WO2016173264A1 - 电子数据保护方法、装置及终端设备 - Google Patents

电子数据保护方法、装置及终端设备 Download PDF

Info

Publication number
WO2016173264A1
WO2016173264A1 PCT/CN2015/097433 CN2015097433W WO2016173264A1 WO 2016173264 A1 WO2016173264 A1 WO 2016173264A1 CN 2015097433 W CN2015097433 W CN 2015097433W WO 2016173264 A1 WO2016173264 A1 WO 2016173264A1
Authority
WO
WIPO (PCT)
Prior art keywords
data protection
encrypted
information
protection key
key hardware
Prior art date
Application number
PCT/CN2015/097433
Other languages
English (en)
French (fr)
Inventor
巴勒色⋅蒂莫西埃林
于三龙
甘图斯⋅尤瑞
Original Assignee
一铂有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 一铂有限公司 filed Critical 一铂有限公司
Priority to US15/570,116 priority Critical patent/US20180152296A1/en
Priority to EP15890639.6A priority patent/EP3291124A4/en
Publication of WO2016173264A1 publication Critical patent/WO2016173264A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/32—User authentication using biometric data, e.g. fingerprints, iris scans or voiceprints
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/72—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information in cryptographic circuits
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0866—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/14—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using a plurality of keys or algorithms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H04L9/3231—Biological data, e.g. fingerprint, voice or retina

