in the Java compiler. During this conversion, the bytecode generator executes the encryption logic described above, replacing the plaintext key with a ciphertext key in the application source code 301, thus ensuring the bytecode does not contain the plaintext key. Finally, bytecode 303 is written into a .class file. This .class file contains all the information needed for the Java program to run and can be executed by the Java Virtual Machine.

[0120] APT is a tool in the Java compiler that can automatically generate encrypted code during compilation based on the annotation information corresponding to the original key. This encrypted code is used to automatically encrypt the original key and replace the original key with the encrypted ciphertext key, thereby reducing manual code input and improving development efficiency.

[0121] This is illustrative; please refer to it. Figure 4 It illustrates a schematic diagram of identifying annotation information during the compilation process of application source code.

[0122] like Figure 4 As shown, the .java code file 410 contains the application source code of the first application. During the compilation process, the compilation tool 420 scans for annotation information in the .java code file using APT, such as @protected. After obtaining the @protected annotation, APT searches for the encryption strategy corresponding to the annotation. This encryption strategy can be obtained through the annotation processor corresponding to the annotation. For example, a custom annotation processor can be defined for the @protected annotation and registered with the Java compiler. When APT scans for the @protected annotation, it calls the annotation processor to generate encrypted code.

[0123] After obtaining the encrypted code, the basic abstract syntax tree is modified based on the encrypted code to obtain the annotation abstract syntax tree. In other words, the code logic corresponding to the encrypted code is the encryption logic in the logic corresponding to the annotation abstract syntax tree. Finally, the compiler 420 compiles the annotation abstract syntax tree to obtain bytecode, which is then written into the .class code file 430.

[0124] In some embodiments, before running the first application, the encrypted key can be imported into a trusted storage unit in the first device via compiled code, thereby performing an encryption process on the application data in the trusted storage unit, further ensuring the security of the application data. For illustrative examples, please refer to [reference needed]. Figure 5 The diagram illustrates a flowchart of an application data management method, which includes steps 501 to 506.

[0125] Step 501: Obtain the application source code of the first application.

[0126] The application source code includes the plaintext key and the corresponding annotation information. The plaintext key is used to encrypt or decrypt the application data generated when the first application runs, and the annotation information is used to encrypt the plaintext key.

[0127] Optionally, the number of plaintext keys in the application source code of the first application can be one or more. In some embodiments, the application source code of the first application includes multiple plaintext keys, and different plaintext keys are used to encrypt or decrypt different application data. Schematic, the application source code of the first application includes plaintext key 1, plaintext key 2, and plaintext key 3. Plaintext key 1 is used to encrypt the user password in the first application, plaintext key 2 is used to encrypt session data in the first application, and plaintext key 3 is used to decrypt user operation data in the first application, etc., without limitation here.

[0128] Step 502: During the compilation of the application source code, the original key is encrypted according to the encryption strategy corresponding to the annotation information to obtain the ciphertext key.

[0129] Optionally, when the application source code of the first application includes multiple plaintext keys, if the encryption strategies of the multiple plaintext keys are the same, then the multiple plaintext keys can correspond to the same annotation information; if the encryption strategies of the multiple plaintext keys are different, then the multiple plaintext keys correspond to different annotation information.

[0130] Optionally, during the compilation of the application source code, the annotation information in the application source code is identified, and the encrypted data is obtained according to the encryption strategy corresponding to the annotation information; the original key is encrypted with the encrypted data to obtain the ciphertext key.

[0131] Optionally, the encrypted data includes at least one of the following: first key data used to encrypt the original key, signature information, token information, etc., without limitation.

[0132] Step 503: After the application source code is compiled, the compiled code is obtained.

[0133] The compiled code is used to import the ciphertext key and replace the original key.

[0134] Optionally, the original key is stored in a key variable. After the application source code is compiled, the value of the key variable in the compiled code is converted from the original key to the ciphertext key.

[0135] Step 504: Load the first application based on the compiled code and import the ciphertext key into the trusted storage unit.

[0136] The trusted storage unit refers to a storage unit within the trusted execution environment (TEU) of the first device. The TEU is an area on the central processing unit of the first device that provides an isolated environment for applications running within it to protect applications and data from attacks by other software. When the encrypted key is stored in the trusted storage unit, it is physically and logically isolated from the normal operating system environment to ensure its security.

[0137] Optionally, after obtaining the compiled code, the first application is loaded on the first device based on the compiled code; or, the first application is loaded on another device based on the compiled code. Schematic, the compiled code obtained on the first device is sent to a second device, and the first application is loaded on the second device based on the compiled code, wherein the first device and the second device are different devices.

[0138] In some embodiments, the compiled code includes import code for importing the ciphertext key into a trusted storage unit. Optionally, during the loading of the first application, the import code in the compiled code is executed to import the ciphertext key into the trusted storage unit.

[0139] To illustrate, when developers write source code, they also write target code. This target code is used to read the encrypted key and import it into a trusted storage unit when the first application is loaded. After compiling the target code, the compiled code contains the corresponding import code (or import instructions). When the first application is loaded onto the first device and ready to run, according to the execution flow of the compiled code, when it reaches the part containing the import code, it retrieves the encrypted key from its storage location and then stores it in the trusted storage unit of the first device. The storage location of the encrypted key can be in the compiled code, a blockchain, a cloud server, etc., and is not limited here.

[0140] In the above embodiments, the ciphertext key is automatically imported into the trusted storage unit by importing code, avoiding the process of manually storing the ciphertext key and improving storage efficiency.

[0141] Optionally, the trusted storage unit also stores decryption data of the ciphertext key, which is used to decrypt the ciphertext key. The decryption data is the data used to decrypt the ciphertext key. Optionally, the encrypted data and decryption data corresponding to the encryption strategy are corresponding; for example, if the encrypted data corresponding to the encryption strategy is public key data, then the decryption data is the private key data corresponding to the public key data.

[0142] Optionally, the decrypted data includes at least one of the following: second key data for decrypting the ciphertext key, a signature credential for verifying signature information, and a token credential for verifying token information; no limitation is made here.

[0143] Step 505: During the process of running the first application based on the compiled code, the original key is obtained by decrypting the ciphertext key through decryption data in the trusted storage unit.

[0144] Optionally, after obtaining the compiled code, the first application is run on the first device based on the compiled code; or, the first application is run on another device based on the compiled code. Schematic, the compiled code obtained on the first device is sent to a second device, and the first application is run on the second device based on the compiled code, wherein the first device and the second device are different devices.

[0145] In some embodiments, the original key is encrypted with the first key data to obtain the ciphertext key, and then the original key is decrypted in the trusted storage unit based on the second key data.

