WO2016169395A1 - Android平台下的PIN码保护方法 - Google Patents

Android平台下的PIN码保护方法 Download PDF

Info

Publication number
WO2016169395A1
WO2016169395A1 PCT/CN2016/077585 CN2016077585W WO2016169395A1 WO 2016169395 A1 WO2016169395 A1 WO 2016169395A1 CN 2016077585 W CN2016077585 W CN 2016077585W WO 2016169395 A1 WO2016169395 A1 WO 2016169395A1
Authority
WO
WIPO (PCT)
Prior art keywords
layer
class instance
password storage
storage class
user
Prior art date
Application number
PCT/CN2016/077585
Other languages
English (en)
French (fr)
Inventor
陆舟
于华章
Original Assignee
飞天诚信科技股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 飞天诚信科技股份有限公司 filed Critical 飞天诚信科技股份有限公司
Publication of WO2016169395A1 publication Critical patent/WO2016169395A1/zh
Priority to US15/710,590 priority Critical patent/US10628607B2/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6245—Protecting personal data, e.g. for financial or medical purposes
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/78—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/82—Protecting input, output or interconnection devices
    • G06F21/83—Protecting input, output or interconnection devices input devices, e.g. keyboards, mice or controllers thereof
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H04L9/3228—One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/03—Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms
    • G06F2221/031—Protect user input by software means