Definitions

  • the present invention relates to the field of information security technologies, and in particular, to an electronic data protection method, an electronic data protection device, and a terminal device.
  • Hardware encryption generally generates a random number by hardware to encrypt a file, and the process of encrypting and decrypting the electronic data file is bound to a specific hardware device.
  • the hardware is generally connected to a terminal device such as a personal computer through a USB (Universal Serial Bus) interface, and has a plug-and-play nature, so the file is almost always encrypted, compared to the pure software encryption method. , enhanced security.
  • this hardware secret method is to store the encrypted file on the hardware used for encryption, and the general hardware storage space is limited, which leads to the limitation of electronic data protection.
  • an object of the embodiments of the present invention is to provide an electronic data protection method.
  • a second object of the embodiments of the present invention is to provide an electronic data protection device.
  • the embodiment of the present invention adopts the following technical solutions:
  • An electronic data protection method comprising the steps of:
  • the encryption process is performed upon receiving the encryption instruction
  • the information acquisition instruction is sent to the data protection key hardware device, where the information acquisition instruction includes a device identifier acquisition instruction and a fingerprint information acquisition instruction, and respectively receives the data protection key hardware device according to the information acquisition.
  • Information returned by the instruction where the information includes device identification and user fingerprint information;
  • Encrypting the object to be encrypted is completed according to the information returned by the data protection key hardware device, and the encrypted object is obtained.
  • An electronic data protection device comprising:
  • An encryption instruction receiving module configured to receive an encryption instruction
  • the information obtaining module is configured to send an information obtaining instruction to the data protection key hardware device in the encryption process, where the information obtaining instruction includes a device identifier obtaining instruction, a fingerprint information acquiring instruction, and respectively receiving the data protection key hardware
  • the device obtains information returned by the instruction according to the information, where the information includes device identifier and user fingerprint information, respectively;
  • the encryption processing module is configured to perform an encryption process according to the encryption instruction, complete encryption of the object to be encrypted according to the information returned by the data protection key hardware device, and obtain an encrypted object.
  • a terminal device includes a terminal device body, and a storage medium of the terminal device body stores an electronic data protection device as described above.
  • a storage medium comprising a computer readable program that, when executed by a computer readable program in the storage medium, performs the electronic data protection method as described above.
  • the encrypted object is encrypted by using a combination of software and hardware, and the data protection key hardware is continuously encrypted in the process of encrypting the object to be encrypted.
  • the device performs communication to obtain the user fingerprint information and the device identifier of the data protection key hardware device.
  • the encryption process depends on the obtained user fingerprint information and the device identification of the data protection key hardware device, and is provided by the data protection key hardware device.
  • Information is encrypted, which greatly improves the security of the encrypted object compared to pure software encryption. As long as the data protection key hardware device is held by the user, no hacker or other person who wants to steal information can Crack the encrypted object.
  • the encryption process is not performed on the data protection key hardware device, it is essentially software execution. Therefore, the storage location of the obtained encrypted object can be flexibly set without being limited to the data protection key hardware device. , effectively expanding the storage space of electronic data.
  • FIG. 1 is a schematic view showing the working environment of the solution of the present invention in an embodiment
  • FIG. 2 is a schematic structural diagram of a terminal device in an embodiment
  • FIG. 3 is a schematic flow chart of an electronic data protection method in an embodiment
  • FIG. 4 is a schematic diagram showing the principle of an encryption process of an electronic data protection method in an embodiment
  • FIG. 5 is a schematic diagram of the principle of performing on-the-fly protection after opening an encrypted object in an embodiment
  • FIG. 6 is a schematic diagram of a protection principle after an open encrypted object is closed in an embodiment
  • Figure 7 is a block diagram showing the structure of an electronic data protection device in an embodiment.
  • Figure 1 shows a schematic diagram of the working environment in one embodiment of the invention.
  • the solution of the embodiment of the present invention relates to a data protection key hardware device 100 and a terminal device 101.
  • the data protection key hardware device 100 can communicate with the terminal device 101 through Bluetooth or the like, and the terminal device 101 is to be encrypted.
  • the terminal device 101 communicates with the data protection key hardware device 100, and acquires information such as the user fingerprint information and the device identifier of the data protection key hardware device 100 from the data protection key hardware device 100, and is based on This information completes the encryption of the object to be encrypted.
  • the encrypted object obtained after encryption can be stored by the terminal device 101 to any possible location.
  • the data protection key hardware device 100 may include multiple, for example, two as shown in FIG. 1. Therefore, in the case that one of the data protection key hardware devices is lost, the other data protection key hardware device can cooperate with the terminal device 101 as a backup device to complete the encryption of the object to be encrypted or the decrypted encrypted object.
  • the embodiment of the present invention relates to a data protection key hardware device 100 and a terminal device 101 for coping with an encrypted object and a protection scheme for the encrypted object.
  • FIG. 2 A schematic structural diagram of the terminal device 101 in one embodiment is shown in FIG. 2.
  • the terminal includes a processor, a power supply module, a storage medium, a communication interface, and a memory connected through a system bus.
  • the storage medium of the terminal device 101 stores an operating system and an electronic data protection device, and the device is used to implement an electronic data protection method.
  • the communication interface of the terminal device is used to communicate with the data protection key hardware device, and the terminal device 101 can be implemented in any possible manner, such as a PC (personal computer), a smart tablet, a smart phone, and the like.
  • the object to be encrypted which is to be encrypted in the embodiment of the present invention, may be a file stored on the terminal device or other device, or may be other types of information such as a character string, and is generally referred to as an object to be encrypted in the embodiment of the present invention.
  • the information obtained after encryption is called an encrypted object.
  • FIG. 3 An electronic data protection method in one embodiment is shown in FIG. As shown in FIG. 3, the method in this embodiment includes the steps of:
  • Step S301 Perform an encryption process when receiving the encryption instruction
  • Step S302 In the encryption process, respectively, sending an information acquisition instruction to the data protection key hardware device, where the information acquisition instruction includes a device identifier acquisition instruction, a fingerprint information acquisition instruction, and respectively receiving the data protection key hardware device according to the Deriving information returned by the information acquisition instruction, where the information includes device identifier and user fingerprint information, respectively;
  • Step S303 Complete encryption of the object to be encrypted according to the information returned by the data protection key hardware device, and obtain the encrypted Object.
  • the essence is that the encryption object is encrypted by using a combination of software and hardware, and the data protection key hardware device is continuously encrypted in the process of encrypting the object to be encrypted.
  • Communicate obtain user fingerprint information and device identification of the data protection key hardware device, and the encryption process depends on the obtained user fingerprint information and the device identification of the data protection key hardware device, and the information provided by the data protection key hardware device
  • Encryption compared to pure software encryption, greatly improves the security of the encrypted object, as long as the data protection key hardware device is held by the user, any hacker or other person who wants to steal information cannot After encryption, the object is cracked.
  • the encryption process is not performed on the data protection key hardware device, it is essentially software execution. Therefore, the storage location of the obtained encrypted object can be flexibly set without being limited to the data protection key hardware device. , effectively expanding the storage space of electronic data.
  • the information acquisition instruction sent to the data protection key hardware device in the above step S302 may further include a password information acquisition instruction.
  • the received data protection key hardware device may further include password information according to the information returned by the information acquisition instruction.
  • the password information returned by the hardware device according to the password information acquisition instruction is encrypted according to the user fingerprint information, the device identifier, and the data protection key hardware device.
  • the object is encrypted.
  • the user fingerprint information may be fingerprint information obtained by an ordinary fingerprint identification device.
  • the user fingerprint information is fingerprint information obtained by the scratch-type fingerprint acquiring device. Since the ordinary fingerprint identification device recognizes the static fingerprint information, the fingerprint image is also recognized as the correct fingerprint, which is easily used by people to generate fraudulent effects and affect file security.
  • the fingerprint information is obtained by the scratching method, which is a method for dynamically acquiring the fingerprint information, and the static fingerprint information cannot be recognized, thereby avoiding the possibility that the fingerprint information is deceived, and the security is enhanced.
  • the user fingerprint information may not be a fingerprint picture, but a binary digitized fingerprint information, which avoids the possibility that the user fingerprint information is copied, thereby further improving security.
  • the device identifier of the data protection key hardware device may be represented by a random number generated by burning the quantum computer when the data protection key hardware device is manufactured.
  • the plurality of digital protection key hardware devices may use the same random number as the device identifier, which may be generated and written by the programming quantum computer at the time of manufacture. Therefore, they can be mutually backed up, and in the case of one of them lost, the encrypted file can be decrypted by another one to ensure the security of the electronic data.
  • the user fingerprint information, the device identifier, and the password information stored on the data protection key hardware device may be information obtained by encrypting the data protection key hardware device to further improve security.
  • the specific encryption method may be performed in any possible manner, and is not specifically limited in this embodiment of the present invention, for example, when encrypting an object to be encrypted. Different ways.
  • the obtained password information may be a random number, and the encrypted password information is stored.
  • the location can also be determined by the generated random number.
  • the data protection key hardware device may first determine the corresponding address random number, and after finding the storage address of the random number of the password information based on the address random number, obtain the storage address of the random number of the password information.
  • the password information is randomly numbered, and the password information is decrypted to obtain the password information.
  • the decrypted password information is transmitted to the sender of the password information acquisition instruction, that is, the terminal device, by Bluetooth, wherein the process of Bluetooth transmission can be performed by encryption.
  • the manner in which the user fingerprint information and the device identifier are stored and obtained may be similar to the password information described above.
  • step S304 may be any location where the electronic file and electronic information can be stored, for example, on the terminal device, portable. Storage devices, the cloud, and more.
  • step S303 After obtaining the encrypted object in the above step S303, It is also possible to proceed to step S305: physically deleting the object to be encrypted.
  • the physical deletion of the object to be encrypted may be performed when needed, or may be physically deleted after each encryption is completed.
  • the encrypted object When the encrypted object is physically deleted when necessary, it can be performed based on the prompt of the terminal device. For example, after the object to be encrypted is obtained in step S303, the prompt information of whether the source file needs to be physically deleted may be given, and the prompt information is displayed on the display interface of the terminal device for the user to select. If the user selects to delete, a physical deletion source file instruction is issued based on the selected selection item, and the terminal device physically deletes the object to be encrypted based on the physical deletion source file instruction.
  • the object to be encrypted is physically deleted after each encryption is completed, the object to be encrypted is directly deleted after the encryption is completed.
  • the operating system deletes files, considering the factors such as speed and disk life, the files deleted by the user are not actually deleted, but the logical deletion is performed.
  • the logical deletion is to delete the file storage location that needs to be deleted.
  • the client informs the client that the file has been deleted and modifies the capacity record. That is, before writing new files to cover these areas, the files that these users think have been deleted can be recovered, and there is a risk that they will be restored by others and affect security.
  • the physical deletion of the object to be encrypted is performed, thereby avoiding the risk that the object to be encrypted is not deleted by the application system.
  • the physical deletion of the object to be encrypted may be performed in various possible manners.
  • the system logically deletes the object to be encrypted
  • the logically deleted tag position is written into the random number. Because it is going through random numbers The location of the encrypted object is overwritten, and the information before the overlay cannot be recovered after the overlay, thereby avoiding the risk that the object to be encrypted is restored by others, thereby further improving the security of the information.
  • FIG. 4 shows a schematic diagram of the principle of the encryption process of the electronic data protection method in one embodiment.
  • FIG. 5 is a schematic flow chart showing an interaction process between a terminal device and a data protection key hardware device in an electronic data protection method in an embodiment.
  • the terminal device may be a terminal of a PC, a tablet, or a mobile phone.
  • the terminal device obtains user fingerprint information, device identification, password information, and the like from the data protection key hardware device in the process of encrypting the object to be encrypted. , complete the encryption process.
  • an example of encrypting a specific object to be encrypted may be as follows.
  • the terminal device starts the encryption process when it receives the encryption instruction.
  • the fingerprint information acquisition instruction is sent to the data protection key hardware device.
  • the data protection key hardware device After receiving the fingerprint information acquisition instruction, the data protection key hardware device first finds the random number of the fingerprint address storing the fingerprint information, and then obtains the encrypted fingerprint random number based on the random number of the fingerprint address, and then decrypts the fingerprint random number to obtain the user. Fingerprint information.
  • the obtained user fingerprint information is encrypted by Bluetooth and transmitted to the terminal device.
  • the terminal device After receiving the fingerprint information of the user encrypted by the Bluetooth, the terminal device performs Bluetooth decryption on the Bluetooth encrypted user fingerprint information to obtain the user fingerprint information, and continues to complete the encryption process based on the user fingerprint information.
  • the terminal device continues to perform the encryption process and sends a device identification acquisition instruction to the data protection key hardware device when it is required to apply to the device identification.
  • the data protection key hardware device After receiving the device identification acquisition command, the data protection key hardware device first searches for the random number of the device identification address of the storage device identifier, and then obtains the encrypted device identification random number based on the device identification address random number, and performs the device identification random number. Decrypt, get the device ID.
  • the obtained device identifier is encrypted by Bluetooth and transmitted to the terminal device.
  • the terminal device After receiving the Bluetooth-encrypted device identifier, the terminal device performs Bluetooth decryption on the Bluetooth-encrypted device identifier to obtain the device identifier, and continues the encryption process based on the device identifier.