[0146] In some embodiments, the original key is encrypted with the first key data to obtain the first ciphertext segment; the verification information and the first ciphertext segment are concatenated to obtain the ciphertext key; then, in the trusted storage unit, the verification information in the ciphertext key is verified based on the data to be verified; if the verification information is verified successfully, the first ciphertext segment in the ciphertext key is decrypted based on the second key data to obtain the original key.

[0147] Step 506: Import the data to be encrypted from the first application into the trusted storage unit. In the trusted storage unit, encrypt the data to be encrypted using the original key to obtain the ciphertext data corresponding to the data to be encrypted.

[0148] To illustrate, during the operation of the first application, the data that needs to be encrypted (such as passwords) is imported into a trusted storage unit. In the trusted storage unit, the imported data is encrypted using the original key to obtain ciphertext data.

[0149] In other embodiments, the original key can also be used to decrypt the data to be decrypted. That is, step 505 above can also be implemented as importing the data to be decrypted in the first application into a trusted storage unit, and decrypting the data to be decrypted in the trusted storage unit using the original key to obtain the original data.

[0150] In summary, the application data management method provided in this application compiles the application source code, identifies the encryption strategy of the annotation information to encrypt the original key, and thus obtains the compiled code. Since the compiled code replaces the original key with the imported ciphertext key, it is impossible to obtain the original key through reverse engineering, which greatly reduces the risk of leakage of the original key and improves the security of application data.

[0151] In addition, the application data management method provided in this application embodiment stores the ciphertext key in a trusted storage unit in the first device when loading the first application. The data in the trusted storage unit cannot be accessed or tampered with by malicious software, thereby improving the security of the ciphertext key. Furthermore, the encryption operation of the application data is also performed in the trusted storage unit, thereby ensuring the security of the application data encryption process and further reducing the risk of data leakage.

[0152] The following example illustrates the process of encrypting the original key and storing the ciphertext key in the application data management method provided in this application embodiment, using the compilation process of the application source code of the first application executed by the first device (compilation device) 601 (i.e., steps 501 to 503 above) and the loading and running process of the application source code of the first application executed by the second device (running device) 602 (i.e., steps 504 to 506 above) as an example.

[0153] This is illustrative; please refer to it. Figure 6 The compilation device 601 obtains the public key used for encrypting the key material, where the key material is also the plaintext key, and the public key is the aforementioned first key data. Then, it uses the public key to encrypt and generate import material. In other words, during the compilation process, the compilation device 601 encrypts the key material using the public key to obtain the ciphertext key, and then generates import material based on the ciphertext key and the import code template. The import material is used to import the ciphertext key into the storage unit of the Trusted Execution Environment (TEE) of the running device 602 when the first application is loaded. After the compilation device 601 finishes compiling the application source code of the first application, it obtains the compiled code, in which the import material is included.

[0154] The running device 602 can send the compiled code to the running device 602. The running device 602 will load the first application based on the compiled code. During the loading process of the first application, the encrypted key will be imported into the storage unit in the trusted execution environment according to the imported materials. The running device 602 will obtain the private key used to decrypt the key material. The private key is also the second key data mentioned above. In the trusted execution environment, the running device 602 will decrypt the encrypted key with the private key to obtain the key material and store the key material in the storage unit of the trusted execution environment.

[0155] The key material includes at least one of the following: a key for decryption, a key for encryption, etc., without limitation. After the key material is stored in a Trusted Execution Environment (TEE), the encryption and decryption process of application data can be performed within the TEE. The TEE provides hardware isolation and encryption protection, safeguarding the security and privacy of data and code. Data and code within the TEE cannot be accessed or tampered with by malicious software, thus enhancing security.

[0156] This is illustrative; please refer to it. Figure 7 It illustrates the network communication process between the client (including the APP's business module 701 and trusted execution environment 702) and the server (i.e., the business backend 703) based on TEE encryption within the APP.

[0157] like Figure 7 As shown, when the APP's business module 701 needs to communicate with the business backend 703 via the network, it first prepares network request parameters, which are the data to be encrypted. It then calls the encryption interface to encrypt the network request parameters in the Trusted Execution Environment (TEE) 702. For illustration, the TEE 702 stores key materials, including a first target public key. This first target public key can be used to encrypt the network request parameters. Therefore, the TEE 702 can encrypt the network request parameters using the first target public key to obtain the encrypted parameters. Then, the TEE 702 returns the obtained encrypted parameters to the APP's business module 701.

[0158] After receiving the encrypted parameters, the APP's business module 701 determines the network request based on these parameters. Then, the APP's business module 701 sends the network request to the business backend 703. The business backend 703 obtains the first target private key corresponding to the first target public key used to decrypt the encrypted parameters. The business backend 703 decrypts the encrypted parameters in the network request using the first target private key to obtain the network request parameters. After obtaining the network request parameters, the business backend 703 performs business processing based on the network request parameters to obtain the response parameters. The business backend 703 then obtains the second target public key used to encrypt the response parameters, encrypts the response parameters using the second target public key to obtain the encrypted response parameters, and sends the encrypted response parameters back to the APP's business module 701.

[0159] When the APP's business module 701 receives the encrypted response parameters, it calls the decryption interface to decrypt the encrypted response parameters in the Trusted Execution Environment (TEE) 702. For illustration, the TEE 702 stores key materials, including a second target private key corresponding to the second target public key. The second target private key can be used to decrypt the encrypted response parameters. Therefore, the encrypted response parameters can be decrypted in the TEE 702 using the second target private key to obtain the response parameters. Then, the TEE 702 returns the response parameters to the APP's business module 701.

[0160] In other embodiments, before running the first application, the encrypted key can be divided and stored in a trusted storage unit in the first device and in the blockchain corresponding to the first device through compiled code, thereby ensuring the security of the encrypted key. Illustratively, the application data management method provided in this application embodiment can also be implemented as follows.

[0161] Step 1 Obtain the application source code of the first application.

[0162] The application source code includes the plaintext key and the corresponding annotation information. The plaintext key is used to encrypt or decrypt the application data generated when the first application runs, and the annotation information is used to encrypt the plaintext key.

[0163] Step 2 During the compilation of the application source code, the original key is encrypted according to the encryption strategy corresponding to the annotation information to obtain the ciphertext key.

[0164] Optionally, during the compilation of the application source code, the annotation information in the application source code is identified, and the encrypted data is obtained according to the encryption strategy corresponding to the annotation information; the original key is encrypted with the encrypted data to obtain the ciphertext key.

[0165] Step 3 After the application source code is compiled, the compiled code is obtained.

[0166] The compiled code is used to import the ciphertext key and replace the plaintext key. Optionally, the plaintext key is stored in a key variable, and after the application source code is compiled, the value of the key variable in the compiled code is converted from the plaintext key to the ciphertext key.

[0167] Step 4 During the loading of the first application based on the compiled code, obtain the first timestamp of the loading process.

[0168] Optionally, the first timestamp is the timestamp between the start time of loading the compiled code on the first device and the end time of loading.