Definitions

  • the embodiments of the present invention relate to the field of information security, and in particular, to a PIN code protection method under the Android platform.
  • Android is an operating system based on the Linux open kernel. It is a mobile operating system announced by Google on November 5, 2007. Now, the Android system is not only used in smart phones, but also in the tablet market, and it has also developed greatly in the smart MP4.
  • Android uses a software heap architecture.
  • the underlying Linux kernel only provides basic functions.
  • the middle layer includes function libraries and virtual machines.
  • the top layer is various application software. Most application software requires input of personal identification password (Personal Identification). Number, referred to as PIN code), in order to improve the security of PIN code, the general method is to encrypt the PIN code, because the user interface (UI) under the Android platform is written in Java language which is easy to be decompiled and analyzed. of.
  • PIN code personal identification password
  • the general method is to encrypt the PIN code, because the user interface (UI) under the Android platform is written in Java language which is easy to be decompiled and analyzed. of.
  • the logic for encrypting the PIN code in the prior art is placed in the C layer which is difficult to be cracked and decompiled in the application, and when the user inputs the PIN code, Java The layer passes the PIN code to the C layer for encryption, but the above method has at least a defect that the PIN code is easily intercepted in the process of being transmitted from the Java layer to the C layer.
  • the embodiment of the invention provides a PIN code protection method under the Android platform, which overcomes the defect that the PIN code is easily intercepted in the process of being transmitted from the Java layer to the C layer.
  • An aspect of the embodiments of the present invention provides a PIN code protection method for an Android platform, where the method includes:
  • Step S1 The Java layer calls the C layer through the JNI, and sends a startup event to the C layer;
  • Step S2 the C layer calls the Java layer through the JNI after receiving the startup event
  • Step S3 the Java layer generates an instance of a password storage class, and passes the JNI to the C layer. Returns the handle of the password storage class instance;
  • Step S4 the C layer receives the handle of the password storage class instance and invokes the Java layer through the JNI;
  • Step S5 the Java layer monitors user input, and if the user inputs the PIN code data, stores the PIN code data currently input by the user into the data memory of the password storage class instance, and updates the password storage class instance.
  • the storage location identifier, the C layer is called by the JNI, the encryption event is transmitted to the C layer, and the step S6 is performed; if the user input confirmation information is received, the C layer is called through the JNI, and the confirmation event is transmitted to the C layer, and the execution is performed.
  • Step S7 the Java layer monitors user input, and if the user inputs the PIN code data, stores the PIN code data currently input by the user into the data memory of the password storage class instance, and updates the password storage class instance.
  • the storage location identifier, the C layer is called by the JNI, the encryption event is transmitted to the C layer, and the step S6 is performed; if the user input confirmation information is received, the C layer is called through the JNI, and the confirmation event is transmitted to the C layer, and the
  • Step S6 The C layer accesses the password storage class instance by using a handle of the password storage class instance, and searches for the PIN code data currently input by the user according to the storage location identifier in the password storage class instance, and searches for the found user.
  • the currently input PIN code data is encrypted to obtain the current encrypted data, save the current encrypted data to the data memory of the password storage class instance, and delete the PIN code data currently input by the found user, and return to step S5;
  • Step S7 The C layer accesses the password storage class instance according to the handle of the password storage class instance, and decrypts all the encrypted data stored in the data memory of the password storage class instance to obtain a PIN code input by the user.
  • step S5 the method further includes: the Java layer generating an cryptographic keyboard class instance, associating the cryptographic keyboard class instance and the password storage class instance, and calling the display function in the cryptographic keyboard class instance to display user input. interface;
  • the method further includes: the Java layer generating an cryptographic keyboard class instance, associating the cryptographic keyboard class instance and the password storage class instance, and calling a display function in the cryptographic keyboard class instance to display a user input interface;
  • the Java layer listens to user input, including: the cryptographic keyboard class instance of the Java layer listens to user input; the Java layer stores PIN code data currently input by the user into a data memory of the password storage class instance, And updating the storage location identifier in the password storage class instance, including: the password keyboard class instance of the Java layer invoking the password storage class instance, and saving the PIN code data currently input by the user to the password storage class
  • the data in the instance is in memory and updates the storage location identifier in the instance of the password storage class.
  • the step S1 further includes: the Java layer generates an instance of a cryptographic keyboard class, and invokes a display function in the cryptographic keyboard class instance to display a user input interface; the step S5 The method further includes: the Java layer associating the cryptographic keyboard class instance with the cryptographic storage class instance; the Java layer listening to user input, including: the cryptographic keyboard class instance of the Java layer listening for user input; The Java layer stores the PIN code data currently input by the user into the data memory of the password storage class instance, and updates the storage location identifier in the password storage class instance, including: the password keyboard class of the Java layer The instance invokes the password storage class instance, saves the PIN code data currently input by the user into the data memory of the password storage class instance, and updates the storage location identifier in the password storage class instance.
  • the step S5 further includes: if the Java layer listens to the cancellation information input by the user, the C layer is called through the JNI, and the cancellation event is transmitted to the C layer; the C layer receives the cancellation event and the A handle of the password storage class instance accesses the password storage class instance, and clears all encrypted data in the data memory of the password storage class instance.
  • the method further includes: the C layer calling the Java layer by using a JNI, the Java layer releasing the password storage class instance; and the C layer accessing according to a handle of the password storage class instance After the password storage class instance clears all the encrypted data in the data memory of the password storage class instance, the method further includes: calling the Java layer by using the JNI, the Java layer releasing the password storage class instance.
  • step S5 further includes: if the Java layer listens to the deletion message input by the user, decrementing the storage location identifier in the password storage instance, and searching for and deleting the user according to the storage location identifier.
  • the newly entered PIN code data is returned to step S5.
  • the encrypting the PIN code data currently input by the searched user includes: after filling the PIN code data currently input by the searched user with a random number, using a pre-stored key to perform encryption according to a preset algorithm. Decrypting all the encrypted data stored in the data memory of the password storage class instance, comprising: using the pre-stored key for all the encrypted data stored in the data memory of the password storage class instance
  • the preset algorithm performs decryption.
  • the C layer after receiving the startup event, the C layer further includes: generating a current key
  • the encrypting the PIN code data currently input by the searched user includes: after filling the PIN code data currently input by the searched user with a random number, using the current key to perform encryption according to a preset algorithm;
  • Decrypting including: decrypting, by using the current key, all the encrypted data stored in the data memory of the password storage class instance according to the preset algorithm;
  • the method further includes: clearing the current key.
  • the method further includes: sending the PIN code input by the user to the smart key device. verification.
  • the saving the current encrypted data into the data memory of the password storage class instance, and deleting the PIN code data currently input by the searched user includes: overwriting the current encrypted data with the current encrypted data The PIN code data currently entered by the found user.
  • the Java layer calls the C layer through the JNI, and before the encryption event is sent to the C layer, the method further includes: the Java layer determining whether the length of the data to be encrypted reaches a preset length, and executing the call C. Layer, the encryption event is transmitted to the C layer, otherwise returns to the step S5;
  • the method further includes: updating the length of the data to be encrypted;
  • the Java layer calls the C layer through the JNI, and after the confirmation event is transmitted to the C layer, the method further includes: the Java layer initializing the length of the data to be encrypted.
  • the method further includes: clearing the entire encrypted data;
  • the clearing the all the encrypted data comprises: updating all the encrypted data stored in the data memory of the password storage class instance to preset data or a random number.
  • the PIN code protection method under the Android platform uses the JNI mechanism to perform event interaction only between the Java layer and the C layer without performing PIN code transmission, thereby avoiding the PIN code being transmitted from the Java layer.
  • the risk of being intercepted in the process of entering the C layer improves the security of the PIN code under the Android platform.
  • FIG. 1 is a flowchart of a PIN code protection method on an Android platform according to Embodiment 1 of the present invention
  • FIG. 2 is a flowchart of a PIN code protection method on an Android platform according to Embodiment 2 of the present invention
  • FIG. 3 is a flowchart of a PIN code protection method on an Android platform according to Embodiment 3 of the present invention.
  • the Java layer described in the present invention includes a Java virtual machine and a program generated by Java code; the C layer contains a program generated by C/C++ code.
  • the program generated by the Java code is included in the dex file, and the program generated by the C/C++ code is included in the so file.
  • the first embodiment of the present invention provides a PIN code protection method for the Android platform. As shown in FIG. 1 , the method specifically includes:
  • Step S1 The Java layer calls the C layer through the JNI, and sends a startup event to the C layer;
  • Step S2 the C layer calls the Java layer through the JNI after receiving the startup event
  • Step S3 the Java layer generates a password storage class instance, and returns a handle of the password storage class instance to the C layer through the JNI;
  • Step S4 the C layer receives the handle of the password storage class instance and invokes the Java layer through the JNI;
  • Step S5 the Java layer monitors user input, and if the user inputs the PIN code data, And storing the PIN code data currently input by the user into the data memory of the password storage class instance, and updating the storage location identifier in the password storage class instance, calling the C layer through the JNI, and transmitting the encryption to the C layer.
  • step S6 is performed; if the user input confirmation message is received, the C layer is called through the JNI, and the confirmation event is transmitted to the C layer, and step S7 is performed;
  • Step S6 The C layer accesses the password storage class instance by using a handle of the password storage class instance, and searches for the PIN code data currently input by the user according to the storage location identifier in the password storage class instance, and searches for the found user.
  • the currently input PIN code data is encrypted to obtain the current encrypted data, save the current encrypted data to the data memory of the password storage class instance, and delete the PIN code data currently input by the found user, and return to step S5;
  • Step S7 The C layer accesses the password storage class instance according to the handle of the password storage class instance, and decrypts all the encrypted data stored in the data memory of the password storage class instance to obtain a PIN code input by the user.
  • the PIN code data currently input by the searched user is encrypted, which may include: after filling the PIN code data currently input by the searched user with a random number, using a pre-stored key according to a preset algorithm. Encrypting; correspondingly, decrypting all the encrypted data stored in the data memory of the password storage class instance, specifically comprising: using the pre-stored secret for all encrypted data stored in the data memory of the password storage class instance The key is decrypted according to the preset algorithm;
  • the PIN code data currently input by the user is encrypted, which may include: after the PIN code data currently input by the searched user is filled with a random number, the current key is used according to the preset.
  • the algorithm performs encryption.
  • the C layer further includes: generating a current key; and decrypting all the encrypted data stored in the data memory of the password storage class instance, specifically: the password storage class All the encrypted data stored in the data memory of the instance is decrypted according to the preset algorithm by using the current key; and all the encrypted data stored in the data memory of the password storage class instance is decrypted to obtain the PIN code input by the user. Also includes clearing the current key.
  • step S5 the method further includes: the Java layer displaying a user input interface by calling a display function in the password storage class instance; correspondingly, the Java layer listening user input is specifically: the Java layer The password storage class instance listens for user input;
  • the method further includes: the Java layer generates an instance of a cryptographic keyboard class, and associates The cryptographic keyboard class instance and the password storage class instance invoke a display function in the cryptographic keyboard class instance to display a user input interface; correspondingly, the Java layer listening user input is specifically: the Java layer The password keyboard class instance listens to the user input; the Java layer saves the PIN code data currently input by the user into the data memory of the password storage class instance, and updates the storage location identifier in the password storage class instance, which may be specifically: The cryptographic keyboard class instance of the Java layer invokes the password storage class instance, saves the PIN code data currently input by the user into the data memory of the password storage class instance, and updates the password storage class instance. Storage location identifier;
  • the step S1 further includes: the Java layer generates an instance of the cryptographic keyboard class, and invokes a display function in the cryptographic keyboard class instance to display a user input interface; correspondingly, the step S5 further includes the Java
  • the layer associates the cryptographic keyboard class instance and the password storage class instance;
  • the Java layer listening user input may be specifically: the cryptographic keyboard class instance of the Java layer listens to user input; and the Java layer saves a user current input
  • the PIN code data is sent to the data memory of the password storage class instance, and the storage location identifier in the password storage class instance is updated, which may be specifically: the password keyboard class instance of the Java layer invokes the password storage
  • the class instance saves the PIN code data currently input by the user into the data memory of the password storage class instance, and updates the storage location identifier in the password storage class instance.
  • the second embodiment of the present invention provides a PIN code protection method for the Android platform. As shown in FIG. 2, the method specifically includes:
