WO2011130970A1

WO2011130970A1 - Device and method for protecting data of mobile terminal

Info

Publication number: WO2011130970A1
Application number: PCT/CN2010/075604
Authority: WO
Inventors: 黄翠荣; 李娜娜; 何经纬
Original assignee: 中兴通讯股份有限公司
Priority date: 2010-04-22
Filing date: 2010-07-30
Publication date: 2011-10-27
Also published as: CN101815292B; CN101815292A

Abstract

A device and method for protecting data of mobile terminal are provided in the present invention. After the mobile terminal starts, if the security function is enabled, the mobile terminal automatically detects whether a security parameter changes or not. If yes, the mobile terminal regenerates an authentication code, and informs the user of said authentication code by a transmitting way of authentication code. Then the mobile terminal enters into a standby state through a new authentication code. If the security parameter does not change, the mobile terminal enters into a standby state through an original authentication code. The mobile terminal, according to a key stored in the mobile terminal itself, encrypts or decrypts the data in the mobile terminal and the data in a storage medium associated with the mobile terminal. The device and method in the present invention can prevent an illegal user from using data of the mobile terminal without permission and protect the data security of the mobile terminal.

Description

Data protection device and method for mobile terminal

The present invention relates to information security technologies, and more particularly to a data protection device and method for a mobile terminal. BACKGROUND OF THE INVENTION Convenient contact can also store a large amount of important information. With the introduction of memory cards and smart phones, personal data stored on mobile terminals has become more and more important. If mobile terminals are lost or illegally obtained by others, the loss to users is far greater than the value of mobile terminals themselves. , which will bring a lot of trouble to the user's life or work. Existing mobile terminals basically support network services, and mobile terminal Internet access has become a trend of development. For example, data obtained by hackers and illegally used will have a great impact on users.

The data of the mobile terminal is lost, usually in the following situations:

(1) When the mobile terminal is using the network, the data stored on the mobile terminal is illegally stolen by the hacker;

(2) The mobile terminal is lost, and the user identity module (SIM, Subscriber Identity Module) card, flash memory (FLASH) data, and external memory card data are acquired by the illegal user;

(3) When the mobile terminal is in use, the data of the external memory card is acquired by the illegal user.

Chinese patent CN200810211327.8, the technical solution disclosed in the name of "communication terminal data security protection method and system", can restore the user data of the terminal as much as possible when the mobile terminal is lost. The main implementations include: Step A. Pre-processing the communication terminal to accept a certain instruction, and can send the user information of the communication terminal to other communication terminals and/or networks according to the instruction; The other communication terminal or network should be in a state in which the user can obtain information from the user to ensure that the user can obtain the received information from the user. User data; Step B. When the user data needs to be transferred, the determined instruction is sent to the communication terminal; Step C. After receiving the determined instruction, the communication terminal sends the user data to the user information by means of MMS The other communication terminal and/or the network, and delete the user profile on the communication terminal after the transmission is successful. However, in the above solution, the feasibility of sending data through the MMS is very low. If the SIM card balance is insufficient, the MMS cannot be sent, and the function of restoring data cannot be realized. It can be seen that this method is not applicable to all situations.

Chinese patent CN200710140321.1, the invention entitled "Anti-theft and data security mobile communication system" discloses a mobile communication system, which comprises a communication device, a user identification module and a controller; the user identification module comprises the first a SIM card; in the booting process, when the controller detects that the original second SIM card is removed and the first SIM card is installed in the subscriber identity module of the mobile communication system, the transmitting device is lost through the communication device The notification information is sent to the receiving end, and the data contained therein can determine the location of the mobile communication system or determine the telephone number of the user used in the mobile communication system. In this solution, although the loss of the mobile terminal can be judged and the SIM card is replaced, but only the user is notified that the terminal is lost, the illegal person can still obtain and use the data of the mobile terminal, and it can be seen that the solution cannot protect the data of the mobile terminal. Sex. Summary of the invention

In view of the above, it is a primary object of the present invention to provide a data protection apparatus and method for a mobile terminal that can ensure the security of data within the mobile terminal and the security of data within the storage medium associated with the mobile terminal.

In order to achieve the above object, the technical solution of the present invention is achieved as follows:

The present invention provides a data protection device for a mobile terminal, the device comprising: a user security management module, configured to enable or disable a security function of the mobile terminal, and automatically detect whether the security parameter changes when the mobile terminal is powered on and the security function is enabled. If the security parameter changes, the verification code is regenerated and the user is notified by the verification code sending manner, and the mobile terminal is put into the standby state through the new verification code; if the security parameter does not change, the mobile terminal is entered through the original verification code. standby mode;

It is also used to encrypt or decrypt the data inside the mobile terminal and the data inside the storage medium associated with the mobile terminal according to the key generated by the verification code after the mobile terminal that has turned on the security function enters the standby state.