[0169] To illustrate, if the first application is loaded onto the first device and ready to run, according to the compiled code execution flow, when the part containing the imported code is reached, that moment is taken as the first timestamp.

[0170] Step 5 Based on the first timestamp, the encrypted key is divided into a first key segment and a second key segment. The first key segment and the first timestamp are sent to the blockchain corresponding to the first device for storage, and the second key segment is imported into the trusted storage unit.

[0171] Optionally, multiple value-taking positions are determined by the first timestamp. Value-taking operations are performed at these multiple value-taking positions of the ciphertext key to obtain key values ​​corresponding to each of the multiple value-taking positions. These key values ​​are used as the first key segment, and the key values ​​in the ciphertext key other than the first key segment are used as the second key segment. For illustration, assuming the ciphertext key is a key segment of a preset length, such as the string "ABC123456", the preset length is 9. The processing value corresponding to the first timestamp (the value obtained according to the preset algorithm) is "428714", where the value of each character in the processing value is less than or equal to the preset length.

[0172] The characters in the ciphertext key are selected based on the last three digits of the timestamp processing value and concatenated in sequence. Therefore, 7, 1, and 4 correspond to the 7th, 1st, and 4th characters in the ciphertext key, respectively, which is 4A1. Thus, the first key segment is 4A1, and the second key segment is BC2356.

[0173] If there is a duplicate character among the characters selected based on the processing value of the timestamp, then that character is skipped and other characters are selected. For example, if the processing value corresponding to the first timestamp is "428722", and the value is taken based on the last 3 digits of the processing value of the timestamp, "722", then the duplicate value position is stored, that is, the second character position. Then, the duplicate character at the end is ignored and "872" is selected as the new value position.

[0174] It should be noted that the above example of dividing the ciphertext key based on the first timestamp is only illustrative and is not intended to be limiting.

[0175] Optionally, a first key segment and a second key segment are obtained, the first key segment and the first timestamp are sent to the blockchain corresponding to the first device for storage, and the second key segment is imported into a trusted storage unit.

[0176] The trusted storage unit is used to indicate the trusted execution environment in the first device. Schematic, the compiled code includes import code, which is used to import the second key segment into the trusted storage unit.

[0177] In this context, the blockchain corresponding to the first device refers to the decentralized database that the first device accesses. The first key segment and the first timestamp are encapsulated into a data storage request, which is then sent to the blockchain. The blockchain will store the first key segment and the first timestamp based on the data storage request through a consensus mechanism.

[0178] Step 6 During the process of running the first application based on the compiled code, the data to be encrypted is obtained and a key acquisition request is sent to the blockchain.

[0179] The key acquisition request includes the requester's information.

[0180] To illustrate, when an application runs, it generates multiple application data. The first application automatically identifies which data needs to be encrypted. Once the data to be encrypted is identified, the first device generates a key acquisition request, which contains the requester's information.

[0181] The requester information includes the unique identifier of the first device, the application's identifier, the user's public key, and the request timestamp, etc., which are not limited in this embodiment. The user's public key is used to encrypt information, ensuring that only the user holding the corresponding private key can decrypt and access sensitive data. The request timestamp refers to the time the key acquisition request was sent.

[0182] Step 7 If the blockchain verifies the requester's information based on the key acquisition request, it obtains the first key segment and the first timestamp sent by the blockchain and imports the first key segment and the first timestamp into the trusted storage unit.

[0183] Optionally, the smart contract or verification node in the blockchain can verify the requester information in the key acquisition request. For example, if the requester information contains the user's public key, the blockchain can determine whether the user's public key is in the public key registration record by querying the public key registration record on the blockchain. If it is, the verification is successful. If the requester information includes the unique identifier of the first device, the blockchain can query the registration record of the unique identifier. If the registration record exists, the verification is successful.

[0184] It should be noted that the above examples of blockchain verification requester information are merely illustrative and are not intended to be limiting.

[0185] After successful verification, the blockchain sends the first key segment and the first timestamp to the first device. Upon receiving the first device, the first device imports the first key segment and the first timestamp into the trusted storage unit.

[0186] Step 8In the trusted storage unit, the first key segment and the second key segment are restored based on the first timestamp to obtain the ciphertext key, and the ciphertext key is decrypted to obtain the original key.

[0187] Optionally, multiple value positions are determined by the first timestamp, and the first key segment is restored to the second key segment based on the multiple value positions to obtain the ciphertext key.

[0188] To illustrate, taking the above example of dividing the key segments as a premise, during recovery, first obtain the processing value of the first timestamp "428714", the first key segment 4A1 and the second key segment BC2356. At this time, an empty array with a preset length of 9 can be determined first. According to the position indicated by the processing value of the first timestamp, the first key segment 4A1 is filled into the corresponding position of the empty array in character order, resulting in "A--1--4--", where "-" indicates an empty position that has not yet been filled with data. Then, the second key segment is filled into the remaining positions in character order, resulting in "ABC123456".

[0189] Optionally, the trusted storage unit stores decryption data of the ciphertext key, which is used to decrypt the ciphertext key.

[0190] After restoring the ciphertext key, the ciphertext key is decrypted using decryption data in the trusted storage unit to obtain the original key.

[0191] Step 9 The data to be encrypted in the first application is imported into the trusted storage unit. In the trusted storage unit, the data to be encrypted in the first application is encrypted based on the original key to obtain the ciphertext data corresponding to the data to be encrypted.

[0192] In a schematic example, in a trusted storage unit, the data to be encrypted in a first application is encrypted based on the first plaintext key corresponding to the data to be encrypted, thereby obtaining the ciphertext data corresponding to the data to be encrypted.

[0193] Alternatively, the data to be decrypted in the first application can be imported into a trusted storage unit. In the trusted storage unit, the data to be decrypted in the first application can be decrypted based on the original key to obtain the original data corresponding to the data to be decrypted.

[0194] In a schematic manner, in a trusted storage unit, the data to be decrypted in the first application is decrypted based on the second original key corresponding to the data to be decrypted, thereby obtaining the original data corresponding to the data to be decrypted.

[0195] In the above embodiments, by encrypting the original key into a ciphertext key and replacing the original key with the ciphertext key in the compiled code, the risk of the original key being leaked is greatly reduced. Furthermore, the ciphertext key is further divided into a first key segment and a second key segment, with the first key segment stored on the blockchain and the second key segment stored in a trusted storage unit. This distributed storage method further enhances the security of the ciphertext key and reduces the risk of its leakage.

[0196] When data needs to be encrypted or decrypted, the stored key segment is only allowed to be accessed after the blockchain verifies the requester's information, ensuring the security of the access key and further reducing the risk of ciphertext key leakage.

