WO2015106513A1

WO2015106513A1 - Method for protecting user data, terminal and computer storage medium

Info

Publication number: WO2015106513A1
Application number: PCT/CN2014/077826
Authority: WO
Inventors: 陈国强
Original assignee: 中兴通讯股份有限公司
Priority date: 2014-01-15
Filing date: 2014-05-19
Publication date: 2015-07-23
Also published as: CN104780530A

Abstract

Disclosed are a method for protecting user data, a terminal and a computer storage medium. The method comprises: acquiring a position where a terminal is located currently; and according to the position and a pre-set security policy, conducting a protection operation on user data saved in the terminal.

Description

Method, terminal and computer storage medium for protecting user data

The present invention relates to the field of information security, and in particular, to a method, a terminal, and a computer storage medium for protecting user data. Background technique

With the improvement of the processing capability of the terminal device and the reduction of the volume, more and more users will save personal privacy information and social information in the terminal device that is carried with them, and the social environment is complicated, which is easy to cause the terminal device. The loss, the risk and harm of user data leakage is also increasing; and, it is likely to be read and illegally used by others, resulting in the leakage of user privacy information. Summary of the invention

In order to solve the existing technical problems, embodiments of the present invention are expected to provide a method, a terminal, and a computer storage medium for protecting user data, which can protect user data stored in the terminal and prevent leakage of privacy information of the user.

The technical solution of the embodiment of the present invention is implemented as follows:

In a first aspect, an embodiment of the present invention provides a method for protecting user data, where the method includes:

Get the current location of the terminal; protect the operation.

In a second aspect, an embodiment of the present invention provides a terminal, including a storage unit that stores user data, where the terminal further includes: a location obtaining unit, configured to acquire a current location of the terminal;

The user data protection unit is configured to perform protection operations on the user data in the storage unit according to the location acquired by the location obtaining unit and the preset security policy.

In a third aspect, an embodiment of the present invention provides a computer storage medium in which a computer program is stored, the computer program being configured to execute the method for protecting user data.

The embodiment of the present invention provides a method for protecting user data, a terminal, and a computer storage medium, and obtains a current location of the terminal, and performs a corresponding security policy according to the location of the terminal, thereby protecting user data stored in the terminal. The probability and risk of leaking user data by low user terminals. DRAWINGS

FIG. 1 is a schematic flowchart of a method for protecting user data according to an embodiment of the present invention; FIG. 2 is a schematic diagram of an application scenario according to an embodiment of the present invention;

3 is a schematic diagram of an authentication process according to an embodiment of the present invention;

FIG. 4 is a schematic structural diagram of a terminal according to an embodiment of the present disclosure;

FIG. 5 is a schematic structural diagram of another terminal according to an embodiment of the present invention. detailed description

In the embodiment of the present invention, the corresponding security policy is executed according to the current location of the terminal, thereby protecting the user data stored in the terminal, and the probability and risk of the user terminal leaking the user data is low.

The technical solutions in the embodiments of the present invention will be clearly and completely described in the following with reference to the accompanying drawings.

1 is a method for protecting user data according to an embodiment of the present invention. It can be understood that the method can be applied to any terminal device capable of storing user data, such as: a mobile phone, a tablet computer, a laptop computer, or a palm. The computer or the like, the embodiment of the present invention does not specifically The user data may also include, but is not limited to, a contact, a short message and a call record corresponding to the contact, a multimedia information such as a picture video, and a user-installed application, etc., which are not specifically limited in this embodiment of the present invention. The method can include:

S101: Obtain a current location of the terminal;

In order to be able to clearly explain the technical solution, the embodiment of the present invention is described by using the scenario shown in FIG. 2 as a specific application scenario, where the scenario includes the terminal 21, the GPS satellite 22, the cell base station 23 accessed by the terminal, and the terminal currently connected. The wireless access point of the incoming wireless local area network 24; the solid ellipse indicates the coverage of the cell base station 23, and the dashed oval indicates the coverage of the wireless access point 24. It is understood that this scenario is only used to illustrate the embodiment of the present invention, and Do not make any specific restrictions.

