WO2016065636A1 - 用于终端的数据管理方法、数据管理装置和终端 - Google Patents

用于终端的数据管理方法、数据管理装置和终端 Download PDF

Info

Publication number
WO2016065636A1
WO2016065636A1 PCT/CN2014/090103 CN2014090103W WO2016065636A1 WO 2016065636 A1 WO2016065636 A1 WO 2016065636A1 CN 2014090103 W CN2014090103 W CN 2014090103W WO 2016065636 A1 WO2016065636 A1 WO 2016065636A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
storage space
application
terminal
security
Prior art date
Application number
PCT/CN2014/090103
Other languages
English (en)
French (fr)
Inventor
郭雄伟
傅文治
Original Assignee
东莞宇龙通信科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 东莞宇龙通信科技有限公司 filed Critical 东莞宇龙通信科技有限公司
Publication of WO2016065636A1 publication Critical patent/WO2016065636A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6209—Protecting access to data via a platform, e.g. using keys or access control rules to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/44—Program or device authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2141—Access rights, e.g. capability lists, access control lists, access tables, access matrices

Definitions

  • the present invention relates to the field of terminal technologies, and in particular, to a data management method for a terminal, a data management device for a terminal, and a terminal.
  • the system architecture of the terminal is often divided into multiple layers, and each has a security architecture corresponding to each layer.
  • Each layer of security architecture often sets different security mechanisms to ensure the security of each layer of data.
  • the Android system architecture can be divided into four layers: Linux (an operating system) Kernel (operating system kernel), Android class library and runtime system layer, application framework layer and application layer.
  • Linux an operating system
  • Kernel operating system kernel
  • Android class library and runtime system layer
  • application framework layer application layer
  • application layer application layer
  • the security mechanisms used by each layer of security architecture are: file access control, security sandbox, digital certificate, code security, and access rights.
  • the security of the system is mainly reflected in the security access control.
  • the access policy is located in the storage space of the Linux kernel. When the Android phone starts, it reads the policy file from the memory to set the access policy.
  • Android applies the ACL (Access Control List) permission mechanism of Linux to the rights management of files.
  • the system stores the access policy file in Android memory, which lists the file access policy of the Android mobile phone, which is customized by the Android mobile phone user according to their own needs, such as allowing the ADB daemon (Android Debug Bridge, Android debugging bridge) to read the file program. It is forbidden to write program files.
  • ADB daemon Android Debug Bridge, Android debugging bridge
  • the outermost security protection of the Android system architecture is provided by the Linux system.
  • the partition where system.img is located is read-only and does not allow users to write.
  • the partition where data.img is located is Read and write, used to store user data.
  • the invention is based on at least one of the above technical problems, and proposes a new data management scheme for a terminal, which can store the user's private data in the kernel area of the terminal operating platform, and grant different systems to read different data. / write permissions, effectively enhance the security of private data.
  • the present invention provides a data management method for a terminal, where the operation platform of the terminal includes a first system and a second system, and the data management method includes: creating in a kernel area of the operation platform a storage space for storing private data; prohibiting an application in the first system from reading data in the storage space, and granting an application in the second system to read data in the storage space permission.
  • the kernel area of the operating platform is provided with a corresponding system level security architecture to protect it, it is possible to ensure the privacy data by creating a storage space for storing private data in the kernel area of the operating platform.
  • System-level security rights effectively protect the security of private data. Even if the terminal is connected to a computer through a data cable, the private data in the terminal cannot be viewed on the computer.
  • the application in the first system can be further prevented from being acquired.
  • User's privacy data which enhances the security of private data.
  • the above solution has multiple application scenarios, such as the user can install the authorized application in the second system, and install the unauthorized application in the first system, thereby preventing the unauthorized application from maliciously obtaining the user's privacy.
  • Data can also avoid authorizing apps to read privacy every time The data needs to be prompted to the user to affect the user's operating experience.
  • the method further includes: granting an application in the first system and an application in the second system to have permission to store data in the storage space, and granting the second An application within the system has permission to edit data in the storage space.
  • the method further includes: authenticating any one of the applications when receiving a request for storing the data in the storage space by the application in the first system, and The application is allowed to store data into the storage space as the authentication passes.
  • any application in the first system requests to store data in the storage space
  • any one of the applications is authenticated, so that the application in the first system is an authorized application.
  • the program can store the data in the storage space, avoiding all the applications having the right to store the data in the storage space, causing the data in the storage space to be confusing and affecting the application in the second system to the storage space.
  • the data in the access when any application in the first system requests to store data in the storage space, any one of the applications is authenticated, so that the application in the first system is an authorized application.
  • the program can store the data in the storage space, avoiding all the applications having the right to store the data in the storage space, causing the data in the storage space to be confusing and affecting the application in the second system to the storage space.
  • the data in the access when any application in the first system requests to store data in the storage space, any one of the applications is authenticated, so that the application in the first system is an authorized application.
  • the program can store the data in the storage space, avoiding all
  • any one of the applications is authenticated by a security chip.
  • the security chip is a Trusted Platform Module (TPM), it is a device capable of independently performing key generation, encryption and decryption functions, and the security chip has an independent processor and a storage unit therein. Key and feature data can be stored, providing encryption and secure authentication services to the terminal.
  • the security chip is used to authenticate the application, that is, the data is encrypted, the key is stored in the hardware, and the stolen data cannot be cracked, thereby further protecting the security of the user data.
  • TPM Trusted Platform Module
  • the application when an application in the first system needs to store data into the above storage space, the application needs to Acquiring, by the security chip, a key generated by the security chip for storing data in the storage space, and then implementing the application by determining whether the key acquired by the application is a key for storing data to the storage space. Authentication. Since the key generated by the security chip is stored in the security chip and cannot be modified, it can effectively prevent the malicious program from modifying the key and obtaining illegal rights.
  • the storage area of the second system includes the storage space.
  • the storage space for storing the private data may be placed in the same partition and the same security level as the storage area of the second system, so as to ensure that the privacy data has kernel-level security. Meanwhile, if the storage space for storing the private data is infinitely expanded, all the storage areas of the second system can be used as the storage space for storing the private data.
