WO2015176531A1

WO2015176531A1 - Terminal data writing and reading methods and devices

Info

Publication number: WO2015176531A1
Application number: PCT/CN2014/094550
Authority: WO
Inventors: 何伟; 惠文武
Original assignee: 中兴通讯股份有限公司
Priority date: 2014-05-21
Filing date: 2014-12-22
Publication date: 2015-11-26
Also published as: CN105095784A

Abstract

A terminal data writing method, a terminal data reading method, and devices. The method comprises the steps of: when a data writing instruction is detected, acquiring first identification information of data to be written and second identification information of a storage device for writing, the second identification information being corresponding to the writing instruction; and when the first identification information is consistent with the second identification information, encrypting the data to be written and writing the encrypted data to be written into the storage device for writing.

Description

Method and device for writing and reading terminal data

Technical field

The present invention relates to the technical field of terminal data processing, and in particular, to a method and an apparatus for writing and reading terminal data.

Background technique

With the continuous development of science and technology, more and more electronic terminals have entered people's daily life and work. People can interact with the outside world through an electronic terminal, and during the interaction process, some data is generated and retained in the electronic terminal. When the file where the data is located is copied to another terminal or the illegal user directly removes the storage device on the electronic terminal to another terminal, the data can be directly read, resulting in leakage of user privacy.

Currently, the protection of data on the terminal is mainly performed in the following two ways: A. A method of setting access rights to the terminal; B. A method of manually encrypting the target file by using encryption software.

The above two methods have different degrees of defects. The defects of the A mode are: A1, the file where the data on the terminal is located cannot be directly copied to other terminals; A2, the storage device on the terminal cannot be protected. Remove it and put it on other terminals.

The disadvantage of the B method is that B1, because these encryption softwares encrypt the file itself through the application layer software, it is easy to be cracked, and the security level is not enough; B2, encryption cannot be bound to a specific terminal, and the terminal and the data cannot be satisfied. One-to-one correspondence protection of files; B3. When third-party software is used to read encrypted files, the user also needs to manually decrypt the data to be read before being accessed by third-party software, which is inefficient and inconvenient to operate. .

The above content is only used to assist in understanding the technical solutions of the present invention, and does not constitute an admission that the above is prior art.

Summary of the invention

The embodiment of the invention provides a method and a device for writing and reading terminal data, aiming at realizing one-to-one correspondence between data and a terminal, preventing the terminal data from being copied to other terminals or storing the data storage device and being removed to other terminals. Technical problems that lead to data leakage, thereby improving the security of terminal data Sex.

The embodiment of the invention provides a method for writing terminal data, including:

When the write command of the data is monitored, the first identifier information of the data to be written and the second identifier information of the storage device to be written corresponding to the write command are acquired;

And when the first identifier information is consistent with the second identifier information, the data to be written is encrypted, and the encrypted data to be written is written into the storage device to be written.

Optionally, after the step of acquiring the first identifier information of the data to be written and the second identifier information of the storage device to be written corresponding to the write command, the method further includes:

When the first identifier information and the second identifier information are inconsistent, the first identifier information is determined to be illegal identifier information, and the user data write failure is prompted.

Optionally, the step of acquiring the first identification information of the data to be written and the second identification information of the to-be-written storage device corresponding to the write instruction is performed when the write instruction of the data is monitored The method further includes:

And creating an encryption module according to the second identification information, and adding the created encryption module to the kernel layer.

The embodiment of the invention further provides a method for reading data of a terminal, comprising:

And acquiring, when the read command of the data is read, the third identifier information corresponding to the read command and the fourth identifier information of the data to be read corresponding to the read command;

When the third identification information is consistent with the fourth identification information, the data to be read is decrypted, and the decrypted data to be read is displayed.

Optionally, after the step of acquiring the third instruction information corresponding to the read instruction and the fourth identification information of the storage device to be read corresponding to the read instruction, The method further includes:

When the third identifier information is inconsistent with the fourth identifier information, determining that the third identifier information is illegal identifier information, prompting the user that the data reading fails.