For example, in the scenario shown in FIG. 2, obtaining the current location of the terminal 21 can be implemented in various manners, including but not limited to: the GPS module in the terminal 21 acquires the current GPS location of the terminal 21 through the GPS satellite 22. The information is used as the location where the terminal 21 is currently located. The location information of the cell base station 23 can be used as the location where the terminal 21 is currently located. The location information of the wireless access point 24 of the wireless local area network, as the current location of the terminal 21;

It can be understood that, in the embodiment, the real position of the terminal is within the error range of the acquired location, because there is a certain error between the acquired location and the real location of the terminal. Then, the obtained location can be used as the current location of the terminal. As shown in FIG. 2, if the terminal is located by the currently accessed cell base station, the location information of the cell base station is used as the current location of the terminal regardless of the location within the coverage of the cell base station. The location of the terminal obtained by other acquisition methods is similar to that of the terminal, and will not be described again.

For example, the location where the terminal is located may be performed when the terminal screen is awakened, for example, the terminal is powered on, the terminal is unlocked, and the like, and is not specifically limited herein. According to the protection operation;

Exemplarily, the preset security policy may specifically include a first location set, where the user includes at least one location information preset by the user, where the location information in the first location set may be a location that the user considers to be secure, for example: The location of the first location set is not limited by the embodiment of the present invention. For example, the location of the user is considered to be a dangerous location, for example, a location of a large number of people in a downtown area, a suburb, or a field; There may be more than one, and multiple first location sets may be set according to different situations.

Therefore, the location information according to the first location is a secure location or a dangerous location, and the protection operation of the user data stored in the terminal according to the location and the preset security policy may include A or B respectively. Two situations:

Case A, if the location information in the first location set is a dangerous location, then when the location is in the first location set, the user data saved in the terminal is hidden, and when the location is not in the location When the first location set is described, the user data saved in the terminal is displayed;

Specifically, if the current location of the terminal is regarded as a dangerous location by the user, the user data saved in the terminal is hidden, and when leaving the dangerous location, it can be considered as safe, and the user data does not need to be hidden. Or you can display hidden user data.

Case B, if the location information in the first location set is a secure location, when the location is in the first location set, the user data saved in the terminal is displayed, and when the location is not in the location When the first location set is described, the user data saved in the terminal is hidden;

Specifically, the location where the terminal is currently located is considered to be a secure location by the user, and the user data does not need to be hidden; when leaving the secure location, it can be considered dangerous, and the user data needs to be hidden.

Preferably, not all of the user data is important information such as private information, for example, Some of the game and news applications in the terminal usually do not include the user's private information, so there is no need to protect all user data. Based on this, the method may further include: generating a user data group according to the at least one piece of the user data; and the user data group may be obtained by setting an important user data in advance by the user;

Since the number of the first location set may be more than one, the number of user data groups may be more than one, and the user data group and the first location set may have corresponding relationships; optionally, the user data group may be The identifier of the corresponding first location set is set to the same label to indicate the corresponding relationship between the two, for example: the user data group A and the first location set A are corresponding, the user data group B and the A set of positions B is corresponding, and so on.

After the user data group is obtained, the user data saved in the terminal is protected according to the location and the preset security policy, and the location information in the first location is a secure location or a dangerous location, respectively. Including C or D:

Case C, if the location information in the first location set is a dangerous location, when the location is in the first location set, hiding user data in the user data group, and when the location is not in the first location When the location is set, the user data in the user data group is displayed; specifically, if the current location of the terminal is regarded as a dangerous location by the user, the user data in the user data group is hidden, when leaving the dangerous When the location is considered to be safe, it is not necessary to hide the user data in the user data group, or the user data in the hidden user data group can be displayed.

Case D, if the location information in the first location set is a secure location, when the location is in the first location set, displaying user data in the user data group, and when the location is not in the location When the first location is aggregated, the user data in the user data group is hidden.

Specifically, the current location of the terminal is considered by the user to be a secure location, and the user data in the user data group does not need to be hidden; when leaving the secure location, it can be considered dangerous, and the user data needs to be User data in the group is hidden. For example, after the user data is hidden, if the hidden user data needs to be displayed, an additional authentication process needs to be included. The specific authentication process is as shown in FIG. 3, and may include:

S301: Receive user authentication information and perform verification;

Specifically, the authentication information may be a password input by the user, or an iconic information of the user, for example: pre-save the feature information such as the user's face photo or sound, and then capture the user's avatar through the camera or collect the user through the microphone. The voice is used to obtain the authentication information; then, the authentication information is compared with the pre-stored feature information; if the comparison is consistent, the verification is successful, and if the comparison is inconsistent, the certificate is unsuccessful.

