WO2016173116A1 - 访问存储数据的方法及装置 - Google Patents

访问存储数据的方法及装置 Download PDF

Info

Publication number
WO2016173116A1
WO2016173116A1 PCT/CN2015/082958 CN2015082958W WO2016173116A1 WO 2016173116 A1 WO2016173116 A1 WO 2016173116A1 CN 2015082958 W CN2015082958 W CN 2015082958W WO 2016173116 A1 WO2016173116 A1 WO 2016173116A1
Authority
WO
WIPO (PCT)
Prior art keywords
operating system
system type
data
access instruction
identity authentication
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2015/082958
Other languages
English (en)
French (fr)
Inventor
杨中云
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Yulong Computer Telecommunication Scientific Shenzhen Co Ltd
Original Assignee
Yulong Computer Telecommunication Scientific Shenzhen Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Yulong Computer Telecommunication Scientific Shenzhen Co Ltd filed Critical Yulong Computer Telecommunication Scientific Shenzhen Co Ltd
Publication of WO2016173116A1 publication Critical patent/WO2016173116A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules

Definitions

  • the present invention relates to the field of mobile terminal technologies, and in particular, to a method and an apparatus for accessing stored data.
  • the encryption storage method is generally adopted to ensure the security of the storage file under the security system, so that the ordinary system cannot read the file stored under the security system because there is no decryption method. Therefore, when the security system writes a file, it needs to be encrypted. When the file is read, it needs to be decrypted, which causes the security system to continuously encrypt and decrypt the file during the process of reading and writing the file. In the prior art, the method of encrypting storage consumes a large amount of system resources, resulting in low utilization of system resources.
  • the present invention provides a method for accessing stored data, so that the security system does not need to undergo encryption and decryption processes when reading and writing files, and only uses one identity authentication.
  • the process greatly reduces the occupation of system resources and improves the utilization of system resources.
  • a method of accessing stored data including:
  • the data access instruction including a target data identifier
  • the method for accessing the stored data further includes: displaying the prompt information of the access failure if the identity authentication fails.
  • step of performing identity authentication on the data access instruction according to the operating system type further includes:
  • step of acquiring the operating system type corresponding to the data access instruction further includes:
  • step of connecting to the target data identifier and the access path corresponding to the operating system type further includes:
  • the soft link corresponding to target data Connecting to the target data identifier and a soft link corresponding to the operating system type, the soft link corresponding to target data in a storage area corresponding to the operating system type.
  • an apparatus for accessing stored data is also provided.
  • An apparatus for accessing stored data comprising:
  • An instruction receiving module configured to receive a data access instruction, where the data access instruction includes a target data identifier
  • An operating system type obtaining module configured to acquire an operating system type corresponding to the data access instruction
  • An identity authentication module configured to perform identity authentication on the data access instruction according to the operating system type
  • the access path returning module is configured to connect to the target data identifier and the access path corresponding to the operating system type when the identity authentication is passed.
  • the access path returning module is further configured to display the prompt information of the access failure when the identity authentication fails.
  • the identity authentication module is further configured to obtain a digital signature corresponding to the data access instruction, generate a private key according to the digital signature, and obtain a public key corresponding to the operating system type, by using a public key corresponding to the operating system type.
  • the key and the private key verify the digital signature, and if the verification passes, the identity authentication passes.
  • the operating system type obtaining module is further configured to acquire an operating system type corresponding to the data access instruction according to a process ID of the init process.
  • the access path returning module is further configured to connect to the target data identifier and a soft link corresponding to the operating system type, where the soft link corresponds to target data in a storage area corresponding to the operating system type.
  • the data stored in the security system can also be stored in plaintext as if the data is stored in a normal system, so that the security system does not read or write files.
  • the process of encryption and decryption requires only the process of identity authentication.
  • the calculation amount of the read and write files of the security system is greatly reduced, and the system resources are reduced. Occupation, improve the utilization of system resources.