  • Step 101 When receiving the upper layer application call, the Java layer calls the C layer through the JNI, and sends a startup event to the C layer;
  • JNI Java Native Interface
  • the Java layer passing events to the C layer may pass corresponding event data to the C layer for the Java layer.
  • the type of the event data may have multiple implementation manners, and the value of the data may also be arbitrarily defined, as long as the Java layer and The C layer can work according to this convention;
  • each event involved in this embodiment is a predefined series of Java layer and C layer.
  • Jint type data where the startup event is defined as an integer 1 of the jint type, the encryption event is defined as an integer 2 of the jint type, the confirmation event is defined as an integer 3 of the jint type, and the cancellation event is defined as an integer 4 of the jint type.
  • Step 102 The C layer generates a current key, and calls the Java layer through the JNI.
  • the C layer generates a random number of a preset length as the current key.
  • Step 103 The Java layer generates an instance of a password storage class.
  • step 102 to step 103 may be specifically: the C layer causes the Java layer to generate a password storage class instance according to the password storage class by calling the NewObject function of the JNI, and the password storage class instance includes logic for storing the user input data. JNI passes the logic of the event to the C layer.
  • Step 104 The Java layer returns a handle of the password storage class instance to the C layer through the JNI.
  • Step 105 the C layer calls the Java layer through the JNI;
  • Step 106 The Java layer generates a password keyboard class instance, associates a password keyboard class instance and a password storage class instance, and displays a user input interface.
  • the Java layer generates an instance of the cryptographic keyboard class by calling an initialization function in the password storage class; and associates the cryptographic keyboard class instance by assigning a handle to the password storage class instance in the cryptographic keyboard class instance.
  • password storage class instances
  • the Java layer may display a user input interface by calling a display function in the password keyboard class instance.
  • the input interface usually includes an input box and a keyboard, and the input box and the keyboard may be customized, or may be provided by the system or the first.
  • the display function of the cryptographic keyboard class instance displays the input interface by calling these implemented display interfaces.
  • Step 107 the Java layer listens to the user input, if the user is prompted to input the PIN code data, step 108 is performed, if the user input confirmation message is received, step 112 is performed, and if the user inputs the cancellation information, step 117 is performed;
  • the user input is specifically monitored by a password keyboard instance of the Java layer;
  • the step 107 may further include: if the user inputs the deletion information, the storage location identifier in the password storage instance is decremented, and the latest input PIN code data is searched for and deleted according to the storage location identifier.
  • Step 108 The Java layer saves the PIN code data currently input by the user to the password storage class.
  • the data memory of the example and update the storage location identifier in the instance of the password storage class;
  • the data memory of the password storage class instance is used for storing data of the PIN code input by the user and the encrypted data obtained by encrypting the PIN code data input by the user;
  • the storage location identifier is used in the password storage class instance to represent the data memory. a variable that stores the location of the PIN code data currently input by the user;
  • the cryptographic keyboard class instance associated with the Java layer is invoked to store the PIN code data currently input by the user into the data memory of the password storage class instance, and the storage in the password storage class instance is updated.
  • the memory structure used to store the PIN code data input by the user may be implemented in any manner.
  • a two-dimensional array mode is adopted;
  • Step 109 The Java layer invokes the C layer through the JNI, and transmits an encryption event to the C layer.
  • the method further includes: determining, by the Java layer, whether the length of the data to be encrypted reaches a preset length, if yes, executing step 109; otherwise, returning to step 107; correspondingly, step 108 further includes updating Encrypting the data length, both in step 106 and step 109, further includes initializing the length of the data to be encrypted.
  • Step 110 The C layer accesses the password storage class instance by using a handle of the password storage class instance to obtain a storage location identifier.
  • Step 111 The C layer searches for the PIN code data currently input by the user stored in the data memory of the password storage class instance according to the storage location identifier, and encrypts the currently selected PIN code data of the found user to obtain the current encrypted data, and saves the current encryption. Data to the password memory class instance data memory, delete the PIN code data currently entered by the found user, return to step 107;
  • the method for encrypting the PIN code data currently input by the user may be implemented in any manner.
  • the PIN code is used to fill the random number after the PIN code data currently input by the user, and the current key is used according to the RC4 algorithm.
  • the data memory of the password storage class instance is specifically a two-dimensional array pin[8][8], The 0th column of pin[8][8] is used to store the data input by the user. If the storage location identifier is p_current, the pin[p_current-1][0] stores the PIN code data currently input by the user, for the user.
  • the currently input PIN code data is encrypted to obtain the current encrypted data, and the current encrypted data is saved into the data memory of the password storage class instance, and deleting the PIN code data currently input by the user may include: in pin[p_current-1][1] to Pin[p_current-1][7] is filled with random numbers, and the data in pin[p_current-1][0] to pin[p_current-1][7] is encrypted according to the key pair using the RC4 encryption algorithm to obtain the current encryption. Data, the current encrypted data is stored in pin[p_current-1][0] to pin[p_current-1][7].
  • Step 112 The Java layer invokes the C layer through the JNI, and sends an acknowledgement event to the C layer.
  • Step 113 The C layer accesses the password storage class instance according to the handle of the password storage class instance, reads all the encrypted data stored in the data memory of the password storage class instance, decrypts the read encrypted data, and obtains the PIN code input by the user. ;
  • the data memory of the password storage class instance is specifically a two-dimensional array pin[8][8], and the 0th column of pin[8][8] is used to store the data input by the user.
  • the encrypted data obtained by encrypting the PIN code data currently input by the user covers the PIN code data currently input by the user, and is stored in the 0th column to the 7th column of the current line. If the storage location identifier is p_current, the C layer reads the pin[0].
  • the data in [0] to pin[p_current-1][7] obtains all the encrypted data, and the RC4 encryption algorithm is performed according to the data in the key pair pin[0][0] to pin[p_current-1][7]. Decrypt, get the PIN code entered by the user.
  • the C layer obtains the PIN code input by the user, and further includes performing a corresponding operation on the PIN code input by the user, and the specific operation depends on the specific scenario of the implemented application, which is not specifically limited in this embodiment, for example, the user may be
  • the entered PIN code is sent to the smart key device for verification and the like.
  • Step 114 The C layer clears the current key, accesses the password storage class instance through the handle of the password storage class instance, and clears all the encrypted data stored in the data memory of the password storage class instance;
  • the data memory of the password storage class instance is specifically a two-dimensional array pin[8][8], and the 0th column of pin[8][8] is used to store the data input by the user.
  • the encrypted data obtained by encrypting the PIN code data currently input by the user overwrites the PIN code data currently input by the user, and is stored in the 0th column to the 7th column of the current line.
  • the C layer clears pin[0][ 0] to the data in pin[p_current-1][7]; where, clear pin[0][0]
  • the data in pin[p_current-1][7] may be to update all the data in pin[0][0] to pin[p_current-1][7] to 0, or to fill the pin with random numbers [ 0][0] to pin[p_current-1][7], in the present embodiment, it is preferable to fill pin[0][0] to pin[p_current-1][7] with a random number.
  • Step 115 The C layer clears the current key and invokes the Java layer through the JNI.
  • Step 116 The Java layer releases the password storage class instance, and ends.
  • the step 115 to the step 116 are specifically: the C layer calls the JNI DeleteGlobalRef function with the handle of the password storage class instance as a parameter, so that the Java layer releases the password storage class instance.
  • Step 117 The Java layer calls the C layer through the JNI, and sends a cancellation event to the C layer.
  • Step 118 The C layer accesses the password storage class instance through the handle of the password storage class instance, and clears all the encrypted data stored in the data memory of the password storage class instance.
  • Step 119 the C layer calls the Java layer through the JNI;
  • Step 120 The Java layer releases the password storage class instance and ends.
  • the step 119 to the step 120 are specifically: the C layer calls the JNI DeleteGlobalRef function with the handle of the password storage class instance as a parameter, so that the Java layer releases the password storage class instance.
  • the third embodiment provides a PIN code protection method for the Android platform. As shown in FIG. 3, the method specifically includes:
  • Step 201 When receiving the upper application call, the Java layer generates an instance of the password keyboard class, and displays a user input interface.
  • the Java layer generates an instance of a cryptographic keyboard class by calling an initialization function in the password storage class;
  • the Java layer may display a user input interface by calling a display function in the password keyboard class instance.
  • the input interface usually includes an input box and a keyboard, and the input box and the keyboard may be customized, or may be provided by the system or the first.
  • the display function of the cryptographic keyboard class instance displays the input interface by calling these implemented display interfaces.
  • Step 202 The Java layer invokes the C layer through the JNI, and sends a startup event to the C layer.
  • Step 203 the C layer calls the Java layer through the JNI;
  • Step 204 The Java layer generates an instance of a password storage class.
  • step 203 to step 204 may be specifically: the C layer causes the Java layer to generate a password storage class instance according to the password storage class by calling the NewObject function of the JNI, and the password storage class instance includes logic for storing the user input data. JNI passes the logic of the event to the C layer.
  • Step 205 The Java layer returns a handle of the password storage class instance to the C layer through the JNI.
  • Step 206 The C layer generates a current key, and calls the Java layer through the JNI.
  • the C layer generates a random number of a preset length as the current key.
  • Step 207 the Java layer associated password keyboard class instance and password storage class instance
  • the Java layer associates the password keyboard class instance and the password storage class instance by assigning a handle to the password storage class instance in the cryptographic keyboard class instance.
  • Step 208 the Java layer listens to the user input, if the user enters the PIN code data, the step 209 is performed, if the user enters the confirmation information, the step 213 is performed, and if the user inputs the cancel information, the step 218 is performed;
  • the user input is specifically monitored by the cryptographic keyboard class instance of the Java layer;
  • the step 208 may further include: if the user inputs the deletion information, the storage location identifier in the password storage class instance is decremented, and the latest input PIN code data is searched for and deleted according to the storage location identifier.
  • Step 209 The Java layer saves the PIN code data currently input by the user into the data memory of the password storage class instance, and updates the storage location identifier in the password storage class instance.
  • the data memory of the password storage class instance is used for storing data of the PIN code input by the user and the encrypted data obtained by encrypting the PIN code data input by the user;
  • the storage location identifier is used in the password storage class instance to represent the data memory. a variable that stores the location of the PIN code data currently input by the user;
  • the cryptographic keyboard class instance associated with the Java layer is invoked to store the PIN code data currently input by the user into the data memory of the password storage class instance, and the storage in the password storage class instance is updated.
  • the memory structure used to store the PIN code data input by the user may be any implementation. This embodiment is not specifically limited.
  • Step 210 The Java layer invokes the C layer through the JNI, and transmits an encryption event to the C layer.
  • the method further includes: determining, by the Java layer, whether the length of the data to be encrypted reaches a preset length, if yes, executing step 210; otherwise, returning to step 208; correspondingly, step 209 further includes updating Encrypting the data length, both step 207 and step 210 further comprise initializing the length of the data to be encrypted.
  • Step 211 The C layer accesses the password storage class instance by using a handle of the password storage class instance to obtain a storage location identifier.
  • Step 212 The C layer searches for the PIN code data currently input by the user stored in the data memory of the password storage class instance according to the storage location identifier, and encrypts the currently selected PIN code data of the found user to obtain the current encrypted data, and saves the current encryption. Data to the password memory class instance data memory, delete the PIN code data currently entered by the found user, return to step 208;
  • the method of encrypting the PIN code data currently input by the user may be implemented in any manner.
  • Step 213 The Java layer invokes the C layer through the JNI, and sends an acknowledgement event to the C layer.
  • Step 214 The C layer accesses the password storage class instance according to the handle of the password storage class instance, reads all the encrypted data stored in the data memory of the password storage class instance, decrypts the read encrypted data, and obtains the PIN code input by the user. ;
  • the C layer obtains the PIN code input by the user, and further includes a corresponding operation on the PIN code input by the user, and the specific operation is not limited by the specific embodiment.
  • Step 215 The C layer clears the current key, accesses the password storage class instance through the handle of the password storage class instance, and clears all the encrypted data stored in the data memory of the password storage class instance;
  • Step 216 the C layer calls the Java layer through the JNI;
  • Step 217 the Java layer releases the password storage class instance, and ends;
  • the steps 216 to 217 are specifically: the C layer calls the JNI DeleteGlobalRef function with the handle of the password storage class instance as a parameter, so that the Java layer releases the password storage class instance.
  • Step 218 The Java layer calls the C layer through the JNI, and sends a cancellation event to the C layer.
  • Step 219 The C layer accesses the password storage class instance through the handle of the password storage class instance, and clears All encrypted data stored in the data memory except the password storage class instance;
  • Step 220 the C layer calls the Java layer through the JNI
  • Step 221 The Java layer releases the password storage class instance and ends.
  • step 220 to step 221 are specifically: the C layer calls the JNI DeleteGlobalRef function with the handle of the password storage class instance as a parameter, so that the Java layer releases the password storage class instance.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Medical Informatics (AREA)
  • Databases & Information Systems (AREA)
  • Telephone Function (AREA)
  • Storage Device Security (AREA)

