WO2016187966A1 - 一种终端及保护终端数据安全的方法 - Google Patents

一种终端及保护终端数据安全的方法 Download PDF

Info

Publication number
WO2016187966A1
WO2016187966A1 PCT/CN2015/087038 CN2015087038W WO2016187966A1 WO 2016187966 A1 WO2016187966 A1 WO 2016187966A1 CN 2015087038 W CN2015087038 W CN 2015087038W WO 2016187966 A1 WO2016187966 A1 WO 2016187966A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
information
location information
security
access mode
Prior art date
Application number
PCT/CN2015/087038
Other languages
English (en)
French (fr)
Inventor
郝志坚
朱钰
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2016187966A1 publication Critical patent/WO2016187966A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication

Definitions

  • This document refers to, but is not limited to, information security technologies, especially a terminal and a method for protecting terminal data security.
  • the solution adopted for protecting the personal privacy information and data security of the terminal is generally to set a network account bound with the terminal identification module (SIM, Subscriber Identity Module) card number. Once the terminal is lost, the network account can be used to remotely control. Perform location tracking and erase the data in the terminal by sending an instruction to ensure the security of the terminal data.
  • SIM terminal identification module
  • Subscriber Identity Module Subscriber Identity Module
  • the scheme for protecting the data security of the terminal requires the user to apply for the network account in advance to be bound to the SIM card of the terminal, and when the terminal is lost, the network control may not be performed in time or inconvenience, or the terminal is directly brushed or replaced.
  • the SIM card invalidates the current scheme for protecting terminal data security.
  • This paper provides a terminal and a method for protecting data security of the terminal, which can prevent the important information in the mobile terminal from being leaked and facilitate the retrieval of the lost terminal, thereby improving the security of the terminal data and the terminal itself.
  • a method of protecting data security of a terminal comprising:
  • the terminal When the terminal is lit, the terminal performs authentication according to the input instruction
  • the terminal After the terminal fails to authenticate, the terminal enters a first access mode; the first access mode sets the low security level data to be accessible, sets other security level data to be inaccessible, and follows the preset
  • the sending policy and the target terminal information pre-existing in the terminal security area, the location information of the terminal itself and the identification information of the terminal are sent to the target terminal;
  • the terminal After the terminal successfully authenticates, the terminal enters a second access mode; the second access mode is to set all data of the terminal to be accessible.
  • the method further includes: the terminal setting a security level of the terminal data according to security of the data.
  • the terminal performing authentication according to the input instruction includes:
  • the terminal receives the input password information
  • the terminal compares the input password information with the preset password information. When the two are consistent, the authentication succeeds; when the two are inconsistent, the authentication fails.
  • the sending, by the terminal, the location information of the terminal and the identifier information of the terminal to the target terminal according to the preset sending policy and the target terminal information in the pre-existing terminal security area includes:
  • the terminal acquires current location information and compares the pre-stored security location information
  • the terminal When the current location information of the terminal is consistent with the pre-stored security location information, the terminal does not send its own location information and identity information of the terminal;
  • the terminal sends the location information of the location and the identity information of the terminal to the target terminal according to a predetermined time interval.
  • the terminal entering the second access mode includes:
  • the terminal When the terminal is in the first access mode before the lighting, and the terminal is successfully authenticated, the terminal stops transmitting its own location information and the identification information of the terminal, and enters the second access mode;
  • the terminal When the terminal is in the second access mode before lighting, and the terminal successfully authenticates, the terminal continues to be in the second access mode.
  • a terminal includes: an authentication unit, a first access control unit, and a second access control unit;
  • the authentication unit is configured to perform authentication according to an input instruction when the terminal is lit;
  • the first access control unit is configured to: after the authentication unit fails to authenticate, instruct the terminal to enter a first access mode; the first access mode is to set low security level data to be accessible, and to perform other security The level data is set to be inaccessible, and the location information of the terminal and the identification information of the terminal are sent to the target terminal according to the preset sending policy and the target terminal information pre-existing in the terminal security area;
  • the second access control unit is configured to: when the authentication unit is successfully authenticated, instruct the terminal to enter a second access mode; and the second access mode is to set all data of the terminal to be accessible.
  • the terminal further includes: a setting unit configured to set a security level of the terminal data according to security of the data in advance.
  • the authentication unit includes a monitoring subunit, a receiving subunit, and a comparing subunit;
  • the monitoring subunit is configured to monitor whether the terminal is lit; and when the terminal is illuminated, triggering the receiving subunit;
  • the receiving subunit is configured to receive the input password information
  • the comparison subunit is configured to compare the input password information with preset password information. When the two are consistent, the authentication succeeds; when the two are inconsistent, the authentication fails.
  • the terminal further includes: an obtaining unit and a comparing unit;
  • the obtaining unit is configured to acquire current location information
  • the comparison unit is configured to compare the current location information with pre-stored security location information
  • the sending, by the first access control unit, the location information of the terminal and the identifier information of the terminal to the target terminal according to the preset transmission policy and the target terminal information in the pre-existing terminal security area means:
  • the first access control unit does not send the location information of the terminal and the identification information of the terminal when the current location information is consistent with the pre-stored security location information; when the current location information and location When the pre-stored security location information is inconsistent, the location information of the terminal and the identity information of the terminal are transmitted to the target terminal according to a predetermined time interval.
  • the second access control unit is configured to: when the authentication unit is successfully authenticated, indicating that the terminal enters the second access mode, is:
  • the second access control unit is in the first access mode before the terminal is lit, and after the authentication unit is successfully authenticated, the location information indicating that the first access control unit stops transmitting and the identifier information of the terminal are instructed. And controlling the terminal to enter the second access mode; and, when the terminal is in the second access mode before lighting, and the authentication unit is successfully authenticated, controlling the terminal to continue in the second access mode.