[0197] In some embodiments, the encryption strategy corresponding to the annotation information indicates that the plaintext key is encrypted using the first public key corresponding to the annotation information. For illustrative purposes, please refer to... Figure 8 The diagram illustrates a flowchart of an application data management method, which includes steps 810 to 850.

[0198] Step 810: Obtain the application source code of the first application.

[0199] The application source code includes the plaintext key and the corresponding annotation information. The plaintext key is used to encrypt or decrypt the application data generated when the first application runs, and the annotation information is used to encrypt the plaintext key.

[0200] Optionally, the plaintext key can be implemented as public key data or private key data. When the plaintext key is used to encrypt application data generated during the runtime of the first application, the plaintext key is public key data; when the plaintext key is used to decrypt application data generated during the runtime of the first application, the plaintext key is private key data.

[0201] Step 820: During the compilation of the application source code, the original key is encrypted based on the first public key corresponding to the annotation information to obtain the ciphertext key.

[0202] In illustrative terms, encrypting the original key using the first public key can be achieved by encrypting the original key using the first public key and the encryption algorithm corresponding to the first public key to obtain the ciphertext key. The encryption algorithm includes at least one of the following: RSA (Rivest-Shamir-Adleman) encryption algorithm, ElGamal (ElGamal Encryption Algorithm) encryption algorithm, Elliptic Curve Cryptography, etc., without limitation here.

[0203] Optionally, during the compilation of the application source code, the annotation information in the application source code is identified, and the encryption strategy corresponding to the annotation information is determined based on the annotation information; if the encryption strategy indicates that the plaintext key is encrypted using the first public key corresponding to the annotation information, the plaintext key is encrypted based on the first public key corresponding to the annotation information to obtain the ciphertext key.

[0204] To illustrate, during the compilation of application source code, the policy list is searched based on the annotation information to obtain the encryption policy. If the encryption policy indicates that the plaintext key is encrypted using the first public key corresponding to the annotation information, then the first public key corresponding to the annotation information is obtained, and the plaintext key is encrypted using the first public key to obtain the ciphertext key.

[0205] In some embodiments, during the compilation of application source code, annotation information in the application source code is identified; encryption code is obtained according to the encryption strategy corresponding to the annotation information, wherein the encryption code is used to encrypt the original key using the first public key corresponding to the annotation information; and the encryption code is invoked to perform the encryption process of the original key to obtain the key ciphertext.

[0206] Step 830: After the application source code is compiled, the compiled code is obtained.

[0207] The compiled code is used to import the ciphertext key and replace the original key.

[0208] Optionally, after obtaining the compiled code, the first application is loaded based on the compiled code, and the encrypted key is imported into the target storage unit. For example, the compiled code includes import code; when the first application is loaded, this import code is executed, thereby importing the encrypted key into the target storage unit of the first device.

[0209] Optionally, the target storage unit can be implemented as a trusted storage unit, blockchain, cloud server, etc., without limitation here.

[0210] In some embodiments, the first public key corresponds to a first private key, which is used to decrypt the ciphertext key. Optionally, the first private key is pre-stored in the target storage unit.

[0211] Step 840: During the process of running the first application based on the compiled code, the original key is obtained by decrypting the ciphertext key using the first private key.

[0212] Optionally, during the execution of the first application based on the compiled code, the original key is obtained by decrypting the ciphertext key using the first private key in the target storage unit.

[0213] As an illustration, decrypting the ciphertext key using the first private key can be achieved by using the first private key and the above encryption algorithm to decrypt the ciphertext key and obtain the original key.

[0214] Step 850: Encrypt the data to be encrypted in the first application based on the original key to obtain ciphertext data; or decrypt the data to be decrypted in the first application based on the original key to obtain original data.

[0215] Optionally, the data to be encrypted in the first application is imported into a trusted storage unit. In the trusted storage unit, the data to be encrypted in the first application is encrypted based on the original key to obtain the ciphertext data corresponding to the data to be encrypted. Illustratively, in the trusted storage unit, the data to be encrypted in the first application is encrypted based on the first original key corresponding to the data to be encrypted to obtain the ciphertext data corresponding to the data to be encrypted.

[0216] Alternatively, the data to be encrypted in the first application can be imported into a trusted storage unit. In the trusted storage unit, the data to be encrypted in the first application is encrypted using the original key to obtain the ciphertext data corresponding to the encrypted data. Illustratively, in the trusted storage unit, the data to be decrypted in the first application is decrypted using the second original key corresponding to the data to be decrypted to obtain the original data corresponding to the data to be decrypted.

[0217] In summary, the application data management method provided in this application encrypts the original key into a ciphertext key using public key data during the compilation process. Attackers cannot directly obtain the original key, thus protecting the security of application data. Furthermore, the process of encrypting the original key using public key data is relatively simple, thereby improving the efficiency of key data encryption and decryption.

[0218] In other embodiments, the encryption strategy corresponding to the annotation information indicates that the plaintext key is encrypted using the first public key corresponding to the annotation information and the signature information of the first application. For illustrative purposes, please refer to... Figure 9 The diagram illustrates a flowchart of an application data management method, which includes steps 910 to 950.

[0219] Step 910: Obtain the application source code of the first application.

[0220] The application source code includes the plaintext key and the corresponding annotation information. The plaintext key is used to encrypt application data generated during the first application runtime, and the annotation information is used to encrypt the plaintext key.

[0221] Optionally, the plaintext key can be implemented as public key data or private key data. When the plaintext key is used to encrypt application data generated during the runtime of the first application, the plaintext key is public key data; when the plaintext key is used to decrypt application data generated during the runtime of the first application, the plaintext key is private key data.

[0222] Step 921: During the compilation of the application source code, obtain the first public key corresponding to the annotation information and the signature information of the first application.

[0223] Indicatively, during the compilation of application source code, annotation information in the application source code is identified, and the encryption strategy corresponding to the annotation information is determined based on the annotation information; if the encryption strategy indicates that the plaintext key is encrypted using the first public key corresponding to the annotation information and the signature information of the first application, the first public key corresponding to the annotation information and the signature information of the first application are obtained.

[0224] The signature information is the information obtained by signing the first application. It is illustrative. Signing the first application refers to the process of encrypting the application through a digital certificate.

[0225] Optionally, the signature information is the information obtained by encrypting the application digest of the first application. Illustratively, the digital certificate can be implemented as a second public key used to encrypt the first application. The application digest of the first application is encrypted using the second public key, and the encrypted application digest serves as the signature information of the first application. The application digest can represent the application content of the first application; for example, the application digest is a fixed-length string obtained by calculating a portion of the first application's source code, executable file, etc., and this string is used to uniquely identify this data.

[0226] Optionally, the original key is encrypted with the first public key to obtain the first ciphertext segment; the signature information and the first ciphertext segment are then concatenated to obtain the ciphertext key.

[0227] Step 922: Encrypt the original key with the first public key to obtain the first ciphertext segment, and concatenate the signature information and the first ciphertext segment to obtain the ciphertext key.