  • a data management apparatus for a terminal includes a first system and a second system
  • the data management apparatus includes: a creating unit, configured to a kernel area of the operating platform creates a storage space for storing private data; a processing unit, configured to prohibit an application in the first system from reading data in the storage space, and granting the data in the second system The application has permission to read data in the storage space.
  • the kernel area of the operating platform is provided with a corresponding system level security architecture to protect it, it is possible to ensure the privacy data by creating a storage space for storing private data in the kernel area of the operating platform.
  • System-level security rights effectively protect the security of private data. Even if the terminal is connected to a computer through a data cable, the private data in the terminal cannot be viewed on the computer.
  • the application in the first system can be further prevented from being acquired.
  • User's privacy data which enhances the security of private data.
  • the above solution has multiple application scenarios, such as the user can install the authorized application in the second system, and install the unauthorized application in the first system, thereby preventing the unauthorized application from maliciously obtaining the user's privacy.
  • the data can also prevent the authorized application from needing to prompt the user every time the private data is read, thereby affecting the user's operating experience.
  • the processing unit is further configured to: grant an application in the first system and an application in the second system to have permission to store data in the storage space, and The application within the second system is granted the right to edit data in the storage space.
  • the method further includes: an authentication unit, configured to: when any application in the first system receives a request for storing data in the storage space, The program authenticates and allows any of the applications to store data into the storage space as the authentication passes.
  • an authentication unit configured to: when any application in the first system receives a request for storing data in the storage space, The program authenticates and allows any of the applications to store data into the storage space as the authentication passes.
  • any application in the first system requests to store data in the storage space
  • any one of the applications is authenticated, so that the application in the first system is an authorized application.
  • the program can store the data in the storage space, avoiding all the applications having the right to store the data in the storage space, causing the data in the storage space to be confusing and affecting the application in the second system to the storage space.
  • the data in the access when any application in the first system requests to store data in the storage space, any one of the applications is authenticated, so that the application in the first system is an authorized application.
  • the program can store the data in the storage space, avoiding all the applications having the right to store the data in the storage space, causing the data in the storage space to be confusing and affecting the application in the second system to the storage space.
  • the data in the access when any application in the first system requests to store data in the storage space, any one of the applications is authenticated, so that the application in the first system is an authorized application.
  • the program can store the data in the storage space, avoiding all
  • the authentication unit is specifically configured to: authenticate any one of the applications by using a security chip.
  • the security chip is a Trusted Platform Module (TPM), it is a device capable of independently performing key generation, encryption and decryption functions, and the security chip has an independent processor and a storage unit therein. Key and feature data can be stored, providing encryption and secure authentication services to the terminal.
  • the security chip is used to authenticate the application, that is, the data is encrypted, the key is stored in the hardware, and the stolen data cannot be cracked, thereby further protecting the security of the user data.
  • the application in the first system needs to store data in the storage space
  • the application needs to acquire, from the security chip, the data generated by the security chip for storing the storage space.
  • the application is authenticated by determining whether the key acquired by the application is a key for storing data in the storage space. Since the key generated by the security chip is stored in the security chip and cannot be modified, it can effectively prevent the malicious program from modifying the key and obtaining illegal rights.
  • a terminal comprising: a data management apparatus for a terminal as described in any one of the above aspects.
  • the user's private data can be stored in the kernel area of the terminal operating platform, and different systems are given different data read/write permissions, which effectively enhances the security of the private data.
  • FIG. 1 shows a schematic flow chart of a data management method for a terminal according to an embodiment of the present invention
  • FIG. 2 shows a schematic block diagram of a data management apparatus for a terminal in accordance with one embodiment of the present invention
  • FIG. 3 shows a schematic diagram of an internal architecture of a terminal according to an embodiment of the present invention.
  • FIG. 1 shows a schematic flow chart of a data management method for a terminal in accordance with one embodiment of the present invention.
  • the operating platform of the terminal according to the present invention includes a first system and a second system.
  • a data management method for a terminal according to an embodiment of the present invention includes: Step 102, creating a storage space for storing private data in a kernel area of the operating platform; Step 104: The application in the first system is prohibited from reading data in the storage space, and the application in the second system is granted the right to read data in the storage space.
  • the kernel area of the operating platform is provided with a corresponding system level security architecture to protect it, it is possible to ensure the privacy data by creating a storage space for storing private data in the kernel area of the operating platform.
  • System-level security rights effectively protect the security of private data. Even if the terminal is connected to a computer through a data cable, the private data in the terminal cannot be viewed on the computer.
  • the application in the first system can be further prevented from being acquired.
  • User's privacy data which enhances the security of private data.
  • the above solution has multiple application scenarios, such as the user can install the authorized application in the second system, and install the unauthorized application in the first system, thereby preventing the unauthorized application from maliciously obtaining the user's privacy.
  • the data can also prevent the authorized application from needing to prompt the user every time the private data is read, thereby affecting the user's operating experience.
  • the method further includes: granting an application in the first system and an application in the second system to have permission to store data in the storage space, and granting the second An application within the system has permission to edit data in the storage space.
  • the method further includes: authenticating any one of the applications when receiving a request for storing the data in the storage space by the application in the first system, and The application is allowed to store data into the storage space as the authentication passes.
  • the storage space is accessed by any application in the first system
  • any one of the above applications is authenticated, so that the application in the first system is an authorized application, and the data can be stored in the storage space, so that all applications have the storage to the above storage.
  • the permission to store data in the space causes the data in the storage space to be confusing and affects the application in the second system to access the data in the storage space.
  • any one of the applications is authenticated by a security chip.