In the above solution, the security parameters include: a user identity module (SIM) card number, a flash memory identifier (FLASH ID), an international mobile device identity code (IMEI) number, and user identity information.

In the above solution, the user security management module includes: a security function setting module, a verification code generation module, and a verification code sending module;

a security function setting module, configured to enable or disable a security function of the mobile terminal;

a verification code generating module, configured to generate a verification code by using a cryptographic algorithm for the security parameter in the mobile terminal, and save the verification code in the mobile terminal;

The verification code sending module is configured to notify the user that the generated verification code is sent by using the verification code. In the foregoing solution, the security function setting module turns on or off the security function, and specifically includes: if the currently input user identity information is consistent with the user identity information stored in the mobile terminal, encrypting all data of the mobile terminal and re-storing the encrypted Data, and turn on security features;

If the currently entered verification code matches the verification code stored in the mobile terminal, all data of the mobile terminal is decrypted and the decrypted data is re-stored, and the security function is turned off.

In the above solution, the verification code sending module notifies the user of the generated verification code by using the verification code, and specifically includes: sending the verification code to the network operator, or sending the mobile terminal or the mailbox specified by the user;

The modification of the verification code sending manner is specifically: after the correct user identity information is input and the verification is successful, the verification code sending manner is modified.

In the above solution, the user security management module further includes: a key generation module and a verification module; wherein a key generation module, configured to generate a generated verification code by using a certain operation and save the key in the mobile terminal;

The verification module is configured to verify whether the currently input verification code is consistent with the verification code stored by the mobile terminal after the mobile terminal is powered on and the security function is enabled. If the authentication code is consistent, the mobile terminal enters a standby state; otherwise, the verification code is required to be re-entered.

The present invention also provides a data protection method for a mobile terminal, the method comprising: after the mobile terminal is powered on, if the security function is enabled, the mobile terminal automatically detects whether the security parameter changes, and if the security parameter changes, the mobile terminal regenerates the verification code. And the user is notified by the verification code sending manner, and the mobile terminal enters the standby state by using the new verification code; if the security parameter does not change, the mobile terminal is put into the standby state by using the original verification code;

After the mobile terminal that has turned on the security function enters the standby state, the mobile terminal performs encryption or decryption operations on the data inside the mobile terminal and the data inside the storage medium associated with the mobile terminal according to the key generated by the verification code.

In the foregoing solution, the security parameter includes: a SIM card number, a FLASH ID, an IMEI number, and user identity information.

In the foregoing solution, the mobile terminal regenerating the verification code specifically includes: the mobile terminal generates a verification code by using a cryptographic algorithm, and saves the verification code in the mobile terminal.

In the foregoing solution, the notifying the user by using the verification code sending manner includes: sending the verification code to the network operator, or sending the verification code to the mobile terminal or mailbox specified by the user; wherein, the modification of the verification code sending manner Specifically, after the correct user identity information is entered and the verification is successful, the verification code sending mode is modified.

In the above solution, after the mobile terminal regenerates the verification code, the method further includes: the mobile terminal generates a new key by using a certain algorithm by the verification code, and saves the data in the mobile terminal, decrypts all the data by using the original key, and uses the new key. After the key is re-encrypted, the encrypted data is saved.

In the above solution, the method further includes: after the mobile terminal is powered on, if the security function is turned off, Then the mobile terminal directly enters the standby state.

The data protection device and method for the mobile terminal provided by the present invention, after the mobile terminal is powered on, if the security function is enabled, the mobile terminal automatically detects whether the security parameter changes. If the security parameter changes, the mobile terminal regenerates the verification code and passes the verification code. The sending method notifies the user that the mobile terminal enters the standby state through the new verification code; if the security parameter does not change, the mobile terminal enters the standby state through the original verification code; the mobile terminal pairs the data of the mobile terminal according to the key stored by the mobile terminal. , or the data inside the storage medium associated with the mobile terminal performs an encryption or decryption operation.