[0228] In illustrative terms, encrypting the original key using the first public key can be achieved by encrypting the original key using the first public key and the encryption algorithm corresponding to the first public key, thus obtaining the first ciphertext segment.

[0229] After obtaining the first ciphertext segment, the signature information and the first ciphertext segment are concatenated together to form the ciphertext key. The concatenation method can be a simple join, or some separators can be added between the two to distinguish the signature information and the first ciphertext segment.

[0230] In some embodiments, during the compilation of application source code, annotation information in the application source code is identified; encryption code is obtained according to the encryption strategy corresponding to the annotation information, wherein the encryption code is used to encrypt the original key with the first public key corresponding to the annotation information to obtain the first ciphertext segment, and concatenate the first ciphertext segment and signature information to obtain the ciphertext key; the encryption code is called to perform the encryption process of the original key to obtain the key ciphertext.

[0231] Step 930: After the application source code is compiled, the compiled code is obtained.

[0232] The compiled code is used to import the ciphertext key and replace the original key.

[0233] Optionally, after obtaining the compiled code, the first application is loaded based on the compiled code, and the encrypted key is imported into the target storage unit. For example, the compiled code includes import code; when the first application is loaded, this import code is executed, thereby importing the encrypted key into the target storage unit of the first device.

[0234] Optionally, the target storage unit can be implemented as a trusted storage unit, blockchain, cloud server, etc., without limitation here.

[0235] In some embodiments, the first public key corresponds to a first private key, which is used to decrypt the first ciphertext segment in the ciphertext key. Optionally, the first private key is pre-stored in the target storage unit.

[0236] Step 941: During the process of running the first application based on the compiled code, the context information of the first application is verified by the signature information in the ciphertext key.

[0237] Context information refers to various data and information related to the current running environment and state of the first application. For illustrative purposes, context information includes the application's unique identifier (such as package name, UUID, etc.), current version number; hardware device information on which the application runs, such as device model, operating system version, screen resolution, etc.; and the username, user ID, and permission level of the currently logged-in user; these are not specifically limited here.

[0238] In some embodiments, the signature information is information obtained by encrypting the application digest of the first application.

[0239] Optionally, during the process of running the first application based on the compiled code, the context information of the first application is obtained; the signature information is decrypted to obtain the application digest of the first application; and the context information of the first application is verified through the application digest of the first application.

[0240] To illustrate, during the operation of the first application, if the ciphertext key is required, that is, if data to be encrypted or decrypted is identified in the first application, the context information of the first application and the second private key used to decrypt the signature information are obtained. The second private key corresponds to the second public key. The signature information in the ciphertext key is decrypted using the second private key to obtain the application digest of the first application.

[0241] Optionally, the context information of the first application includes a digest data that matches the decrypted signature information (i.e., the application digest of the first application). The context information of the first application is verified by the application digest of the first application. That is, the decrypted application digest is compared with the application digest in the context information. If they are the same, the verification passes; if they are different, the verification fails.

[0242] Step 942: If the context information of the first application is verified, the first ciphertext segment in the ciphertext key is decrypted using the first private key to obtain the original key.

[0243] Optionally, if the application digest of the first application and the context information of the first application meet the consistency condition, the first ciphertext segment in the ciphertext key is decrypted using the first private key to obtain the original key.

[0244] Indicatively, the application digest obtained from decryption is compared with the application digest in the context information. If they are the same, the verification is successful, indicating that the context information of the first application contains a valid application digest that matches the signature information, thus confirming the integrity of the application.

[0245] In the above embodiments, the application digest of the first application obtained by decrypting the signature information is compared and verified with the context information of the first application to ensure that the application has not been tampered with, thereby enhancing the security of the application and preventing the implantation of malicious software or viruses.

[0246] Optionally, if the context information verification of the first application passes, the first ciphertext segment is decrypted using the first private key to obtain the original key. Illustratively, in the target storage unit, the ciphertext key is decrypted using the first private key to obtain the original key. Decrypting the ciphertext key using the first private key can be implemented by using the first private key and the aforementioned encryption algorithm to decrypt the ciphertext key to obtain the original key.

[0247] Step 950: Encrypt the data to be encrypted in the first application based on the original key to obtain ciphertext data; or, decrypt the data to be decrypted in the first application based on the original key to obtain original data.

[0248] Optionally, the data to be encrypted in the first application is imported into a trusted storage unit, where it is encrypted using the original key to obtain the ciphertext data corresponding to the data to be encrypted. Alternatively, the data to be encrypted in the first application is imported into a trusted storage unit, where it is encrypted using the original key to obtain the ciphertext data corresponding to the data to be encrypted.

[0249] In summary, the application data management method provided in this application encrypts the original key into a ciphertext key during the compilation process using public key data and application signature. Even if an attacker is in a fake application, they cannot obtain the key because the fake application will not be able to decrypt or access the original key without a correct signature, thereby further ensuring the security of the original key.

[0250] In addition, by signing the first application and including the signature information in the ciphertext key, the application's context information can be verified at runtime, which helps ensure the integrity of the application and prevents it from being tampered with.

[0251] In some embodiments, the application data management method provided in this application can be applied to key protection in the client of a first application, mainly addressing the security of APP keys in a white-box environment, and effectively reducing the risks caused by client key leakage. Here, a white-box attack refers to an attacker having complete control over the operating environment and executable program of an encryption system, and being able to observe and modify arbitrary internal operations and data.

[0252] The application data management method provided in this application embodiment will be described below in conjunction with the various stages of the first application lifecycle.

[0253] This is illustrative; please refer to it. Figure 10 The lifecycle of the first application includes the coding phase 1010, the compilation phase 1020, the loading phase 1030, and the runtime phase 1040.

[0254] During the encoding phase, 1010 primarily utilizes the ability of program annotations to easily set any key in the encoding process to become a protected key.

[0255] This is illustrative; please refer to it. Figure 10 During the encoding stage 1010, annotation information is added to the key variables that need to be protected in the source code, for example: @protected private pkKey = "123456", where @protected is the annotation information, pkKey is the key variable, and "123456" is the value assigned to the key variable, which is the original key.

[0256] During the compilation phase 1020, plaintext keys (i.e., original keys) are automatically converted into ciphertext keys through annotations. This way, even if the code is decompiled and restored, the real key cannot be obtained. In addition, the key is associated with the APP signature information, so even in a counterfeit APP, the key cannot be obtained.

[0257] Optionally, the compilation phase of 1020 mainly consists of three steps: scanning annotations, finding annotation specifications, and compilation. Among these, the annotation specifications are the encryption strategies mentioned above. The most crucial step in the compilation phase of 1020 is defining the annotation specifications: for example, variables modified with the `@protected` keyword will have their plaintext keys encrypted using the specified public key. Furthermore, the annotation specifications need to be extended according to the actual application; in this solution, the APP's signature information needs to be merged into the encrypted plaintext key.