  • the terminal device continues to perform the encryption process, and when it is required to apply to the information that needs to be obtained from the data protection key hardware device, such as password information, the encryption is continued in the same manner as described above, and the encryption process is completed until the encryption process is completed.
  • the encryption process is completed until the encryption process is completed.
  • Object and physically delete the encrypted object.
  • the user fingerprint information and the device identifier are sequentially obtained as an example. According to the actual needs and the design of the encryption algorithm, the user fingerprint information may be obtained in another order.
  • the information such as the device identifier and the password information may also be obtained at the same time, which is not specifically limited in the embodiment of the present invention.
  • the solution of the embodiment of the present invention may also be used to implement the sharing of the encrypted file.
  • the encryption may be performed based on the selection item, such as a menu bar, or a conventional file encryption. Encryption, encryption that requires file sharing, different encryption trigger controls to receive encrypted instructions, etc., can be implemented in a variety of different ways.
  • the encrypted file After the obtained encrypted file is shared to the target user B, the encrypted file can be decrypted based on the private key of the data protection key hardware device B, and the file is encrypted and shared. Therefore, when the encryption sharing is performed, the public key of the data protection key hardware device held by the target user to be shared is performed, so that only the private key of the data protection key hardware device held by the target user to be shared can be combined. In order to decrypt the encrypted file, the file can be safely shared.
  • FIG. 5 is a schematic diagram showing the principle of performing on-the-fly protection when an encrypted object is opened in one embodiment.
  • the encrypted object is a file
  • the encrypted file is encrypted by combining user fingerprint information, password information, and device identification.
  • the encrypted file can be opened by using the software corresponding to the method of the present invention, or can be opened by using external software.
  • the specific acquisition process may be the same as in the example described above;
  • the encrypted file is decrypted by using a decryption manner corresponding to the manner of decryption described above;
  • the application system memory sandbox is called, and the decrypted file is run in the application system memory sandbox.
  • the decrypted file obtained after decryption can also be opened by calling external software, but the solution of the embodiment of the present invention tracks the opening and closing of each encrypted file.
  • the application system memory sandbox is called, and the memory file generated after the encrypted file is opened by the external application is run in the application system memory sandbox.
  • FIG. 6 shows a schematic diagram of the protection principle after the closed encrypted object is closed in an example.
  • the temporary file generated by the terminal application system can be deleted.
  • the process of deleting the temporary file generated by the terminal application system may be performed by: writing a random number in the storage location of the temporary file to overwrite the temporary file, Then delete the overwritten temporary file.
  • the encrypted object is opened under the sandbox protection in any way, and the temporary file is closed after the file is closed when opened by the external software.
  • the deletion was performed in time to avoid the security risks of the memory files in the file opening process and the temporary files being stolen after the files were closed.
  • the embodiment of the present invention further provides an electronic data protection device based on the same idea as the electronic data protection method described above.
  • a schematic block diagram of an electronic data protection device in one embodiment is shown in FIG.
  • the electronic data protection device in this embodiment includes:
  • the encryption instruction receiving module 701 is configured to receive an encryption instruction
  • the information obtaining module 702 is configured to send an information obtaining instruction to the data protection key hardware device in the encryption process, where the information obtaining instruction includes a device identifier obtaining instruction, a fingerprint information acquiring instruction, and respectively receiving the data protection key
  • the hardware device obtains information returned by the instruction according to the information, where the information includes device identifier and user fingerprint information, respectively;
  • the encryption processing module 703 is configured to perform an encryption process according to the encryption instruction, and complete encryption of the object to be encrypted according to the information returned by the data protection key hardware device, to obtain an encrypted object.
  • the encrypted object is encrypted by means of combining software and hardware
  • the data protection key hardware device is continuously encrypted in the process of encrypting the object to be encrypted.
  • Communicate obtain user fingerprint information and device identification of the data protection key hardware device
  • the encryption process depends on the obtained user fingerprint information and the device identification of the data protection key hardware device, and the information provided by the data protection key hardware device
  • Encryption compared to pure software encryption, greatly improves the security of the encrypted object, as long as the data protection key hardware device is held by the user, any hacker or other person who wants to steal information cannot After encryption, the object is cracked.
  • the encryption process is not performed on the data protection key hardware device, it is essentially software execution. Therefore, the storage location of the obtained encrypted object can be flexibly set without being limited to the data protection key hardware device. , effectively expanding the storage space of electronic data.
  • the information acquisition instruction sent by the information acquiring module 702 to the data protection key hardware device may further include a password information acquisition instruction.
  • the data protection key hardware device received by the information obtaining module 702 may further return information according to the information acquisition instruction. To include password information.
  • the encryption processing module 703 encrypts the object to be encrypted, according to the user fingerprint information, the device identifier, and the data protection key hardware device, the password information returned by the password information acquisition instruction is The encrypted object is encrypted.
  • the user fingerprint information may be fingerprint information obtained by an ordinary fingerprint identification device.
  • the user fingerprint information is fingerprint information obtained by the scratch-type fingerprint acquiring device. Since the ordinary fingerprint identification device recognizes the static fingerprint information, the fingerprint image is also recognized as the correct fingerprint, which is easily used by people to generate fraudulent effects and affect file security.
  • the fingerprint information is obtained by the scratching method, which is a method for dynamically acquiring the fingerprint information, and the static fingerprint information cannot be recognized, thereby avoiding the possibility that the fingerprint information is deceived, and the security is enhanced.
  • the user fingerprint information may not be a fingerprint picture, but a binary digitized fingerprint information, which avoids the possibility that the user fingerprint information is copied, thereby further improving security.
  • the device identifier of the data protection key hardware device may be represented by a random number generated by burning the quantum computer when the data protection key hardware device is manufactured.
  • the plurality of digital protection key hardware devices may use the same random number as the device identifier, which may be generated and written by the programming quantum computer at the time of manufacture. Therefore, they can be mutually backed up, and in the case of one of them lost, the encrypted file can be decrypted by another one to ensure the security of the electronic data.
  • the user fingerprint information, the device identifier, and the password information stored on the data protection key hardware device may be information obtained by encrypting the data protection key hardware device to further improve security.
  • the specific encryption method may be performed in any possible manner, and is not specifically limited in this embodiment of the present invention. For example, it may be performed in a different manner from when the object to be encrypted is encrypted.
  • the obtained password information may be a random number, and the encrypted password information is stored.
  • the location can also be determined by the generated random number.
  • the data protection key hardware device may first determine the corresponding address random number, and after finding the storage address of the random number of the password information based on the address random number, obtain the storage address of the random number of the password information.
  • the password information is randomly numbered, and the password information is decrypted to obtain the password information.
  • the decrypted password information is transmitted to the sender of the password information acquisition instruction, that is, the terminal device, by Bluetooth, wherein the process of Bluetooth transmission can be performed by encryption.
  • the manner in which the user fingerprint information and the device identifier are stored and obtained may be similar to the password information described above.
  • the obtained encrypted object can be stored in a location corresponding to the predetermined path, which can be any location where the electronic file and the electronic information can be stored, for example, on the terminal device and portable. Storage Equipment, cloud, and so on.
  • the device in this embodiment may further include The physical deletion module 704 is configured to physically delete the object to be encrypted after the encryption processing module 703 obtains the encrypted object.
  • the physical deletion of the object to be encrypted may be performed when needed, or may be physically deleted after each encryption is completed.
  • the encrypted object In the case that the encrypted object is physically deleted, it can be performed based on the prompt of the terminal device. For example, after the encryption processing module 703 obtains the object to be encrypted, the physical deletion module 704 can provide whether the source file needs to be physically deleted. The prompt information is displayed on the display interface of the terminal device for the user to select. If the user selects to delete, a physical deletion source file instruction is issued based on the selected selection item, so that the physical deletion module 704 physically deletes the object to be encrypted based on the physical deletion source file instruction.
  • the physical deletion module 704 directly deletes the object to be encrypted.
  • the operating system deletes files, considering the factors such as speed and disk life, the files deleted by the user are not actually deleted, but the logical deletion is performed.
  • the logical deletion is to delete the file storage location that needs to be deleted.
  • the client informs the client that the file has been deleted and modifies the capacity record. That is, before writing new files to cover these areas, the files that these users think have been deleted can be recovered, and there is a risk that they will be restored by others and affect security.
  • the physical deletion of the object to be encrypted is performed, thereby avoiding the risk that the object to be encrypted is not deleted by the application system.
  • the physical deletion module 704 may perform the physical deletion of the object to be encrypted, and may be performed in various possible manners. In the embodiment of the present invention, after the system logically deletes the object to be encrypted, the physical deletion module 704 deletes the logic. The tag position is written to a random number. Since the location of the object to be encrypted is covered by the random number, the information before the coverage cannot be recovered after the coverage, thereby avoiding the risk that the object to be encrypted is restored by others, thereby further improving the security of the information.
  • the solution of the embodiment of the present invention may also be used to implement the sharing of the encrypted file.
  • the encryption may be performed based on the selection item, such as a menu bar, or a conventional file encryption. Encryption, encryption that requires file sharing, different encryption trigger controls to receive encrypted instructions, etc., can be implemented in a variety of different ways.
  • the encryption processing module 703 needs to combine the public key of the data protection key hardware device held by the target user to be shared when encrypting the object to be encrypted.
  • the target user B For example, suppose user A needs to encrypt the file and share it with target user B.
  • User A holds the data protection key hardware.
  • the target user B holds the data protection key hardware device B.
  • the user fingerprint information and device stored in the hardware device A of the data protection key are not only required to be combined.
  • the identification and other information must also be combined with the public key of the data protection key hardware device B.
  • the encrypted file can be decrypted based on the private key of the data protection key hardware device B, and the file is encrypted and shared.
  • the public key of the data protection key hardware device held by the target user to be shared is performed, so that only the private key of the data protection key hardware device held by the target user to be shared can be combined.
  • the file can be safely shared.
  • a file running protection module 705 may be further included to implement protection for the file after encryption.
  • the file runs a protection module 705, configured to invoke an application system memory sandbox when the encrypted file is decrypted, and run the decrypted file in the application system memory sandbox.
  • the encrypted file is encrypted by combining the user fingerprint information, the password information, and the device identifier.
  • the file running protection module 705 may receive the encrypted file open command from the data protection key.
  • the hardware device acquires user fingerprint information, password information, and device identifier of the data protection key hardware device, decrypts the encrypted object according to the obtained user fingerprint information, password information, and device identifier, and invokes an application system memory sandbox. And executing the decrypted file in a sandbox of the application system memory.
  • the current software application generates a temporary file in the terminal application system when the file is opened, and the temporary file is not deleted after the file is closed, thus affecting the security of the file.
  • the file running protection module 705 also tracks the closed condition of the encrypted object, and when the object is closed after the encryption is detected, the temporary file generated by the terminal application system can be deleted.
  • the file operation protection module 705 when detecting that the encrypted object is closed, the process of deleting the temporary file generated by the terminal application system may be performed by: writing a random number coverage in the storage location of the temporary file. The temporary file is then deleted from the overwritten temporary file. Thus, even if the temporary file is known by others, since the temporary file has been corrupted by the random number, the original file cannot be restored.
  • the encrypted object is opened in any manner, and the files in the memory are all run under the sandbox protection.
  • the temporary file is closed after the file is closed. The deletion was performed in time to avoid the security risks of the memory files in the file opening process and the temporary files being stolen after the files were closed.
  • an embodiment of the present invention further provides a terminal device, where the terminal device includes a terminal device body, and the electronic data protection device as described above is stored in a storage medium of the terminal device body.
  • Electronic data protection When the device is in operation, the electronic data protection method of the embodiment of the present invention as described above is executed.
  • the terminal device in the embodiment of the present invention may further include the foregoing data protection key hardware device, and the data protection key hardware device may have more than two, and the device identifier thereof may be used to manufacture the data protection key hardware.
  • the device burns the random numbers generated by the quantum computer to indicate that they use the same random number as the device identifier. Therefore, they are mutually backups. In the case where one of them is lost, the encrypted file can be decrypted by another one to ensure the security of the electronic data.
  • the data protection key hardware device may be provided with a reset button, such as a back of the data protection key hardware device or other location, through which the reset command can receive a reset command and receive a reset command Clear or reset the device identifier (ie, random number) saved on the data protection key hardware device. After the device ID is cleared or reset, files previously encrypted with this hardware cannot be opened, which makes it easy for users to quickly destroy all data in an emergency, regardless of where the encrypted objects are stored. In addition, in the case of resetting the device identification, the data protection key hardware device can also be used as a new device, which improves the sustainability of the device usage.
  • a reset button such as a back of the data protection key hardware device or other location
  • one of the data protection key hardware devices can be integrated in the terminal device body, so that the aesthetics of the terminal device can be ensured without increasing the volume of the terminal device body. And easy for users to use.
  • the storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • General Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • Computing Systems (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Biodiversity & Conservation Biology (AREA)
  • Biomedical Technology (AREA)
  • Power Engineering (AREA)
  • Mathematical Physics (AREA)
  • Storage Device Security (AREA)