  • the security chip is a Trusted Platform Module (TPM), it is a device capable of independently performing key generation, encryption and decryption functions, and the security chip has an independent processor and a storage unit therein. Key and feature data can be stored, providing encryption and secure authentication services to the terminal.
  • the security chip is used to authenticate the application, that is, the data is encrypted, the key is stored in the hardware, and the stolen data cannot be cracked, thereby further protecting the security of the user data.
  • the application in the first system needs to store data in the storage space
  • the application needs to acquire, from the security chip, the data generated by the security chip for storing the storage space.
  • the key authenticates the application by determining whether the key obtained by the application is a key for storing data to the storage space. Since the key generated by the security chip is stored in the security chip and cannot be modified, it can effectively prevent the malicious program from modifying the key and obtaining illegal rights.
  • the storage area of the second system includes the storage space.
  • the storage space for storing the private data may be placed in the same partition and the same security level as the storage area of the second system, so as to ensure that the privacy data has kernel-level security. Meanwhile, if the storage space for storing the private data is infinitely expanded, all the storage areas of the second system can be used as the storage space for storing the private data.
  • FIG. 2 shows a schematic block diagram of a data management apparatus for a terminal in accordance with one embodiment of the present invention.
  • the operation platform of the terminal includes a first system and a second system, and the data management device is as shown in FIG. 2, and the data management device for the terminal according to an embodiment of the present invention.
  • 200 comprising: a creating unit 202, configured to create a storage space for storing private data in a kernel area of the operating platform; and a processing unit 204, configured to prohibit an application in the first system from reading the storage space And the application in the second system is granted the right to read data in the storage space.
  • the kernel area of the operating platform is provided with a corresponding system level security architecture to protect it, it is possible to ensure the privacy data by creating a storage space for storing private data in the kernel area of the operating platform.
  • System-level security rights effectively protect the security of private data. Even if the terminal is connected to a computer through a data cable, the private data in the terminal cannot be viewed on the computer.
  • the application in the first system can be further prevented from being acquired.
  • User's privacy data which enhances the security of private data.
  • the above solution has multiple application scenarios, such as the user can install the authorized application in the second system, and install the unauthorized application in the first system, thereby preventing the unauthorized application from maliciously obtaining the user's privacy.
  • the data can also prevent the authorized application from needing to prompt the user every time the private data is read, thereby affecting the user's operating experience.
  • the processing unit 204 is further configured to: grant an application in the first system and an application in the second system to have permission to store data in the storage space, And granting the application in the second system the right to edit the data in the storage space.
  • the method further includes: an authentication unit 206, configured to: when receiving any request from the application in the first system to store data in the storage space, The application authenticates and allows any of the applications to store data into the storage space as the authentication passes.
  • an authentication unit 206 configured to: when receiving any request from the application in the first system to store data in the storage space, The application authenticates and allows any of the applications to store data into the storage space as the authentication passes.
  • any application in the first system requests to store data in the storage space
  • any one of the applications is authenticated, so that the application in the first system is an authorized application.
  • the program can store the data in the storage space, avoiding all the applications having the right to store the data in the storage space, causing the data in the storage space to be confusing and affecting the application in the second system to the storage space.
  • the data in the access when any application in the first system requests to store data in the storage space, any one of the applications is authenticated, so that the application in the first system is an authorized application.
  • the program can store the data in the storage space, avoiding all the applications having the right to store the data in the storage space, causing the data in the storage space to be confusing and affecting the application in the second system to the storage space.
  • the data in the access when any application in the first system requests to store data in the storage space, any one of the applications is authenticated, so that the application in the first system is an authorized application.
  • the program can store the data in the storage space, avoiding all
  • the authentication unit 206 is specifically configured to: authenticate any one of the applications by using a security chip.
  • the security chip is a Trusted Platform Module (TPM), it is a device capable of independently performing key generation, encryption and decryption functions, and the security chip has an independent processor and a storage unit therein. Key and feature data can be stored, providing encryption and secure authentication services to the terminal.
  • the security chip is used to authenticate the application, that is, the data is encrypted, the key is stored in the hardware, and the stolen data cannot be cracked, thereby further protecting the security of the user data.
  • the application in the first system needs to store data in the storage space
  • the application needs to acquire, from the security chip, the data generated by the security chip for storing the storage space.
  • the key authenticates the application by determining whether the key obtained by the application is a key for storing data to the storage space. Since the key generated by the security chip is stored in the security chip and cannot be modified, it can effectively prevent the malicious program from modifying the key and obtaining illegal rights.
  • the present invention also proposes a terminal (not shown) including a data management apparatus 200 for a terminal as shown in FIG. 2.
  • the security box is used as a storage space for storing private data, and the operating system is terminated by the Android system.
  • the common system is used as the first system, and the security system is used as the second system to elaborate the technical solution of an embodiment of the present invention.
  • FIG. 3 shows a schematic diagram of an internal architecture of a terminal according to an embodiment of the present invention.
  • the terminal includes a common system and a security system.
  • the security box in the terminal is encrypted and protected in the kernel layer of Android, and enjoys system-level authority security.
  • the partition of the security box in the memory can be used for the common system and the security system. Both systems access together, but as a kernel layer Partition, the application 302 in the normal system can only write data, and must obtain the key from the security chip (as shown in Figure 3, installed in the ordinary system, of course, can also be installed in the security system).
  • the security box writes data.
  • the application 304 can directly access the data in the security box, and does not need to apply for a key, but also can read data, modify data, and delete data.
  • Security systems have extended the protection of private data to protect user behavior and data, and the security system itself is a larger security box.
  • the present invention proposes a new data management scheme for a terminal, which can store the user's private data in the kernel area of the terminal operating platform, and grant different systems with different data read/write permissions, which effectively enhances The security of privacy data.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Storage Device Security (AREA)