  • the embodiment of the invention provides a terminal and a method for protecting the data security of the terminal, pre-storing the information of the target terminal in the terminal security area, and setting the low security level data to be accessible after the terminal authentication fails, and the other security level data are It is set to be inaccessible, and the relevant information of the terminal itself is sent to the target terminal according to the information of the security terminal pre-stored target terminal.
  • the technical solution provided by the embodiment of the invention can prevent the important information in the terminal from being leaked and facilitate the retrieval of the lost terminal, thereby improving the security of the terminal data and the terminal itself.
  • FIG. 1 is a schematic flowchart of a method for protecting data security of a terminal according to Embodiment 1 of the present invention
  • FIG. 2 is a schematic flowchart of a method for protecting data security of a terminal according to Embodiment 2 of the present invention
  • FIG. 3 is a schematic structural diagram of a terminal according to Embodiment 3 of the present invention.
  • FIG. 4 is a schematic structural diagram of another terminal according to Embodiment 3 of the present invention.
  • This embodiment provides a method for protecting data security of a terminal. As shown in FIG. 1, the method may include S101 to S103:
  • the terminal when the terminal is woken up in the black screen standby state, the terminal can perform authentication by password verification.
  • the terminal performing the authentication according to the input instruction may include: the terminal receiving the password information input by the user, and then comparing the input password information with the preset password information, and when the two are consistent, the authentication succeeds; When the inconsistencies are inconsistent, the authentication fails.
  • the password information in this embodiment may be a digital password, a graphic image password, a gesture password, etc., which is not specifically limited in the embodiment.
  • the terminal may set the data access mode of the terminal according to the authentication result, and the specific form of the data access mode may be as described in subsequent S102 and S103.
  • the first access mode may be strict when the terminal authentication fails, so the first access mode may set the low security level data to be accessible, set other security level data to be inaccessible, and send according to the preset.
  • the policy and the target terminal information pre-existing in the terminal security area transmit the location information of the terminal itself and the identification information of the terminal to the target terminal; thereby ensuring the security of the terminal data.
  • the meanings that can be accessed include operations such as viewing, deleting, and modifying data.
  • the terminal when the terminal authentication fails, the terminal may be considered to be lost or the terminal is temporarily lending to others for use.
  • the accessibility of the terminal data needs to be set.
  • the terminal data may include various types of data, such as an application, a personal identity data, an audio file, a video file, and a text file, which is not specifically limited in this embodiment. .
  • the security level of the terminal data may be set in advance according to the security of the data.
  • the step of setting the security level may be, but is not limited to, being performed before step S101; the user may also modify the security level of the terminal data after the authentication is successful.
  • the security level of the terminal data may be set to a general level, an important level, a special level, a privacy level, etc., and the default level is a general level.
  • the data of the general level can be regarded as data that does not include the personal information of the terminal user, such as a downloaded game, a video file, an audio file, etc., and the low security level data in this embodiment may correspond to general level data.
  • the terminal security area may be a specific area in the terminal, and the storage content of the specific area is not affected by operations such as flashing, formatting, and restoring factory settings.
  • security software may be installed in the specific area, and the security software may bind the terminal to the target terminal information, where the target terminal information may be an identifier of the target terminal, such as a mobile device international identity code (IMEI of the target terminal). , International Mobile Equipment Identity), an International Mobile Subscriber Identification Number (IMSI) of the SIM card inserted in the target terminal, or a network account bound to the SIM card inserted in the target terminal.
  • IMEI mobile device international identity code
  • IMSI International Mobile Subscriber Identification Number
  • the terminal is operated by other users within the controllable range of the user, for example, when the child in the home holds the terminal and performs irregular operation, resulting in incorrect password input, the terminal can be set to not need to set itself.
  • the location information and the identification information of the terminal are sent to the target terminal;
  • the terminal sends the location information of the terminal and the identifier information of the terminal to the target terminal according to the preset sending policy and the target terminal information in the pre-existing terminal security area, which may include:
  • the terminal acquires current location information and compares it with pre-stored security location information
  • the terminal When the current location information of the terminal is consistent with the pre-stored security location information, the terminal does not send its own location information and the identity information of the terminal;
  • the terminal When the current location information of the terminal is inconsistent with the pre-stored security location information, the terminal sends its own location information and the identification information of the terminal to the target terminal according to a predetermined time interval.
  • the stored secure location information may have one or more.
  • the current location information of the terminal is considered to be consistent with the pre-stored security location information as long as it is the same as the security location information.
  • the terminal may periodically and continuously send its own location information and the identification information of the terminal to the target terminal, or may only send N times its own location information to the target terminal and the Identification information of the terminal, where N is a predetermined number of times.
  • the second access mode is to set all data of the terminal to be accessible.
  • the second access mode should be all data that can access the terminal.
  • the terminal may be in the first access mode before lighting, that is, the terminal may send its own location information and the identification information of the terminal to the target terminal before lighting, and the information may be stopped at this time.
  • the terminal After the terminal successfully authenticates, the terminal enters the second access mode, including:
  • the terminal When the terminal is in the first access mode before the lighting, and the terminal is successfully authenticated, the terminal stops transmitting its own location information and the identification information of the terminal, and enters the second access mode;
  • the terminal When the terminal is in the second access mode before the lighting, and the terminal is successfully authenticated, the terminal continues to be in the second access mode.
  • the embodiment provides a method for protecting data security of a terminal.
  • a method for protecting data security of a terminal By pre-storing the information of the target terminal in the security area of the terminal, and setting the low security level data to be accessible after the terminal authentication fails, setting other security level data to It is inaccessible, and the related information of the terminal itself is transmitted to the target terminal according to the information of the target terminal in the security zone, which can prevent the important information in the terminal from being leaked and facilitate the retrieval of the lost terminal, thereby improving the security of the terminal data and the terminal itself.
  • this embodiment provides a method for protecting data security of a terminal.
  • the detailed process of the method may include S201 to S209:
  • the terminal pre-stores the target terminal information in the security area, and sets the security level of the terminal data to a general level, an important level, a special level, and a privacy level;
  • S203 the terminal compares the input password information with the preset password information; when the two are inconsistent, the process proceeds to S204; when the two are consistent, the process proceeds to S207;
  • steps S202 to S203 are processes for performing authentication according to an input instruction when the terminal is lit.
  • step S204 The terminal determines to obtain the current location information, and compares with the pre-stored security location information. When the current location information of the terminal is consistent with the pre-stored security location information, step S205 is performed; when the current location information of the terminal and the pre-stored security When the location information is inconsistent, step S206 is performed;
  • S205 The terminal sets the terminal data with the data security level of the general level to be accessible, and sets other security level data to be inaccessible;
  • the terminal sets the terminal data with the data security level to the general level to be accessible, and sets other security level data to be inaccessible; and sets the own terminal information according to the predetermined time interval and the target terminal information in the pre-existing terminal security area.
  • the location information and the identification information of the terminal are sent to the target terminal;
  • steps S204 to S206 are the process in which the terminal enters the first access mode after the terminal fails to authenticate, and it can be understood that when the terminal enters the first access mode, the low security level data is set to be accessible. The other security level data is set to be inaccessible.
  • the terminal location information when the terminal is in the user controllable range, the terminal does not need to send its own location information and the terminal identification information to the target terminal.
  • the following steps S207 to S209 are the processes of entering the second access mode after the terminal is successfully authenticated. It can be understood that, after the terminal is successfully authenticated, the terminal is operated by the user. Therefore, the second access mode is accessible. All data of the terminal, so the second access mode is to set all data of the terminal to be accessible.
  • S207 The terminal acquires an access mode before lighting
  • the embodiment provides a specific process for protecting data security of the terminal.
  • the information of the target terminal is pre-stored in the security area of the terminal, and the low security level data is set to be accessible after the terminal authentication fails, and other security level data are set.
  • the information of the target terminal is pre-stored in the security area of the terminal, and the low security level data is set to be accessible after the terminal authentication fails, and other security level data are set.
  • the terminal 30 may include: an authentication unit 301, a first access control unit 302, and a second access. Control unit 303, wherein
  • the authentication unit 301 is configured to perform authentication according to an input instruction when the terminal is lit;
  • the first access control unit 302 is configured to instruct the terminal 30 to enter the first access mode after the authentication unit 302 fails to authenticate; wherein the first access mode is to set the low security level data to be accessible, and the other security levels are The data is set to be inaccessible, and the location information of the terminal 30 and the identification information of the terminal 30 are sent to the target terminal according to the preset transmission policy and the target terminal information in the security area of the pre-existing terminal 30;
  • the second access control unit 303 is configured to instruct the terminal 30 to enter the second access mode after the authentication unit 301 successfully authenticates; wherein the second access mode is to set all data of the terminal 30 to be accessible.
  • the terminal 30 further includes a setting unit 304 configured to set the security level of the terminal 30 data according to the security of the data.
  • the authentication unit 301 includes a monitoring subunit 3023, a receiving subunit 3021, and a comparing subunit 3022, where
  • the monitoring subunit 3023 is configured to monitor whether the terminal is lit; and when the terminal is illuminated, the receiving subunit 3021 is triggered;
  • the receiving subunit 3021 is configured to receive the input password information
  • the comparison sub-unit 3022 is configured to compare the input password information with the preset password information. When the two are consistent, the authentication succeeds; when the two are inconsistent, the authentication fails.
  • the terminal 30 further includes: an obtaining unit 305, a comparing unit 306, wherein the obtaining unit 305 is configured to acquire current location information of the terminal 30;
  • the comparison unit 306 is configured to compare the current location information of the terminal 30 with the pre-stored security location information
  • the sending, by the first access control unit, the location information of the terminal and the identifier information of the terminal to the target terminal according to the preset transmission policy and the target terminal information in the pre-existing terminal security area means:
  • the first access control unit When the current location information of the terminal 30 is consistent with the pre-stored security location information, the first access control unit does not send the location information of the terminal 30 and the identifier information of the terminal 30; when the current location information of the terminal 30 and the pre-stored security location information When they are inconsistent, the location information of the terminal 30 and the identification information of the terminal 30 are transmitted to the target terminal at predetermined time intervals.
  • the second access control unit 303 is configured to: when the authentication unit is successfully authenticated, indicating that the terminal enters the second access mode, is:
  • the second access control unit 303 is configured to indicate that the first access control unit 302 stops transmitting the location information and the identifier of the terminal 30 after the terminal 30 is in the first access mode before the lighting is performed, and the authentication unit 302 succeeds in authenticating. Information, and controlling the terminal 30 to enter the second access mode; and, when the terminal 30 is in the second access mode before lighting, and the authentication unit 302 succeeds in authentication, the control terminal 30 continues to be in the second access mode.
  • the embodiment provides a terminal 30, by pre-storing the information of the target terminal in the security area of the terminal 30, and setting the low security level data to be accessible after the authentication failure of the terminal 30, setting other security level data to be inaccessible. And transmitting the related information of the terminal 30 itself to the target terminal according to the information of the security area pre-stored target terminal, thereby preventing important information in the mobile terminal from being leaked and facilitating retrieval of the lost mobile terminal, thereby improving the security of the terminal data and the terminal itself. Sex.
  • the embodiment of the invention provides a terminal and a method for protecting the data security of the terminal, pre-storing the information of the target terminal in the terminal security area, and setting the low security level data to be accessible after the terminal authentication fails, and the other security level data are It is set to be inaccessible, and the relevant information of the terminal itself is sent to the target terminal according to the information of the security terminal pre-stored target terminal.
  • the technical solution provided by the embodiment of the invention can prevent the important information in the terminal from being leaked and recover the lost terminal in time, thereby improving the security of the terminal data and the terminal itself.