[0258] This is illustrative; please refer to it. Figure 10During compilation phase 1020, the SDK (Software Development Kit) embeds a public key for encryption. During compilation, the SDK scans for annotations in the source code, such as `@protected`. After obtaining the `@protected` annotation, the SDK looks up the corresponding annotation specification. If the specification indicates using the embedded first public key to encrypt the plaintext key and then appending the app's signature information to the encrypted plaintext key, then during compilation, the first public key is used to encrypt the plaintext key to obtain the first ciphertext segment. This first key segment is then appended to the app's signature to generate ciphertext code, for example: `private pkKey = "*******#####"`, where "*******#####" represents the ciphertext key (it should be noted that this is only an illustrative example; "*******#####" does not necessarily represent the actual ciphertext key). After compiling the source code, the compiled code is obtained, and the ciphertext code can be included in the compiled code.

[0259] During loading phase 1030, the ciphertext key needs to be automatically imported into the TEE environment.

[0260] This is illustrative; please refer to it. Figure 10 When automatically generating the ciphertext key, the import code is placed in a static module within the compiled code. This way, the import code is automatically executed when the app is loaded, thus importing the ciphertext key into the TEE. For example... Figure 10 As shown, when the imported code is executed, the APP package name is obtained, and then the APP package name and encrypted key are imported into the TEE. The APP package name and encrypted key are then sent to the TEE key storage unit for storage. The TEE key storage unit also has a pre-embedded private key for key decryption, which includes the first private key corresponding to the first public key mentioned above.

[0261] During the runtime phase 1040, the application data is mainly encrypted and decrypted in the TEE through the encryption and decryption interface.

[0262] This is illustrative; please refer to it. Figure 10When the APP passes in the context, key identifier, and content to be encrypted, all of these are in plaintext. At this point, the legitimacy of the APP is verified within the TEE, and the corresponding key is used for encryption. For example, the encryption interface is called, and the context, key identifier, and content to be encrypted are passed to the TEE. The ciphertext key is obtained from the TEE key storage unit through the key identifier. The decryption data for decrypting the APP signature in the ciphertext key is obtained through the APP package name. After decrypting the APP signature, it is verified whether the decrypted APP signature is consistent with the corresponding content in the context currently passed to the APP. If they are consistent, the verification is successful, and the APP is determined to be legitimate. At this point, the first key segment in the ciphertext key can be decrypted using the first private key to obtain the plaintext key. The content to be encrypted is then encrypted using the plaintext key, and the encrypted content is used as the ciphertext.

[0263] In the above introduction, TEE refers to Trusted Execution Environment. On the device running the application, TEE can provide hardware isolation and encryption protection, safeguarding the security of data and code. Data and code within a TEE cannot be accessed or tampered with by malicious software. The following is an introduction to Trusted Execution Environments (TEEs).

[0264] This is illustrative; please refer to it. Figure 11 The device running the application includes a Rich Execution Environment (REE) 1110 and a Trusted Execution Environment (TEE) 1120. The REE usually corresponds to the TEE. The two coexist on the same device but are isolated from each other by an isolation zone.

[0265] The rich execution environment 1110 interacts with the client APP and is mainly used to provide security interfaces, such as key import interface and encryption / decryption interface. The key import interface is used to import ciphertext keys into the trusted execution environment 1120; the encryption / decryption interface is used to encrypt and decrypt application data in the TEE.

[0266] The Trusted Execution Environment 1120 mainly includes a Trusted Module and a Security Module. The Trusted Module is used to provide storage services, namely the aforementioned TEE key storage unit, which ensures the security and integrity of key data during storage. The Security Module is used to provide cryptographic services, mainly for encryption keys, decryption keys, verifying application signature information, key management, etc.

[0267] In summary, the solution provided in this application makes password protection during client development extremely easy. Only a single annotation is needed to protect the key identified by that annotation, significantly reducing development costs and maintenance difficulty. The solution also verifies the client app's signature. Even if an attacker gains access to the encryption process, repackaging the app will prevent the encryption operation from being invoked, eliminating the possibility of forged ciphertext and further ensuring client communication security. Furthermore, the encryption and decryption operations provided in this application run within a TEE environment, effectively resisting white-box attacks and eliminating the key update and maintenance costs required for white-box encryption.

[0268] This is illustrative; please refer to it. Figure 12 The diagram illustrates a structural block diagram of an application data management device provided in an embodiment of this application. The device includes:

[0269] The acquisition module 1210 is used to acquire the application source code of the first application, wherein the application source code includes a plain text key and annotation information corresponding to the plain text key, the plain text key is used to encrypt the application data generated when the first application runs, and the annotation information is used to encrypt the plain text key;

[0270] The compilation module 1220 is used to encrypt the original key according to the encryption strategy corresponding to the annotation information during the compilation of the application source code to obtain the ciphertext key.

[0271] The compilation module 1220 is used to obtain compiled code after the application source code is compiled, and the compiled code is used to import the ciphertext key to replace the plaintext key;

[0272] The execution module 1230 is used to decrypt the ciphertext key to obtain the plaintext key during the process of running the first application based on the compiled code;

[0273] The running module 1230 is further configured to encrypt the data to be encrypted in the first application based on the original key to obtain ciphertext data; or, to decrypt the data to be decrypted in the first application based on the original key to obtain the original data.

[0274] In some embodiments, the encryption strategy instructs the encryption of the plaintext key using the first public key corresponding to the annotation information; the compilation module 1220 is used to encrypt the plaintext key using the first public key corresponding to the annotation information during the compilation of the application source code to obtain the ciphertext key.

[0275] In some embodiments, the first public key corresponds to a first private key, which is used to decrypt the ciphertext key; the running module 1230 is used to decrypt the ciphertext key using the first private key to obtain the plaintext key during the process of running the first application based on the compiled code.

[0276] In some embodiments, the encryption strategy instructs the encryption of the plaintext key using the first public key corresponding to the annotation information and the signature information of the first application; the compilation module 1220 is used to obtain the first public key and the signature information of the first application during the compilation of the application source code; to encrypt the plaintext key using the first public key to obtain a first ciphertext segment; and to concatenate the signature information and the first ciphertext segment to obtain the ciphertext key.

[0277] In some embodiments, the first public key corresponds to a first private key, which is used to decrypt the first ciphertext segment in the ciphertext key; the running module 1230 is used to verify the context information of the first application through the signature information in the ciphertext key during the process of running the first application based on the compiled code; if the context information of the first application is verified, the first ciphertext segment in the ciphertext key is decrypted through the first private key to obtain the original key.