Abstract

本发明实施例提供一种Android平台下的PIN码保护方法。该方法包括：Java层接收到上层调用后向C层传入启动事件，C层接收到启动事件后通过JNI调用Java层生成密码存储类实例，并在接收到Java层返回的句柄后再次调用Java层使Java层监听用户输入，Java层监听到用户输入PIN码数据时存储PIN码数据到实例内存，更新存储位置标识，向C层传入加密事件，监听到用户输入确认信息时向C层传入确认事件；C层接收到加密事件时通过句柄访问实例对PIN码数据加密，接收到确认事件时通过句柄访问实例对实例内存中的加密数据进行解密得到PIN码。本发明实施例提高了Android平台下的PIN码的安全性。

Description

Android平台下的PIN码保护方法 技术领域
本发明实施例涉及信息安全领域，尤其涉及一种Android平台下的PIN码保护方法。
背景技术
Android是基于Linux开放性内核的操作系统，是Google公司在2007年11月5日公布的手机操作系统。现在，Android系统不但应用于智能手机，也在平板电脑市场急速扩张，在智能MP4方面也有较大发展。
Android采用了软件堆层的架构，其底层Linux内核只提供基本功能，中间层包括函数库和虚拟机，最上层是各种应用软件，大部分应用软件在使用时需要输入个人识别密码(Personal Identification Number，简称PIN码)，为了提高PIN码的安全性，一般的方法是对PIN码进行加密，由于Android平台下的用户界面(User Interface，简称UI)是采用容易被反编译分析的Java语言编写的。
因此为了进一步提高PIN码的安全性，现有技术中将对PIN码进行加密的逻辑放在了应用程序中不易被破解和反编译分析难度较大的C层，当用户输入PIN码时，Java层将PIN码传入到C层进行加密，但上述方法至少存在PIN码在从Java层传入到C层的过程中容易被截获的缺陷。
发明内容
本发明实施例提供一种Android平台下的PIN码保护方法，以克服PIN码从Java层传入到C层的过程中容易被截获的缺陷。
本发明实施例的一个方面是提供一种Android平台下的PIN码保护方法，该方法包括：
步骤S1、Java层通过JNI调用C层，向C层传入启动事件；
步骤S2、所述C层接收到启动事件后通过JNI调用所述Java层；
步骤S3、所述Java层生成密码存储类实例，并通过JNI向所述C层 返回密码存储类实例的句柄；
步骤S4、所述C层接收到密码存储类实例的句柄后通过JNI调用所述Java层；
步骤S5、所述Java层监听用户输入，若监听到用户输入PIN码数据则将用户当前输入的PIN码数据存储到所述密码存储类实例的数据内存中，并更新所述密码存储类实例中的存储位置标识，通过JNI调用C层，向所述C层传入加密事件，执行步骤S6；若监听到用户输入确认信息则通过JNI调用C层，向所述C层传入确认事件，执行步骤S7；
步骤S6、所述C层通过所述密码存储类实例的句柄访问所述密码存储类实例，根据所述密码存储类实例中的存储位置标识查找用户当前输入的PIN码数据，对查找到的用户当前输入的PIN码数据进行加密得到当前加密数据，保存所述当前加密数据到所述密码存储类实例的数据内存中，并删除所述查找到的用户当前输入的PIN码数据，返回步骤S5；
步骤S7、所述C层根据所述密码存储类实例的句柄访问所述密码存储类实例，对所述密码存储类实例的数据内存中存储的全部加密数据进行解密得到用户输入的PIN码。
上述方法中，步骤S5之前，还包括：所述Java层生成密码键盘类实例，关联所述密码键盘类实例和所述密码存储类实例，调用所述密码键盘类实例中的显示函数显示用户输入界面；
或者，步骤S5之前，还包括：所述Java层生成密码键盘类实例，关联所述密码键盘类实例和所述密码存储类实例，调用所述密码键盘类实例中的显示函数显示用户输入界面；所述Java层监听用户输入，包括：所述Java层的所述密码键盘类实例监听用户输入；所述Java层将用户当前输入的PIN码数据存储到所述密码存储类实例的数据内存中，并更新所述密码存储类实例中的存储位置标识，包括：所述Java层的所述密码键盘类实例调用所述密码存储类实例，将用户当前输入的PIN码数据保存到所述密码存储类实例的数据内存中，并更新所述密码存储类实例中的存储位置标识。
或者，所述步骤S1中还包括：所述Java层生成密码键盘类实例，调用所述密码键盘类实例中的显示函数显示用户输入界面；所述步骤S5之 前，还包括：所述Java层关联所述密码键盘类实例和所述密码存储类实例；所述Java层监听用户输入，包括：所述Java层的所述密码键盘类实例监听用户输入；所述Java层将用户当前输入的PIN码数据存储到所述密码存储类实例的数据内存中，并更新所述密码存储类实例中的存储位置标识，包括：所述Java层的所述密码键盘类实例调用所述密码存储类实例，将用户当前输入的PIN码数据保存到所述密码存储类实例的数据内存中，并更新所述密码存储类实例中的存储位置标识。
上述方法中，所述步骤S5中还包括：若Java层监听到用户输入的取消信息则通过JNI调用C层，向所述C层传入取消事件；所述C层接收到取消事件后根据所述密码存储类实例的句柄访问所述密码存储类实例，清除所述密码存储类实例的数据内存中的全部加密数据。
进一步地，所述步骤S7之后，还包括：所述C层通过JNI调用所述Java层，所述Java层释放所述密码存储类实例；所述C层根据所述密码存储类实例的句柄访问所述密码存储类实例，清除所述密码存储类实例的数据内存中的全部加密数据之后，还包括：通过JNI调用所述Java层，所述Java层释放所述密码存储类实例。
上述方法中，所述步骤S5中还包括：若所述Java层监听到用户输入的删除消息，则将所述密码存储实例中的存储位置标识递减后，根据所述存储位置标识查找并删除用户最新输入的PIN码数据，返回步骤S5。
上述方法中，所述对查找到的用户当前输入的PIN码数据进行加密，包括：对查找到的用户当前输入的PIN码数据填充随机数后，使用预先存储的密钥根据预设算法进行加密；所述对所述密码存储类实例的数据内存中存储的全部加密数据进行解密，包括：对所述密码存储类实例的数据内存中存储的全部加密数据使用所述预先存储的密钥根据所述预设算法进行解密。
上述方法中，所述C层接收到启动事件后，还包括：生成当前密钥；
所述对查找到的用户当前输入的PIN码数据进行加密，包括：对查找到的用户当前输入的PIN码数据填充随机数后，使用所述当前密钥根据预设算法进行加密；
所述对所述密码存储类实例的数据内存中存储的全部加密数据进行 解密，包括：对所述密码存储类实例的数据内存中存储的全部加密数据使用所述当前密钥根据所述预设算法进行解密；
所述对所述密码存储类实例的数据内存中存储的全部加密数据进行解密得到用户输入的PIN码之后，还包括：清除所述当前密钥。
上述方法中，所述对所述密码存储类实例的数据内存中存储的全部加密数据进行解密得到用户输入的PIN码之后，还包括：将所述用户输入的PIN码发送给智能密钥设备进行验证。
上述方法中，所述保存所述当前加密数据到所述密码存储类实例的数据内存中，并删除所述查找到的用户当前输入的PIN码数据，包括：用所述当前加密数据覆盖所述查找到的用户当前输入的PIN码数据。
上述方法中，所述Java层通过JNI调用C层，向所述C层传入加密事件之前，还包括：所述Java层判断待加密数据长度是否达到预设长度，是则执行所述调用C层，向所述C层传入加密事件，否则返回所述步骤S5；
所述Java层保存用户当前输入的PIN码数据到所述密码存储类实例的数据内存中之后，还包括：更新所述待加密数据长度；
所述Java层通过JNI调用C层，向所述C层传入确认事件之后，还包括：所述Java层初始化所述待加密数据长度。
上述方法中，所述对所述密码存储类实例的数据内存中存储的全部加密数据进行解密得到用户输入的PIN码之后，还包括：清除所述全部加密数据；
进一步地，所述清除所述全部加密数据，包括：将所述密码存储类实例的数据内存中存储的全部加密数据更新为预设数据或随机数。
本发明实施例提供的Android平台下的PIN码保护方法，利用JNI机制，在Java层和C层之间只进行事件的交互，而不进行PIN码的传输，避免了PIN码在从Java层传入到C层的过程中被截获的风险，提高了Android平台下的PIN码的安全性。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作一简单地介绍，显而易见 地，下面描述中的附图是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1为本发明实施例一提供的Android平台下的PIN码保护方法的流程图；
图2为本发明实施例二提供的Android平台下的PIN码保护方法的流程图；
图3为本发明实施例三提供的Android平台下的PIN码保护方法的流程图。
具体实施方式