  • FIG. 1 is a flow chart of a method for accessing stored data in an embodiment
  • FIG. 2 is a schematic diagram of a method for accessing stored data in an application scenario of an android system in an embodiment
  • FIG. 3 is a structural diagram of an apparatus for accessing stored data in an embodiment.
  • a method for accessing stored data is proposed, and the execution of the method may depend on a computer system of a von Neumann system, which may be A computer device such as a smartphone, tablet, laptop, or personal computer with multiple operating systems installed.
  • the multiple operating systems herein may be common systems and security systems with different security rights, or may be the first operating system, the second operating system, the third operating system, and the like having the same security authority level.
  • the method for accessing the stored data is as shown in FIG. 1 , and specifically includes the following steps:
  • Step S102 Receive a data access instruction, where the data access instruction includes a target data identifier.
  • the target data can be a file or folder, such as an album, a log, a contact profile, a system file, and the like.
  • the target data identifier is the file name or file path used to access the target data. For example, in an application scenario of an Android system, if a user wants to access a photo in an album, the file path of the photo needs to be input, and a data access instruction is generated according to the input file path. Or the user accesses the directory where the photo is located, and the photo album application traverses the file path of the photo under the directory to obtain a thumbnail display to the user. When the mobile phone operating system traverses the file path of the photo under the directory, a data access instruction is generated, and the data access instruction includes parameters of the file path of the photo.
  • Step S104 Acquire an operating system type corresponding to the data access instruction.
  • the type of operating system corresponding to the data access instruction is the type of system that receives the data access instruction.
  • the operation of multiple systems is based on the same Linux kernel, and multiple systems are processes of multiple Linux systems running on the Linux kernel, and each system corresponds to one process. If a process receives a data access instruction and reads the target data, the type of the operating system corresponding to the obtained data access instruction is the type of the system corresponding to the process.
  • the type of the operating system obtained is the normal operating system type.
  • the type of the operating system obtained is the security operating system. Types of.
  • the acquisition of the operating system type may be obtained according to the process ID of the init process (English: Process Identifier, abbreviated as: PID).
  • the operating system type may be a normal system or a security system, or may be a first operating system or a second operating system.
  • the init process is a user-level process after the linux kernel is started. After receiving the data access instruction, it is loaded into the kernel shared by the common system and the security system, and the data is acquired according to the application that submits the data access instruction. Access the operating system type corresponding to the instruction. That is to say, the identification information of the process corresponding to the system can be adopted as the operating system type.
  • Step S106 Perform identity authentication on the data access instruction according to the operating system type.
  • the process of authenticating a data access instruction is a process of determining whether the data access instruction has permission to access the target data it contains.
  • the method of authenticating the data access instruction is a method of verifying by using the digital signature of the operator according to the input data access instruction, that is, the operator according to the input data access instruction.
  • the digital signature generates a key, and then decrypts the key to determine whether the identity of the operator is consistent with the right to access the corresponding target data.
  • the step of authenticating the data access command according to the operating system type may be specifically:
  • each system can contain multiple user accounts, each with a corresponding digital signature.
  • the digital signature corresponding to the entered data access instruction is the digital signature of the user account.
  • Each system generates a public key that matches the type of the system itself based on the digital signature of the user account, and saves it, that is, a digital signature corresponds to a different public key in each system.
  • the digital signature corresponding to the data access instruction is the digital signature of user A, in the right
  • the public key corresponding to the digital signature of the user A stored in the ordinary system may be obtained, and then the private key is generated according to the digital signature corresponding to the data access instruction, and the public key is paired with the private key. Therefore, the data access instruction input by the user A in the ordinary system is authenticated.