Abstract

一种终端及保护终端数据安全的方法，该方法可以包括：当终端被点亮时，所述终端根据输入指令进行鉴权；当所述终端鉴权失败后，所述终端进入第一访问模式；所述第一访问模式为将低安全级别数据设置为可访问，将其他安全级别数据均设置为不可访问，并且按照预设的发送策略以及预存在终端安全区域中的目标终端信息将所述终端自身的位置信息和所述终端的标识信息发送至目标终端；当所述终端鉴权成功后，所述终端进入第二访问模式；所述第二访问模式为将终端的所有数据均设置为可访问。

Description

一种终端及保护终端数据安全的方法 技术领域
本文涉及但不限于信息安全技术，尤指一种终端及保护终端数据安全的方法。
背景技术
随着通信技术的不断发展和成熟，移动终端已成为人们日常生活和工作中不可缺少的工具。很多用户将个人隐私信息及数据，例如银行账号、密码、财务信息、个人身份信息等存储到移动终端。当移动终端遗失或者需要临时借用给他人使用时，很容易将个人的隐私信息及数据泄露出去。
目前，保护终端个人隐私信息及数据安全所采用的方案普遍是设置与终端的客户识别模块(SIM，Subscriber Identity Module)卡号绑定的网络账号，一旦终端遗失就可以利用网络账号通过远程控制的方式进行定位追踪，通过发送指令擦除终端内的数据，从而保证终端数据的安全。
但这种保护终端数据安全的方案需要用户提前申请网络账号与终端的SIM卡相绑定，而且当终端遗失后会由于不能及时或不方便进行网络控制、或者终端被直接刷机、或者更换了终端的SIM卡来使得目前保护终端数据安全的方案失效。
发明内容
以下是对本文详细描述的主题的概述。本概述并非是为了限制权利要求的保护范围。
本文提供了一种终端及保护终端数据安全的方法，能够防止移动终端内重要信息被泄露并且便于找回遗失的终端，提高了终端数据及终端本身的安全性。
一种保护终端数据安全的方法，包括：
当终端被点亮时，所述终端根据输入指令进行鉴权；
当所述终端鉴权失败后，所述终端进入第一访问模式；所述第一访问模式为将低安全级别数据设置为可访问，将其他安全级别数据均设置为不可访问，并且按照预设的发送策略以及预存在终端安全区域中的目标终端信息将所述终端自身的位置信息和所述终端的标识信息发送至目标终端；
当所述终端鉴权成功后，所述终端进入第二访问模式；所述第二访问模式为将终端的所有数据均设置为可访问。
可选地，所述的方法还包括：所述终端按照数据的安全性设置终端数据的安全级别。
可选地，所述终端根据输入指令进行鉴权包括：
所述终端接收输入的密码信息；
所述终端将所述输入的密码信息与预设的密码信息进行比对，当两者一致时，鉴权成功；当两者不一致时，鉴权失败。
可选地，所述终端按照预设的发送策略以及预存在终端安全区域中的目标终端信息将终端自身的位置信息和终端的标识信息发送至目标终端包括：
所述终端获取当前的位置信息，并且与预存的安全位置信息进行比对；
当所述终端当前的位置信息与所述预存的安全位置信息一致时，所述终端不发送自身的位置信息和所述终端的标识信息；
当所述终端当前的位置信息与所述预存的安全位置信息不一致时，所述终端按照预定的时间间隔将所述自身的位置信息和所述终端的标识信息发送至所述目标终端。
可选地，当所述终端鉴权成功后，所述终端进入第二访问模式包括：
当所述终端在点亮之前处于第一访问模式，且所述终端鉴权成功后，所述终端停止发送自身的位置信息和终端的标识信息，并进入第二访问模式；
当所述终端在点亮之前处于第二访问模式，且所述终端鉴权成功后，所述终端继续处于第二访问模式。
一种终端，包括：鉴权单元、第一访问控制单元和第二访问控制单元；
所述鉴权单元设置成当所述终端被点亮时根据输入指令进行鉴权；
所述第一访问控制单元设置成当所述鉴权单元鉴权失败后，指示所述终端进入第一访问模式；所述第一访问模式为将低安全级别数据设置为可访问，将其他安全级别数据均设置为不可访问，并且按照预设的发送策略以及预存在终端安全区域中的目标终端信息将所述终端的位置信息和所述终端的标识信息发送至目标终端；
所述第二访问控制单元设置成当所述鉴权单元鉴权成功后，指示所述终端进入第二访问模式；所述第二访问模式为将终端的所有数据均设置为可访问。
可选地，所述的终端还包括：设置单元，设置成预先按照数据的安全性设置终端数据的安全级别。
可选地，所述鉴权单元包括监视子单元、接收子单元和对比子单元；
所述监视子单元设置成监测所述终端是否点亮；并且监测到所述终端被点亮时，触发所述接收子单元；
所述接收子单元设置成接收输入的密码信息；
所述对比子单元设置成将所述输入的密码信息与预设的密码信息进行比对，当两者一致时，鉴权成功；当两者不一致时，鉴权失败。
可选地，所述的终端还包括：获取单元和比对单元；
所述获取单元设置成获取当前的位置信息；
所述比对单元设置成将所述当前的位置信息与预存的安全位置信息进行比对；
所述第一访问控制单元按照预设的发送策略以及预存在终端安全区域中的目标终端信息将终端的位置信息和终端的标识信息发送至目标终端是指：
所述第一访问控制单元当所述当前的位置信息与所述预存的安全位置信息一致时，不发送所述终端的位置信息和所述终端的标识信息；当所述当前的位置信息与所述预存的安全位置信息不一致时，按照预定的时间间隔将所述终端的位置信息和所述终端的标识信息发送至所述目标终端。
可选地，所述第二访问控制单元设置成当所述鉴权单元鉴权成功后，指示所述终端进入第二访问模式是指：
所述第二访问控制单元当所述终端在点亮之前处于第一访问模式，且所述鉴权单元鉴权成功后，指示所述第一访问控制单元停止发送的位置信息和终端的标识信息，并控制所述终端进入第二访问模式；以及，当所述终端在点亮之前处于第二访问模式，且所述鉴权单元鉴权成功后，控制所述终端继续处于第二访问模式。
本发明实施例提供了一种终端及保护终端数据安全的方法，在终端安全区域预存目标终端的信息，并且在终端鉴权失败后将低安全级别数据设置为可访问，将其他安全级别数据均设置为不可访问，并根据安全区域预存目标终端的信息将终端自身的相关信息发送至目标终端。通过本发明实施例提供的技术方案，能够防止终端内重要信息被泄露并且便于找回遗失的终端，提高了终端数据及终端本身的安全性。