After the mobile terminal enters the standby state under the security function, the data in the SIM card, the FLASH and the external memory card are all encrypted, and the verification code is difficult to obtain, and the key is verified. The code generation is also difficult to obtain, so the data encrypted by the key can ensure the security of the data, can prevent the illegal user from stealing the data of the mobile terminal, and can completely solve the problem of data security of the mobile terminal, and the advantages thereof are as follows:

1) If the mobile terminal is using the network, the data is stolen by the hacker, but since the hacker does not have the key, the real data cannot be obtained;

2) If the mobile terminal is lost, the SIM card, FLASH data and external memory card data are acquired by the illegal user, but since the illegal user does not have the key, the real data cannot be obtained as well;

3) If the mobile terminal is in use, the data of the external memory card is acquired by the illegal user and placed in another mobile terminal, but since the read data is encrypted, and the illegal user does not have the key, the real data cannot be obtained. That is to say, the data of the mobile terminal can only be used normally on the terminal, and the data obtained by other means is encrypted data. Since there is no key and related terminal software for decryption, the data cannot be used normally. DRAWINGS

1 is a structural diagram of a data protection device of a mobile terminal according to the present invention;

2 is a menu interface diagram of a security management module in a data protection device of a mobile terminal of the present invention; Intention

detailed description

The basic idea of the present invention is: After the mobile terminal is powered on, if the security function is enabled, the mobile terminal automatically detects whether the security parameter changes. If the security parameter changes, the mobile terminal regenerates the verification code and notifies the user through the verification code sending manner, The verification code causes the mobile terminal to enter the standby state; if the security parameter does not change, the mobile terminal enters the standby state through the original verification code; the mobile terminal pairs the data of the mobile terminal according to the key stored by the mobile terminal, and is related to the mobile terminal The data inside the connected storage medium is encrypted or decrypted.

The data protection device of the mobile terminal provided by the present invention, as shown in FIG. 1, includes: a user security management module, located in an existing setting module of the mobile terminal, used to enable or disable the security function of the mobile terminal, and when moving When the terminal is powered on and the security function is enabled, the security parameter is automatically detected. If the security parameter changes, the verification code is regenerated and the user is notified by the verification code sending mode, and the mobile terminal is put into the standby state through the new verification code; If there is no change, the mobile terminal is put into the standby state by using the original verification code;

It is further configured to perform encryption or decryption operations on data internal to the mobile terminal and data internal to the storage medium associated with the mobile terminal based on a key stored by the mobile terminal, such as data storage, data reading.

Here, the security parameters include: a SIM card number, a flash memory identifier (FLASH ID), an International Mobile Equipment Identity (IMEI) number, and user identity information; wherein the first three parameters are automatically read by the software of the mobile terminal. Take, and the user identity information is entered by the user.

Further, the security management module includes: a security function setting module, a verification code generation module, and a verification code sending module; wherein

a security function setting module, configured to enable or disable a security function of the mobile terminal; The security function can be turned on or off by setting the menu option of the security function on the interface. As shown in Figure 2, if the current security function is enabled, the option to turn off the security function is visible; if the current security function is off, it is turned on. The options for the security feature are visible.

The opening security function is specifically: if the currently input user identity information is consistent with the user identity information stored in the mobile terminal, encrypting all data of the mobile terminal, re-storing the encrypted data, and enabling the security function; The security function is turned off, specifically: if the currently input verification code is consistent with the verification code stored in the mobile terminal, all the data of the mobile terminal is decrypted and the decrypted data is re-stored, and the security function is turned off;

a verification code generating module, configured to generate a verification code by using a certain algorithm, such as a non-symmetric password (RSA, Rivest Shamir Adlemen) algorithm, and save the verification code in a flash memory (FLASH) of the mobile terminal;

The verification code sending module is configured to notify the user that the generated verification code is sent by using the verification code. The verification code sending manner may include: sending the verification code to the network operator, where the user can obtain the verification code by logging in to the operator's website. , or send the verification code to the mobile terminal or mailbox specified by the user, so that the user obtains the verification code by means of a mobile phone short message or email; when the verification code needs to be regenerated, the user can freely select one or more of the above verification codes to send. In the mode, a new verification code is obtained. If the user needs to modify the current verification code, the user identity information needs to be entered. Otherwise, the current verification code cannot be modified.

The device further includes: a key generation module and a verification module; wherein

The key generation module is configured to generate a key by using a certain algorithm and save the key in a mobile terminal; wherein a relatively secure algorithm may be selected according to an actual situation to generate a key.