  • the digital signature corresponding to the data access instruction is the number of user A.
  • Signature when the data access instruction is authenticated, the public key corresponding to the digital signature of the user A stored in the security system may be obtained, and then according to the data access instruction The corresponding digital signature generates a private key.
  • User A does not have access to the folder in the security system, so the public key cannot be paired with the private key, that is, the access authentication authentication of the access command entered by the user A in the security system fails.
  • Step S108 If the identity authentication is passed, connecting to the target data identifier and the access path corresponding to the operating system type.
  • the access path corresponds to the target data file or directory. That is to say, for a multi-system, a separate storage area corresponding to the operating system type can be divided for each system in advance, and a correspondence relationship between the target data identifier and the storage area corresponding to the operating system type is established.
  • the access path in the storage area of the operating system type corresponding to the target data identifier may be searched according to the operating system type.
  • the storage areas of the two pre-divided systems are " ⁇ sys1 ⁇ ” and “ ⁇ sys2 ⁇ ” respectively.
  • the target data identifier "1.jpg”
  • the operating system type is 1, you can return " ⁇ sys1 ⁇ 1”.
  • .jpg if the operating system type is 2, you can return " ⁇ sys2 ⁇ 1.jpg”.
  • a soft link corresponding to the target data identifier and the operating system type is connected, and the soft link corresponds to target data in a storage area corresponding to the operating system type.
  • a soft link contains a reference to an object file or directory in the form of an absolute path or a relative path, which can link files of different file systems. That is, you can return a file that contains the access path.
  • the above logic can be implemented by modifying the underlying data access interface functions.
  • you can modify the Environment class in the android system which contains the interface function getExternalStorageDirectory() that gets the access path.
  • the logic decision step can be added to the interface function.
  • the interface function getExternalStorageDirectory() returns the corresponding file path or soft link.
  • the application calls the interface function for data access, the operating system type and the target data identifier are input as parameters to the function.
  • the function determines the operating system type and selects a corresponding callback function to return the operating system type.
  • a file path or soft link that corresponds to the target data ID.
  • an apparatus for accessing stored data includes: an instruction receiving module 302, an operating system type obtaining module 304.
  • the instruction receiving module 302 is configured to receive a data access instruction, where the data access instruction includes a target data identifier
  • An operating system type obtaining module 304 configured to acquire an operating system type corresponding to the data access instruction
  • the identity authentication module 306 is configured to perform identity authentication on the data access instruction according to the operating system type.
  • the access path returning module 308 is configured to connect to the target data identifier and the access path corresponding to the operating system type when the identity authentication is passed.
  • the access path returning module 308 is further configured to display the prompt information of the access failure when the identity authentication fails.
  • the identity authentication module 306 is further configured to obtain a digital signature corresponding to the data access instruction, generate a private key according to the digital signature, and obtain a public key corresponding to the operating system type, by using the operation
  • the public key corresponding to the system type and the private key verify the digital signature, and if the verification passes, the identity authentication passes.
  • the operating system type obtaining module 304 is further configured to acquire an operating system type corresponding to the data access instruction according to the process ID of the init process.
  • the access path returning module 308 is further configured to connect to the target data identifier and a soft link corresponding to the operating system type, where the soft link corresponds to a storage area corresponding to the operating system type.
  • Target data is further configured to connect to the target data identifier and a soft link corresponding to the operating system type, where the soft link corresponds to a storage area corresponding to the operating system type.
  • the data stored in the security system can also be stored in plaintext, so that the security system does not need to be encrypted when reading and writing files.
  • the process of decryption only requires the process of identity authentication.
  • the calculation of the file size of the security system is greatly reduced, and the occupation of system resources is reduced. Increased system resource usage.
  • the storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Storage Device Security (AREA)