Abstract

一种用于终端的数据管理方法、一种用于终端的数据管理装置和一种终端。所述终端的操作平台包括第一系统和第二系统。其中，所述数据管理方法包括：在所述操作平台的内核区域创建用于存储隐私数据的存储空间（102）；禁止所述第一系统内的应用程序读取所述存储空间中的数据，并授予所述第二系统内的应用程序具有读取所述存储空间中的数据的权限（104）。本技术方案可以将用户的隐私数据存放在终端操作平台的内核区域，并且授予不同系统以不同的数据读/写权限，有效的增强了隐私数据的安全性。

Description

用于终端的数据管理方法、数据管理装置和终端 技术领域
本发明涉及终端技术领域，具体而言，涉及一种用于终端的数据管理方法、一种用于终端的数据管理装置和一种终端。
背景技术
目前，终端的系统架构往往分为多层，并分别设置有与每层相对应的安全架构，每层安全架构往往设置不同的安全机制，以保证每层数据的安全。例如：Android系统架构可分为四层，分别是：Linux(一种操作系统)Kernel(操作系统内核)、Android类库与运行时系统层、应用程序框架层和应用程序层。在安全方面，与Android系统架构相对应，Android对其安全架构也分为四层，分别为系统级安全、虚拟机安全、应用框架安全和应用程序安全。每层安全架构所用到的安全机制分别为：文件访问控制、安全沙箱、数字证书、代码安全及接入权限。
在Android内核，系统在安全方面的工作主要表现在安全访问控制上。访问策略位于Linux内核的存储空间，Android手机启动时从存储器中读取策略文件来调置访问策略。
具体地，Android在文件的权限管理上应用了Linux的ACL(Access Control list，访问控制列表)权限机制。系统将访问策略文件存放在Android存储器中，该文件列出了Android手机的文件访问策略，由Android手机用户根据自己的需要加以定制，如允许ADB daemon(Android Debug Bridge，Android调试桥)读文件程序，禁止写程序文件。
分区层面，在系统运行时，Android系统架构最外层的安全防护是由Linux系统提供的，其中system.img所在的分区是只读的，不允许用户写入，而data.img所在的分区是可读写的，用于存放用户数据。
但是，当前大多数智能终端(如智能手机)对于用户的隐私数据的保护只是对文件夹的访问加了一个密码，使用密钥才能打开文件夹并查看里面的保密文件。这种方式并不能从根本上保护用户的数据安全，如在通过数据线将手机连接至电脑上时，可以在电脑上查看到手机中存储的隐私数据，如视频，图片等，严重影响了用户隐私数据的安全性。
因此，如何能够有效地对终端中的隐私数据进行保护成为亟待解决的技术问题。
发明内容
本发明正是基于上述技术问题至少之一，提出了一种新的用于终端的数据管理方案，可以将用户的隐私数据存放到终端操作平台的内核区域，并且授予不同系统以不同的数据读/写权限，有效地增强了隐私数据的安全性。
有鉴于此，本发明提出了一种用于终端的数据管理方法，所述终端的操作平台包括第一系统和第二系统，所述数据管理方法，包括：在所述操作平台的内核区域创建用于存储隐私数据的存储空间；禁止所述第一系统内的应用程序读取所述存储空间中的数据，并授予所述第二系统内的应用程序具有读取所述存储空间中的数据的权限。
在该技术方案中，由于操作平台的内核区域设置有与之对应的系统级别安全架构对其进行保护，因此通过在操作平台的内核区域创建用于存储隐私数据的存储空间，能够确保隐私数据享有系统级别的安全权限，有效地保护了隐私数据的安全性，即便是通过数据线将终端与电脑进行连接，也无法在电脑上查看到终端中的隐私数据。而通过禁止第一系统内的应用程序读取存储空间中的数据，且授予第二系统中的应用程序具有读取存储空间中数据的权限，使得能够进一步防止第一系统中的应用程序获取到用户的隐私数据，从而增强了隐私数据的安全性。
上述方案有多种应用场景，如用户可以将授权的应用程序安装在第二系统内，将未授权的应用程序安装在第一系统内，这样既避免了未授权的应用程序恶意获取用户的隐私数据，也能够避免授权应用在每次读取隐私 数据时都需要向用户提示而影响用户的操作体验。
在上述技术方案中，优选地，还包括：授予所述第一系统内的应用程序和所述第二系统内的应用程序具有向所述存储空间中存储数据的权限，并授予所述第二系统内的应用程序具有对所述存储空间中的数据进行编辑的权限。
在该技术方案中，通过授予第一系统和第二系统中的应用程序向存储空间存储数据的权限，同时授予第二系统内的应用程序对存储空间中的数据的编辑的权限，使得能够在保证两个系统中的应用程序向存储空间中存储数据的功能的前提下，防止第一系统中的应用程序对存储空间中的数据进行修改、删除等操作，从而保护了存储空间中隐私数据的安全。
在上述技术方案中，优选地，还包括：在接收到所述第一系统内的任一应用程序向所述存储空间中存储数据的请求时，对所述任一应用程序进行鉴权，并在鉴权通过时，允许所述任一应用程序向所述存储空间中存储数据。
在该技术方案中，通过在第一系统中的任一应用程序向所述存储空间中存储数据的请求时，对上述任一应用程序进行鉴权，使得第一系统中的应用程序为授权应用程序时才能够将数据存储到存储空间中，避免所有的应用程序都具有向上述存储空间中存储数据的权限而造成上述存储空间中的数据混乱而影响第二系统中的应用程序对上述存储空间中的数据进行访问。
在上述技术方案中，优选地，通过安全芯片对所述任一应用程序进行鉴权。
在该技术方案中，由于安全芯片是可信任平台模块(Trusted Platform Module，TPM)，是一种能够独立进行密钥生成、加解密功能的装置，安全芯片内部拥有独立的处理器和存储单元，可以存储密钥和特征数据，能够为终端提供加密和安全认证服务。使用安全芯片对应用程序进行鉴权，即对数据进行加密，密钥会被存储在硬件中，被窃取的数据无法破解，从而进一步保护了用户数据的安全。针对本发明的技术方案来说，第一系统内的应用程序在需要向上述的存储空间内存储数据时，该应用程序需要从 安全芯片内获取由安全芯片生成的用于向上述存储空间存储数据的密钥，进而通过判断该应用程序获取到的密钥是否是用于向上述存储空间存储数据的密钥实现对该应用程序的鉴权。由于安全芯片生成的密钥存储在安全芯片内，无法进行修改，因此可以有效地避免恶意程序对密钥进行修改而导致获得非法权限。
在上述技术方案中，优选地，所述第二系统的存储区域包括所述存储空间。
在该技术方案中，具体来说，上述存储隐私数据的存储空间可以与第二系统的存储区域置于同一个分区和相同的安全级别下，以保证隐私数据具有内核级的安全性。同时，若存储隐私数据的存储空间无限扩大，则可以将第二系统的所有存储区域均作为存储隐私数据的存储空间。