The embodiment of the invention further provides a device for writing terminal data, the device comprising:

The first obtaining module is configured to: when the write command of the data is monitored, obtain the first identifier information of the data to be written and the second identifier information to be written into the storage device corresponding to the write command;

The encryption module is configured to: when the first identifier information is consistent with the second identifier information, encrypt the to-be-written data;

The writing module is configured to: write the encrypted data to be written to the storage device to be written.

Optionally, the device further includes: a first prompt module,

The first prompting module is configured to: when the first identifier information and the second identifier information are inconsistent, determine that the first identifier information is illegal identifier information, and prompt the user data to fail to write.

Optionally, the device further includes a first creation module,

The first creating module is configured to: create an encryption module according to the second identifier information, and add the created encryption module to the kernel layer.

The embodiment of the invention further provides a device for reading terminal data, the device comprising:

The second obtaining module is configured to: acquire the third identification information corresponding to the read instruction and the fourth identification information of the storage device to be read corresponding to the read instruction when the read instruction of the data is monitored;

The decryption module is configured to: when the third identifier information is consistent with the fourth identifier information, decrypt the data to be read;

The reading module is configured to: display the decrypted data to be read.

Optionally, the device further includes a second prompt module,

The second prompting module is configured to: when the third identifier information is inconsistent with the fourth identifier information, determine that the third identifier information is illegal identifier information, and prompt the user data to fail to read.

The embodiment of the invention also provides a computer program for implementing the above method.

Embodiments of the present invention also provide a computer readable storage medium storing the computer program.

In the embodiment of the present invention, when the data is written, the identification information of the data to be written is legally determined, and when the identification information of the data to be written is legal, the writing of the data to be written is authorized, and the information is automatically Write data encryption is described. The one-to-one correspondence between the data and the terminal is realized, and the technical problem that the terminal data is copied to other terminals or the storage device that saves the data is removed and put on other terminals causes data leakage, thereby improving the security of the terminal data.

BRIEF abstract

1 is a schematic flow chart of an embodiment of a method for writing terminal data according to the present invention;

2 is a schematic flowchart diagram of an embodiment of a method for reading terminal data according to the present invention;

3 is a schematic diagram of functional modules of an apparatus for writing terminal data according to the present invention;

4 is a schematic diagram of functional modules of an apparatus for reading terminal data according to the present invention.

The implementation, functional features, and advantages of the present invention will be further described in conjunction with the embodiments.

Preferred embodiment of the invention

It is understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

FIG. 1 is a schematic flowchart diagram of an embodiment of a method for writing terminal data according to the present invention.

Obtaining first identifier information of the data to be written and second identifier information to be written to the storage device corresponding to the write command when the write command of the data is monitored; the first identifier information and the When the second identifier information is consistent, the data to be written is encrypted, and the encrypted data to be written is written into the storage device to be written.

The following steps are performed to gradually read the user data of the terminal in this embodiment:

In step S10, when the write command of the data is monitored, the first identifier information of the data to be written and the second identifier information of the storage device to be written corresponding to the write command are acquired;

The user can interact with the outside world through the electronic terminal, and during the interaction process, some user data is generated and retained in the electronic terminal. These user data are relatively private data for the end user, and need to be secured to prevent other users from reading and writing the data. In the embodiment of the present invention, in order to ensure the security of the user data, a second identifier information is first set for the storage device of the terminal, and the second identifier information may be a terminal ID, for example, an international identity code of the mobile device (International Mobile Equipment) Identity, IMEI), the IP address of the desktop/laptop, and other identification information that can distinguish the terminal from other terminals. The storage device of the terminal may be a hard disk that is provided by the terminal or a storage medium such as a U disk or a mobile hard disk that is connected to the mobile device. Creating an encryption module according to the second identifier information, that is, adding the identifier information of the terminal to the encryption In the module, before the encryption module is started, the second identification information is first verified, that is, the identification information of the terminal is verified, and after the second identification information is verified, the encryption module is called to encrypt the data. operating. Add the created cryptographic module to the kernel layer to encrypt the data written by the user through the created cryptographic module. By adding the second identification information, for example, the ID of the terminal, in the encryption module, when the user data is copied to other terminals for reading or modifying, when the user reads or modifies through other terminals, It is its own identification information, and the second identification information cannot be carried. Therefore, during the reading process, other terminals cannot read the user data saved on the storage device.