Abstract

一种访问存储数据的方法，包括：接收数据访问指令（S102），所述数据访问指令包含目标数据标识；获取所述数据访问指令对应的操作系统类型（S104）；根据所述操作系统类型对所述数据访问指令进行身份认证（S106）；若所述身份认证通过，则返回与所述目标数据标识和所述操作系统类型对应的访问路径（S108）。另外，还提出了一种访问存储数据的装置。采用上述技术方案，可减小对操作系统资源的占用，大大提高操作系统资源的利用率。

Description

访问存储数据的方法及装置
本申请要求于2015年4月30日提交中国专利局，申请号为201510219209.1、发明名称为“访问存储数据的方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及移动终端技术领域，尤其涉及一种访问存储数据的方法及装置。
背景技术
现有的双系统智能终端中，通常采用加密存储的方式来保证安全系统下存储文件的安全性，使得普通系统因为没有解密方法而无法读取安全系统下存储的文件。因此，安全系统在写文件时，需要经过加密处理，在读取文件时，需要经过解密处理，从而导致安全系统在读写文件的过程中，需要不断地进行加密和解密的过程。现有技术中这种加密存储的方式花费的系统资源较大，导致系统资源的利用率不高。
发明内容
鉴于此，为了解决上述系统资源利用率不高的问题，本发明提供了一种访问存储数据的方法，使得安全系统在读写文件时不用经过加密和解密的过程，只用经过一个身份认证的过程，大大降低了对系统资源的占用，提高了系统资源的利用率。
一种访问存储数据的方法，包括：
接收数据访问指令，所述数据访问指令包含目标数据标识；
获取所述数据访问指令对应的操作系统类型；
根据所述操作系统类型对所述数据访问指令进行身份认证；
若所述身份认证通过，则连接至所述目标数据标识和所述操作系统类型对应的访问路径。
进一步地，所述访问存储数据的方法还包括：若所述身份认证失败，展示访问失败的提示信息。
进一步地，所述根据所述操作系统类型对所述数据访问指令进行身份认证的步骤还包括：
获取所述数据访问指令对应的数字签名，根据所述数字签名生成私钥，获取与所述操作系统类型对应的公钥，通过与所述操作系统类型对应的公钥和所述私钥校验所述数字签名，若校验通过，则身份认证通过。
进一步地，所述获取所述数据访问指令对应的操作系统类型的步骤还包括：
根据init进程的进程号获取所述数据访问指令对应的操作系统类型。
进一步地，所述连接至所述目标数据标识和所述操作系统类型对应的访问路径的步骤还包括：
连接至所述目标数据标识和所述操作系统类型对应的软链接，所述软链接对应于与所述操作系统类型对应的存储区域中的目标数据。
此外，为了解决上述系统资源利用率不高的技术问题，还提供了一种访问存储数据的装置。
一种访问存储数据的装置，包括：
指令接收模块，用于接收数据访问指令，所述数据访问指令包含目标数据标识；
操作系统类型获取模块，用于获取所述数据访问指令对应的操作系统类型；
身份认证模块，用于根据所述操作系统类型对所述数据访问指令进行身份认证；
访问路径返回模块，用于在身份认证通过时，连接至所述目标数据标识和所述操作系统类型对应的访问路径。
进一步地，所述访问路径返回模块还用于在所述身份认证失败时，展示访问失败的提示信息。
所述身份认证模块还用于获取所述数据访问指令对应的数字签名，根据所述数字签名生成私钥，获取与所述操作系统类型对应的公钥，通过与所述操作系统类型对应的公钥和所述私钥校验所述数字签名，若校验通过，则身份认证通过。
所述操作系统类型获取模块还用于根据init进程的进程号获取所述数据访问指令对应的操作系统类型，。
所述访问路径返回模块还用于连接至所述目标数据标识和所述操作系统类型对应的软链接，所述软链接对应于与所述操作系统类型对应的存储区域中的目标数据。
与现有技术相比，采用了本发明提出的访问存储数据的方法和装置之后，安全系统下存储的数据也可以如同普通系统下存储数据一般采用明文存储，使得安全系统在读写文件时不需要经过加密和解密的过程，只需要经过身份认证的过程，在保证了安全系统下的存储的数据的安全性的前提下，大大降低了安全系统读写文件的计算量，降低了对系统资源的占用，提高了系统资源的利用率。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
其中：
图1为一个实施例中一种访问存储数据的方法的流程图；