[0278] In some embodiments, the signature information is information obtained by encrypting the application digest of the first application; the running module 1230 is used to obtain the context information of the first application during the process of running the first application based on the compiled code; decrypt the signature information to obtain the application digest of the first application; verify the context information of the first application through the application digest of the first application; and, if the application digest of the first application and the context information of the first application meet the consistency condition, decrypt the first ciphertext segment in the ciphertext key through the first private key to obtain the original key.

[0279] In some embodiments, the running module 1230 is configured to load the first application based on the compiled code and import the ciphertext key into a trusted storage unit, wherein the trusted storage unit is used to indicate a storage unit in a trusted execution environment in the first device.

[0280] In some embodiments, the trusted storage unit stores decryption data of the ciphertext key, and the decryption data is used to decrypt the ciphertext key; the running module 1230 is used to, during the process of running the first application based on the compiled code, decrypt the ciphertext key in the trusted storage unit using the decryption data to obtain the original key; import the data to be encrypted in the first application into the trusted storage unit, and encrypt the data to be encrypted in the trusted storage unit using the original key to obtain the ciphertext data; or, import the data to be decrypted in the first application into the trusted storage unit, and decrypt the data to be decrypted in the trusted storage unit using the original key to obtain the original data.

[0281] In some embodiments, the compiled code includes import code, which is used to import the ciphertext key into the trusted storage unit; the running module 1230 is used to execute the import code in the compiled code during the loading of the first application to import the ciphertext key into the trusted storage unit.

[0282] In some embodiments, the running module 1230 is configured to obtain a first timestamp during the process of loading the first application based on the compiled code; divide the encrypted key into a first key segment and a second key segment based on the first timestamp; send the first key segment and the first timestamp to the blockchain corresponding to the first device for storage; and import the second key segment into a trusted storage unit.

[0283] In some embodiments, the running module 1230 is configured to, during the process of running the first application based on the compiled code, acquire data to be encrypted and send a key acquisition request to the blockchain, the key acquisition request including requester information; if the blockchain verifies the requester information based on the key acquisition request, acquire the first key segment and the first timestamp sent by the blockchain, and import the first key segment and the first timestamp into the trusted storage unit; in the trusted storage unit, restore the first key segment and the second key segment based on the first timestamp to obtain the ciphertext key, and decrypt the ciphertext key to obtain the plaintext key.

[0284] In summary, the application data management device provided in this application embeds annotation information into the application source code during the development of the first application. This annotation information can mark the original key used for data encryption or decryption. During the compilation of the application source code, the encryption strategy specified in the annotation information is automatically identified, and the original key is encrypted accordingly, resulting in compiled code containing the ciphertext key. Since the compiled code replaces the original key with the imported ciphertext key, it is impossible to obtain the original key through reverse engineering, greatly reducing the risk of original key leakage. Therefore, it is impossible to decrypt the encrypted application data using the original key, thus improving the security of the application data. Furthermore, by automatically encrypting the original key using annotation information during the compilation of the application source code, the tedious steps of manually encrypting the original key are avoided, improving the encryption efficiency of the original key.

[0285] It should be noted that the specific limitations of the embodiments of the one or more application data management devices provided above can be found in the limitations of the application data management method above, and will not be repeated here. Each module of the above device can be implemented entirely or partially by software, hardware, or a combination thereof. Each module can be embedded in the processor of the computer device in hardware form or independent of the processor, or it can be stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0286] This application also provides a computer device, which includes: a processor and a memory, wherein the memory stores a computer program; the processor is used to execute the computer program in the memory to implement the application data management method provided in the above-described method embodiments.

[0287] For example, Figure 13 This is a structural block diagram of a computer device 1300 provided in an exemplary embodiment of this application. Optionally, the computer device 1300 is a server 1300.

[0288] Typically, server 1300 includes a processor 1301 and memory 1302.

[0289] Processor 1301 may include one or more processing cores, such as a quad-core processor, an octa-core processor, etc. Processor 1301 may be implemented using at least one hardware form selected from Digital Signal Processing (DSP), Field-Programmable Gate Array (FPGA), and Programmable Logic Array (PLA). Processor 1301 may also include a main processor and a coprocessor. The main processor, also known as a central processing unit (CPU), is used to process data in the wake-up state; the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, processor 1301 may integrate a Graphics Processing Unit (GPU), which is responsible for rendering and drawing the content required to be displayed on the screen. In some embodiments, processor 1301 may also include an Artificial Intelligence (AI) processor, which is used to handle computational operations related to machine learning.

[0290] The memory 1302 may include one or more computer-readable storage media, which may be non-transitory. The memory 1302 may also include high-speed random access memory and non-volatile memory, such as one or more disk storage devices or flash memory devices. In some embodiments, the non-transitory computer-readable storage media in the memory 1302 are used to store at least one instruction, which is executed by the processor 1301 to implement the application data management methods provided in the various method embodiments of this application.

[0291] In some embodiments, server 1300 may optionally include an input interface 1303 and an output interface 1304. Processor 1301, memory 1302, and input interfaces 1303 and 1304 can be connected via a bus or signal lines. Various peripheral devices can be connected to input interfaces 1303 and 1304 via a bus, signal lines, or a circuit board. Input interfaces 1303 and 1304 can be used to connect at least one input / output (I / O) related peripheral device to processor 1301 and memory 1302. In some embodiments, processor 1301, memory 1302, and input interfaces 1303 and 1304 are integrated on the same chip or circuit board; in some other embodiments, any one or two of processor 1301, memory 1302, and input interfaces 1303 and 1304 can be implemented on separate chips or circuit boards, and this application does not limit this aspect.

[0292] Those skilled in the art will understand that Figure 13 The structure shown does not constitute a limitation on the computer device 1300, and may include more or fewer components than shown, or combine certain components, or use different component arrangements.

[0293] In an exemplary embodiment, this application provides a chip including programmable logic circuits and / or program instructions, which, when run on a computer device, are used to implement the application data management methods provided in the above-described method embodiments.

[0294] In an exemplary embodiment, this application provides a computer-readable storage medium storing a computer program that is loaded and executed by a processor to implement the application data management method provided in the above-described method embodiments.

[0295] In an exemplary embodiment, this application provides a computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the processor of the computer device to load and execute the application data management method provided in the above-described method embodiments.

[0296] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0297] Those skilled in the art will understand that all or part of the steps of the above embodiments can be implemented by hardware or by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk.

[0298] Those skilled in the art will recognize that the functions described in the embodiments of this application in one or more of the above examples can be implemented using hardware, software, firmware, or any combination thereof. When implemented using software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or code on a computer-readable medium. Computer-readable media include computer storage media and communication media, wherein communication media include any medium that facilitates the transfer of a computer program from one place to another. Storage media can be any available medium that can be accessed by a general-purpose or special-purpose computer.