S302: When the authentication information is successfully verified, the hidden user data is displayed, and the current processing flow is ended.

When the authentication information is successfully verified, the current operating terminal is the user, so the hidden user data is displayed.

S303: When the authentication information verification is unsuccessful, the terminal is restored to a factory setting or the storage unit of the terminal is formatted.

When the authentication information is unsuccessful, it indicates that the current terminal is not on the user, and it is likely to have been lost. Therefore, in order to protect the user privacy in the user data, the terminal can be restored to the factory settings or the storage unit can be formatted, thereby eliminating user data and ensuring User privacy is not compromised.

The embodiment of the present invention provides a method for protecting user data, and performs a corresponding security policy according to the location of the terminal, thereby protecting user data stored in the terminal, and reducing the probability and risk of the user terminal leaking user data.

Referring to FIG. 4, a terminal 40 is provided in the embodiment of the present invention. The terminal 40 may include a storage unit 401 for storing user data. The specific form of the storage unit 401 may include: a readable storage device and a readable storage base. a chip, random or serial access memory array or device, or a combination of one or more of the above; In addition to the storage unit 401, the terminal 40 may further include a location obtaining unit 402 and a user data protection unit 403, where

The location obtaining unit 402 is configured to acquire a current location of the terminal.

The user data protection unit 403 is configured to perform protection operations on the user data in the storage unit 401 according to the location acquired by the location obtaining unit 402 and the preset security policy.

Illustratively, in the same manner as the foregoing method embodiment, in order to clearly illustrate the technical solution, the embodiment of the present invention is described by using the scenario shown in FIG. 2 as a specific application scenario of the method, and the specific description of FIG. 2 and the foregoing implementation. The examples are consistent and will not be described here. It should be noted that the terminal 21 described in FIG. 2 is the same as the terminal 40 described in this embodiment. It is to be understood that the scenario is only used to describe the embodiment of the present invention, and is not specifically limited. .

For example, in the scenario shown in FIG. 2, the location obtaining unit 402 can obtain the location where the terminal 40 is currently located in multiple manners, including but not limited to: acquiring the current terminal of the terminal through the GPS satellite 22 through the GPS module in the terminal 40. The GPS location information is used as the location where the terminal 40 is currently located. The location information of the cell base station 23 is also used as the location where the terminal 40 is currently located. The location information of the wireless access point 24 of the wireless local area network is the current location of the terminal 40. It can be understood that there is a certain difference between the acquired location and the real location of the terminal due to the different manners of obtaining the current location of the terminal. The error, in this embodiment, the real position of the terminal is within the error range of the acquired location, and the location obtaining unit 402 can use the acquired location as the current location of the terminal 40. As shown in FIG. 2, if the location acquiring unit 402 performs positioning by the currently accessed cell base station, the location acquiring unit 402 uses the positioning information of the cell base station as the terminal 40 regardless of the location within the coverage of the cell base station. The current location of the terminal 40 obtained by the location obtaining unit 402 by other acquisition methods is similar to that of the terminal 40, and will not be described again.

Exemplarily, the location obtaining unit 402 acquires the current location of the terminal 40 and can wake up. When the terminal 40 is on the screen, for example, the terminal 40 is powered on, the terminal 40 is unlocked, and the like, and is not specifically limited herein.

Exemplarily, the preset security policy may specifically include a first location set, where the user includes at least one location information preset by the user, where the location information in the first location set may be a location that the user considers to be secure, such as a residence. The location of the company or the like; may also be a location that the user considers to be dangerous, such as a downtown area, a suburb or a field, etc., which is not specifically limited in the embodiment of the present invention. It can be understood that the number of the first location set is There may be more than one, and multiple first location sets may be set according to different situations.

Therefore, the user data protection unit 403 can specifically protect the user data stored in the storage unit 401 in either A or B according to the location information in the first location being a secure location or a dangerous location:

Case A: If the location information in the first location set is a dangerous location, the user data protection unit 403 is specifically configured to hide the user data saved in the storage unit 401 when the location is in the first location set. And displaying the user data saved in the storage unit 401 when the location is not in the first location set;

Specifically, the location where the terminal 40 is currently located is considered to be a dangerous location by the user, and the user data protection unit 403 can hide the user data saved in the storage unit 401, and when leaving the dangerous location, it can be considered as safe. Therefore, the user data protection unit 403 does not need to hide the user data or can display the hidden user data.