In order to implement the security protection of the terminal data, when the user writes data to the storage device of the terminal through the terminal, the user needs to carry the identification information of the terminal, that is, the first identification information, that is, the first is set for the data to be written. Identification information. The first identification information may be a terminal ID, for example, an IMEI, an IP address of a desktop/notebook, and the like, which can distinguish the terminal from other terminals. The event that the user writes the data is monitored, and when the write command of the user data is monitored, the first identifier information carried by the write command and the second to be written to the storage device corresponding to the write command are acquired. Identification information.

In step S20, it is determined whether the first identification information is consistent with the second identification information; if yes, step S30 is performed, and if no, step S40 is performed.

Step S30, encrypting the data to be written, and writing the encrypted data to be written into the storage device to be written;

Step S40, determining that the first identification information is illegal identification information, prompting the user that the data writing fails.

When the first identification information is consistent with the second identification information, determining that the first identification information is legal identification information, encrypting the to-be-written data, and encrypting the to-be-written Data is written to the storage device to be written. Specifically, the process of the data to be written is: calling an encryption module of the kernel layer to encrypt the data to be written, and writing the encrypted data to be written into the storage to be written The device, for example, is written to the hard disk of the terminal or a USB disk or a mobile hard disk that is connected to the terminal. It can be understood that the user can write data in the storage device to be written through the application layer software, for example, write data in the storage device to be written by using Word software, Text software or PDF software of the application layer.

Determining the first identifier when the first identifier information is inconsistent with the second identifier information The information is illegal identification information. At this time, the user cannot write data to the storage device to be written through the application layer software, and prompts the user that the write data to be written fails. For example, when the user writes data on the terminal remotely through other terminals connected to the terminal, the identification information carried by the other terminal is inconsistent with the identification information of the terminal, and therefore, the data cannot be written in the terminal. . For example, when the user copies other terminals to the terminal, the identification information included in the data of the other terminal is inconsistent with the information included in the storage device of the terminal, and therefore, the copied data cannot be written. On the terminal. The writing of the data to be written includes writing of new data, and may also include modified writing of the saved data.

FIG. 2 is a schematic flowchart diagram of a preferred embodiment of a method for reading terminal data according to the present invention. Based on the method for writing terminal data, the method for reading data of the terminal includes the following steps:

In step S50, when the read command of the data is monitored, the third identifier information corresponding to the read command and the fourth identifier information of the data to be read corresponding to the read command are acquired;

After the data written to the device to be stored is written according to the method for writing the terminal data, the event of reading the data by the user is monitored, and when the read command of the data is monitored, the corresponding command of the read command is acquired. And third identification information and fourth identification information of the data to be read corresponding to the read instruction. That is, the third identifier information carried by the read command and the fourth identifier information of the data to be read in the storage device to be read are obtained. The third and fourth identification information may be a terminal ID, for example, an IMEI code, an IP address of a desktop/laptop computer, and the like, which can distinguish the terminal from other terminals.

Step S60, determining whether the third identification information is consistent with the fourth identification information; if yes, executing step S70; if not, executing step S80.

Step S70, decrypting the data to be read, and displaying the data to be read after decryption;

Step S80, determining that the third identification information is illegal identification information, prompting the user that the data reading fails.

When the third identifier information is consistent with the fourth identifier information, determining that the third identifier information is legal identifier information, decrypting the data to be read, and displaying the decrypted file to be read data. Specifically, the process of decrypting the data to be read is: calling a decryption module of the kernel layer to decrypt the data to be read. The data to be read is read from the hard disk of the terminal or the U disk and the mobile hard disk that are connected to the mobile terminal, and the data to be read is read by the third-party software of the application layer on the terminal. For example, the data to be read is read in the storage device to be read by the Word software of the application layer, the Text software, or the PDF software.

When the third identifier information is inconsistent with the fourth identifier information, the third identifier information is determined to be illegal identifier information. At this time, the user cannot read the data to be read through the application layer software, and prompt the user. The data to be read is read unsuccessfully.