Abstract

一种电子数据保护方法、装置、终端设备及存储介质，该方法包括步骤：在接收到加密指令时，执行加密过程（S301）；在加密过程中，分别向数据保护密钥硬件设备发送信息获取指令，所述信息获取指令包括设备标识获取指令、指纹信息获取指令，并分别接收数据保护密钥硬件设备根据所述信息获取指令返回的信息，所述信息分别包括设备标识、用户指纹信息（S302）；根据数据保护密钥硬件设备返回的信息完成对待加密对象的加密，得到加密后对象（S303）。上述方法是采用了软硬件结合的方式对文件进行加密，在对文件进行加密时基于数据保护密钥硬件设备所提供的信息进行加密，相对于纯软件加密的方式来说，而无需局限在数据保护密钥硬件设备，有效扩展了电子数据的存储空间。

Description

电子数据保护方法、装置及终端设备 技术领域
本发明涉及信息安全技术领域，特别涉及一种电子数据保护方法、一种电子数据保护装置以及一种终端设备。
背景技术
随着信息技术的日益发展以及节约资源的需求，通过电子数据对信息进行保存应用的日益广泛，而电子数据保存应用的广泛性也对电子数据保存的安全性提出了更高的要求，以避免被他人窃取以及在他人窃取后无法知晓电子数据的具体内容。在目前的电子数据保护方案中，普遍采用的是用软件对电子数据文件用密码进行加密，只有在输入正确的密码时才能打开电子数据文件查看文件中的内容。这种电子数据保护方式加密强度低，且需要用户记住高强度密码，若用户忘记了密码，将导致该电子数据文件无法打开。目前出现了采用硬件对电子文件进行加密的方式，硬件加密一般是通过硬件随机生成一个随机数来对文件进行加密，对电子数据文件的加密和解密过程与特定的硬件设备相绑定，由于目前硬件一般都是通过USB(Universal Serial Bus，通用串行总线)接口与个人计算机等终端设备连接，具有即插即用的性质，因此文件几乎始终处于加密状态，相对于纯软件的加密方式来说，加强了安全性。然而，这种硬件机密方式是将加密后的文件存放在用以加密的硬件上，而一般硬件的存储空间有限，从而导致了电子数据保护的局限性。
发明内容
基于此，本发明实施例的一个目的在于提供一种电子数据保护方法，本发明实施例的第二个目的在于提供一种电子数据保护装置，本发明实施例的第三个目的在于提供一种终端设备，本发明实施例的方案实施时，均可以增强电子数据保护的安全性，且可以扩展电子数据的存储空间。
为达到上述目的，本发明实施例采用以下技术方案：
一种电子数据保护方法，包括步骤：
在接收到加密指令时，执行加密过程；
在加密过程中，分别向数据保护密钥硬件设备发送信息获取指令，所述信息获取指令包括设备标识获取指令、指纹信息获取指令，并分别接收所述数据保护密钥硬件设备根据所述信息获取指令返回的信息，所述信息分别包括设备标识、用户指纹信息；
根据所述数据保护密钥硬件设备返回的信息完成对待加密对象的加密，得到加密后对象。
一种电子数据保护装置，包括：
加密指令接收模块，用于接收加密指令；
信息获取模块，用于在加密过程中，分别向数据保护密钥硬件设备发送信息获取指令，所述信息获取指令包括设备标识获取指令、指纹信息获取指令，并分别接收所述数据保护密钥硬件设备根据所述信息获取指令返回的信息，所述信息分别包括设备标识、用户指纹信息；
加密处理模块，用于根据所述加密指令执行加密过程，根据所述数据保护密钥硬件设备返回的信息完成对待加密对象的加密，得到加密后对象。
一种终端设备，包括终端设备本体，所述终端设备本体的存储介质存储有如上所述的电子数据保护装置。
一种包含计算机可读程序的存储介质，当该存储介质中的计算机可读程序执行时，执行如上所述的电子数据保护方法。
根据如上所述的本发明实施例的方案，其本质上是实现了是采用了软硬件结合的方式对待加密对象进行加密，且在对待加密对象进行加密的过程中不断地与数据保护密钥硬件设备进行通信，获得用户指纹信息以及数据保护密钥硬件设备的设备标识，加密过程依赖于所获得的用户指纹信息以及数据保护密钥硬件设备的设备标识，基于数据保护密钥硬件设备所提供的信息进行加密，相对于纯软件加密的方式来说，极大地提高了加密后对象的安全性，只要数据保护密钥硬件设备被用户持有，任何黑客或者其他想要盗取信息的人都无法对加密后对象进行破解。另一方面，由于加密过程并不是在数据保护密钥硬件设备上进行，本质上是软件执行，因此，所得到的加密后对象的存储位置可以灵活设置，而无需局限在数据保护密钥硬件设备，有效扩展了电子数据的存储空间。
附图说明
图1是一个实施例中的本发明方案的工作环境示意图；
图2是一个实施例中终端设备的组成结构示意图；
图3是一个实施例中的电子数据保护方法的流程示意图；
图4是一个实施例中的电子数据保护方法的加密过程的原理示意图；
图5是一个实施例中打开加密后对象进行运行中保护的原理示意图；
图6是一个实施例中关闭打开的加密后对象后的保护原理示意图；
图7是一个实施例中的电子数据保护装置的结构示意图。
具体实施方式
为使本发明的目的、技术方案及优点更加清楚明白，以下结合附图及实施例，对本发明进行进一步的详细说明。应当理解，此处所描述的具体实施方式仅仅用以解释本发明，并不限定本发明的保护范围。
图1示出了本发明一个实施例中的工作环境示意图。如图1所示，本发明实施例的方案涉及数据保护密钥硬件设备100以及终端设备101，数据保护密钥硬件设备100可以通过蓝牙等方式与终端设备101进行通信，在终端设备101对待加密对象进行加密的过程中，终端设备101与数据保护密钥硬件设备100进行通信，从数据保护密钥硬件设备100获取用户指纹信息、该数据保护密钥硬件设备100的设备标识等信息，并基于这些信息完成对待加密对象的加密。加密后得到的加密后对象可由终端设备101存储到任何可能的位置。其中，上述数据保护密钥硬件设备100可以包括有多个，例如图1中所示的2个。从而在其中一个数据保护密钥硬件设备丢失的情况下，其他的数据保护密钥硬件设备可以作为备份设备与终端设备101相配合完成对待加密对象的加密或者对已加密的加密后对象的解密。本发明实施例涉及的是数据保护密钥硬件设备100与终端设备101相配合对待加密对象进行加密以及对加密后对象的保护方案。
终端设备101在一个实施例中的结构示意图如图2所示。该终端包括通过系统总线连接的处理器、供电模块、存储介质、通信接口和内存。其中，终端设备101的存储介质存储有操作系统和一种电子数据保护装置，该装置用于实现一种电子数据保护方法。终端设备的通信接口用于与数据保护密钥硬件设备通信，该终端设备101可以采用任何可能的方式来实现，例如PC(personal computer，个人计算机)、智能平板、智能手机等等。
本发明各实施例中进行加密时所针对的待加密对象，可以是终端设备或者其他设备上所存储的文件，也可以是字符串等其他类型的信息，本发明实施例中统称为待加密对象。相应地，加密后得到的信息称之为加密后对象。
图3中示出了一个实施例中的电子数据保护方法。如图3所示，本实施例中的方法包括步骤：
步骤S301：在接收到加密指令时，执行加密过程；
步骤S302：在加密过程中，分别向数据保护密钥硬件设备发送信息获取指令，所述信息获取指令包括设备标识获取指令、指纹信息获取指令，并分别接收所述数据保护密钥硬件设备根据所述信息获取指令返回的信息，所述信息分别包括设备标识、用户指纹信息；
步骤S303：根据所述数据保护密钥硬件设备返回的信息完成对待加密对象的加密，得到加密后 对象。
根据如上所述的本发明实施例的方案，其本质上是实现了是采用了软硬件结合的方式对待加密对象进行加密，且在对待加密对象进行加密过程中不断地与数据保护密钥硬件设备进行通信，获得用户指纹信息以及数据保护密钥硬件设备的设备标识，加密过程依赖于所获得的用户指纹信息以及数据保护密钥硬件设备的设备标识，基于数据保护密钥硬件设备所提供的信息进行加密，相对于纯软件加密的方式来说，极大地提高了加密后对象的安全性，只要数据保护密钥硬件设备被用户持有，任何黑客或者其他想要盗取信息的人都无法对加密后对象进行破解。另一方面，由于加密过程并不是在数据保护密钥硬件设备上进行，本质上是软件执行，因此，所得到的加密后对象的存储位置可以灵活设置，而无需局限在数据保护密钥硬件设备，有效扩展了电子数据的存储空间。
其中，在上述对待加密对象进行加密时，还可以结合用户设定的密码进行。因此，上述步骤S302中向数据保护密钥硬件设备发送的信息获取指令，还可以包括密码信息获取指令。
此时，接收的数据保护密钥硬件设备根据所述信息获取指令返回的信息还可以包括有密码信息。
相应地，在步骤S303中对待加密对象进行加密时，根据所述用户指纹信息、所述设备标识、所述数据保护密钥硬件设备根据所述密码信息获取指令返回的密码信息对所述待加密对象进行加密。
其中，上述用户指纹信息可以是通过普通的指纹识别设备获得的指纹信息。为了进一步提高信息安全性，在本发明实施例中，该用户指纹信息为通过划擦式指纹获取装置获得的指纹信息。由于普通的指纹识别设备是对静态的指纹信息进行识别，指纹图片也会识别为是正确的指纹，极易被人冒用而产生欺骗效果，影响文件安全。而本发明实施例通过划擦式的方式获得指纹信息，是一种动态获取指纹信息的方式，静态的指纹信息将无法识别，避免了指纹信息被欺骗的可能，加强了安全性。
另一方面，该用户指纹信息可以不是指纹图片，而是二进制数字化的指纹信息，避免用户指纹信息被复制的可能性，进一步提高了安全性。
上述数据保护密钥硬件设备的设备标识，可以采用制造该数据保护密钥硬件设备时烧录量子计算机所产生的随机数来表示。在具有多个数字保护密钥硬件设备的情况下，这多个数字保护密钥硬件设备可以采用同一个随机数作为设备标识，该随机数可以在制造时由烧录量子计算机产生并写入，从而它们可以互为备份，在其中一个丢失的情况下，还可以由另外一个来解密加密过的文件，保证电子数据的安全。
为了进一步提高安全性，数据保护密钥硬件设备上存储的用户指纹信息、设备标识以及密码信息，可以是经过数据保护密钥硬件设备加密后得到的信息，以进一步提高安全性。具体的加密方式可以采用任何可能的方式进行，本发明实施例对此不做具体限定，例如可以采用与对待加密对象进行加密时 不同的方式进行。