Case B: If the location information in the first location set is a secure location, the user data protection unit 403 is specifically configured to display the user data saved in the storage unit 401 when the location is in the first location set. And hiding the user data saved in the storage unit 401 when the location is not in the first location set;

Specifically, the location where the terminal 40 is currently located is considered to be a secure location by the user, and the user data protection unit 403 does not need to hide the user data in the stored 401; When a secure location is considered dangerous, the user data protection unit 403 needs to hide the user data in the storage unit 401.

Preferably, the user data in the storage unit 401 is not all important data such as private information. For example, some game classes and news applications in the storage unit 401 generally do not include the user's private information, so The user data protection unit 403 does not need to protect all user data. Therefore, as shown in FIG. 5, the terminal 40 may further include: a generating unit 404 configured to generate a user data group according to at least one piece of the user data in the storage unit 401; and an important user may be pre-assigned by the user in the user data group Data is set to get;

Since the number of the first location set may be more than one, the number of user data groups may be more than one, and the user data group and the first location set may have corresponding relationships; optionally, the user data group may be The identifier is set to the identifier of the first location set corresponding thereto to represent a corresponding relationship between the two, for example, the user data group A and the first location set A are corresponding, the user data group B and the first location set B is corresponding, and so on.

After obtaining the user data group, the user data protection unit 403 may protect the user data in the user data group in the C or D case according to the foregoing location information in the first location set being a secure location or a dangerous location. Operation:

Case C: If the location information in the first location set is a dangerous location, the user data protection unit 403 is specifically configured to: when the location is in the first location set, hide user data in the user data group, And displaying, when the location is not in the first location set, user data in the user data group;

Specifically, the location where the terminal 40 is currently located is considered to be a dangerous location by the user, and the user data protection unit 403 can hide the user data in the user data group, and when leaving the dangerous location, the user can be considered as a safe user. The data protection unit 403 does not need to hide user data in the user data group or can display user data in the hidden user data group. Case D: If the location information in the first location set is a secure location, the user data protection unit 403 is specifically configured to: when the location is in the first location set, perform user data in the user data group Displaying, and hiding user data in the user data set when the location is not in the first location set.

Specifically, the location where the terminal 40 is currently located is considered to be a secure location by the user, and the user data protection unit 403 does not need to hide the user data in the user data group; when leaving the secure location, it can be considered dangerous. The user data protection unit 403 needs to hide the user data in the user data group.

For example, after the user data is hidden, if the hidden user data needs to be displayed, the terminal 40 also needs to include a unit capable of performing an authentication process. Optionally, as shown in FIG. 5, the terminal 40 may further include:

The receiving unit 405 is configured to receive authentication information of the user;

The verification unit 406 is configured to verify the authentication information received by the receiving unit 405. Specifically, the authentication information may be a password input by the user or an iconic information of the user. For example, the receiving unit 405 may take the user's face photo or The feature information such as sound is pre-saved, and then the receiving unit 405 captures the user's avatar through the camera or collects the voice sent by the user with the microphone to obtain the authentication information, and then the verification unit 406 compares the authentication information received by the receiving unit 405 with the pre-saved feature information. The comparison is performed; if the comparison is consistent, the verification is successful, and if the comparison is inconsistent, the certificate is unsuccessful.

After the verification unit 406 verifies the authentication information, the user data protection unit 403 can also be configured to

When the verification unit 406 successfully verifies the authentication information, the hidden user data is displayed;

Preferably, when the verification unit 406 fails to verify the authentication information, the terminal is restored to the factory settings or the storage unit 401 of the terminal 40 is formatted; Specifically, when the authentication information is successfully verified by the verification unit 406, indicating that the current operation terminal is a user, the user data protection unit 403 displays the hidden user data.

When the authentication information is unsuccessfully verified by the verification unit 406, it indicates that the current terminal 40 is not on the user, and is likely to have been lost. Therefore, in order to protect user privacy in the user data, the user data protection unit 403 may restore the terminal 40 to the factory settings or The storage unit is formatted to eliminate user data, ensuring that user privacy is not compromised.