在阅读并理解了附图和详细描述后，可以明白其它方面。
附图概述
图1为本发明实施例一提供的一种保护终端数据安全的方法的流程示意图；
图2为本发明实施例二提供的一种保护终端数据安全的方法的流程示意图；
图3为本发明实施例三提供的一种终端的结构示意图；
图4为本发明实施例三提供的另一种终端的结构示意图。
本申请的实施方式
下文中将结合附图对本发明实施例进行详细说明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互任意组合。
在附图的流程图示出的步骤可以在诸如一组计算机可执行指令的计算机系统中执行。并且，虽然在流程图中示出了逻辑顺序，但是在某些情况下， 可以以不同于此处的顺序执行所示出或描述的步骤。
实施例一
本实施例提供了一种保护终端数据安全的方法，如图1所示，该方法可以包括S101～S103：
S101：当终端被点亮时，终端根据输入指令进行鉴权；
可选地，在本实施例中，终端在黑屏待机状态下被唤醒点亮时，可以通过密码验证来进行鉴权。
可选地，终端根据输入指令进行鉴权可以包括：终端接收用户输入的密码信息，然后将输入的密码信息与预设的密码信息进行比对，当两者一致时，鉴权成功；当两者不一致时，鉴权失败。
可选地，本实施例中的密码信息可以为数字密码、图形图像密码、手势密码等，在实施例对此不作具体限定。
可选地，终端可以根据鉴权结果设定终端的数据访问模式，数据访问模式的具体形式可以如后续的S102和S103所述。
S102：当终端鉴权失败后，终端进入第一访问模式；
其中，当终端鉴权失败时，第一访问模式较为严格，因此第一访问模式可以为将低安全级别数据设置为可访问，将其他安全级别数据均设置为不可访问，并且按照预设的发送策略以及预存在终端安全区域中的目标终端信息将终端自身的位置信息和所述终端的标识信息发送至目标终端；从而保证了终端数据的安全。在本实施例中，可访问的含义包括可以对数据进行查看、删除、修改等操作。
可选地，当终端鉴权失败时，可以认为终端遗失或者终端正临时借给他人使用。此时，需要对终端数据的可访问性进行设置；其中，终端数据可以包括应用程序、个人身份数据、音频文件、视频文件、文本文件等各种类型的数据，本实施例对此不作具体限定。
可选地，本实施例可以预先按照数据的安全性设置终端数据的安全级别。设置安全级别的步骤可以但不限于在步骤S101之前执行；用户也可以在鉴权成功后修改终端数据的安全级别。
可选地，终端数据的安全级别可以设置为一般等级、重要等级、特殊等级、隐私等级等，默认等级为一般等级。一般等级的数据可以认为是不包括终端用户个人信息的数据，比如下载的游戏、视频文件、音频文件等，本实施例中的低安全级别数据可以对应为一般等级数据。
可选地，所述终端安全区域，可以为终端中的一个特定区域，该特定区域的存储内容不会由于刷机、格式化及恢复出厂设置等操作而产生影响。例如目前的自安全存储系统等。可选地，可以在该特定区域中安装安全软件，该安全软件可以将终端与目标终端信息进行绑定，该目标终端信息可以为目标终端的标识，比如目标终端的移动设备国际身份码(IMEI，International Mobile Equipment Identity)、目标终端中所插入的SIM卡的国际移动用户识别码(IMSI，International Mobile Subscriber Identification Number)或者目标终端中所插入的SIM卡所绑定的网络账户。通过终端安全区域保存目标终端信息，可以使得保存的目标终端信息即使在终端经过刷机、格式化及恢复出厂设置等操作之后依然保存，加强了终端的安全性。
还需要说明的是，在某些情况下，终端在用户可控范围内由其他用户操作，比如在家中的小孩拿着终端进行无规则操作所导致密码输入错误时，终端可以设置成无需将自身的位置信息和终端的标识信息发送至目标终端；
可选地，终端按照预设的发送策略以及预存在终端安全区域中的目标终端信息将终端自身的位置信息和终端的标识信息发送至目标终端，可以包括：
终端获取当前的位置信息，并且与预存的安全位置信息进行比对；
当终端当前的位置信息与预存的安全位置信息一致时，终端不发送自身的位置信息和终端的标识信息；
当终端当前的位置信息与预存的安全位置信息不一致时，终端按照预定的时间间隔将自身的位置信息和所述终端的标识信息发送至目标终端。
可选地，所述运存的安全位置信息可以有一个或多个。终端当前的位置信息只要和一个安全位置信息相同，就认为与预存的安全位置信息一致。
可选地，终端可以周期性地、不断地发送自身的位置信息和所述终端的标识信息至目标终端，也可以只向目标终端发送N次自身的位置信息和所述 终端的标识信息，其中N为预定次数。
S103：当终端鉴权成功后，终端进入第二访问模式；
其中，第二访问模式为将终端的所有数据均设置为可访问。
其中，当终端鉴权成功后，说明此时终端由用户自己进行操作，因此，第二访问模式应当为能够访问终端的所有数据。但是，终端在点亮之前可能处于第一访问模式，也就是说，终端在点亮之前可能会在向目标终端发送自身的位置信息和终端的标识信息，此时可以停止发送这些信息。
可选地，当终端鉴权成功后，终端进入第二访问模式包括：
当终端在点亮之前处于第一访问模式，且终端鉴权成功后，终端停止发送自身的位置信息和终端的标识信息，并进入第二访问模式；
当终端在点亮之前处于第二访问模式，且终端鉴权成功后，终端继续处于第二访问模式。
本实施例提供了一种保护终端数据安全的方法，通过在终端安全区域预存目标终端的信息，并且在终端鉴权失败后将低安全级别数据设置为可访问，将其他安全级别数据均设置为不可访问，并根据安全区域预存目标终端的信息将终端自身的相关信息发送至目标终端，能够防止终端内重要信息被泄露并且便于找回遗失的终端，提高了终端数据及终端本身的安全性。
实施例二