In other embodiments of the present invention, in order to ensure the security of the terminal data, the fifth identifier information of the storage device to be read where the data to be read is located may be obtained, and the third identifier information and the Whether the fifth identification information is consistent; when the third identification information is consistent with the third identification information, decrypting the to-be-read data, and displaying the decrypted data to be read; When the three identification information is inconsistent with the fifth identification information, the user is prompted to read the data. That is to say, this is a process of extracting a hard disk or a mobile connected USB flash drive or a mobile hard disk on one terminal to another terminal for reading. The fifth identification information may be a terminal ID, for example, an IMEI code, an IP address of a desktop/laptop computer, and the like, which can distinguish the terminal from other terminals.

The embodiment of the present invention determines the legality of the identification information of the data to be read when the data is read, and authorizes the reading of the data to be read when the identification information of the data to be read is legal, and automatically The data to be read is decrypted. The one-to-one correspondence between the data and the terminal is realized, and the technical problem that the terminal data is copied to other terminals or the storage device that saves the data is removed and put on other terminals causes data leakage, thereby improving the security of the terminal data.

FIG. 3 is a schematic diagram of functional modules of a preferred embodiment of a device for writing terminal data according to the present invention. The device includes a first obtaining module 100, an encryption module 200, a writing module 300, and a first prompting module 400.

The first obtaining module 100 is configured to: when the write command of the data is monitored, obtain the first identifier information of the data to be written and the second identifier of the storage device to be written corresponding to the write command information;

The user can interact with the outside world through the electronic terminal, and during the interaction process, some user data is generated and retained in the electronic terminal. These user data are relatively private data for the end user, and need to be secured to prevent other users from reading and writing the data. In the embodiment of the present invention, in order to ensure the security of the user data, a second identifier information is first set for the storage device of the terminal, and the second identifier information may be a terminal ID, for example, an IMEI code, a desktop/laptop computer. An identification information that can distinguish the terminal from other terminals, such as an IP address. The storage device of the terminal may be a hard disk that is provided by the terminal or a storage medium such as a U disk or a mobile hard disk that is connected to the mobile device. And the cryptographic module is created according to the second identifier information, that is, the identifier information of the terminal is added to the cryptographic module. Before the cryptographic module is started, the second identifier information is verified, that is, the identifier information of the terminal is verified. After the second identification information is verified, the encryption module is invoked to perform data encryption operation. Add the created cryptographic module to the kernel layer to encrypt the data written by the user through the created cryptographic module. By adding the second identification information, for example, the ID of the terminal, in the encryption module, when the user data is copied to other terminals for reading or modifying, when the user reads or modifies through other terminals, It is its own identification information, and the second identification information cannot be carried. Therefore, during the reading process, other terminals cannot read the user data saved on the storage device.

In order to implement the security protection of the terminal data, when the user writes data to the storage device of the terminal through the terminal, the user needs to carry the identification information of the terminal, that is, the first identification information, that is, the first is set for the data to be written. Identification information. The first identification information may be a terminal ID, for example, an IMEI code, an IP address of a desktop/laptop computer, and the like, which can distinguish the terminal from other terminals. The event that the user writes the data is monitored. When the write command of the user data is monitored, the first obtaining module 100 acquires the first identifier information carried by the write command and the to-be-written corresponding to the write command. The second identification information of the storage device.

The encryption module 200 is configured to encrypt the data to be written when the first identification information and the second identification information are consistent;

The writing module 300 is configured to write the encrypted data to be written into the storage device to be written;

The first prompting module 400 is configured to determine that the first identifier information is illegal identifier information when the first identifier information is inconsistent with the second identifier information, and prompts the user data to fail to write.

When the first identifier information is consistent with the second identifier information, the first identifier information is determined to be legal identifier information, and the encryption module 200 encrypts the data to be written and writes through the writing module 300. The encrypted data to be written is written to the storage device to be written. Specifically, the process performed by the writing module 300 on the data to be written is: the writing module 300 invokes an encryption module of the kernel layer to encrypt the data to be written, and the encrypted data to be written Write to the storage device to be written, for example, a hard disk written to the terminal or a USB disk or a mobile hard disk that is connected to the terminal. It can be understood that the user can write data in the storage device to be written through the application layer software, for example, write data in the storage device to be written by using Word software, Text software or PDF software of the application layer.