在本发明的一个具体示例中，以密码信息为例，用户输入的原始密码经过数据保护密钥硬件设备的加密后，得到的密码信息可以为一个随机数，且加密后得到的密码信息的存储位置也可以通过生成的随机数来确定。基于此，数据保护密钥硬件设备在接收到密码信息获取指令时，可以先确定相应的地址随机数，基于地址随机数找到密码信息随机数的存储地址后，从密码信息随机数的存储地址获得密码信息随机数，并对该密码信息随机数进行解密得到密码信息。然后将解密得到的密码信息通过蓝牙传输给密码信息获取指令的发送方，即终端设备，其中，蓝牙传输的过程可以通过加密的方式进行。用户指纹信息、设备标识的存储和获取方式可以与上述密码信息类似。
如图3所示，在上述步骤S303中得到加密后对象后，可在步骤S304中存储到预定路径对应的位置，其可以是任何可以存储电子文件及电子信息的位置，例如终端设备上、便携式存储设备、云端等等。
考虑到在得到加密后对象后，将未加密前的待加密对象继续存储存在被他人获知进而影响文件信息安全性的风险，因此，如图3所示，在上述步骤S303得到加密后对象后，还可以进入步骤S305：将所述待加密对象进行物理删除。
其中，对待加密对象的物理删除，可以在需要时才进行，也可以是每一次加密完成后都直接对待加密对象进行物理删除。
在有需要时才对待加密对象进行物理删除的情况下，可以基于终端设备的提示进行。例如，在步骤S303中得到待加密对象后，可以给出是否需要物理删除源文件的提示信息，该提示信息会在终端设备的显示界面上进行显示，以供用户进行选择。若用户选择删除，基于其选定的选择项，会发出一个物理删除源文件指令，终端设备会基于该物理删除源文件指令物理删除上述待加密对象。
在每一次加密完成后都要将待加密对象进行物理删除的情况下，则在加密完成后，直接将上述待加密对象进行物理删除即可。
由于操作系统对文件删除时，考虑到速度以及磁盘寿命等因素，一般并不会真正删除用户删掉的文件，而是进行逻辑删除，逻辑删除是在需要删除的文件存储位置做一个删除标记，并在客户端告知客户文件已删除，并修改容量记录。即在写入新文件来覆盖这些区域之前，这些用户认为已经删除的文件是可以被恢复的，存在被他人恢复而影响安全性的风险。本发明实施例方案通过对待加密对象进行物理删除，避免了待加密对象未被应用系统真正删除所存在的被恢复的风险。
在对待加密对象进行物理删除时，可以采用各种可能的方式进行，在本发明实施例中，可以是在系统将待加密对象进行逻辑删除后，将逻辑删除后的标记位置写入随机数。由于是通过随机数来将待 加密对象的位置进行覆盖，覆盖后无法恢复出覆盖之前的信息，避免了待加密对象被他人恢复的风险，进一步提高了信息的安全性。
基于上述图3中所示的示例性说明，可以得知，本发明实施例方案，涉及到将硬件与软件结合来实现电子数据的保护。据此，图4示出了一个实施例中的电子数据保护方法的加密过程的原理示意图。图5示出了一个实施例中的电子数据保护方法中，终端设备与数据保护密钥硬件设备之间的交互过程的流程示意图。
如图4所示，终端设备可以是PC、平板、手机的终端，终端设备在待加密对象进行加密的过程中，从数据保护密钥硬件设备分别获得用户指纹信息、设备标识、密码信息等信息，完成加密过程。
结合图4、图5所示，一个具体的对待加密对象进行加密的示例可以是如下所述。
首先，终端设备在接收到加密指令时，开始执行加密过程。在加密过程中，需要应用到指纹信息时，向数据保护密钥硬件设备发送指纹信息获取指令。
数据保护密钥硬件设备接收到该指纹信息获取指令后，先查找到存储指纹信息的指纹地址随机数，然后基于指纹地址随机数获得加密的指纹随机数，再对指纹随机数进行解密，获得用户指纹信息。获得的用户指纹信息经过蓝牙加密后传输给终端设备。
终端设备接收到经过蓝牙加密的用户指纹信息后，对蓝牙加密的用户指纹信息进行蓝牙解密，得到用户指纹信息，并继续完成基于用户指纹信息的加密过程。
随后，终端设备继续执行加密过程，并在需要应用到设备标识时，向数据保护密钥硬件设备发送设备标识获取指令。
数据保护密钥硬件设备接收到该设备标识获取指令后，先查找到存储设备标识的设备标识地址随机数，然后基于设备标识地址随机数获得加密的设备标识随机数，在对设备标识随机数进行解密，获得设备标识。获得的设备标识经过蓝牙加密后传输给终端设备。
终端设备接收到经过蓝牙加密的设备标识后，对蓝牙加密的设备标识进行蓝牙解密，得到设备标识，并继续完成基于设备标识的加密过程。
随后，终端设备继续执行加密过程，并在需要应用到需要从数据保护密钥硬件设备获得的信息时，例如密码信息，采用与上述同样的方式获得后继续进行加密，直至完成加密过程得到加密后对象，并对待加密对象进行物理删除。
需要说明的是，上述具体示例的说明中，是以依次获得用户指纹信息、设备标识为例进行说明，基于实际需要以及加密算法设计的不同，也可以是采用其他的顺序来获得用户指纹信息、设备标识以及密码信息等信息，也可以是同时获得这些信息，本发明实施例对此不做具体限定。
基于本发明实施例的方案，还可以用以实现加密后文件的分享，在具体实施时，可以基于选择项来选择是进行常规的加密还是需要进行文件分享的加密，例如菜单栏，或者为常规加密、需要进行文件分享的加密设置不同的加密触发控件来接收加密指令等等，可以基于各种不同的方式来实现这种选择。
在需要加密生成可以进行分享的加密后文件时，在对待加密对象进行加密时，同时需结合待分享目标用户持有的数据保护密钥硬件设备的公有密钥进行。例如，假设用户A需要对文件进行加密后分享给目标用户B，用户A持有数据保护密钥硬件设备A，目标用户B持有数据保护密钥硬件设备B，则用户A采用终端设备对待分享的待加密文件进行加密时，不仅需要结合数据保护密钥硬件设备A中存储的用户指纹信息、设备标识等信息，还需同时结合数据保护密钥硬件设备B的公有密钥进行。得到的加密后文件分享给目标用户B之后，基于数据保护密钥硬件设备B的私有密钥即可实现对加密后文件的解密，实现文件的加密分享。从而，在进行加密分享时，是基于待分享目标用户持有的数据保护密钥硬件设备的公有密钥进行，从而仅能结合待分享目标用户持有的数据保护密钥硬件设备的私有密钥才能实现加密后文件的解密，实现了文件的安全分享。
基于本发明实施例的思想，在加密后对象需要打开时，也可以对其进行保护，以防被他人窃取。图5中示出了一个实施例中打开加密后对象时进行运行中保护的原理示意图。在图5所示中，是以加密后对象为文件、且加密后文件是结合用户指纹信息、密码信息、设备标识进行加密为例进行说明。
如图5所示，加密后文件可以采用本发明方法对应的软件打开，也可以采用外部软件来打开。
在采用与本发明方法对应的软件打开时，一个具体的实现过程可以是如下所述：
在接收到加密文件打开指令时，执行对加密后文件的解密过程，并在解密过程中，从所述数据保护密钥硬件设备获取用户指纹信息、密码信息以及所述数据保护密钥硬件设备的设备标识，具体的获取过程可以与如上所述的示例中的相同；
随后，根据获取的用户指纹信息、密码信息、设备标识，采用与上述解密时的方式对应的解密方式对加密后文件进行解密；
调用应用系统内存沙箱，将解密后文件在所述应用系统内存沙箱中运行。
此外，解密后得到的解密后文件，还可以通过调用外部软件来打开，但本发明实施例方案会追踪每一个加密后文件的打开与关闭情况。此时，在监测到加密后文件被外部应用打开时，调用应用系统内存沙箱，将加密后文件被外部应用打开后生成的内存文件在应用系统内存沙箱中运行。
另一方面，目前的软件应用在打开文件时，都在终端应用系统生成临时文件，而在文件关闭后该临时文件并不会予以删除，因而会影响到文件的安全性。据此，本发明实施例方案还追踪加密后对象 的关闭情况，图6中示出了一个示例中关闭打开的加密后对象后的保护原理示意图。如图6所示，在监测到加密后对象关闭时，可以删除终端应用系统生成的临时文件。为了进一步增强安全性，在监测到所述加密后对象关闭时，删除终端应用系统生成的临时文件的过程可以通过下述方式进行：在临时文件的存储位置写入随机数覆盖所述临时文件，然后再删除覆盖后的临时文件。从而即使临时文件被他人获知，由于该临时文件已经被随机数破坏，因而也无法还原出原始文件。
由此可见，基于本发明实施例的方法，加密后对象无论采用何种方式打开，在内存中的文件都是在沙箱保护下运行，在被外部软件打开时，在文件关闭后对临时文件及时进行了删除，避免了文件打开过程中的内存文件和文件关闭后的临时文件被盗取的安全隐患。
基于与上述电子数据保护方法相同的思想，本发明实施例还提供一种电子数据保护装置。图7中示出了一个实施例中的电子数据保护装置的结构示意图。
如图7所示，本实施例中的电子数据保护装置包括有：
加密指令接收模块701，用于接收加密指令；
信息获取模块702，用于在加密过程中，分别向数据保护密钥硬件设备发送信息获取指令，所述信息获取指令包括设备标识获取指令、指纹信息获取指令，并分别接收所述数据保护密钥硬件设备根据所述信息获取指令返回的信息，所述信息分别包括设备标识、用户指纹信息；
加密处理模块703，用于根据所述加密指令执行加密过程，并根据所述数据保护密钥硬件设备返回的信息完成对待加密对象的加密，得到加密后对象。
根据如上所述的本发明实施例的装置，其本质上是实现了是采用了软硬件结合的方式对待加密对象进行加密，且在对待加密对象进行加密过程中不断地与数据保护密钥硬件设备进行通信，获得用户指纹信息以及数据保护密钥硬件设备的设备标识，加密过程依赖于所获得的用户指纹信息以及数据保护密钥硬件设备的设备标识，基于数据保护密钥硬件设备所提供的信息进行加密，相对于纯软件加密的方式来说，极大地提高了加密后对象的安全性，只要数据保护密钥硬件设备被用户持有，任何黑客或者其他想要盗取信息的人都无法对加密后对象进行破解。另一方面，由于加密过程并不是在数据保护密钥硬件设备上进行，本质上是软件执行，因此，所得到的加密后对象的存储位置可以灵活设置，而无需局限在数据保护密钥硬件设备，有效扩展了电子数据的存储空间。