为使本发明实施例的目的、技术方案和优点更加清楚，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
本发明中所述的Java层包含Java虚拟机和用Java代码所生成的程序；C层包含C/C++代码所生成的程序。在一般Android平台下，用Java代码所生成的程序包含在dex文件中，C/C++代码所生成的程序包含在so文件中。
实施例一
本发明实施例一提供一种Android平台下的PIN码保护方法，如图1所示，所述方法具体包括：
步骤S1、Java层通过JNI调用C层，向C层传入启动事件；
步骤S2、所述C层接收到启动事件后通过JNI调用所述Java层；
步骤S3、所述Java层生成密码存储类实例，并通过JNI向所述C层返回密码存储类实例的句柄；
步骤S4、所述C层接收到密码存储类实例的句柄后通过JNI调用所述Java层；
步骤S5、所述Java层监听用户输入，若监听到用户输入PIN码数据 则将用户当前输入的PIN码数据存储到所述密码存储类实例的数据内存中，并更新所述密码存储类实例中的存储位置标识，通过JNI调用C层，向所述C层传入加密事件，执行步骤S6；若监听到用户输入确认信息则通过JNI调用C层，向所述C层传入确认事件，执行步骤S7；
步骤S6、所述C层通过所述密码存储类实例的句柄访问所述密码存储类实例，根据所述密码存储类实例中的存储位置标识查找用户当前输入的PIN码数据，对查找到的用户当前输入的PIN码数据进行加密得到当前加密数据，保存所述当前加密数据到所述密码存储类实例的数据内存中，并删除所述查找到的用户当前输入的PIN码数据，返回步骤S5；
步骤S7、所述C层根据所述密码存储类实例的句柄访问所述密码存储类实例，对所述密码存储类实例的数据内存中存储的全部加密数据进行解密得到用户输入的PIN码。
本实施例中，对查找到的用户当前输入的PIN码数据进行加密，可以具体包括：对查找到的用户当前输入的PIN码数据填充随机数后，使用预先存储的密钥根据预设算法进行加密；相应地，对所述密码存储类实例的数据内存中存储的全部加密数据进行解密，具体包括：对所述密码存储类实例的数据内存中存储的全部加密数据使用所述预先存储的密钥根据所述预设算法进行解密；
或者，本实施例中，对查找到的用户当前输入的PIN码数据进行加密，可以具体包括：对查找到的用户当前输入的PIN码数据填充随机数后，使用所述当前密钥根据预设算法进行加密；相应地，C层接收到启动事件后还包括：生成当前密钥；对所述密码存储类实例的数据内存中存储的全部加密数据进行解密，具体包括：对所述密码存储类实例的数据内存中存储的全部加密数据使用所述当前密钥根据所述预设算法进行解密；对所述密码存储类实例的数据内存中存储的全部加密数据进行解密得到用户输入的PIN码之后，还包括清除所述当前密钥。
进一步地，步骤S5之前还可以包括：所述Java层通过调用所述密码存储类实例中的显示函数显示用户输入界面；相应地，所述Java层监听用户输入具体为：所述Java层的所述密码存储类实例监听用户输入；
或者，步骤S5之前还包括：所述Java层生成密码键盘类实例，关联 所述密码键盘类实例和所述密码存储类实例，调用所述密码键盘类实例中的显示函数显示用户输入界面；相应地，所述Java层监听用户输入具体为：所述Java层的所述密码键盘类实例监听用户输入；所述Java层保存用户当前输入的PIN码数据到所述密码存储类实例的数据内存中，并更新所述密码存储类实例中的存储位置标识，可以具体为：所述Java层的所述密码键盘类实例调用所述密码存储类实例，将用户当前输入的PIN码数据保存到所述密码存储类实例的数据内存中，并更新所述密码存储类实例中的存储位置标识；
或者，所述步骤S1中还包括：所述Java层生成密码键盘类实例，调用所述密码键盘类实例中的显示函数显示用户输入界面；相应地，所述步骤S5之前还包括，所述Java层关联所述密码键盘类实例和所述密码存储类实例；所述Java层监听用户输入可以具体为：所述Java层的所述密码键盘类实例监听用户输入；所述Java层保存用户当前输入的PIN码数据到所述密码存储类实例的数据内存中，并更新所述密码存储类实例中的存储位置标识，可以具体为：所述Java层的所述密码键盘类实例调用所述密码存储类实例，将用户当前输入的PIN码数据保存到所述密码存储类实例的数据内存中，并更新所述密码存储类实例中的存储位置标识。
实施例二
本发明实施例二提供一种Android平台下的PIN码保护方法，如图2所示，所述方法具体包括：
步骤101、当接收到上层应用调用时，Java层通过JNI调用C层，向C层传入启动事件；
JNI(Java Native Interface，Java本地编程接口)，它使得在Java虚拟机内部运行的Java代码能够与用其它编程语言(如C、C++和汇编语言)编写的应用程序和库进行相互操作。
具体地，Java层向C层传入事件可以为Java层向C层传入相应的事件数据，事件数据的类型可以有多种实现方式，其数据的值也是可以任意定义的，只要Java层和C层可按此约定进行工作即可；
例如，本实施例涉及的各事件为Java层和C层预先定义好的一系列 jint类型数据，其中，启动事件定义为jint类型的整数1，加密事件定义为jint类型的整数2，确认事件定义为jint类型的整数3，取消事件定义为jint类型的整数4。
步骤102、C层生成当前密钥，通过JNI调用Java层；
本实施例中，C层生成预设长度的随机数作为当前密钥。
步骤103、Java层生成密码存储类实例；
本实施例中，步骤102至步骤103可以具体为：C层通过调用JNI的NewObject函数使Java层根据密码存储类生成一个密码存储类实例，密码存储类实例中包括存储用户输入数据的逻辑和通过JNI向C层传入事件的逻辑。
步骤104、Java层通过JNI向C层返回密码存储类实例的句柄；
步骤105、C层通过JNI调用Java层；
步骤106、Java层生成密码键盘类实例，关联密码键盘类实例和密码存储类实例，显示用户输入界面；
本实施例中，具体地，Java层通过调用密码存储类中的的初始化函数生成一个密码键盘类的实例；通过对密码键盘类实例中的密码存储类实例的句柄进行赋值来关联密码键盘类实例和密码存储类实例；
本实施例中，Java层可以通过调用密码键盘类实例中的显示函数显示用户输入界面，输入界面通常包含输入框和键盘，输入框和键盘可以是自定义的，也可以是系统自带或第三方实现的，当输入框和键盘为系统自带或第三方实现的时，密码键盘类实例的显示函数通过调用这些实现的显示接口来显示输入界面。
步骤107、Java层监听用户输入，若监听到用户输入PIN码数据则执行步骤108，若监听到用户输入确认信息则执行步骤112，若监听到用户输入取消信息则执行步骤117；
本实施例中，具体由Java层的密码键盘实例监听用户输入；
进一步地，步骤107中还可以包括：若监听到用户输入删除信息，则将密码存储实例中的存储位置标识递减后，根据存储位置标识查找并删除用户最新输入的PIN码数据。
步骤108、Java层将用户当前输入的PIN码数据保存到密码存储类实 例的数据内存中，并更新密码存储类实例中的存储位置标识；
其中，密码存储类实例的数据内存用于存储用户输入的PIN码数据以及对用户输入的PIN码数据进行加密得到的加密数据等数据；存储位置标识为密码存储类实例中用于表示数据内存中存储用户当前输入的PIN码数据的位置的变量；
本实施例中，具体由Java层的密码键盘类实例调用与其关联的密码存储类实例将用户当前输入的PIN码数据保存到密码存储类实例的数据内存中，以及更新密码存储类实例中的存储位置标识；
具体地，用来存储用户输入的PIN码数据的内存结构可以是任意方式实现，本实施例中，优选地，采用二维数组方式；
例如，密码存储类实例的数据内存具体为二维数组pin[8][8]，其中，pin[8][8]的第0列用于存储用户输入的数据，若存储位置标识为p_current，用户当前输入的PIN码数据为0x31(即用户触发数字键1)，则Java层将用户当前输入的PIN码数据0x31存储到二维数组的pin[p_current][0]处，并更新存储位置标识p_current＝p_current+1。
步骤109、Java层通过JNI调用C层，向C层传入加密事件；
进一步地，本实施例中，执行步骤109之前还可以包括：Java层判断待加密数据长度是否达到预设长度，是则执行步骤109，否则返回步骤107；相应地，步骤108中还包括更新待加密数据长度，步骤106和步骤109中均还包括初始化待加密数据长度。
步骤110、C层通过密码存储类实例的句柄访问密码存储类实例，获取存储位置标识；
步骤111、C层根据存储位置标识查找存储在密码存储类实例的数据内存中的用户当前输入的PIN码数据，对查找到的用户当前输入的PIN码数据进行加密得到当前加密数据，保存当前加密数据到密码存储类实例的数据内存中，删除查找到的用户当前输入的PIN码数据，返回步骤107；