When the first identification information is inconsistent with the second identification information, the first prompting module 400 determines that the first identification information is illegal identification information, and at this time, the user cannot write the information to be written through the application layer software. The storage device writes data, and the first prompting module 400 prompts the user that the data to be written is failed to be written. For example, when the user writes data on the terminal remotely through other terminals connected to the terminal, the identification information carried by the other terminal is inconsistent with the identification information of the terminal, and therefore, the data cannot be written in the terminal. . For example, when the user copies other terminals to the terminal, the identification information included in the data of the other terminal is inconsistent with the information included in the storage device of the terminal, and therefore, the copied data cannot be written. On the terminal. The writing of the data to be written includes writing of new data, and may also include modified writing of the saved data.

FIG. 4 is a schematic diagram of functional modules of a preferred embodiment of a device for reading terminal data according to the present invention. The device includes a second obtaining module 500, a decryption module 600, a reading module 700, and a second prompt module 800.

The second obtaining module 500 is configured to acquire, when the read command of the data is monitored, the third identifier information corresponding to the read command and the fourth identifier information of the data to be read corresponding to the read command. ;

After the data written to the device to be stored is written according to the method for writing the terminal data, the event of the user reading the data is monitored, and when the read command of the data is monitored, the second obtaining module 500 acquires the And reading third identification information corresponding to the instruction and fourth identification information of the data to be read corresponding to the read instruction. That is, the third identifier information carried by the read command and the fourth identifier information of the data to be read in the storage device to be read are obtained. The third and fourth identification information may be a terminal ID, for example, an IMEI code, an IP address of a desktop/laptop computer, and the like, which can distinguish the terminal from other terminals.

The decryption module 600 is configured to decrypt the data to be read when the third identifier information is consistent with the fourth identifier information;

The reading module 700 is configured to display the decrypted data to be read;

The second prompting module 800 is configured to determine that the third identifier information is illegal identifier information when the third identifier information is inconsistent with the fourth identifier information, and prompts the user data to fail to read.

When the third identifier information is consistent with the fourth identifier information, the third identifier information is determined to be legal identifier information, and the decryption module 600 decrypts the to-be-read data and displays it by the reading module 700. The decrypted data to be read. Optionally, the process of decrypting the data to be read by the decryption module 600 is: the decryption module 600 calls a decryption module of the kernel layer to decrypt the data to be read. The data to be read is read from the hard disk of the terminal or the U disk and the mobile hard disk of the mobile connection, and the reading module 700 reads the data to be read through the third layer software of the application layer on the terminal. For example, the data to be read is read in the storage device to be read by the Word software of the application layer, the Text software, or the PDF software.

When the third identifier information is inconsistent with the fourth identifier information, the second prompting module 800 determines that the third identifier information is illegal identifier information. At this time, the user cannot read the to-be read by the application layer software. Taking the data, the second prompting module 800 prompts the user that the reading of the data to be read fails.

In other embodiments of the present invention, in order to ensure the security of the terminal data, the fifth identifier information of the storage device to be read where the data to be read is located may be obtained, and the third identifier information and the Whether the fifth identifier information is consistent; when the third identifier information is consistent with the third identifier information, the decryption module 600 decrypts the data to be read, and displays the decrypted candidate by the reading module 700. The data is read; when the third identifier information is inconsistent with the fifth identifier information, the second prompting module 800 prompts the user to read the data. That is, this situation will be one end The process of reading the hard disk or the mobile connected USB flash drive and the removable hard disk to other terminals for reading. The fifth identification information may be a terminal ID, for example, an IMEI code, an IP address of a desktop/laptop computer, and the like, which can distinguish the terminal from other terminals. In other embodiments of the present invention, there may be a device for reading and writing terminal data, the device having an obtaining module, an encryption module, a writing module, a decrypting module, a reading module, and a prompting module, and the obtaining The module is the same function as the first obtaining module and the second obtaining module, and the prompting module is the same function as the first prompting module and the second prompting module, and when the data writing operation is performed, the acquiring module is called. The encryption module, the writing module and the prompting module perform data writing operations, and each module respectively corresponds to each module in the device for writing the terminal data; when the data reading operation is performed, the acquiring module, the decrypting module, The reading module and the prompting module perform an operation of reading data, and each module implements a corresponding one of each of the devices in which the terminal data is read.