其中，在上述对待加密对象进行加密时，还可以结合用户设定的密码进行。因此，上述信息获取模块702向数据保护密钥硬件设备发送的信息获取指令，还可以包括密码信息获取指令。
此时，信息获取模块702接收的数据保护密钥硬件设备根据所述信息获取指令返回的信息还可 以包括有密码信息。
相应地，加密处理模块703在对待加密对象进行加密时，根据所述用户指纹信息、所述设备标识、所述数据保护密钥硬件设备根据所述密码信息获取指令返回的密码信息对所述待加密对象进行加密。
其中，上述用户指纹信息可以是通过普通的指纹识别设备获得的指纹信息。为了进一步提高信息安全性，在本发明实施例中，该用户指纹信息为通过划擦式指纹获取装置获得的指纹信息。由于普通的指纹识别设备是对静态的指纹信息进行识别，指纹图片也会识别为是正确的指纹，极易被人冒用而产生欺骗效果，影响文件安全。而本发明实施例通过划擦式的方式获得指纹信息，是一种动态获取指纹信息的方式，静态的指纹信息将无法识别，避免了指纹信息被欺骗的可能，加强了安全性。
另一方面，该用户指纹信息可以不是指纹图片，而是二进制数字化的指纹信息，避免用户指纹信息被复制的可能性，进一步提高了安全性。
上述数据保护密钥硬件设备的设备标识，可以采用制造该数据保护密钥硬件设备时烧录量子计算机所产生的随机数来表示。在具有多个数字保护密钥硬件设备的情况下，这多个数字保护密钥硬件设备可以采用同一个随机数作为设备标识，该随机数可以在制造时由烧录量子计算机产生并写入，从而它们可以互为备份，在其中一个丢失的情况下，还可以由另外一个来解密加密过的文件，保证电子数据的安全。
为了进一步提高安全性，数据保护密钥硬件设备上存储的用户指纹信息、设备标识以及密码信息，可以是经过数据保护密钥硬件设备加密后得到的信息，以进一步提高安全性。具体的加密方式可以采用任何可能的方式进行，本发明实施例对此不做具体限定，例如可以采用与对待加密对象进行加密时不同的方式进行。
在本发明的一个具体示例中，以密码信息为例，用户输入的原始密码经过数据保护密钥硬件设备的加密后，得到的密码信息可以为一个随机数，且加密后得到的密码信息的存储位置也可以通过生成的随机数来确定。基于此，数据保护密钥硬件设备在接收到密码信息获取指令时，可以先确定相应的地址随机数，基于地址随机数找到密码信息随机数的存储地址后，从密码信息随机数的存储地址获得密码信息随机数，并对该密码信息随机数进行解密得到密码信息。然后将解密得到的密码信息通过蓝牙传输给密码信息获取指令的发送方，即终端设备，其中，蓝牙传输的过程可以通过加密的方式进行。用户指纹信息、设备标识的存储和获取方式可以与上述密码信息类似。
在经过加密处理模块703的加密处理得到加密后对象后，可将得到的加密后对象存放到预定路径对应的位置，其可以是任何可以存储电子文件及电子信息的位置，例如终端设备上、便携式存储设 备、云端等等。
考虑到在得到加密后对象后，将未加密前的待加密对象继续存储存在被他人获知进而影响文件信息安全性的风险，因此，如图7所示，本实施例中的装置还可以包括有物理删除模块704，用于在加密处理模块703得到加密后对象后，将所述待加密对象进行物理删除。
其中，对待加密对象的物理删除，可以在需要时才进行，也可以是每一次加密完成后都对待加密对象进行物理删除。
在有需要时才对待加密对象进行物理删除的情况下，可以基于终端设备的提示进行，例如，在加密处理模块703得到待加密对象后，物理删除模块704可以给出是否需要物理删除源文件的提示信息，该提示信息会在终端设备的显示界面上进行显示，以供用户进行选择。若用户选择删除，基于其选定的选择项，会发出一个物理删除源文件指令，从而物理删除模块704会基于该物理删除源文件指令物理删除上述待加密对象。
在每一次加密完成后都要将待加密对象进行物理删除的情况下，则在加密处理模块703完成加密过程得到加密后对象后，物理删除模块704直接将上述待加密对象进行物理删除即可。
由于操作系统对文件删除时，考虑到速度以及磁盘寿命等因素，一般并不会真正删除用户删掉的文件，而是进行逻辑删除，逻辑删除是在需要删除的文件存储位置做一个删除标记，并在客户端告知客户文件已删除，并修改容量记录。即在写入新文件来覆盖这些区域之前，这些用户认为已经删除的文件是可以被恢复的，存在被他人恢复而影响安全性的风险。本发明实施例方案通过对待加密对象进行物理删除，避免了待加密对象未被应用系统真正删除所存在的被恢复的风险。
物理删除模块704在对待加密对象进行物理删除时，可以采用各种可能的方式进行，在本发明实施例中，可以是在系统将待加密对象进行逻辑删除后，物理删除模块704将逻辑删除后的标记位置写入随机数。由于是通过随机数来将待加密对象的位置进行覆盖，覆盖后无法恢复出覆盖之前的信息，避免了待加密对象被他人恢复的风险，进一步提高了信息的安全性。
基于本发明实施例的方案，还可以用以实现加密后文件的分享，在具体实施时，可以基于选择项来选择是进行常规的加密还是需要进行文件分享的加密，例如菜单栏，或者为常规加密、需要进行文件分享的加密设置不同的加密触发控件来接收加密指令等等，可以基于各种不同的方式来实现这种选择。
在需要加密生成可以进行分享的加密后文件时，加密处理模块703在对待加密对象进行加密时，同时需结合待分享目标用户持有的数据保护密钥硬件设备的公有密钥进行。
例如，假设用户A需要对文件进行加密后分享给目标用户B，用户A持有数据保护密钥硬件设 备A，目标用户B持有数据保护密钥硬件设备B，则用户A采用终端设备对待分享的待加密文件进行加密时，不仅需要结合数据保护密钥硬件设备A中存储的用户指纹信息、设备标识等信息，还需同时结合数据保护密钥硬件设备B的公有密钥进行。得到的加密后文件分享给目标用户B之后，基于数据保护密钥硬件设备B的私有密钥即可实现对加密后文件的解密，实现文件的加密分享。从而，在进行加密分享时，是基于待分享目标用户持有的数据保护密钥硬件设备的公有密钥进行，从而仅能结合待分享目标用户持有的数据保护密钥硬件设备的私有密钥才能实现加密后文件的解密，实现了文件的安全分享。
如图7所示，在本实施例的装置中，还可以包括文件运行保护模块705，用以实现对加密后文件运行时的保护。
在其中一个方式中，该文件运行保护模块705，用于在加密后文件被解密后运行时，调用应用系统内存沙箱，将解密后的文件在所述应用系统内存沙箱中运行。
在另一种方式中，以加密后文件是结合用户指纹信息、密码信息、设备标识进行加密为例，该文件运行保护模块705可以在接收到加密文件打开指令时，从所述数据保护密钥硬件设备获取用户指纹信息、密码信息以及所述数据保护密钥硬件设备的设备标识，根据获取的用户指纹信息、密码信息、设备标识对所述加密后对象进行解密，并调用应用系统内存沙箱，将所述解密后的文件在所述应用系统内存沙箱中运行。
另一方面，目前的软件应用在打开文件时，都在终端应用系统生成临时文件，而在文件关闭后该临时文件并不会予以删除，因而会影响到文件的安全性。
据此，文件运行保护模块705还追踪加密后对象的关闭情况，在监测到加密后对象关闭时，可以删除终端应用系统生成的临时文件。为了进一步增强安全性，文件运行保护模块705在监测到所述加密后对象关闭时，删除终端应用系统生成的临时文件的过程可以通过下述方式进行：在临时文件的存储位置写入随机数覆盖所述临时文件，然后再删除覆盖后的临时文件。从而即使临时文件被他人获知，由于该临时文件已经被随机数破坏，也无法还原出原始文件。
从而，基于文件运行保护模块705的保护机制，加密后对象无论采用何种方式打开，在内存中的文件都是在沙箱保护下运行，在被外部软件打开时，在文件关闭后对临时文件及时进行了删除，避免了文件打开过程中的内存文件和文件关闭后的临时文件被盗取的安全隐患。
基于上述电子数据保护装置，本发明的一个实施例还提供一种终端设备，该终端设备包括有终端设备本体，在该终端设备本体的存储介质中，存储有如上所述的电子数据保护装置。该电子数据保护 装置运行时，会执行如上所述的本发明实施例的电子数据保护方法。
此外，本发明实施例中的终端设备，还可以包括有上述数据保护密钥硬件设备，且该数据保护密钥硬件设备可以有两个以上，它们的设备标识可以用制造该数据保护密钥硬件设备时烧录量子计算机所产生的随机数来表示，即它们采用相同的随机数来作为设备标识。从而它们互为备份，在其中一个丢失的情况下，还可以由另外一个来解密加密过的文件，保证电子数据的安全。
其中，在上述数据保护密钥硬件设备上可设置有重置按键，例如数据保护密钥硬件设备的背部或者其他的位置，通过该重置按键可以接收重置指令，并在接收到重置指令时，清除或者重置所述数据保护密钥硬件设备上保存的设备标识(即随机数)。在对设备标识进行清除或者重置后，之前采用此硬件加密过的文件将无法打开，可以便于用户在紧急情况下，无论加密后对象存放于何处，都可以迅速销毁所有数据。此外，在对设备标识进行重置的情况下，该数据保护密钥硬件设备还可以作为一个新的设备来使用，提升了设备使用的可持续性。
在这多个数据保护密钥硬件中，其中一个数据保护密钥硬件设备可以整合在所述终端设备本体中，从而可以在不增加终端设备本体的体积的情况下，保证了终端设备的美观性，且便于用户使用。
本领域普通技术人员可以理解实现上述实施例方法中的全部或部分流程，是可以通过计算机程序来指令相关的硬件来完成，所述的程序可存储于一计算机可读取存储介质中，该程序在执行时，可包括如上述各方法的实施例的流程。其中，所述的存储介质可为磁碟、光盘、只读存储记忆体(Read-Only Memory，ROM)或随机存储记忆体(Random Access Memory，RAM)等。
以上所述实施例的各技术特征可以进行任意的组合，为使描述简洁，未对上述实施例中的各个技术特征所有可能的组合都进行描述，然而，只要这些技术特征的组合不存在矛盾，都应当认为是本说明书记载的范围。
以上所述实施例仅表达了本发明的几种实施方式，其描述较为具体和详细，但并不能因此而理解为对发明专利范围的限制。应当指出的是，对于本领域的普通技术人员来说，在不脱离本发明构思的前提下，还可以做出若干变形和改进，这些都属于本发明的保护范围。因此，本发明专利的保护范围应以所附权利要求为准。