具体地，对用户当前输入的PIN码数据进行加密的方法可以是任意方式实现，本实施例中，优选地，采用对用户当前输入的PIN码数据填充随机数后整体使用当前密钥根据RC4算法进行加密的方式；
例如，密码存储类实例的数据内存具体为二维数组pin[8][8]， pin[8][8]的第0列用于存储用户输入的数据，若存储位置标识为p_current，则pin[p_current-1][0]处存储的为用户当前输入的PIN码数据，对用户当前输入的PIN码数据进行加密，得到当前加密数据，保存当前加密数据到密码存储类实例的数据内存中，删除用户当前输入的PIN码数据可以包括：在pin[p_current-1][1]至pin[p_current-1][7]中填充随机数，根据密钥对pin[p_current-1][0]至pin[p_current-1][7]中的数据采用RC4加密算法进行加密，得到当前加密数据，将当前加密数据存储于pin[p_current-1][0]至pin[p_current-1][7]中。
步骤112、Java层通过JNI调用C层，向C层传入确认事件；
步骤113、C层根据密码存储类实例的句柄访问密码存储类实例，读取密码存储类实例的数据内存中存储的全部加密数据，对读取到的加密数据进行解密，得到用户输入的PIN码；
在前文所述的示例中，即密码存储类实例的数据内存具体为二维数组pin[8][8]，pin[8][8]的第0列用于存储用户输入的数据，用对用户当前输入的PIN码数据进行加密得到的加密数据覆盖用户当前输入的PIN码数据存储于当前行的第0列至第7列，若存储位置标识为p_current，则C层读取pin[0][0]至pin[p_current-1][7]中的数据得到全部加密数据，根据密钥对pin[0][0]至pin[p_current-1][7]中的数据采用RC4加密算法进行解密，得到用户输入的PIN码。
进一步地，C层得到用户输入的PIN码之后还包括对用户输入的PIN码进行相应操作，具体如何操作，取决于所实现应用的具体场景，本实施例不做具体限定，例如可以是将用户所输入的PIN码发给智能密钥设备进行验证等。
步骤114、C层清除当前密钥，通过密码存储类实例的句柄访问密码存储类实例，清除密码存储类实例的数据内存中存储的全部加密数据；
在前文所述的示例中，即密码存储类实例的数据内存具体为二维数组pin[8][8]，pin[8][8]的第0列用于存储用户输入的数据，用对用户当前输入的PIN码数据进行加密得到的加密数据覆盖用户当前输入的PIN码数据存储于当前行的第0列至第7列，若存储位置标识为p_current，则C层清除pin[0][0]至pin[p_current-1][7]中的数据；其中，清除pin[0][0] 至pin[p_current-1][7]中的数据可以是将pin[0][0]至pin[p_current-1][7]中的数据全部更新为0，还可以是用随机数填充pin[0][0]至pin[p_current-1][7]，本实施例中，优选地，用随机数填充pin[0][0]至pin[p_current-1][7]。
步骤115、C层清除当前密钥，通过JNI调用Java层；
步骤116、Java层释放密码存储类实例，结束；
本实施例中，步骤115至步骤116具体为：C层以密码存储类实例的句柄为参数调用JNI的DeleteGlobalRef函数，使Java层释放密码存储类实例。
步骤117、Java层通过JNI调用C层，向C层传入取消事件；
步骤118、C层通过密码存储类实例的句柄访问密码存储类实例，清除密码存储类实例的数据内存中存储的全部加密数据；
步骤119、C层通过JNI调用Java层；
步骤120、Java层释放密码存储类实例，结束。
本实施例中，步骤119至步骤120具体为：C层以密码存储类实例的句柄为参数调用JNI的DeleteGlobalRef函数，使Java层释放密码存储类实例。
实施例三
本实施例三提供一种Android平台下的PIN码保护方法，如图3所示，所述方法具体包括：
步骤201、当接收到上层应用调用时，Java层生成密码键盘类实例，显示用户输入界面；
本实施例中，具体地，Java层通过调用密码存储类中的的初始化函数生成一个密码键盘类的实例；
本实施例中，Java层可以通过调用密码键盘类实例中的显示函数显示用户输入界面，输入界面通常包含输入框和键盘，输入框和键盘可以是自定义的，也可以是系统自带或第三方实现的，当输入框和键盘为系统自带或第三方实现的时，密码键盘类实例的显示函数通过调用这些实现的显示接口来显示输入界面。
步骤202、Java层通过JNI调用C层，向C层传入启动事件；
步骤203、C层通过JNI调用Java层；
步骤204、Java层生成密码存储类实例；
本实施例中，步骤203至步骤204可以具体为：C层通过调用JNI的NewObject函数使Java层根据密码存储类生成一个密码存储类实例，密码存储类实例中包括存储用户输入数据的逻辑和通过JNI向C层传入事件的逻辑。
步骤205、Java层通过JNI向C层返回密码存储类实例的句柄；
步骤206、C层生成当前密钥，通过JNI调用Java层；
本实施例中，C层生成预设长度的随机数作为当前密钥。
步骤207、Java层关联密码键盘类实例和密码存储类实例；
本实施例中，具体地，Java层通过对密码键盘类实例中的密码存储类实例的句柄进行赋值来关联密码键盘类实例和密码存储类实例。
步骤208、Java层监听用户输入，若监听到用户输入PIN码数据则执行步骤209，若监听到用户输入确认信息则执行步骤213，若监听到用户输入取消信息则执行步骤218；
本实施例中，具体由Java层的密码键盘类实例监听用户输入；
进一步地，步骤208中还可以包括：若监听到用户输入删除信息，则将密码存储类实例中的存储位置标识递减后，根据存储位置标识查找并删除用户最新输入的PIN码数据。
步骤209、Java层将用户当前输入的PIN码数据保存到密码存储类实例的数据内存中，并更新密码存储类实例中的存储位置标识；
其中，密码存储类实例的数据内存用于存储用户输入的PIN码数据以及对用户输入的PIN码数据进行加密得到的加密数据等数据；存储位置标识为密码存储类实例中用于表示数据内存中存储用户当前输入的PIN码数据的位置的变量；
本实施例中，具体由Java层的密码键盘类实例调用与其关联的密码存储类实例将用户当前输入的PIN码数据保存到密码存储类实例的数据内存中，以及更新密码存储类实例中的存储位置标识；
具体地，用来存储用户输入的PIN码数据的内存结构可以是任意实现， 本实施例不做具体限定。
步骤210、Java层通过JNI调用C层，向C层传入加密事件；
进一步地，本实施例中，执行步骤210之前还可以包括：Java层判断待加密数据长度是否达到预设长度，是则执行步骤210，否则返回步骤208；相应地，步骤209中还包括更新待加密数据长度，步骤207和步骤210中均还包括初始化待加密数据长度。
步骤211、C层通过密码存储类实例的句柄访问密码存储类实例，获取存储位置标识；
步骤212、C层根据存储位置标识查找存储在密码存储类实例的数据内存中的用户当前输入的PIN码数据，对查找到的用户当前输入的PIN码数据进行加密得到当前加密数据，保存当前加密数据到密码存储类实例的数据内存中，删除查找到的用户当前输入的PIN码数据，返回步骤208；
具体地，对用户当前输入的PIN码数据进行加密的方法可以是任意方式实现。
步骤213、Java层通过JNI调用C层，向C层传入确认事件；
步骤214、C层根据密码存储类实例的句柄访问密码存储类实例，读取密码存储类实例的数据内存中存储的全部加密数据，对读取到的加密数据进行解密，得到用户输入的PIN码；
进一步地，C层得到用户输入的PIN码之后还包括对用户输入的PIN码进行相应操作，具体如何操作，取决于所实现应用的具体场景，本实施例不做具体限定。
步骤215、C层清除当前密钥，通过密码存储类实例的句柄访问密码存储类实例，清除密码存储类实例的数据内存中存储的全部加密数据；
步骤216、C层通过JNI调用Java层；
步骤217、Java层释放密码存储类实例，结束；
本实施例中，步骤216至步骤217具体为：C层以密码存储类实例的句柄为参数调用JNI的DeleteGlobalRef函数，使Java层释放密码存储类实例。
步骤218、Java层通过JNI调用C层，向C层传入取消事件；
步骤219、C层通过密码存储类实例的句柄访问密码存储类实例，清 除密码存储类实例的数据内存中存储的全部加密数据；
步骤220、C层通过JNI调用Java层；
步骤221、Java层释放密码存储类实例，结束。
本实施例中，步骤220至步骤221具体为：C层以密码存储类实例的句柄为参数调用JNI的DeleteGlobalRef函数，使Java层释放密码存储类实例。
以上所述的实施例只是本发明较优选的具体实施方式，本领域的技术人员在本发明技术方案范围内进行的通常变化和替换都应包含在本发明的保护范围内。