图2为一个实施例中android系统的应用场景中的访问存储数据的方法的示意图；
图3为一个实施例中一种访问存储数据的装置的结构图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
为解决上述系统资源利用率不高的问题，在一个实施例中，特提出了一种访问存储数据的方法，该方法的执行可依赖于冯诺依曼体系的计算机系统，该计算机系统可以是安装了多操作系统的智能手机、平板电脑、笔记本电脑或者个人电脑等计算机设备。这里的多操作系统可以是安全权限不同的普通系统和安全系统等，也可以是安全权限级别相同的第一操作系统、第二操作系统、第三操作系统等。
具体的，在本实施例中，该访问存储数据的方法如图1所示，具体包括如下步骤：
步骤S102：接收数据访问指令，所述数据访问指令包含目标数据标识。
目标数据可以是文件或文件夹，例如，相册、日志、联系人资料、系统文件等。目标数据标识即为用于访问目标数据的文件名或文件路径。例如，在一个安卓系统的应用场景中，用户若要访问相册中的某张照片，则需要输入该照片的文件路径，并根据该输入的文件路径生成数据访问指令。或者用户访问该照片所在的目录，相册应用遍历该目录下的照片的文件路径，获取缩略图展示给用户。手机操作系统在遍历该目录下的照片的文件路径时，即生成了数据访问指令，且该数据访问指令中包含了该照片的文件路径的参数。
步骤S104：获取所述数据访问指令对应的操作系统类型。
与数据访问指令对应的操作系统类型即为接收该数据访问指令的系统的类型。例如，在安卓android的应用场景中，多系统的运行基于同一个linux内核，多个系统即为该linux内核上运行的多个linux系统的进程，且每个系统对应一个进程。若某个进程接收到数据访问指令，从而对目标数据进行读取，则获取到的数据访问指令对应的操作系统类型即为该进程对应的系统的类型。
例如，用户在普通系统下操作应用进行读写时，获取到的操作系统类型即为普通操作系统类型；用户在安全系统下操作应用进行读写时，获取到的操作系统类型即为安全操作系统类型。
进一步地，操作系统类型的获取可以根据init进程的进程号PID(英文：Process Identifier，简称：PID)来获取。操作系统类型可以为普通系统或安全系统，也可以为第一操作系统或第二操作系统。在android系统中，init进程是linux内核启动之后的用户级进程，当接收到数据访问指令之后，加载到普通系统和安全系统共用的内核，根据提交数据访问指令的应用来获取所述数据 访问指令对应的操作系统类型。也就是说，可采用与系统对应的进程的标识信息作为操作系统类型。
步骤S106：根据所述操作系统类型对所述数据访问指令进行身份认证。
对数据访问指令进行身份认证的过程即为判断该数据访问指令是否有权限访问其包含的目标数据的过程。在现有的单一系统的运行环境中，对数据访问指令进行身份认证的方式即为采用根据输入数据访问指令的操作者的数字签名进行校验的方式，即根据输入数据访问指令的操作者的数字签名生成密钥，然后通过对该密钥进行解密来判断操作者的身份是否符合访问相应的目标数据的权限。
而在本实施例中，对于多系统的运行环境，根据所述操作系统类型对所述数据访问指令进行身份认证的步骤即可具体为：
获取所述数据访问指令对应的数字签名，根据所述数字签名生成私钥，获取与所述操作系统类型对应的公钥，通过与所述操作系统类型对应的公钥和所述私钥校验所述数字签名，若校验通过，则身份认证通过；否则，身份认证失败。
也就是说，每个系统都可以包含多个用户帐户，每个用户帐户均具有相应的数字签名。用户在使用某个用户帐户操作时，输入的数据访问指令对应的数字签名即为该用户帐户的数字签名。每个系统预先根据用户帐户的数字签名生成与系统自身的类型匹配的公钥，并保存下来，即某个数字签名在每个系统中均对应有各不相同的公钥。
例如，用户A在普通系统中输入了数据访问指令后(假设用户A对于数据访问指令中包含的目标数据具有访问权限)，该数据访问指令对应的数字签名即为用户A的数字签名，在对该数据访问指令进行身份认证时，则可获取普通系统中存储的与用户A的数字签名对应的公钥，然后根据数据访问指令对应的数字签名生成私钥，该公钥与该私钥配对，因此，该用户A在普通系统中输入的数据访问指令身份认证通过。