The embodiment of the present invention provides a terminal 40, which performs a corresponding security policy by using the location where the terminal 40 is located, thereby protecting user data stored in the terminal 40, and competing for the probability and risk of the user terminal leaking user data.

Those skilled in the art will appreciate that embodiments of the present invention can be provided as a method, system, or computer program product. Accordingly, the present invention can take the form of a hardware embodiment, a software embodiment, or a combination of software and hardware aspects. Moreover, the invention can take the form of a computer program product embodied on one or more computer usable storage media (including but not limited to disk storage and optical storage, etc.) including computer usable program code.

The present invention has been described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (system), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flowchart and/or block diagrams, and combinations of flow and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine that causes configuration of instructions executed by a processor of a computer or other programmable data processing device Means for implementing the functions specified in a block or blocks of a flow or a flow and/or a block diagram of a flow chart.

The computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device. The device is implemented in a flow chart A function specified in a block or blocks of a process or multiple processes and/or block diagrams. These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device. The instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Correspondingly, the embodiment of the present invention further provides a computer storage medium, wherein the method for protecting user data provided by the embodiment of the present invention is stored, and the corresponding security policy can be executed according to the location of the terminal, thereby Protect user data stored in the terminal,

P strives for the probability and risk of leaking user data by user terminals.

The above is only the preferred embodiment of the present invention and is not intended to limit the scope of the present invention.

Claims

claims

1. A method for protecting user data, the method includes:

Get the current location of the terminal; protect operations.

2. The method according to claim 1, wherein the preset security policy includes a first location set;

Correspondingly, performing protection operations on the user data stored in the terminal according to the location and the preset security policy includes:

When the location is in the first location set, hide the user data saved in the terminal; when the location is not in the first location set, display the user data saved in the terminal;

Or, when the location is in the first location set, display the user data saved in the terminal; when the location is not in the first location set, display the user data saved in the terminal. hide.

3. The method according to claim 2, wherein the method further includes:

Generate a user data group according to at least one piece of user data; wherein, the user data group corresponds to the first location set;

When the location is in the first location set, hide the user data in the user data group; when the location is not in the first location set, display the user data in the user data group;

Or, when the location is in the first location set, display the user data in the user data group; when the location is not in the first location set, display the user data group User data in is hidden.

4. The method according to claim 2 or 3, wherein the method further includes: receiving the user's authentication information and verifying it;

When the authentication information is verified successfully, the hidden user data is displayed.

5. The method according to claim 4, wherein when the verification of the authentication information is unsuccessful, the terminal is restored to factory settings or the storage unit of the terminal is formatted.

6. A terminal, including a storage unit for storing user data, wherein the terminal further includes: a location acquisition unit configured to acquire the current location of the terminal;

The user data protection unit is configured to perform a protection operation on the user data in the storage unit according to the location obtained by the location acquisition unit and the preset security policy.

7. The terminal according to claim 6, wherein the preset security policy includes a first location set;

Correspondingly, the user data protection unit is configured to hide the user data in the storage unit when the location is in the first location set; when the location is not in the first location set, Display the user data in the storage unit;

Alternatively, the user data protection unit is configured to: when the location is in the first location set, display the user data in the storage unit; when the location is not in the first location set, display The user data in the storage unit is hidden.

8. The terminal according to claim 7, wherein the terminal further includes a generating unit configured to generate a user data group according to at least one piece of user data in the storage unit; wherein the user data group is identical to the user data group. Corresponds to the first position set;

Correspondingly, the user data protection unit is configured to hide the user data in the user data group when the location is in the first location set; when the location is not in the first location set , display the user data in the user data group;

Alternatively, the user data protection unit is configured to: when the location is in the first location set When , the user data in the user data group is displayed; when the position is not in the first position set, the user data in the user data group is hidden.

9. The terminal according to claim 7 or 8, wherein the terminal further includes a receiving unit and a verification unit, wherein,

The receiving unit is configured to receive the user's authentication information;

The verification unit is configured to verify the authentication information received by the receiving unit; the user data protection unit is also configured to display the hidden user data when the authentication information is successfully verified.

10. The terminal according to claim 9, wherein the user data protection unit is further configured to, when the verification of the authentication information fails, restore the terminal to factory settings or restore the storage unit of the terminal. format.

11. A computer storage medium in which a computer program is stored, the computer program being used to execute the method of protecting user data according to any one of claims 1 to 5.