Here, when the verification code is updated, a new key is generated synchronously, and all data of the mobile terminal is decrypted by the original key, and then encrypted with a new key and stored in a SIM card, a FLASH or an external memory card;

Verification module, after the mobile terminal is powered on and the security function is turned on, verify the current input test Whether the verification code is consistent with the verification code stored by the mobile terminal. If they are consistent, the mobile terminal enters the standby state; otherwise, the verification code is required to be re-entered.

Based on the foregoing apparatus, the present invention further provides a data protection method for a mobile terminal, and the power-on verification process of the mobile terminal, as shown in FIG. 3, includes the following steps:

Step 301: After the mobile terminal is powered on, it is determined whether the security function is enabled. If the security function is enabled, step 302 is performed; otherwise, the mobile terminal directly enters the standby state, and the process ends.

In this step, after the mobile terminal is powered on, it is determined whether the security function is enabled by looking up the corresponding status bit in the software program in the user security management module, for example: the status bit is 1 means to be on, the status bit is 0 means to be off; if the mobile terminal is After the power is turned on, the security function is turned off, and the mobile terminal directly enters the standby state.

Step 302: Detect whether the security parameter of the mobile terminal is changed. If there is no change, go to step 304; otherwise, go to step 303;

In this step, after the security function is enabled, the mobile terminal automatically detects whether the existing security parameters and the security parameters stored during the last shutdown change, wherein the SIM card number, the FLASH ID, and the IMEI number of the mobile terminal can be automatically read by the software. User identity information needs to be input by the user; if all the parameters are consistent with the parameters stored in the previous shutdown, the security parameters are not changed, and step 304 is performed; as long as one parameter changes, the security parameter is changed, and step 303 is performed, usually In this case, these parameters do not change, so there is no need to regenerate the verification code.

Step 303: Regenerate the verification code and notify the user, simultaneously update the key and re-encrypt all data, and save the encrypted data;

In this step, the mobile terminal can automatically read parameters such as the SIM card number, the FLASH ID, and the IMEI number of the mobile terminal. If the user information changes, the user must first input the correct original user identity information, and then input the new user identity information. And storing the new user identity information in the mobile terminal; all the above parameters are notified to the user by using a certain algorithm, such as an RSA algorithm, to generate a verification code, and the verification code is saved in the FLASH of the mobile terminal; after the verification code is updated, the mobile terminal According to Actually, choose a more secure algorithm to generate a new key synchronously, and use the original key to all

After decrypting the data of the SIM card, the FLASH, and the external memory card, the data is re-encrypted with the new key and the encrypted data is saved. The method for sending the verification code may include: sending the verification code to the network operator, or sending the verification code to the network operator. The user-specified mobile terminal or mailbox can be selected or modified by the user.

Step 304: Enter the verification code and determine whether it is correct. If it is correct, the mobile terminal enters the standby state, and ends the process; otherwise, the user is required to re-enter the verification code, and returns to step 304;

In this step, a verification code is input in the corresponding menu interface, and the input verification code is compared with the verification code stored in the mobile terminal. If the two are consistent, the user verification code is correct, and the mobile terminal enters a standby state; If the two are inconsistent, the user is required to re-enter the verification code.

In the present application, if the security function is turned off when the mobile terminal is powered on, the option to enable the security function is visible, and the security function of the mobile terminal can be turned on by inputting the correct user identity information in the setting menu; the security parameters are: SIM card number, The FLASH ID, the IMEI number, and the user identity information are used to generate a verification code to notify the user through a certain algorithm, such as the RSA algorithm, and the verification code is stored in the FLASH of the mobile terminal; meanwhile, the verification code is generated by a relatively secure algorithm, and the All the data of the mobile terminal is encrypted, and the encrypted data is re-stored; after the user obtains the correct verification code, the mobile terminal enters the standby state under the security function by inputting the verification code.

After the mobile terminal enters the standby state under the security function, the data in the SIM card, the FLASH and the external memory card are all encrypted, and the data stored in the mobile terminal by the key stored by the mobile terminal itself and associated with the mobile terminal can be associated with the mobile terminal. The data inside the storage medium is encrypted or decrypted.

The following describes, in a specific embodiment, the process of encrypting or decrypting data inside the mobile terminal and data inside the storage medium associated with the mobile terminal:

Embodiment 1: Modify the data in the SIM card, and encrypt the modified data and rewrite the data SIM card:

After the security function of the mobile terminal is turned on, after the mobile terminal enters the standby state, first, the data in the SIM card file is read, decrypted into normal data by using the key, and then saved to a temporary file; secondly, the content of the temporary file is modified, and The data of the temporary file is encrypted by using a key; finally, the encrypted data is written into the SIM card file, and the temporary file is automatically deleted by the mobile terminal, thereby protecting the security of the SIM card file.