例如，若用户A在安全系统中对某个文件夹没有访问权限，当用户A在安全系统中输入访问所述文件夹的访问指令后，该数据访问指令对应的数字签名即为用户A的数字签名，在对该数据访问指令进行身份认证时，则可获取安全系统中存储的与用户A的数字签名对应的公钥，然后根据数据访问指令 对应的数字签名生成私钥。用户A在所述安全系统中对该文件夹没有访问权限，因此该公钥与该私钥不能配对，即该用户A在安全系统中输入的访问该文件夹的访问指令身份认证失败。
步骤S108：若所述身份认证通过，则连接至所述目标数据标识和所述操作系统类型对应的访问路径。该访问路径对应于所述目标数据文件或目录。也就是说，对于多系统而言，可预先为每个系统划分独立的与操作系统类型对应的存储区域，并建立目标数据标识和与操作系统类型对应的存储区域的对应关系。在连接至目标数据标识对应的访问路径时，可根据操作系统类型查找目标数据标识对应的在该操作系统类型的存储区域中的访问路径。
例如，预先划分的两个系统的存储区域分别为“\sys1\”和“\sys2\”，对于目标数据标识“1.jpg”，若操作系统类型为1，则可返回“\sys1\1.jpg”；若操作系统类型为2，则可返回“\sys2\1.jpg”。
进一步地，连接至所述目标数据标识和所述操作系统类型对应的软链接，所述软链接对应于与所述操作系统类型对应的存储区域中的目标数据。软链接包含有一条以绝对路径或者相对路径的形式指向目标文件或者目录的引用，可以链接不同文件系统的文件。也就是说，可以返回一个包含了访问路径的文件。
在一个android系统的应用场景中，如图2所示，可通过修改底层的数据访问的接口函数实现上述逻辑。例如，可修改android系统中的Environment类，该类中包含了获取访问路径的接口函数getExternalStorageDirectory()。可在该接口函数中添加逻辑判断的步骤，对于每种系统，该接口函数getExternalStorageDirectory()均返回相应的文件路径或软链接。当应用在进行数据访问调用该接口函数时，将操作系统类型和目标数据标识作为参数输入给该函数，该函数通过对操作系统类型进行判断，选择相应的回调函数来返回该操作系统类型下的与目标数据标识对应的文件路径或软链接。
此外，在一个实施例中，为解决上述系统资源利用率不高的问题，还提出了一种访问存储数据的装置，如图3所示，包括：指令接收模块302、操作系统类型获取模块304、身份认证模块306、访问路径返回模块308，其中：
指令接收模块302，用于接收数据访问指令，所述数据访问指令包含目标数据标识；
操作系统类型获取模块304，用于获取所述数据访问指令对应的操作系统类型；
身份认证模块306，用于根据所述操作系统类型对所述数据访问指令进行身份认证；
访问路径返回模块308，用于在身份认证通过时，连接至所述目标数据标识和所述操作系统类型对应的访问路径。
在本实施例中，访问路径返回模块308还用于在所述身份认证失败时，展示访问失败的提示信息。
在本实施例中，身份认证模块306还用于获取所述数据访问指令对应的数字签名，根据所述数字签名生成私钥，获取与所述操作系统类型对应的公钥，通过与所述操作系统类型对应的公钥和所述私钥校验所述数字签名，若校验通过，则身份认证通过。
在本实施例中，操作系统类型获取模块304还用于根据init进程的进程号获取所述数据访问指令对应的操作系统类型，。
在本实施例中，访问路径返回模块308还用于连接至所述目标数据标识和所述操作系统类型对应的软链接，所述软链接对应于与所述操作系统类型对应的存储区域中的目标数据。
综上所述，实施本发明实施例后，将具有如下有益效果：
采用了本发明提出的访问存储数据的方法和访问存储数据的装置后，与现有技术相比，安全系统下存储的数据也可以采用明文存储，使得安全系统在读写文件时不需要经过加密解密的过程，只需要经过身份认证的过程，在保证了安全系统下的存储的数据的安全性的前提下，大大降低了安全系统都系而文件的计算量，降低了对系统资源的占用，提高了系统资源的占用率。
本领域普通技术人员可以理解实现上述实施例方法中的全部或部分流程，是可以通过计算机程序来指令相关的硬件来完成，所述的程序可存储于一计算机可读取存储介质中，该程序在执行时，可包括如上述各方法的实施例的流程。其中，所述的存储介质可为磁碟、光盘、只读存储记忆体(Read-Only Memory，ROM)或随机存储记忆体(Random Access Memory，RAM)等。
以上所揭露的仅为本发明较佳实施例而已，当然不能以此来限定本发明之权利范围，因此依本发明权利要求所作的等同变化，仍属本发明所涵盖的范围。