基于实施例一的技术方案，本实施例提供了一种保护终端数据安全的方法，参见图2，该方法的详细过程可以包括S201～S209：
S201：终端在安全区域预存目标终端信息，并且将终端数据的安全级别设置为一般等级、重要等级、特殊等级、隐私等级；
S202：终端被点亮时，终端接收用户输入的密码信息；
S203：终端将输入的密码信息与预设的密码信息进行比对；当两者不一致时，转向S204；当两者一致时，转向S207；
可以理解地，步骤S202至S203为终端被点亮时，根据输入指令进行鉴权的过程。
S204：终端确定获取当前的位置信息，并且与预存的安全位置信息进行比对；当终端当前的位置信息与预存的安全位置信息一致时，执行步骤S205；当终端当前的位置信息与预存的安全位置信息不一致时，执行步骤S206；
S205：终端将数据安全等级为一般等级的终端数据设置为可访问，并且将其他安全级别数据均设置为不可访问；
S206：终端将数据安全等级为一般等级的终端数据设置为可访问，并且将其他安全级别数据均设置为不可访问；以及按照预定的时间间隔和预存在终端安全区域中的目标终端信息将自身的位置信息和终端的标识信息发送至目标终端；
可以理解地，步骤S204至S206为终端鉴权失败后，终端进入第一访问模式的过程，可以理解地，当终端进入第一访问模式后，均会将低安全级别数据设置为可访问，将其他安全级别数据均设置为不可访问，但是，根据终端位置信息，当终端处于用户可控范围时，终端无需将自身的位置信息和终端的标识信息发送至目标终端。
接下来步骤S207至S209为终端鉴权成功后进入第二访问模式的过程；可以理解地，当终端鉴权成功后，说明此时终端由用户自己进行操作，因此，第二访问模式为能够访问终端的所有数据，所以第二访问模式为将终端的所有数据均设置为可访问。
S207：终端获取点亮之前的访问模式；
S208：当终端在点亮之前处于第一访问模式，终端停止发送自身的位置信息和终端的标识信息，并进入第二访问模式；
S209：当终端在点亮之前处于第二访问模式，终端继续处于第二访问模式。
本实施例提供了一种保护终端数据安全的具体流程，通过在终端安全区域预存目标终端的信息，并且在终端鉴权失败后将低安全级别数据设置为可访问，将其他安全级别数据均设置为不可访问，并根据安全区域预存目标终端的信息将终端自身的相关信息发送至目标终端，从而能够防止终端内重要信息被泄露并且便于找回遗失的终端，提高了终端数据及终端本身的安全性。
实施例三
基于前述实施例相同的技术构思，参见图3，其示出了本实施例提供的一种终端30的结构，该终端30可以包括：鉴权单元301、第一访问控制单元302和第二访问控制单元303，其中，
所述鉴权单元301设置成当所述终端被点亮时根据输入指令进行鉴权；
所述第一访问控制单元302设置成当鉴权单元302鉴权失败后，指示终端30进入第一访问模式；其中，第一访问模式为将低安全级别数据设置为可访问，将其他安全级别数据均设置为不可访问，并且按照预设的发送策略以及预存在终端30安全区域中的目标终端信息将终端30的位置信息和终端30的标识信息发送至目标终端；
所述第二访问控制单元303设置成当鉴权单元301鉴权成功后，指示终端30进入第二访问模式；其中，第二访问模式为将终端30的所有数据均设置为可访问。
可选地，参见图4，终端30还包括设置单元304，设置成按照数据的安全性设置终端30数据的安全级别。
可选地，鉴权单元301包括监视子单元3023、接收子单元3021和对比子单元3022，其中，
所述监视子单元3023设置成监测所述终端是否点亮；并且监测到所述终端被点亮时，触发所述接收子单元3021；
所述接收子单元3021设置成接收输入的密码信息；
所述对比子单元3022设置成将输入的密码信息与预设的密码信息进行比对，当两者一致时，鉴权成功；当两者不一致时，鉴权失败。
可选地，参见图4，终端30还包括：获取单元305、比对单元306，其中，所述获取单元305设置成获取终端30当前的位置信息；
所述比对单元306设置成将终端30当前的位置信息与预存的安全位置信息进行比对；
所述第一访问控制单元按照预设的发送策略以及预存在终端安全区域中的目标终端信息将终端的位置信息和终端的标识信息发送至目标终端是指：
所述第一访问控制单元当终端30当前的位置信息与预存的安全位置信息一致时，不发送终端30的位置信息和终端30的标识信息；当终端30当前的位置信息与预存的安全位置信息不一致时，按照预定的时间间隔将终端30的位置信息和终端30的标识信息发送至目标终端。
可选地，第二访问控制单元303设置成当所述鉴权单元鉴权成功后，指示所述终端进入第二访问模式是指：
第二访问控制单元303设置成当终端30在点亮之前处于第一访问模式，且鉴权单元302鉴权成功后，指示所述第一访问控制单元302停止发送的位置信息和终端30的标识信息，并控制终端30进入第二访问模式；以及，当终端30在点亮之前处于第二访问模式，且鉴权单元302鉴权成功后，控制终端30继续处于第二访问模式。
本实施例提供了一种终端30，通过在终端30安全区域预存目标终端的信息，并且在终端30鉴权失败后将低安全级别数据设置为可访问，将其他安全级别数据均设置为不可访问，并根据安全区域预存目标终端的信息将终端30自身的相关信息发送至目标终端，从而能够防止移动终端内重要信息被泄露并且便于找回遗失的移动终端，提高了终端数据及终端本身的安全性。
本实施例用于实现上述各方法实施例，本实施例中各个单元的工作流程和工作原理可以参见上述各方法实施例中的描述，在此不再赘述。
工业实用性
本发明实施例提供了一种终端及保护终端数据安全的方法，在终端安全区域预存目标终端的信息，并且在终端鉴权失败后将低安全级别数据设置为可访问，将其他安全级别数据均设置为不可访问，并根据安全区域预存目标终端的信息将终端自身的相关信息发送至目标终端。通过本发明实施例提供的技术方案，能够防止终端内重要信息被泄露并且及时找回遗失的终端，提高了终端数据及终端本身的安全性。