Claims (23)

  1. 一种电子数据保护方法，其特征在于，包括步骤：
    在接收到加密指令时，执行加密过程；
    在加密过程中，分别向数据保护密钥硬件设备发送信息获取指令，所述信息获取指令包括设备标识获取指令、指纹信息获取指令，并分别接收所述数据保护密钥硬件设备根据所述信息获取指令返回的信息，所述信息分别包括设备标识、用户指纹信息；
    根据所述数据保护密钥硬件设备返回的信息完成对待加密对象的加密，得到加密后对象。
  2. 根据权利要求1所述的电子数据保护方法，其特征在于：
    所述信息获取指令还包括密码信息获取指令，所述信息还包括数据保护密钥硬件设备根据所述密码信息获取指令返回的密码信息；
    在对所述待加密对象进行加密时，根据所述用户指纹信息、所述设备标识、所述密码信息对所述待加密对象进行加密。
  3. 根据权利要求1或2所述的电子数据保护方法，其特征在于，在对所述待加密对象进行加密时，还结合待分享目标对象的数据保护密钥硬件设备的公有密钥对所述待加密对象进行加密。
  4. 根据权利要求1或2所述的电子数据保护方法，其特征在于，在得到加密后对象后，还包括步骤：在系统将所述待加密对象进行逻辑删除后，将逻辑删除后的标记位置写入随机数。
  5. 根据权利要求1所述的电子数据保护方法，其特征在于，所述用户指纹信息为二进制数字化的指纹信息。
  6. 根据权利要求2所述的电子数据保护方法，其特征在于，在接收到加密文件打开指令时，从所述数据保护密钥硬件设备获取用户指纹信息、密码信息以及所述数据保护密钥硬件设备的设备标识；
    根据获取的用户指纹信息、密码信息、设备标识对所述加密后对象进行解密；
    调用应用系统内存沙箱，将所述解密后的文件在所述应用系统内存沙箱中运行。
  7. 根据权利要求1所述的电子数据保护方法，其特征在于，在监测到所述加密后对象被外部应用打开时，调用应用系统内存沙箱，将所述加密后对象被外部应用打开后生成的内存文件在所述应用系统内存沙箱中运行。
  8. 根据权利要求7所述的电子数据保护方法，其特征在于，在监测到所述加密后对象关闭时，在对应于所述加密后对象的临时文件的存储位置写入随机数覆盖所述临时文件后，删除覆盖后的临时文件。
  9. 根据权利要求1所述的电子数据保护方法，其特征在于，所述数据保护密钥硬件设备的设备标识为制造所述数据保护密钥硬件设备时烧录量子计算机产生的随机数。
  10. 一种电子数据保护装置，其特征在于，包括：
    加密指令接收模块，用于接收加密指令；
    信息获取模块，用于在加密过程中，分别向数据保护密钥硬件设备发送信息获取指令，所述信息获取指令包括设备标识获取指令、指纹信息获取指令，并分别接收所述数据保护密钥硬件设备根据所述信息获取指令返回的信息，所述信息分别包括设备标识、用户指纹信息；
    加密处理模块，用于根据所述加密指令执行加密过程，根据所述数据保护密钥硬件设备返回的信息完成对待加密对象的加密，得到加密后对象。
  11. 根据权利要求10所述的电子数据保护装置，其特征在于，
    所述信息获取指令还包括密码信息获取指令，所述信息还包括数据保护密钥硬件设备根据所述密码信息获取指令返回的密码信息；
    所述加密处理模块根据所述用户指纹信息、所述设备标识、所述密码信息对所述待加密对象进行加密。
  12. 根据权利要求10或11所述的电子数据保护装置，其特征在于，所述加密处理模块还结合待分享目标对象的数据保护密钥硬件设备的公有密钥对所述待加密对象进行加密。
  13. 根据权利要求10所述的电子数据保护装置，其特征在于：还包括物理删除模块，用于在所述加密处理模块得到加密后对象后，在系统将所述待加密对象进行逻辑删除后，将逻辑删除后的标记位置写入随机数。
  14. 根据权利要求10所述的电子数据保护装置，其特征在于，所述用户指纹信息为二进制数字化的指纹信息。
  15. 根据权利要求11所述的电子数据保护装置，其特征在于，还包括文件运行保护模块，用于在接收到加密文件打开指令时，从所述数据保护密钥硬件设备获取用户指纹信息、密码信息以及所述数据保护密钥硬件设备的设备标识，根据获取的用户指纹信息、密码信息、设备标识对所述加密后对象进行解密，并调用应用系统内存沙箱，将所述解密后的文件在所述应用系统内存沙箱中运行。
  16. 根据权利要求10述的电子数据保护装置，其特征在于，还包括文件运行保护模块，用于在监测到所述加密后对象被外部应用打开时，调用应用系统内存沙箱，将所述加密后对象被外部应用打开后生成的内存文件在所述应用系统内存沙箱中运行。
  17. 根据权利要求16所述的电子数据保护装置，其特征在于，所述文件运行保护模块，还用于 在监测到所述加密后对象关闭时，在对应于所述加密后对象的临时文件的存储位置写入随机数覆盖所述临时文件后，删除覆盖后的临时文件。
  18. 根据权利要求10所述的电子数据保护装置，其特征在于，所述数据保护密钥硬件设备的设备标识为制造所述数据保护密钥硬件设备时烧录量子计算机产生的随机数。
  19. 一种终端设备，包括终端设备本体，其特征在于，所述终端设备本体的存储介质存储有如上权利要求10至18任意一项所述的电子数据保护装置。
  20. 根据权利要求19所述的终端设备，其特征在于，所述终端设备还包括所述数据保护密钥硬件设备。
  21. 根据权利要求20所述的终端设备，其特征在于，所述数据保护密钥硬件设备有两个以上。
  22. 根据权利要求21所述的终端设备，其特征在于，其中一个数据保护密钥硬件设备整合在所述终端设备本体中。
  23. 一种包含计算机可读程序的存储介质，其特征在于，当该存储介质中的计算机可读程序执行时，执行上述权利要求1至9任意一项中的电子数据保护方法。
PCT/CN2015/097433 2015-04-28 2015-12-15 电子数据保护方法、装置及终端设备 WO2016173264A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US15/570,116 US20180152296A1 (en) 2015-04-28 2015-12-15 Electronic data protection method and device and terminal device
EP15890639.6A EP3291124A4 (en) 2015-04-28 2015-12-15 Electronic data protection method and device, and terminal device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510209406.5A CN104834868A (zh) 2015-04-28 2015-04-28 电子数据保护方法、装置及终端设备
CN201510209406.5 2015-04-28

Publications (1)

Publication Number Publication Date
WO2016173264A1 true WO2016173264A1 (zh) 2016-11-03

Family

ID=53812749

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/097433 WO2016173264A1 (zh) 2015-04-28 2015-12-15 电子数据保护方法、装置及终端设备

Country Status (4)

Country Link
US (1) US20180152296A1 (zh)
EP (1) EP3291124A4 (zh)
CN (1) CN104834868A (zh)
WO (1) WO2016173264A1 (zh)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2019036972A1 (zh) * 2017-08-23 2019-02-28 深圳市优品壹电子有限公司 一种数据备份方法及装置
CN110519268A (zh) * 2019-08-27 2019-11-29 深圳前海微众银行股份有限公司 基于区块链的投票方法、装置、设备、系统及存储介质
CN111259432A (zh) * 2020-02-18 2020-06-09 福州瑞芯微电子股份有限公司 一种模型数据保护方法和可读计算机存储介质
CN112733209A (zh) * 2021-01-19 2021-04-30 贵州黔龙图视科技有限公司 一种低成本硬件加密方法及装置
CN116015900A (zh) * 2022-12-28 2023-04-25 中国联合网络通信集团有限公司 数据自存储自验证方法、装置、设备及存储介质