根据本发明的第二方面，还提出了一种用于终端的数据管理装置，所述终端的操作平台包括第一系统和第二系统，所述数据管理装置，包括：创建单元，用于在所述操作平台的内核区域创建用于存储隐私数据的存储空间；处理单元，用于禁止所述第一系统内的应用程序读取所述存储空间中的数据，并授予所述第二系统内的应用程序具有读取所述存储空间中的数据的权限。
在该技术方案中，由于操作平台的内核区域设置有与之对应的系统级别安全架构对其进行保护，因此通过在操作平台的内核区域创建用于存储隐私数据的存储空间，能够确保隐私数据享有系统级别的安全权限，有效地保护了隐私数据的安全性，即便是通过数据线将终端与电脑进行连接，也无法在电脑上查看到终端中的隐私数据。而通过禁止第一系统内的应用程序读取存储空间中的数据，且授予第二系统中的应用程序具有读取存储空间中数据的权限，使得能够进一步防止第一系统中的应用程序获取到用户的隐私数据，从而增强了隐私数据的安全性。
上述方案有多种应用场景，如用户可以将授权的应用程序安装在第二系统内，将未授权的应用程序安装在第一系统内，这样既避免了未授权的应用程序恶意获取用户的隐私数据，也能够避免授权应用在每次读取隐私数据时都需要向用户提示而影响用户的操作体验。
在上述技术方案中，优选地，所述处理单元还用于：授予所述第一系统内的应用程序和所述第二系统内的应用程序具有向所述存储空间中存储数据的权限，并授予所述第二系统内的应用程序具有对所述存储空间中的数据进行编辑的权限。
在该技术方案中，通过授予第一系统和第二系统中的应用程序向存储空间存储数据的权限，同时授予第二系统内的应用程序对存储空间中的数据的编辑的权限，使得能够在保证两个系统中的应用程序向存储空间中存储数据的功能的前提下，防止第一系统中的应用程序对存储空间中的数据进行修改、删除等操作，从而保护了存储空间中隐私数据的安全。
在上述技术方案中，优选地，还包括：鉴权单元，用于在接收到所述第一系统内的任一应用程序向所述存储空间中存储数据的请求时，对所述任一应用程序进行鉴权，并在鉴权通过时，允许所述任一应用程序向所述存储空间中存储数据。
在该技术方案中，通过在第一系统中的任一应用程序向所述存储空间中存储数据的请求时，对上述任一应用程序进行鉴权，使得第一系统中的应用程序为授权应用程序时才能够将数据存储到存储空间中，避免所有的应用程序都具有向上述存储空间中存储数据的权限而造成上述存储空间中的数据混乱而影响第二系统中的应用程序对上述存储空间中的数据进行访问。
在上述技术方案中，优选地，所述鉴权单元具体用于：通过安全芯片对所述任一应用程序进行鉴权。
在该技术方案中，由于安全芯片是可信任平台模块(Trusted Platform Module，TPM)，是一种能够独立进行密钥生成、加解密功能的装置，安全芯片内部拥有独立的处理器和存储单元，可以存储密钥和特征数据，能够为终端提供加密和安全认证服务。使用安全芯片对应用程序进行鉴权，即对数据进行加密，密钥会被存储在硬件中，被窃取的数据无法破解，从而进一步保护了用户数据的安全。针对本发明的技术方案来说，第一系统内的应用程序在需要向上述的存储空间内存储数据时，该应用程序需要从安全芯片内获取由安全芯片生成的用于向上述存储空间存储数据的密钥， 进而通过判断该应用程序获取到的密钥是否是用于向上述存储空间存储数据的密钥实现对该应用程序的鉴权。由于安全芯片生成的密钥存储在安全芯片内，无法进行修改，因此可以有效地避免恶意程序对密钥进行修改而导致获得非法权限。
根据本发明的第三方面，还提出了一种终端，包括：如上述任一项技术方案中所述的用于终端的数据管理装置。
通过以上技术方案，可以将用户的隐私数据存放到终端操作平台的内核区域，并且授予不同系统以不同的数据读/写权限，有效地增强了隐私数据的安全性。
附图说明
图1示出了根据本发明的一个实施例的用于终端的数据管理方法的示意流程图；
图2示出了根据本发明的一个实施例的用于终端的数据管理装置的示意框图；
图3示出了根据本发明的一个实施例的终端的内部架构示意图。
具体实施方式
为了能够更清楚地理解本发明的上述目的、特征和优点，下面结合附图和具体实施方式对本发明进行进一步的详细描述。需要说明的是，在不冲突的情况下，本申请的实施例及实施例中的特征可以相互组合。
在下面的描述中阐述了很多具体细节以便于充分理解本发明，但是，本发明还可以采用其他不同于在此描述的其他方式来实施，因此，本发明的保护范围并不受下面公开的具体实施例的限制。
图1示出了根据本发明的一个实施例的用于终端的数据管理方法的示意流程图。
其中，本发明所述的终端的操作平台包括第一系统和第二系统。如图1所示，根据本发明的一个实施例的用于终端的数据管理方法，包括：步骤102，在所述操作平台的内核区域创建用于存储隐私数据的存储空间； 步骤104，禁止所述第一系统内的应用程序读取所述存储空间中的数据，并授予所述第二系统内的应用程序具有读取所述存储空间中的数据的权限。
在该技术方案中，由于操作平台的内核区域设置有与之对应的系统级别安全架构对其进行保护，因此通过在操作平台的内核区域创建用于存储隐私数据的存储空间，能够确保隐私数据享有系统级别的安全权限，有效地保护了隐私数据的安全性，即便是通过数据线将终端与电脑进行连接，也无法在电脑上查看到终端中的隐私数据。而通过禁止第一系统内的应用程序读取存储空间中的数据，且授予第二系统中的应用程序具有读取存储空间中数据的权限，使得能够进一步防止第一系统中的应用程序获取到用户的隐私数据，从而增强了隐私数据的安全性。
上述方案有多种应用场景，如用户可以将授权的应用程序安装在第二系统内，将未授权的应用程序安装在第一系统内，这样既避免了未授权的应用程序恶意获取用户的隐私数据，也能够避免授权应用在每次读取隐私数据时都需要向用户提示而影响用户的操作体验。
在上述技术方案中，优选地，还包括：授予所述第一系统内的应用程序和所述第二系统内的应用程序具有向所述存储空间中存储数据的权限，并授予所述第二系统内的应用程序具有对所述存储空间中的数据进行编辑的权限。
在该技术方案中，通过授予第一系统和第二系统中的应用程序向存储空间存储数据的权限，同时授予第二系统内的应用程序对存储空间中的数据的编辑的权限，使得能够在保证两个系统中的应用程序向存储空间中存储数据的功能的前提下，防止第一系统中的应用程序对存储空间中的数据进行修改、删除等操作，从而保护了存储空间中隐私数据的安全。
在上述技术方案中，优选地，还包括：在接收到所述第一系统内的任一应用程序向所述存储空间中存储数据的请求时，对所述任一应用程序进行鉴权，并在鉴权通过时，允许所述任一应用程序向所述存储空间中存储数据。
在该技术方案中，通过在第一系统中的任一应用程序向所述存储空间 中存储数据的请求时，对上述任一应用程序进行鉴权，使得第一系统中的应用程序为授权应用程序时才能够将数据存储到存储空间中，避免所有的应用程序都具有向上述存储空间中存储数据的权限而造成上述存储空间中的数据混乱而影响第二系统中的应用程序对上述存储空间中的数据进行访问。