Claims (10)

  1. 一种保护终端数据安全的方法，包括：
    当终端被点亮时，所述终端根据输入指令进行鉴权；
    当所述终端鉴权失败后，所述终端进入第一访问模式；所述第一访问模式为将低安全级别数据设置为可访问，将其他安全级别数据均设置为不可访问，并且按照预设的发送策略以及预存在终端安全区域中的目标终端信息将所述终端自身的位置信息和所述终端的标识信息发送至目标终端；
    当所述终端鉴权成功后，所述终端进入第二访问模式；所述第二访问模式为将终端的所有数据均设置为可访问。
  2. 根据权利要求1所述的方法，还包括：所述终端按照数据的安全性设置终端数据的安全级别。
  3. 根据权利要求1所述的方法，其中，所述终端根据输入指令进行鉴权包括：
    所述终端接收输入的密码信息；
    所述终端将所述输入的密码信息与预设的密码信息进行比对，当两者一致时，鉴权成功；当两者不一致时，鉴权失败。
  4. 根据权利要求1所述的方法，其中，所述终端按照预设的发送策略以及预存在终端安全区域中的目标终端信息将终端自身的位置信息和终端的标识信息发送至目标终端包括：
    所述终端获取当前的位置信息，并且与预存的安全位置信息进行比对；
    当所述终端当前的位置信息与所述预存的安全位置信息一致时，所述终端不发送自身的位置信息和所述终端的标识信息；
    当所述终端当前的位置信息与所述预存的安全位置信息不一致时，所述终端按照预定的时间间隔将所述自身的位置信息和所述终端的标识信息发送至所述目标终端。
  5. 根据权利要求1所述的方法，其中，当所述终端鉴权成功后，所述终端进入第二访问模式包括：
    当所述终端在点亮之前处于第一访问模式，且所述终端鉴权成功后，所述终端停止发送自身的位置信息和终端的标识信息，并进入第二访问模式；
    当所述终端在点亮之前处于第二访问模式，且所述终端鉴权成功后，所述终端继续处于第二访问模式。
  6. 一种终端，包括：鉴权单元、第一访问控制单元和第二访问控制单元；
    所述鉴权单元设置成当所述终端被点亮时根据输入指令进行鉴权；
    所述第一访问控制单元设置成当所述鉴权单元鉴权失败后，指示所述终端进入第一访问模式；所述第一访问模式为将低安全级别数据设置为可访问，将其他安全级别数据均设置为不可访问，并且按照预设的发送策略以及预存在终端安全区域中的目标终端信息将所述终端的位置信息和所述终端的标识信息发送至目标终端；
    所述第二访问控制单元设置成当所述鉴权单元鉴权成功后，指示所述终端进入第二访问模式；所述第二访问模式为将终端的所有数据均设置为可访问。
  7. 根据权利要求6所述的终端，还包括：设置单元，设置成预先按照数据的安全性设置终端数据的安全级别。
  8. 根据权利要求6所述的终端，其中，所述鉴权单元包括监视子单元、接收子单元和对比子单元；
    所述监视子单元设置成监测所述终端是否点亮；并且监测到所述终端被点亮时，触发所述接收子单元；
    所述接收子单元设置成接收输入的密码信息；
    所述对比子单元设置成将所述输入的密码信息与预设的密码信息进行比对，当两者一致时，鉴权成功；当两者不一致时，鉴权失败。
  9. 根据权利要求6所述的终端，还包括：获取单元和比对单元；
    所述获取单元设置成获取当前的位置信息；
    所述比对单元设置成将所述当前的位置信息与预存的安全位置信息进行比对；
    所述第一访问控制单元按照预设的发送策略以及预存在终端安全区域中的目标终端信息将终端的位置信息和终端的标识信息发送至目标终端是指：
    所述第一访问控制单元当所述当前的位置信息与所述预存的安全位置信息一致时，不发送所述终端的位置信息和所述终端的标识信息；当所述当前的位置信息与所述预存的安全位置信息不一致时，按照预定的时间间隔将所述终端的位置信息和所述终端的标识信息发送至所述目标终端。
  10. 根据权利要求6所述的终端，其中，所述第二访问控制单元设置成当所述鉴权单元鉴权成功后，指示所述终端进入第二访问模式是指：
    所述第二访问控制单元当所述终端在点亮之前处于第一访问模式，且所述鉴权单元鉴权成功后，指示所述第一访问控制单元停止发送的位置信息和终端的标识信息，并控制所述终端进入第二访问模式；以及，当所述终端在点亮之前处于第二访问模式，且所述鉴权单元鉴权成功后，控制所述终端继续处于第二访问模式。
PCT/CN2015/087038 2015-05-27 2015-08-14 一种终端及保护终端数据安全的方法 WO2016187966A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510280537.2 2015-05-27
CN201510280537.2A CN106304063A (zh) 2015-05-27 2015-05-27 一种终端及保护终端数据安全的方法