Embodiment 2: Sending the encrypted picture file in the mobile terminal in the form of a multimedia message: Opening the security function of the mobile terminal, after the mobile terminal enters the standby state, first, opening the picture file in the FLASH of the mobile terminal and reading the data, using the key Decrypt the data and save it to a temporary file; secondly, rename the temporary file to the image file name, and then insert the temporary file into the multimedia message, and after the multimedia message is sent, the mobile terminal automatically deletes The above temporary file, thereby ensuring that the file can be normally received by the other party.

Embodiment 3: Encrypt the downloaded data and store it on the external memory card:

After the security function of the mobile terminal is turned on, after the mobile terminal enters the standby state, first, the file is downloaded to an external memory card such as a USB flash drive, and a temporary file is newly created on the external memory card; secondly, the data in the temporary file is read and Encryption is performed using the key, and then the encrypted data is saved in the temporary file, the temporary file is renamed to the downloaded file name, and the downloaded original file is deleted, thereby ensuring storage on the external memory card. File security.

Through the foregoing specific embodiments, the encryption or decryption operation of the data stored in the mobile terminal and the storage medium associated with the mobile terminal by the key pair can effectively prevent data loss and theft, thereby greatly improving the mobile terminal. The security of the data.

The above description is only for the preferred embodiment of the present invention, and is not intended to limit the scope of the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included. Within the scope of protection of the present invention.

Claims

Claim

A data protection device for a mobile terminal, the device comprising: a user security management module, configured to enable or disable a security function of the mobile terminal, and automatically detect whether the security parameter is automatically activated when the mobile terminal is powered on and the security function is enabled. If the security parameter changes, the verification code is regenerated and the user is notified by the verification code transmission mode, so that the mobile terminal enters the standby state through the new verification code; if the security parameter does not change, the mobile terminal is entered through the original verification code. standby mode;

2. The apparatus according to claim 1, wherein the security parameters comprise: a user identity module (SIM) card number, a flash memory identifier (FLASH ID), an international mobile device identity code (IMEI) number, and user identity information. .

The device according to claim 1, wherein the user security management module comprises: a security function setting module, a verification code generating module, and a verification code sending module; wherein the security function setting module is configured to be turned on or off The security function of the mobile terminal;

The verification code sending module is configured to notify the user that the generated verification code is sent by using the verification code.

The device according to claim 3, wherein the security function setting module turns on or off the security function, specifically:

If the currently input user identity information is consistent with the user identity information stored in the mobile terminal, encrypt all data of the mobile terminal and re-store the encrypted data, and enable the security function;

If the currently input verification code is consistent with the verification code stored in the mobile terminal, the mobile terminal will be All data is decrypted and the decrypted data is re-stored and the security function is turned off.

The device according to claim 3, wherein the verification code sending module notifies the user of the generated verification code by using a verification code, specifically: sending the verification code to the network operator, or sending the verification code to the user The specified mobile terminal or mailbox;

The device according to claim 2, wherein the user security management module further comprises: a key generation module and a verification module;

a key generation module, configured to generate a generated verification code by using a certain operation and save the key in the mobile terminal;

A data protection method for a mobile terminal, the method comprising: after the mobile terminal is powered on, if the security function is enabled, the mobile terminal automatically detects whether the security parameter changes, and if the security parameter changes, the mobile terminal re-generates the verification. And the user is notified by the verification code sending manner, and the mobile terminal enters the standby state by using the new verification code; if the security parameter does not change, the mobile terminal is put into the standby state by using the original verification code;

The method according to claim 7, wherein the security parameter comprises: a SIM card number, a FLASH ID, an IMEI number, and user identity information.

The method according to claim 7, wherein the re-generating the verification code by the mobile terminal comprises: the mobile terminal generating the verification code by using a cryptographic algorithm, and ensuring There is a mobile terminal.

The method according to claim 7, wherein the notifying the user by the verification code sending manner comprises: sending the verification code to the network operator, or sending the verification code to the mobile terminal or mailbox specified by the user. ;

The method according to any one of claims 7 to 10, wherein, after the mobile terminal regenerates the verification code, the method further includes: the mobile terminal generates a new key by using a certain algorithm by using the verification code, and Saved on the mobile terminal, decrypt all the data with the original key, and re-encrypt with the new key to save the encrypted data.

The method according to claim 7, further comprising: after the mobile terminal is powered on, if the security function is turned off, the mobile terminal directly enters a standby state.