One of ordinary skill in the art will appreciate that all or a portion of the steps of the above-described embodiments can be implemented using a computer program flow, which can be stored in a computer readable storage medium, such as on a corresponding hardware platform (eg, The system, device, device, device, etc. are executed, and when executed, include one or a combination of the steps of the method embodiments.

Alternatively, all or part of the steps of the above embodiments may also be implemented by using an integrated circuit. These steps may be separately fabricated into individual integrated circuit modules, or multiple modules or steps may be fabricated into a single integrated circuit module. achieve. Thus, the invention is not limited to any specific combination of hardware and software.

The devices/function modules/functional units in the above embodiments may be implemented by a general-purpose computing device, which may be centralized on a single computing device or distributed over a network of multiple computing devices.

When each device/function module/functional unit in the above embodiment is implemented in the form of a software function module and sold or used as a stand-alone product, it can be stored in a computer readable storage medium. The above mentioned computer readable storage medium may be a read only memory, a magnetic disk or an optical disk or the like.

Industrial applicability

The embodiment of the present invention implements a one-to-one correspondence between the data and the terminal, and prevents the terminal data from being copied to other terminals or the storage device that saves the data is removed and put into other terminals to cause data leakage, thereby improving the security of the terminal data.

Claims

A method for writing terminal data includes:

When the write command of the data is monitored, the first identifier information of the data to be written and the second identifier information of the storage device to be written corresponding to the write command are acquired;

And when the first identifier information is consistent with the second identifier information, the data to be written is encrypted, and the encrypted data to be written is written into the storage device to be written.
The method for writing terminal data according to claim 1, wherein the step of acquiring first identification information of data to be written and second identification information of a storage device to be written corresponding to the write instruction The method further includes:

When the first identifier information and the second identifier information are inconsistent, the first identifier information is determined to be illegal identifier information, and the user data write failure is prompted.
The method for reading data of a terminal according to claim 1 or 2, wherein when the write command of the data is monitored, the first identification information of the data to be written is acquired and corresponding to the write command Before the step of writing the second identification information of the storage device, the method further includes:

And creating an encryption module according to the second identification information, and adding the created encryption module to the kernel layer.
A method for reading terminal data includes:

When the read instruction of the data is monitored, the third identifier information corresponding to the read command and the fourth identifier information of the storage device to be read corresponding to the read command are acquired;

When the third identification information is consistent with the fourth identification information, the data to be read is decrypted, and the data to be read after decryption is displayed.
The method of reading data of a terminal according to claim 4, wherein the third identification information corresponding to the read instruction and the corresponding to the read instruction are acquired when the read instruction of the data is monitored After the step of reading the fourth identification information of the storage device, the method further includes:

When the third identifier information is inconsistent with the fourth identifier information, determining that the third identifier information is illegal identifier information, prompting the user that the data reading fails.
A device for writing terminal data, comprising:

a first obtaining module, configured to: obtain first identification information of the data to be written and second identification information to be written to the storage device corresponding to the write instruction when the write instruction of the data is monitored;

An encryption module, configured to: encrypt the data to be written when the first identification information is consistent with the second identification information;

And a write module, configured to: write the encrypted data to be written to the storage device to be written.
The apparatus for writing terminal data according to claim 6, further comprising: a first prompting module,

The first prompting module is configured to: when the first identifier information and the second identifier information are inconsistent, determine that the first identifier information is illegal identifier information, and prompt the user data to fail to write.
The apparatus for reading terminal data according to claim 6 or 7, further comprising a first creation module,

The first creating module is configured to: create an encryption module according to the second identifier information, and add the created encryption module to the kernel layer.
A device for reading terminal data, the device comprising:

a second acquiring module, configured to: acquire third identification information corresponding to the read instruction and fourth identification information of the storage device to be read corresponding to the read instruction, when the read instruction of the data is monitored ;

a decryption module, configured to: when the third identification information is consistent with the fourth identification information, decrypt the data to be read;

The reading module is configured to: display the decrypted data to be read.
The apparatus for reading end user data according to claim 9, further comprising a second prompting module,

The second prompting module is configured to: the third identifier information and the fourth identifier information are not When the information is consistent, the third identification information is determined to be illegal identification information, and the user data reading failure is prompted.
A computer program for implementing the method of any of claims 1-5.
A computer readable storage medium storing the computer program of claim 11.