在上述技术方案中，优选地，通过安全芯片对所述任一应用程序进行鉴权。
在该技术方案中，由于安全芯片是可信任平台模块(Trusted Platform Module，TPM)，是一种能够独立进行密钥生成、加解密功能的装置，安全芯片内部拥有独立的处理器和存储单元，可以存储密钥和特征数据，能够为终端提供加密和安全认证服务。使用安全芯片对应用程序进行鉴权，即对数据进行加密，密钥会被存储在硬件中，被窃取的数据无法破解，从而进一步保护了用户数据的安全。针对本发明的技术方案来说，第一系统内的应用程序在需要向上述的存储空间内存储数据时，该应用程序需要从安全芯片内获取由安全芯片生成的用于向上述存储空间存储数据的密钥，进而通过判断该应用程序获取到的密钥是否是用于向上述存储空间存储数据的密钥实现对该应用程序的鉴权。由于安全芯片生成的密钥存储在安全芯片内，无法进行修改，因此可以有效地避免恶意程序对密钥进行修改而导致获得非法权限。
在上述技术方案中，优选地，所述第二系统的存储区域包括所述存储空间。
在该技术方案中，具体来说，上述存储隐私数据的存储空间可以与第二系统的存储区域置于同一个分区和相同的安全级别下，以保证隐私数据具有内核级的安全性。同时，若存储隐私数据的存储空间无限扩大，则可以将第二系统的所有存储区域均作为存储隐私数据的存储空间。
图2示出了根据本发明的一个实施例的用于终端的数据管理装置的示意框图。
其中，所述终端的操作平台包括第一系统和第二系统，所述数据管理装置如图2所示，根据本发明的一个实施例的用于终端的数据管理装置 200，包括：创建单元202，用于在所述操作平台的内核区域创建用于存储隐私数据的存储空间；处理单元204，用于禁止所述第一系统内的应用程序读取所述存储空间中的数据，并授予所述第二系统内的应用程序具有读取所述存储空间中的数据的权限。
在该技术方案中，由于操作平台的内核区域设置有与之对应的系统级别安全架构对其进行保护，因此通过在操作平台的内核区域创建用于存储隐私数据的存储空间，能够确保隐私数据享有系统级别的安全权限，有效地保护了隐私数据的安全性，即便是通过数据线将终端与电脑进行连接，也无法在电脑上查看到终端中的隐私数据。而通过禁止第一系统内的应用程序读取存储空间中的数据，且授予第二系统中的应用程序具有读取存储空间中数据的权限，使得能够进一步防止第一系统中的应用程序获取到用户的隐私数据，从而增强了隐私数据的安全性。
上述方案有多种应用场景，如用户可以将授权的应用程序安装在第二系统内，将未授权的应用程序安装在第一系统内，这样既避免了未授权的应用程序恶意获取用户的隐私数据，也能够避免授权应用在每次读取隐私数据时都需要向用户提示而影响用户的操作体验。
在上述技术方案中，优选地，所述处理单元204还用于：授予所述第一系统内的应用程序和所述第二系统内的应用程序具有向所述存储空间中存储数据的权限，并授予所述第二系统内的应用程序具有对所述存储空间中的数据进行编辑的权限。
在该技术方案中，通过授予第一系统和第二系统中的应用程序向存储空间存储数据的权限，同时授予第二系统内的应用程序对存储空间中的数据的编辑的权限，使得能够在保证两个系统中的应用程序向存储空间中存储数据的功能的前提下，防止第一系统中的应用程序对存储空间中的数据进行修改、删除等操作，从而保护了存储空间中隐私数据的安全。
在上述技术方案中，优选地，还包括：鉴权单元206，用于在接收到所述第一系统内的任一应用程序向所述存储空间中存储数据的请求时，对所述任一应用程序进行鉴权，并在鉴权通过时，允许所述任一应用程序向所述存储空间中存储数据。
在该技术方案中，通过在第一系统中的任一应用程序向所述存储空间中存储数据的请求时，对上述任一应用程序进行鉴权，使得第一系统中的应用程序为授权应用程序时才能够将数据存储到存储空间中，避免所有的应用程序都具有向上述存储空间中存储数据的权限而造成上述存储空间中的数据混乱而影响第二系统中的应用程序对上述存储空间中的数据进行访问。
在上述技术方案中，优选地，所述鉴权单元206具体用于：通过安全芯片对所述任一应用程序进行鉴权。
在该技术方案中，由于安全芯片是可信任平台模块(Trusted Platform Module，TPM)，是一种能够独立进行密钥生成、加解密功能的装置，安全芯片内部拥有独立的处理器和存储单元，可以存储密钥和特征数据，能够为终端提供加密和安全认证服务。使用安全芯片对应用程序进行鉴权，即对数据进行加密，密钥会被存储在硬件中，被窃取的数据无法破解，从而进一步保护了用户数据的安全。针对本发明的技术方案来说，第一系统内的应用程序在需要向上述的存储空间内存储数据时，该应用程序需要从安全芯片内获取由安全芯片生成的用于向上述存储空间存储数据的密钥，进而通过判断该应用程序获取到的密钥是否是用于向上述存储空间存储数据的密钥实现对该应用程序的鉴权。由于安全芯片生成的密钥存储在安全芯片内，无法进行修改，因此可以有效地避免恶意程序对密钥进行修改而导致获得非法权限。
本发明还提出了一种终端(图中未示出)，包括如图2所示的用于终端的数据管理装置200。
以下以安全箱作为存储隐私数据的存储空间，并以Android系统为终端的操作平台，以普通系统作为第一系统，安全系统作为第二系统详细阐述本发明的一个实施例的技术方案。
图3示出了根据本发明的一个实施例的终端的内部架构示意图。
如图3所示，终端包括普通系统和安全系统，终端中的安全箱放在Android的内核层加密保护起来，享受系统级的权限安全，安全箱在内存中的分区可以供普通系统和安全系统两个系统共同访问，但作为内核层的 分区，在普通系统下的应用程序302只能写入数据，并且需先从安全芯片(如图3所示，安装在普通系统内，当然也可以安装在安全系统内)获取密钥才能有往安全箱写入数据。而在安全系统下应用程序304可以直接访问安全箱中的数据，不需要再申请密钥，同时还可以读数据、修改数据和删除数据。安全系统已经将对于隐私数据的保护扩大到对用户行为和数据的保护，安全系统本身就是一个更大范围的安全箱。
以上结合附图详细说明了本发明的技术方案，考虑到当前大多数智能终端(如智能手机)对于用户的隐私数据的保护只是对文件夹的访问加了一个密码，使用密钥才能打开文件夹并查看里面的保密文件。这种方式并不能从根本上保护用户的数据安全，如在通过数据线将手机连接至电脑上时，可以在电脑上查看到手机中存储的隐私数据，如视频，图片等，严重影响了用户隐私数据的安全性。因此，本发明提出了一种新的用于终端的数据管理方案，可以将用户的隐私数据存放到终端操作平台的内核区域，并且授予不同系统以不同的数据读/写权限，有效地增强了隐私数据的安全性。
以上所述仅为本发明的优选实施例而已，并不用于限制本发明，对于本领域的技术人员来说，本发明可以有各种更改和变化。凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。