Claims (10)

  1. 一种访问存储数据的方法，包括：
    接收数据访问指令，所述数据访问指令包含目标数据标识；
    获取所述数据访问指令对应的操作系统类型；
    根据所述操作系统类型对所述数据访问指令进行身份认证；
    若所述身份认证通过，则连接至所述目标数据标识和所述操作系统类型对应的访问路径。
  2. 如权利要求1所述的访问存储数据的方法，其特征在于，若所述身份认证失败，展示访问失败的提示信息。
  3. 如权利要求1所述的访问存储数据的方法，其特征在于，所述根据所述操作系统类型对所述数据访问指令进行身份认证的步骤还包括：
    获取所述数据访问指令对应的数字签名，根据所述数字签名生成私钥，获取与所述操作系统类型对应的公钥，通过与所述操作系统类型对应的公钥和所述私钥校验所述数字签名，若校验通过，则身份认证通过。
  4. 如权利要求1所述的访问存储数据的方法，其特征在于，所述获取所述数据访问指令对应的操作系统类型的步骤还包括：
    根据init进程的进程号获取所述数据访问指令对应的操作系统类型。
  5. 如权利要求4所述的访问存储数据的方法，其特征在于，所述连接至所述目标数据标识和所述操作系统类型对应的访问路径的步骤还包括：
    连接至所述目标数据标识和所述操作系统类型对应的软链接，所述软链接对应于与所述操作系统类型对应的存储区域中的目标数据。
  6. 一种访问存储数据的装置，包括：
    指令接收模块，用于接收数据访问指令，所述数据访问指令包含目标数据标识；
    操作系统类型获取模块，用于获取所述数据访问指令对应的操作系统类型；
    身份认证模块，用于根据所述操作系统类型对所述数据访问指令进行身份认证；
    访问路径返回模块，用于在身份认证通过时，连接至所述目标数据标识和所述操作系统类型对应的访问路径。
  7. 如权利要求6所述的访问存储数据的装置，其特征在于，访问路径返回模块还用于在所述身份认证失败时，展示访问失败的提示信息。
  8. 如权利要求6所述的访问存储数据的装置，其特征在于，所述身份认证模块还用于获取所述数据访问指令对应的数字签名，根据所述数字签名生成私钥，获取与所述操作系统类型对应的公钥，通过与所述操作系统类型对应的公钥和所述私钥校验所述数字签名，若校验通过，则身份认证通过。
  9. 如权利要求6所述的访问存储数据的装置，其特征在于，所述操作系统类型获取模块还用于根据init进程的进程号获取所述数据访问指令对应的操作系统类型。
  10. 如权利要求9所述的访问存储数据的装置，其特征在于，所述访问路径返回模块还用于连接至所述目标数据标识和所述操作系统类型对应的软链接，所述软链接对应于与所述操作系统类型对应的存储区域中的目标数据。
PCT/CN2015/082958 2015-04-30 2015-06-30 访问存储数据的方法及装置 Ceased WO2016173116A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510219209.1 2015-04-30
CN201510219209.1A CN105574425B (zh) 2015-04-30 2015-04-30 访问存储数据的方法及装置

Publications (1)

Publication Number Publication Date
WO2016173116A1 true WO2016173116A1 (zh) 2016-11-03

Family

ID=55884541

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/082958 Ceased WO2016173116A1 (zh) 2015-04-30 2015-06-30 访问存储数据的方法及装置

Country Status (2)