[0299] The above description is merely an optional embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. An application data management method characterized by comprising: The method comprises: obtaining application source code of a first application, the application source code comprising a plaintext key and annotation information corresponding to the plaintext key, the plaintext key being used to encrypt or decrypt application data generated by the first application when running, and the annotation information being used to encrypt the plaintext key; in the process of compiling the application source code, encrypting the plaintext key according to an encryption strategy corresponding to the annotation information to obtain a ciphertext key; after the compilation of the application source code is completed, obtaining compiled code, the compiled code being used to import the ciphertext key to replace the plaintext key; in the process of running the first application based on the compiled code, decrypting the ciphertext key to obtain the plaintext key; encrypting data to be encrypted in the first application based on the plaintext key to obtain ciphertext data, or decrypting data to be decrypted in the first application based on the plaintext key to obtain plaintext data.

2. The method of claim 1, wherein, The encryption strategy indicates that the plaintext key is encrypted by a first public key corresponding to the annotation information. In the process of compiling the application source code, the plaintext key is encrypted by the first public key corresponding to the annotation information to obtain the ciphertext key. The first public key corresponds to a first private key, and the first private key is used to decrypt the ciphertext key.

3. The method of claim 2, wherein, In the process of running the first application based on the compiled code, the ciphertext key is decrypted by the first private key to obtain the plaintext key. The encryption strategy indicates that the plaintext key is encrypted by a first public key corresponding to the annotation information and signature information of the first application. The method further comprises:

4. The method of claim 2, wherein, in the process of compiling the application source code, obtaining the first public key and the signature information of the first application; The first public key is used to encrypt the plaintext key to obtain the ciphertext key, comprising: the plaintext key is encrypted by the first public key to obtain a first ciphertext segment; the signature information and the first ciphertext segment are spliced to obtain the ciphertext key. The first public key corresponds to a first private key, and the first private key is used to decrypt the first ciphertext segment in the ciphertext key. In the process of running the first application based on the compiled code, the context information of the first application is verified by the signature information in the ciphertext key; 5. The method of claim 4, wherein, if the context information of the first application is verified, the first private key is used to decrypt the first ciphertext segment in the ciphertext key to obtain the plaintext key. The signature information is information obtained by encrypting an application digest of the first application. ​ ​ 6. The method of claim 5, wherein, ​ The context information of the first application is verified by the signature information in the ciphertext key in the process of running the first application based on the compiled code, and the verification includes: In the process of running the first application based on the compiled code, the context information of the first application is obtained; the signature information is decrypted to obtain the application digest of the first application; and the context information of the first application is verified by the application digest of the first application. In the case that the application digest of the first application and the context information of the first application meet the consistency condition, the first private key is used to decrypt the first ciphertext segment in the ciphertext key to obtain the plaintext key. The method is executed by a first device; and before the ciphertext key is decrypted to obtain the plaintext key in the process of running the first application based on the compiled code, the method includes:

7. The method according to any one of claims 1 to 6, characterized in that, Based on the compiled code, the first application is loaded, and the ciphertext key is imported into a trusted storage unit, which is used to indicate a storage unit in a trusted execution environment in the first device. The trusted storage unit stores decryption data of the ciphertext key, and the decryption data is used to decrypt the ciphertext key; 8. The method of claim 7, wherein, In the process of running the first application based on the compiled code, the ciphertext key is decrypted to obtain the plaintext key in the trusted storage unit by using the decryption data; In the process of running the first application based on the compiled code, the ciphertext key is decrypted to obtain the plaintext key in the trusted storage unit by using the decryption data; The ciphertext data is obtained by encrypting the to-be-encrypted data in the first application based on the plaintext key; or the plaintext data is obtained by decrypting the to-be-decrypted data in the first application based on the plaintext key, and the method includes: The to-be-encrypted data in the first application is imported into the trusted storage unit, and the to-be-encrypted data is encrypted in the trusted storage unit by using the plaintext key to obtain the ciphertext data; or the to-be-decrypted data in the first application is imported into the trusted storage unit, and the to-be-decrypted data is decrypted in the trusted storage unit by using the plaintext key to obtain the plaintext data. The compiled code includes import code, and the import code is used to import the ciphertext key into the trusted storage unit; 9. The method of claim 7, wherein, The ciphertext key is imported into the trusted storage unit based on the compiled code loading the first application, and the method includes: In the process of loading the first application, the import code in the compiled code is executed to import the ciphertext key into the trusted storage unit. The method is executed by a first device; and before the ciphertext key is decrypted to obtain the plaintext key in the process of running the first application based on the compiled code, the method includes:

10. The method according to any one of claims 1 to 6, characterized in that, In the process of loading the first application based on the compiled code, a first timestamp is obtained; ​ The ciphertext key is divided into a first key segment and a second key segment based on the first timestamp, the first key segment and the first timestamp are sent to a blockchain corresponding to the first device for storage, and the second key segment is imported into a trusted storage unit.

11. The method of claim 10, wherein, The process of decrypting the ciphertext key to obtain the plaintext key during the running of the first application based on the compiled code comprises: During the running of the first application based on the compiled code, the to-be-encrypted data is obtained and a key acquisition request is sent to the blockchain, and the key acquisition request includes requestor information; In the case where the requestor information is verified by the blockchain based on the key acquisition request, the first key segment and the first timestamp sent by the blockchain are obtained, and the first key segment and the first timestamp are imported into the trusted storage unit; In the trusted storage unit, the first key segment and the second key segment are restored based on the first timestamp to obtain the ciphertext key, and the ciphertext key is decrypted to obtain the plaintext key.

12. An application data management apparatus characterized by comprising: The device comprises: The acquisition module is configured to acquire application source code of a first application, the application source code comprising a plaintext key and annotation information corresponding to the plaintext key, the plaintext key being used to encrypt application data generated when the first application runs, and the annotation information being used to encrypt the plaintext key. The compiling module is configured to encrypt the plaintext key according to an encryption strategy corresponding to the annotation information to obtain a ciphertext key during the compilation of the application source code. The compiling module is configured to obtain compiled code after the compilation of the application source code, the compiled code being used to import the ciphertext key to replace the plaintext key. The running module is configured to decrypt the ciphertext key to obtain the plaintext key during the running of the first application based on the compiled code. The running module is further configured to encrypt to-be-encrypted data in the first application based on the plaintext key to obtain ciphertext data, or decrypt to-be-decrypted data in the first application based on the plaintext key to obtain plaintext data.

13. A computer device, comprising: The computer device comprises a processor and a memory, and the memory stores at least one program, which is loaded and executed by the processor to implement the application data management method according to any one of claims 1 to 11.

14. A computer-readable storage medium, characterized in that, The storage medium stores at least one program, which is loaded and executed by the processor to implement the application data management method according to any one of claims 1 to 11.

15. A computer program product, characterised in that, The computer program is executed by the processor to implement the application data management method according to any one of claims 1 to 11.

Images