Claims (10)

  1. 一种用于终端的数据管理方法，所述终端的操作平台包括第一系统和第二系统，其特征在于，所述数据管理方法，包括：
    在所述操作平台的内核区域创建用于存储隐私数据的存储空间；
    禁止所述第一系统内的应用程序读取所述存储空间中的数据，并授予所述第二系统内的应用程序具有读取所述存储空间中的数据的权限。
  2. 根据权利要求1所述的用于终端的数据管理方法，其特征在于，还包括：
    授予所述第一系统内的应用程序和所述第二系统内的应用程序具有向所述存储空间中存储数据的权限，并授予所述第二系统内的应用程序具有对所述存储空间中的数据进行编辑的权限。
  3. 根据权利要求2所述的用于终端的数据管理方法，其特征在于，还包括：
    在接收到所述第一系统内的任一应用程序向所述存储空间中存储数据的请求时，对所述任一应用程序进行鉴权，并在鉴权通过时，允许所述任一应用程序向所述存储空间中存储数据。
  4. 根据权利要求3所述的用于终端的数据管理方法，其特征在于，通过安全芯片对所述任一应用程序进行鉴权。
  5. 根据权利要求1至4中任一项所述的用于终端的数据管理方法，其特征在于，所述第二系统的存储区域包括所述存储空间。
  6. 一种用于终端的数据管理装置，所述终端的操作平台包括第一系统和第二系统，其特征在于，所述数据管理装置，包括：
    创建单元，用于在所述操作平台的内核区域创建用于存储隐私数据的存储空间；
    处理单元，用于禁止所述第一系统内的应用程序读取所述存储空间中的数据，并授予所述第二系统内的应用程序具有读取所述存储空间中的数据的权限。
  7. 根据权利要求6所述的用于终端的数据管理装置，其特征在于， 所述处理单元还用于：
    授予所述第一系统内的应用程序和所述第二系统内的应用程序具有向所述存储空间中存储数据的权限，并授予所述第二系统内的应用程序具有对所述存储空间中的数据进行编辑的权限。
  8. 根据权利要求7所述的用于终端的数据管理装置，其特征在于，还包括：
    鉴权单元，用于在接收到所述第一系统内的任一应用程序向所述存储空间中存储数据的请求时，对所述任一应用程序进行鉴权，并在鉴权通过时，允许所述任一应用程序向所述存储空间中存储数据。
  9. 根据权利要求8所述的用于终端的数据管理装置，其特征在于，所述鉴权单元具体用于：通过安全芯片对所述任一应用程序进行鉴权。
  10. 一种终端，其特征在于，包括：如权利要求6至9中任一项所述的用于终端的数据管理装置。
PCT/CN2014/090103 2014-10-28 2014-10-31 用于终端的数据管理方法、数据管理装置和终端 WO2016065636A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410593892.0 2014-10-28
CN201410593892.0A CN104318176B (zh) 2014-10-28 2014-10-28 用于终端的数据管理方法、数据管理装置和终端