Country Link
CN (1) CN105574425B (zh)
WO (1) WO2016173116A1 (zh)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108733467A (zh) * 2017-04-20 2018-11-02 海马云（天津）信息技术有限公司 电子设备运行应用的方法及装置、电子设备
CN107911820B (zh) * 2017-12-28 2021-02-09 上海传英信息技术有限公司 私密系统数据文件管理方法及终端设备
CN119783081B (zh) * 2025-03-10 2025-07-25 深圳市沃信达科技有限公司 安全控制方法、设备以及存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102043927A (zh) * 2010-12-29 2011-05-04 北京深思洛克软件技术股份有限公司 一种用于数据泄密防护的计算机系统
US20140122902A1 (en) * 2012-10-31 2014-05-01 Kabushiki Kaisha Toshiba Information processing apparatus
US20140149746A1 (en) * 2012-11-28 2014-05-29 Arnold Yau Method and system of providing authentication of user access to a computer resource on a mobile device
CN104284027A (zh) * 2014-10-29 2015-01-14 东莞宇龙通信科技有限公司 用于终端的权限管理方法和权限管理系统

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101547092B (zh) * 2008-03-27 2011-06-08 天津德智科技有限公司 用于统一用户认证的多应用系统数据同步的方法及装置
CN103268455B (zh) * 2013-05-09 2015-12-02 华为技术有限公司 数据的访问方法及装置
CN104168291A (zh) * 2014-08-29 2014-11-26 宇龙计算机通信科技(深圳)有限公司 数据访问方法、数据访问装置和终端

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102043927A (zh) * 2010-12-29 2011-05-04 北京深思洛克软件技术股份有限公司 一种用于数据泄密防护的计算机系统
US20140122902A1 (en) * 2012-10-31 2014-05-01 Kabushiki Kaisha Toshiba Information processing apparatus
US20140149746A1 (en) * 2012-11-28 2014-05-29 Arnold Yau Method and system of providing authentication of user access to a computer resource on a mobile device
CN104284027A (zh) * 2014-10-29 2015-01-14 东莞宇龙通信科技有限公司 用于终端的权限管理方法和权限管理系统

Also Published As

Publication number Publication date
CN105574425A (zh) 2016-05-11
CN105574425B (zh) 2018-06-15

Similar Documents

Publication Publication Date Title
US10708051B2 (en) Controlled access to data in a sandboxed environment
US8505084B2 (en) Data access programming model for occasionally connected applications
US12132836B2 (en) Verified presentation of non-fungible tokens
US9172724B1 (en) Licensing and authentication with virtual desktop manager
US20190121981A1 (en) Bios startup method and data processing method
US20140380058A1 (en) Process Authentication and Resource Permissions
US10127317B2 (en) Private cloud API
TWI793215B (zh) 資料加密、解密方法及裝置
KR102030858B1 (ko) 디지털 서명 권한자 의존형 플랫폼 기밀 생성 기법
CN108229190B (zh) 透明加解密的控制方法、装置、程序、存储介质和电子设备
US20240323023A1 (en) Sample alignment method and apparatus, device, and storage medium
WO2022193494A1 (zh) 权限控制方法及服务器、终端、存储介质和计算机程序
CN114244565B (zh) 密钥分发方法、装置、设备及存储介质
CN110321757A (zh) 跨端生物特征识别系统、生物特征管理系统、方法及装置
CN115766173A (zh) 数据的处理方法、系统及装置
CN115758419A (zh) 用于数据安全的方法、装置、设备和存储介质
WO2016101559A1 (zh) 一种数据安全存取方法、装置和计算机存储介质
US11777724B2 (en) Data fragmentation and reconstruction
WO2016173116A1 (zh) 访问存储数据的方法及装置
CN103530169B (zh) 虚拟机文件保护方法和用户终端
CN111090616B (zh) 一种文件管理方法、对应装置、设备及存储介质
CN111400726B (zh) 一种数据处理方法、装置、设备和机器可读介质
WO2017067513A1 (zh) 数据处理方法及存储网关
CN110457959B (zh) 一种基于Trust应用的信息传输方法及装置
WO2017020449A1 (zh) 一种指纹读取方法及用户设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15890495

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 11.04.2018)

122 Ep: pct application non-entry in european phase

Ref document number: 15890495

Country of ref document: EP

Kind code of ref document: A1