Publications (1)

Publication Number Publication Date
WO2016187966A1 true WO2016187966A1 (zh) 2016-12-01

Family

ID=57393742

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/087038 WO2016187966A1 (zh) 2015-05-27 2015-08-14 一种终端及保护终端数据安全的方法

Country Status (2)

Country Link
CN (1) CN106304063A (zh)
WO (1) WO2016187966A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170355942A1 (en) * 2016-06-13 2017-12-14 University Of Kentucky Research Foundation Cyclic photobioreactor and method for biofilm control
CN109189412A (zh) * 2018-08-23 2019-01-11 深圳市宝尔爱迪科技有限公司 一种无网络下通讯终端应用备份及恢复安装的方法
CN112187797A (zh) * 2020-09-28 2021-01-05 深圳市雁云信息技术有限公司 一种云数据的传输方法及系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1351174A1 (en) * 2001-01-12 2003-10-08 Secom Co., Ltd. Search supporting apparatus, search supporting system, operation instructing terminal, search supporting method, and operation instructing system
CN101656966A (zh) * 2009-09-01 2010-02-24 成都市华为赛门铁克科技有限公司 移动终端的数据保护方法、装置及移动终端
CN104380298A (zh) * 2011-07-22 2015-02-25 优盖提特拜克有限公司 用于动态地评估和减轻被保险实体风险的系统和方法
CN104408360A (zh) * 2014-10-24 2015-03-11 上海微肯网络科技有限公司 基于移动终端的加密设备及方法

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102929807A (zh) * 2012-11-19 2013-02-13 周万荣 一种主动进行丢失判断及数据处理的方法和移动终端

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1351174A1 (en) * 2001-01-12 2003-10-08 Secom Co., Ltd. Search supporting apparatus, search supporting system, operation instructing terminal, search supporting method, and operation instructing system
CN101656966A (zh) * 2009-09-01 2010-02-24 成都市华为赛门铁克科技有限公司 移动终端的数据保护方法、装置及移动终端
CN104380298A (zh) * 2011-07-22 2015-02-25 优盖提特拜克有限公司 用于动态地评估和减轻被保险实体风险的系统和方法
CN104408360A (zh) * 2014-10-24 2015-03-11 上海微肯网络科技有限公司 基于移动终端的加密设备及方法

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170355942A1 (en) * 2016-06-13 2017-12-14 University Of Kentucky Research Foundation Cyclic photobioreactor and method for biofilm control
CN109189412A (zh) * 2018-08-23 2019-01-11 深圳市宝尔爱迪科技有限公司 一种无网络下通讯终端应用备份及恢复安装的方法
CN112187797A (zh) * 2020-09-28 2021-01-05 深圳市雁云信息技术有限公司 一种云数据的传输方法及系统

Also Published As

Publication number Publication date
CN106304063A (zh) 2017-01-04

Similar Documents

Publication Publication Date Title
US10361857B2 (en) Electronic stamp system for security intensification, control method thereof, and non-transitory computer readable storage medium having computer program recorded thereon
KR101904338B1 (ko) 모바일 디바이스에서의 사용자 인증 및 인간 의도 검증을 위한 방법 및 장치
CN114338230A (zh) 用于访问受保护资源的口令状态机
CA2813855C (en) Methods and systems for conducting smart card transactions
JP2015509632A (ja) ログイン方法及びログイン装置、端末並びにネットワークサーバー
CN104980926B (zh) 移动终端的远程控制方法及装置
AU2013245980A1 (en) Location-based access control for portable electronic device
EP2693789A1 (en) Mobile terminal encryption method, hardware encryption device and mobile terminal
CN103813334A (zh) 权限控制方法和权限控制装置
US9699656B2 (en) Systems and methods of authenticating and controlling access over customer data
US8706158B2 (en) Mobile phone for authenticating SIM card and method thereof
CN106559213B (zh) 设备管理方法、设备及系统
US20100308962A1 (en) Method and electronic device capable of user identification
WO2016187966A1 (zh) 一种终端及保护终端数据安全的方法
US20210234700A1 (en) Cryptographic access to bios
CN108021967B (zh) 复制智能卡的方法、装置及计算机可读存储介质
EP3346406A1 (en) Data input method, and electronic device and system for implementing the data input method
US10158616B1 (en) Methods and systems for online access credential transition
KR20210011577A (ko) 심툴킷과 애플릿을 이용한 개인 정보 인증 장치 및 방법
KR101495766B1 (ko) 원격 보안 관리가 가능한 시스템 및 방법
CN104598784A (zh) 一种信息处理方法及电子设备
KR101578383B1 (ko) 프로파일을 이용한 사용자 단말기 제어 시스템 및 방법
WO2016165447A1 (zh) 遥控终端的方法、装置及系统
KR102171720B1 (ko) 플래시메모리 보안시스템 및 이를 이용한 플래시메모리의 보안설정방법
US20080271128A1 (en) Method and System for Retaining and Protecting Sensitive User-Related Information

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15893047

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15893047

Country of ref document: EP

Kind code of ref document: A1