Claims (16)

  1. 一种Android平台下的PIN码保护方法，其特征在于，包括：
    步骤S1、Java层通过JNI调用C层，向C层传入启动事件；
    步骤S2、所述C层接收到启动事件后通过JNI调用所述Java层；
    步骤S3、所述Java层生成密码存储类实例，并通过JNI向所述C层返回密码存储类实例的句柄；
    步骤S4、所述C层接收到密码存储类实例的句柄后通过JNI调用所述Java层；
    步骤S5、所述Java层监听用户输入，若监听到用户输入PIN码数据则将用户当前输入的PIN码数据存储到所述密码存储类实例的数据内存中，并更新所述密码存储类实例中的存储位置标识，通过JNI调用C层，向所述C层传入加密事件，执行步骤S6；若监听到用户输入确认信息则通过JNI调用C层，向所述C层传入确认事件，执行步骤S7；
    步骤S6、所述C层通过所述密码存储类实例的句柄访问所述密码存储类实例，根据所述密码存储类实例中的存储位置标识查找用户当前输入的PIN码数据，对查找到的用户当前输入的PIN码数据进行加密得到当前加密数据，保存所述当前加密数据到所述密码存储类实例的数据内存中，并删除所述查找到的用户当前输入的PIN码数据，返回步骤S5；
    步骤S7、所述C层根据所述密码存储类实例的句柄访问所述密码存储类实例，对所述密码存储类实例的数据内存中存储的全部加密数据进行解密得到用户输入的PIN码。
  2. 根据权利要求1所述的方法，其特征在于，所述步骤S5之前，还包括：
    所述Java层通过调用所述密码存储类实例中的显示函数显示用户输入界面；
    所述Java层监听用户输入，包括：
    所述Java层的所述密码存储类实例监听用户输入。
  3. 根据权利要求1所述的方法，其特征在于，所述步骤S5之前，还包括：
    所述Java层生成密码键盘类实例，关联所述密码键盘类实例和所述 密码存储类实例，调用所述密码键盘类实例中的显示函数显示用户输入界面。
  4. 根据权利要求1所述的方法，其特征在于，所述步骤S1中还包括：
    所述Java层生成密码键盘类实例，调用所述密码键盘类实例中的显示函数显示用户输入界面；
    所述步骤S5之前，还包括：
    所述Java层关联所述密码键盘类实例和所述密码存储类实例。
  5. 根据权利要求3所述的方法，其特征在于，所述Java层监听用户输入，包括：
    所述Java层的所述密码键盘类实例监听用户输入；
    所述Java层将用户当前输入的PIN码数据存储到所述密码存储类实例的数据内存中，并更新所述密码存储类实例中的存储位置标识，包括：
    所述Java层的所述密码键盘类实例调用所述密码存储类实例，将用户当前输入的PIN码数据保存到所述密码存储类实例的数据内存中，并更新所述密码存储类实例中的存储位置标识。
  6. 根据权利要求1所述的方法，其特征在于，所述步骤S5中还包括：
    若Java层监听到用户输入的取消信息则通过JNI调用C层，向所述C层传入取消事件；所述C层接收到取消事件后根据所述密码存储类实例的句柄访问所述密码存储类实例，清除所述密码存储类实例的数据内存中的全部加密数据。
  7. 根据权利要求6所述的方法，其特征在于，所述步骤S7之后，还包括：
    所述C层通过JNI调用所述Java层，所述Java层释放所述密码存储类实例；
    所述C层根据所述密码存储类实例的句柄访问所述密码存储类实例，清除所述密码存储类实例的数据内存中的全部加密数据之后，还包括：
    通过JNI调用所述Java层，所述Java层释放所述密码存储类实例。
  8. 根据权利要求1所述的方法，其特征在于，所述步骤S5中还包括：
    若所述Java层监听到用户输入的删除消息，则将所述密码存储实例中的存储位置标识递减后，根据所述存储位置标识查找并删除用户最新输 入的PIN码数据，返回步骤S5。
  9. 根据权利要求1所述的方法，其特征在于，所述对查找到的用户当前输入的PIN码数据进行加密，包括：
    对查找到的用户当前输入的PIN码数据填充随机数后，使用预先存储的密钥根据预设算法进行加密；
    所述对所述密码存储类实例的数据内存中存储的全部加密数据进行解密，包括：
    对所述密码存储类实例的数据内存中存储的全部加密数据使用所述预先存储的密钥根据所述预设算法进行解密。
  10. 根据权利要求1所述的方法，其特征在于，所述C层接收到启动事件后，还包括：
    生成当前密钥；
    所述对查找到的用户当前输入的PIN码数据进行加密，包括：
    对查找到的用户当前输入的PIN码数据填充随机数后，使用所述当前密钥根据预设算法进行加密；
    所述对所述密码存储类实例的数据内存中存储的全部加密数据进行解密，包括：
    对所述密码存储类实例的数据内存中存储的全部加密数据使用所述当前密钥根据所述预设算法进行解密；
    所述对所述密码存储类实例的数据内存中存储的全部加密数据进行解密得到用户输入的PIN码之后，还包括：
    清除所述当前密钥。
  11. 根据权利要求1所述的方法，其特征在于，所述对所述密码存储类实例的数据内存中存储的全部加密数据进行解密得到用户输入的PIN码之后，还包括：
    将所述用户输入的PIN码发送给智能密钥设备进行验证。
  12. 根据权利要求1所述的方法，其特征在于，所述保存所述当前加密数据到所述密码存储类实例的数据内存中，并删除所述查找到的用户当前输入的PIN码数据，包括：
    用所述当前加密数据覆盖所述查找到的用户当前输入的PIN码数据。
  13. 根据权利要求1所述的方法，其特征在于，所述Java层通过JNI调用C层，向所述C层传入加密事件之前，还包括：
    所述Java层判断待加密数据长度是否达到预设长度，是则执行所述调用C层，向所述C层传入加密事件，否则返回所述步骤S5；
    所述Java层保存用户当前输入的PIN码数据到所述密码存储类实例的数据内存中之后，还包括：
    更新所述待加密数据长度；
    所述Java层通过JNI调用C层，向所述C层传入确认事件之后，还包括：
    所述Java层初始化所述待加密数据长度。
  14. 根据权利要求1所述的方法，其特征在于，所述对所述密码存储类实例的数据内存中存储的全部加密数据进行解密得到用户输入的PIN码之后，还包括：
    清除所述全部加密数据。
  15. 根据权利要求14所述的方法，其特征在于，所述清除所述全部加密数据，包括：
    将所述密码存储类实例的数据内存中存储的全部加密数据更新为预设数据。
  16. 根据权利要求14所述的方法，其特征在于，所述清除所述全部加密数据，包括：
    将所述密码存储类实例的数据内存中存储的全部加密数据更新为随机数。
PCT/CN2016/077585 2015-04-22 2016-03-28 Android平台下的PIN码保护方法 WO2016169395A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US15/710,590 US10628607B2 (en) 2015-04-22 2017-09-20 Method for protecting pin code on android platform