Publications (1)

Publication Number Publication Date
WO2016065636A1 true WO2016065636A1 (zh) 2016-05-06

Family

ID=52373407

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/090103 WO2016065636A1 (zh) 2014-10-28 2014-10-31 用于终端的数据管理方法、数据管理装置和终端

Country Status (2)

Country Link
CN (1) CN104318176B (zh)
WO (1) WO2016065636A1 (zh)

Families Citing this family (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104318176B (zh) * 2014-10-28 2021-01-15 东莞宇龙通信科技有限公司 用于终端的数据管理方法、数据管理装置和终端
CN104850793B (zh) * 2015-05-28 2017-09-29 成都中科创达软件有限公司 一种安卓系统智能控制管理方法
CN104955043B (zh) * 2015-06-01 2018-02-16 成都中科创达软件有限公司 一种智能终端安全防护系统
CN104866761B (zh) * 2015-06-01 2017-10-31 成都中科创达软件有限公司 一种高安全性安卓智能终端
CN105100217B (zh) * 2015-06-30 2019-05-31 努比亚技术有限公司 多系统共享数据方法和装置
CN105631293A (zh) * 2015-12-29 2016-06-01 宇龙计算机通信科技(深圳)有限公司 数据访问方法、数据访问系统和终端
CN106201675B (zh) * 2016-06-25 2019-10-25 依偎科技（南昌）有限公司 一种移动终端应用冻结方法及移动终端
CN108509788B (zh) * 2018-03-29 2021-03-23 Oppo广东移动通信有限公司 信息共享方法和装置、计算机可读存储介质、终端
CN112069535B (zh) * 2020-08-13 2023-01-31 中国电子科技集团公司第三十研究所 一种基于访问分区物理隔离的双系统安全智能终端架构
CN114091027B (zh) * 2021-12-01 2023-08-29 海光信息技术股份有限公司 信息配置方法、数据访问方法及相关装置、设备

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102254124A (zh) * 2011-07-21 2011-11-23 周亮 一种移动终端信息安全防护系统和方法
CN103400081A (zh) * 2013-07-30 2013-11-20 东莞宇龙通信科技有限公司 终端和用户界面的显示控制方法
CN103514414A (zh) * 2012-06-26 2014-01-15 上海盛轩网络科技有限公司 一种基于ARM TrustZone的加密方法及加密系统
CN103530578A (zh) * 2013-10-18 2014-01-22 武汉大学 一种android系统的软构可信平台模块STPM的构建方法
CN104008345A (zh) * 2013-02-27 2014-08-27 腾讯科技（深圳）有限公司 对应用程序的用户隐私数据的保护方法和装置
CN104318176A (zh) * 2014-10-28 2015-01-28 东莞宇龙通信科技有限公司 用于终端的数据管理方法、数据管理装置和终端

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8904552B2 (en) * 2007-04-17 2014-12-02 Samsung Electronics Co., Ltd. System and method for protecting data information stored in storage
CN104091135A (zh) * 2014-02-24 2014-10-08 电子科技大学 一种智能终端安全系统及安全存储方法

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102254124A (zh) * 2011-07-21 2011-11-23 周亮 一种移动终端信息安全防护系统和方法
CN103514414A (zh) * 2012-06-26 2014-01-15 上海盛轩网络科技有限公司 一种基于ARM TrustZone的加密方法及加密系统
CN104008345A (zh) * 2013-02-27 2014-08-27 腾讯科技（深圳）有限公司 对应用程序的用户隐私数据的保护方法和装置
CN103400081A (zh) * 2013-07-30 2013-11-20 东莞宇龙通信科技有限公司 终端和用户界面的显示控制方法
CN103530578A (zh) * 2013-10-18 2014-01-22 武汉大学 一种android系统的软构可信平台模块STPM的构建方法
CN104318176A (zh) * 2014-10-28 2015-01-28 东莞宇龙通信科技有限公司 用于终端的数据管理方法、数据管理装置和终端

Also Published As

Publication number Publication date
CN104318176B (zh) 2021-01-15
CN104318176A (zh) 2015-01-28

Similar Documents

Publication Publication Date Title
WO2016065636A1 (zh) 用于终端的数据管理方法、数据管理装置和终端
CN109923548B (zh) 通过监管进程访问加密数据实现数据保护的方法、系统及计算机程序产品
US11126754B2 (en) Personalized and cryptographically secure access control in operating systems
US9515832B2 (en) Process authentication and resource permissions
US8213618B2 (en) Protecting content on client platforms
US9075984B2 (en) Secure system for allowing the execution of authorized computer program code
CN103827881B (zh) 用于设备操作系统中的动态平台安全的方法和系统
JP4880029B2 (ja) 暗号化されたストレージデバイスについてのチップセット鍵管理サービスの利用の強制
US20170329963A1 (en) Method for data protection using isolated environment in mobile device
US20160004859A1 (en) Method and system for platform and user application security on a device
Atamli-Reineh et al. Analysis of trusted execution environment usage in samsung KNOX
WO2015117523A1 (zh) 访问控制方法及装置
US20170201528A1 (en) Method for providing trusted service based on secure area and apparatus using the same
EP2835758B1 (en) System and method for controlling access to encrypted files
Rehman et al. Security-enhanced Android for an enterprise
Patil et al. User Privacy and Database Security using Context based Access Control in Android Devices: A Survey
CN116823585A (zh) Gpu可信执行环境的构建方法、gpu可信计算执行方法及装置
Asokan et al. Platform Security Model

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14905190

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205 DATED 25/09/2017)

122 Ep: pct application non-entry in european phase

Ref document number: 14905190

Country of ref document: EP

Kind code of ref document: A1