Families Citing this family (18)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104834868A (zh) * 2015-04-28 2015-08-12 一铂有限公司 电子数据保护方法、装置及终端设备
CN105740684B (zh) * 2016-01-25 2019-04-26 联想(北京)有限公司 一种信息处理方法及电子设备
TWI623849B (zh) * 2016-01-30 2018-05-11 Wang yu qi Electronic file security system and method
CN106067875B (zh) * 2016-05-24 2020-04-17 珠海市魅族科技有限公司 智能终端加密方法与系统
CN107977569B (zh) * 2016-10-21 2021-11-12 佛山市顺德区顺达电脑厂有限公司 登入密码保护系统
CN106980580B (zh) * 2017-03-29 2018-08-03 宁夏凯速德科技有限公司 去中心化的移动硬盘加解密方法及系统
CN108229203A (zh) * 2017-12-29 2018-06-29 北京安云世纪科技有限公司 一种终端中的文件保护方法及装置
US11171959B2 (en) * 2018-08-03 2021-11-09 Dell Products L.P. Selective blocking of network access for third party applications based on file content
CN109753770A (zh) * 2019-01-07 2019-05-14 北京地平线机器人技术研发有限公司 确定烧录数据的方法及装置、烧录方法及装置、电子设备
CN109936448A (zh) * 2019-02-26 2019-06-25 北京钰安信息科技有限公司 一种数据传输方法及装置
CN113452654B (zh) * 2020-03-25 2023-04-28 深圳法大大网络科技有限公司 一种数据解密的方法
CN113221143A (zh) * 2020-04-24 2021-08-06 支付宝(杭州)信息技术有限公司 一种信息处理的方法、装置及设备
CN111639352B (zh) * 2020-05-24 2023-06-20 中信银行股份有限公司 电子证明的生成方法、装置、电子设备及可读存储介质
CN113114474B (zh) * 2021-04-17 2022-07-08 中科启迪光电子科技(广州)有限公司 一种基于芯片原子钟的量子时频密码生成识别方法
CN114513302A (zh) * 2022-01-24 2022-05-17 上海焜耀网络科技有限公司 一种数据加解密方法及设备
CN115809459B (zh) * 2023-01-18 2023-08-15 成都卫士通信息产业股份有限公司 软件密码模块的数据保护及解密方法、系统、设备及介质
CN115828289B (zh) * 2023-02-16 2023-05-30 中信天津金融科技服务有限公司 一种数字化档案的加密方法和系统
CN116192388B (zh) * 2023-04-26 2023-08-01 广东广宇科技发展有限公司 一种基于数字指纹的混合密钥加密处理方法

Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1866224A (zh) * 2005-05-20 2006-11-22 联想(北京)有限公司 一种移动存储装置及存取移动存储装置中加密数据的方法
CN101345619A (zh) * 2008-08-01 2009-01-14 清华大学深圳研究生院 基于生物特征和移动密钥的电子数据保护方法及装置
CN103942488A (zh) * 2011-04-21 2014-07-23 北京奇虎科技有限公司 利用沙箱技术进行防御的方法、装置及安全浏览器
CN104090793A (zh) * 2014-07-07 2014-10-08 四川效率源信息安全技术有限责任公司 一种销毁安卓手机机身数据的装置和方法
CN104158880A (zh) * 2014-08-19 2014-11-19 济南伟利迅半导体有限公司 一种用户端云数据共享解决方法
US20150010146A1 (en) * 2012-03-02 2015-01-08 Sony Corporation Information processing apparatus, information processing method, and program
CN104468937A (zh) * 2013-09-12 2015-03-25 中兴通讯股份有限公司 移动终端的数据加、解密方法、装置及保护系统
CN104834868A (zh) * 2015-04-28 2015-08-12 一铂有限公司 电子数据保护方法、装置及终端设备

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP3434756B2 (ja) * 1999-12-07 2003-08-11 エヌイーシ−カスタムテクニカ株式会社 指紋認証方法及び装置
US7447911B2 (en) * 2003-11-28 2008-11-04 Lightuning Tech. Inc. Electronic identification key with portable application programs and identified by biometrics authentication
TWI307046B (en) * 2004-04-30 2009-03-01 Aimgene Technology Co Ltd Portable encrypted storage device with biometric identification and method for protecting the data therein
DE202005011204U1 (de) * 2005-07-16 2005-09-22 Eugster/Frismag Ag Espressomaschine mit einer Espressobrüheinheit
CN101325774A (zh) * 2008-07-30 2008-12-17 青岛海信移动通信技术股份有限公司 一种加、解密方法及其移动终端
WO2010035202A1 (en) * 2008-09-26 2010-04-01 Koninklijke Philips Electronics N.V. Authenticating a device and a user
US8817984B2 (en) * 2011-02-03 2014-08-26 mSignia, Inc. Cryptographic security functions based on anticipated changes in dynamic minutiae
CN102857336A (zh) * 2011-06-28 2013-01-02 北大方正集团有限公司 用于点阵文件的加密方法、解密方法及系统
US8645763B2 (en) * 2011-09-12 2014-02-04 Microsoft Corporation Memory dump with expanded data and user privacy protection
KR102251831B1 (ko) * 2015-04-16 2021-05-13 삼성전자주식회사 외부 디바이스에게 태스크 실행을 요청하는 디바이스 및 그 방법

Patent Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1866224A (zh) * 2005-05-20 2006-11-22 联想(北京)有限公司 一种移动存储装置及存取移动存储装置中加密数据的方法
CN101345619A (zh) * 2008-08-01 2009-01-14 清华大学深圳研究生院 基于生物特征和移动密钥的电子数据保护方法及装置
CN103942488A (zh) * 2011-04-21 2014-07-23 北京奇虎科技有限公司 利用沙箱技术进行防御的方法、装置及安全浏览器
US20150010146A1 (en) * 2012-03-02 2015-01-08 Sony Corporation Information processing apparatus, information processing method, and program
CN104468937A (zh) * 2013-09-12 2015-03-25 中兴通讯股份有限公司 移动终端的数据加、解密方法、装置及保护系统
CN104090793A (zh) * 2014-07-07 2014-10-08 四川效率源信息安全技术有限责任公司 一种销毁安卓手机机身数据的装置和方法
CN104158880A (zh) * 2014-08-19 2014-11-19 济南伟利迅半导体有限公司 一种用户端云数据共享解决方法
CN104834868A (zh) * 2015-04-28 2015-08-12 一铂有限公司 电子数据保护方法、装置及终端设备

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3291124A4 *

Cited By (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2019036972A1 (zh) * 2017-08-23 2019-02-28 深圳市优品壹电子有限公司 一种数据备份方法及装置
CN110519268A (zh) * 2019-08-27 2019-11-29 深圳前海微众银行股份有限公司 基于区块链的投票方法、装置、设备、系统及存储介质
CN110519268B (zh) * 2019-08-27 2024-03-05 深圳前海微众银行股份有限公司 基于区块链的投票方法、装置、设备、系统及存储介质
CN111259432A (zh) * 2020-02-18 2020-06-09 福州瑞芯微电子股份有限公司 一种模型数据保护方法和可读计算机存储介质
CN111259432B (zh) * 2020-02-18 2023-09-12 瑞芯微电子股份有限公司 一种模型数据保护方法和可读计算机存储介质
CN112733209A (zh) * 2021-01-19 2021-04-30 贵州黔龙图视科技有限公司 一种低成本硬件加密方法及装置
CN112733209B (zh) * 2021-01-19 2023-08-08 贵州黔龙图视科技有限公司 一种低成本硬件加密方法及装置
CN116015900A (zh) * 2022-12-28 2023-04-25 中国联合网络通信集团有限公司 数据自存储自验证方法、装置、设备及存储介质
CN116015900B (zh) * 2022-12-28 2024-05-17 中国联合网络通信集团有限公司 数据自存储自验证方法、装置、设备及存储介质

Also Published As

Publication number Publication date
US20180152296A1 (en) 2018-05-31
CN104834868A (zh) 2015-08-12
EP3291124A4 (en) 2018-05-16
EP3291124A1 (en) 2018-03-07

Similar Documents

Publication Publication Date Title
WO2016173264A1 (zh) 电子数据保护方法、装置及终端设备
US11263020B2 (en) System and method for wiping encrypted data on a device having file-level content protection
CN103106372B (zh) 用于Android系统的轻量级隐私数据加密方法及系统
US8589680B2 (en) System and method for synchronizing encrypted data on a device having file-level content protection
US8412934B2 (en) System and method for backing up and restoring files encrypted with file-level content protection
US8433901B2 (en) System and method for wiping encrypted data on a device having file-level content protection
CN107078904B (zh) 混合密码密钥导出
US9811478B2 (en) Self-encrypting flash drive
US7257717B2 (en) Method with the functions of virtual space and data encryption and invisibility
CN103617401B (zh) 一种数据文件保护方法及装置
CN103955654A (zh) 基于虚拟文件系统的u盘安全存储方法
US10430596B2 (en) Information processing method, terminal and nonvolatile machine-readable medium
CN110806919A (zh) 一种云环境下保护虚拟机镜像的方法及系统
EP2835997A1 (en) Cell phone data encryption method and decryption method
WO2015176531A1 (zh) 终端数据写入、读取的方法及装置
WO2013155800A1 (zh) 一种移动终端信息安全管理的方法、装置和移动终端
CN115982761A (zh) 敏感信息处理方法、装置、电子设备和存储介质
CN109934013A (zh) 一种数据保护方法及装置
CN116594567A (zh) 信息管理方法、装置和电子设备
CN109344632A (zh) 一种基于硬件加密卡的openstack卷加密方法
CN107688729B (zh) 基于可信主机的应用程序保护系统及方法
WO2015131585A1 (zh) 一种保证sd卡安全的方法和装置
CN108319872A (zh) 一种封闭容器生成方法、装置及设备
JP2016538640A (ja) プログラム保護装置
TWI432986B (zh) Mobile device specific encryption method

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15890639

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 15570116

Country of ref document: US

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 2015890639

Country of ref document: EP