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510192517.XA CN104915602B (zh) 2015-04-22 2015-04-22 一种Android平台下的PIN码保护方法
CN201510192517.X 2015-04-22

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/710,590 Continuation US10628607B2 (en) 2015-04-22 2017-09-20 Method for protecting pin code on android platform

Publications (1)

Publication Number Publication Date
WO2016169395A1 true WO2016169395A1 (zh) 2016-10-27

Family

ID=54084662

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/077585 WO2016169395A1 (zh) 2015-04-22 2016-03-28 Android平台下的PIN码保护方法

Country Status (3)

Country Link
US (1) US10628607B2 (zh)
CN (1) CN104915602B (zh)
WO (1) WO2016169395A1 (zh)

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104915602B (zh) 2015-04-22 2017-08-11 飞天诚信科技股份有限公司 一种Android平台下的PIN码保护方法
CN108718317A (zh) * 2018-06-12 2018-10-30 飞天诚信科技股份有限公司 一种个人识别码保护的方法及装置
CN109063519A (zh) * 2018-07-24 2018-12-21 深圳享米科技有限公司 Android密码安全输入键盘
US11204986B1 (en) * 2018-11-28 2021-12-21 American Megatrends International, Llc Control of a prompt for a credential to unlock a storage device
CN109948333A (zh) * 2019-03-08 2019-06-28 北京顺丰同城科技有限公司 一种账户攻击的安全防御方法及装置
CN111222128A (zh) * 2019-12-31 2020-06-02 北京握奇数据股份有限公司 一种安全输入和校验USBKey PIN码的方法及模块
CN116483760B (zh) * 2023-06-16 2024-03-22 荣耀终端有限公司 交互方法、装置、芯片、键盘、电子设备及介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6945454B2 (en) * 2003-04-22 2005-09-20 Stmicroelectronics, Inc. Smart card device used as mass storage device
CN101383833A (zh) * 2008-10-24 2009-03-11 北京飞天诚信科技有限公司 提高智能密钥装置pin码输入安全性的装置和方法
CN104092683A (zh) * 2014-07-04 2014-10-08 飞天诚信科技股份有限公司 一种pin码保护方法及系统
CN104915602A (zh) * 2015-04-22 2015-09-16 飞天诚信科技股份有限公司 一种Android平台下的PIN码保护方法

Family Cites Families (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB0024918D0 (en) * 2000-10-11 2000-11-22 Sealedmedia Ltd Method of providing java tamperproofing
US20050223392A1 (en) * 2000-12-01 2005-10-06 Cox Burke D Method and system for integration of software applications
US7516333B2 (en) * 2003-08-01 2009-04-07 Mamoon Yunis Hybrid Java-C network appliance
WO2005109360A1 (en) * 2004-05-10 2005-11-17 Hani Girgis Secure pin entry using personal computer
GB2410113A (en) * 2004-11-29 2005-07-20 Morse Group Ltd A system and method of accessing banking services via a mobile telephone
US8817984B2 (en) * 2011-02-03 2014-08-26 mSignia, Inc. Cryptographic security functions based on anticipated changes in dynamic minutiae
US8639938B2 (en) * 2011-05-03 2014-01-28 International Business Machines Corporation Personal identification number security enhancement
US9073164B2 (en) * 2011-10-07 2015-07-07 Bombardier Transportation Gmbh Precision rail profiling device for railway crossovers
EP2790993B1 (en) * 2011-12-13 2020-02-19 Dellner Couplers AB Assembly of parts suitable to be used as part of a connecting device for connecting a first car of a multi-car vehicle with a second car of said vehicle
KR20130143263A (ko) * 2012-06-21 2013-12-31 에스케이플래닛 주식회사 트러스티드 플랫폼 기반의 개방형 아이디 인증 방법, 이를 위한 장치 및 시스템
CN104243144B (zh) * 2013-06-08 2018-03-13 科大国盾量子技术股份有限公司 一种基于Android智能移动终端的通信密钥分配方法
US9842214B2 (en) * 2013-09-10 2017-12-12 Insyde Software Corp. System and method to secure on-board bus transactions
US9235714B1 (en) * 2013-11-12 2016-01-12 Amazon Technologies, Inc. Preventing persistent storage of cryptographic information using signaling
US9832207B2 (en) * 2014-12-23 2017-11-28 Mcafee, Inc. Input verification

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6945454B2 (en) * 2003-04-22 2005-09-20 Stmicroelectronics, Inc. Smart card device used as mass storage device
CN101383833A (zh) * 2008-10-24 2009-03-11 北京飞天诚信科技有限公司 提高智能密钥装置pin码输入安全性的装置和方法
CN104092683A (zh) * 2014-07-04 2014-10-08 飞天诚信科技股份有限公司 一种pin码保护方法及系统
CN104915602A (zh) * 2015-04-22 2015-09-16 飞天诚信科技股份有限公司 一种Android平台下的PIN码保护方法

Also Published As

Publication number Publication date
US10628607B2 (en) 2020-04-21
US20180025177A1 (en) 2018-01-25
CN104915602A (zh) 2015-09-16
CN104915602B (zh) 2017-08-11

Similar Documents

Publication Publication Date Title
WO2016169395A1 (zh) Android平台下的PIN码保护方法
JP6871393B2 (ja) ログイン情報処理の方法およびデバイス
EP3229397B1 (en) Method for fulfilling a cryptographic request requiring a value of a private key
JP6516342B2 (ja) アクセスデータ改ざん防止方法及び携帯端末
CN103069428B (zh) 不可信云基础设施中的安全虚拟机引导
US20210133334A1 (en) Display method, apparatus, and storage medium
US9195849B2 (en) Cloud application installed in client terminal connected to cloud server
TW201939345A (zh) 資料處理方法、可信用戶介面資源資料的應用方法及裝置
US20150095652A1 (en) Encryption and decryption processing method, apparatus, and device
CN104392188A (zh) 一种安全数据存储方法和系统
CN107196907B (zh) 一种安卓so文件的保护方法及装置
CN111274611A (zh) 数据脱敏方法、装置及计算机可读存储介质
WO2017156962A1 (zh) Elf 共享库保护方法及其系统
CN108183796A (zh) 利用白盒库文件和白盒密钥文件进行加解密的方法及装置
CN112839013B (zh) 一种密钥传输方法、装置及计算机可读存储介质
US20170200020A1 (en) Data management system, program recording medium, communication terminal, and data management server
CN107995230B (zh) 一种下载方法及终端
WO2019134278A1 (zh) 聊天加密方法、聊天解密方法、装置、电子终端及可读存储介质
CN106453335B (zh) 一种数据传输方法及装置
CN111542050B (zh) 一种基于tee的保障虚拟sim卡远程初始化安全的方法
CN105760719B (zh) 一种密文数据解密方法及系统
CN107688729B (zh) 基于可信主机的应用程序保护系统及方法
JP6741236B2 (ja) 情報処理装置
CN109286488B (zh) Hdcp关键密钥保护方法
CN113505364B (zh) 密码保护方法、电子设备和计算机可读存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16782543

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16782543

Country of ref document: EP

Kind code of ref document: A1