WO2017024820A1 - 一种移动应用擦除的方法、移动终端和计算机可读存储介质 - Google Patents
一种移动应用擦除的方法、移动终端和计算机可读存储介质 Download PDFInfo
- Publication number
- WO2017024820A1 WO2017024820A1 PCT/CN2016/080778 CN2016080778W WO2017024820A1 WO 2017024820 A1 WO2017024820 A1 WO 2017024820A1 CN 2016080778 W CN2016080778 W CN 2016080778W WO 2017024820 A1 WO2017024820 A1 WO 2017024820A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- application
- mobile
- data
- user
- policy
- Prior art date
Links
- 238000000034 method Methods 0.000 title claims abstract description 50
- 238000012795 verification Methods 0.000 claims abstract description 41
- 238000012545 processing Methods 0.000 claims abstract description 26
- 238000012217 deletion Methods 0.000 claims description 8
- 230000037430 deletion Effects 0.000 claims description 8
- 238000010586 diagram Methods 0.000 description 5
- 230000006870 function Effects 0.000 description 5
- 238000005516 engineering process Methods 0.000 description 3
- 238000003491 array Methods 0.000 description 2
- 238000011161 development Methods 0.000 description 2
- 230000003993 interaction Effects 0.000 description 2
- NJPPVKZQTLUDBO-UHFFFAOYSA-N novaluron Chemical compound C1=C(Cl)C(OC(F)(F)C(OC(F)(F)F)F)=CC=C1NC(=O)NC(=O)C1=C(F)C=CC=C1F NJPPVKZQTLUDBO-UHFFFAOYSA-N 0.000 description 2
- 238000003672 processing method Methods 0.000 description 2
- 230000002159 abnormal effect Effects 0.000 description 1
- 238000004891 communication Methods 0.000 description 1
- 230000000052 comparative effect Effects 0.000 description 1
- 238000004590 computer program Methods 0.000 description 1
- 230000003111 delayed effect Effects 0.000 description 1
- 230000000977 initiatory effect Effects 0.000 description 1
- 230000010354 integration Effects 0.000 description 1
- 238000010295 mobile communication Methods 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 230000000737 periodic effect Effects 0.000 description 1
- 239000004065 semiconductor Substances 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W8/00—Network data management
- H04W8/22—Processing or transfer of terminal data, e.g. status or physical capabilities
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04M—TELEPHONIC COMMUNICATION
- H04M1/00—Substation equipment, e.g. for use by subscribers
- H04M1/72—Mobile telephones; Cordless telephones, i.e. devices for establishing wireless links to base stations without route selection
- H04M1/725—Cordless telephones
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/06—Authentication
Definitions
- the present application relates to, but is not limited to, the field of mobile communication technologies, and in particular, to a method for erasing mobile applications, a mobile terminal, and a computer readable storage medium.
- the factory reset policy can be used only when the mobile phone is lost, scrapped, or recycled, and the individual user is no longer used.
- the inadequacies of restoring factory settings are mainly reflected in:
- Data erasure through a custom interface can be used to erase the application's own private data, but generally can not solve the following problems:
- Application data of a non-private directory such as application data or documents on an external TF card, cannot be known and deleted.
- a method of mobile application erasure comprising:
- the method further includes:
- the application data of the mobile security application accessed by the user is erased.
- the method further includes: if the identity verification of the user fails, returning a failure;
- the write path is allocated according to the user and the write data request, and the write path is securely recorded;
- the mobile security application writing data according to the feature information includes:
- the mobile security application encrypts the write data according to the encryption key, and writes the encrypted write data according to the write path and the feature information.
- the receiving the policy information sent by the mobile application management server includes:
- the mobile application management server After the mobile application management server checks that the policy information needs to be updated, the new policy information delivered by the mobile application management server is received.
- the policy information includes: an instruction erasure policy, an application data validity period policy, an application permission policy, a deletion mobile security application policy, an offline access policy, and a key management policy.
- the instruction erasure strategy includes: a preset erase execution delay time and an instruction to execute the failed process;
- the application data validity period policy includes: a pre-set security save validity period of the application data, and a processing manner of the application data after the security save validity period arrives;
- the application permission policy includes: a pre-set processing method of the mobile security application that the user does not have access rights;
- Deleting the mobile security application policy includes: pre-setting the processing manner of the mobile security application when it needs to be deleted or updated;
- the offline access policy includes: a method for processing a mobile security application when the mobile application management server cannot be connected;
- the key management policy includes: an encryption key algorithm of the application data preset.
- a mobile terminal includes:
- the mobile application data security packager is configured to encrypt and process the read and write operations of the enterprise mobile application to generate a mobile security application
- a mobile application base container configured to receive a write data request from a user to the mobile security application and, if an identity verification is performed on a user who issues a write data request, if the identity of the user After the verification passes, after the mobile security application writes data according to the feature information, the feature information of the written data is recorded;
- the mobile application base container is further configured to receive policy information sent by the mobile application management server, and execute an erase instruction on the mobile security application according to the policy information, and apply data to the mobile security application according to the feature information. Erase.
- the mobile application management server is configured to: receive a read data request from the user for the mobile security application, and perform identity verification on the user who issues the read data request.
- the mobile application base container is further configured to:
- the application data of the mobile security application accessed by the user is erased.
- the mobile application data security packager is further configured to: if the identity verification of the user fails, returning a failure;
- the write path is allocated according to the user and the write data request, and the write path is securely recorded;
- the mobile security application writing data according to the feature information includes:
- the mobile security application encrypts the write data according to the encryption key, and writes the encrypted write data according to the write path and the feature information.
- the mobile application base container receiving the policy information sent by the mobile application management server includes:
- the mobile application management server checks that the certificate needs to be issued. After the certificate is updated, the certificate sent or updated by the mobile application management server is received;
- the mobile application management server After the mobile application management server checks that the policy information needs to be updated, the new policy information delivered by the mobile application management server is received.
- the policy information includes: an instruction erasure policy, an application data validity period policy, an application permission policy, a deletion mobile security application policy, an offline access policy, and a key management policy.
- the instruction erasure strategy includes: a preset erase execution delay time and an instruction to execute the failed process;
- the application data validity period policy includes: a pre-set security save validity period of the application data, and a processing manner of the application data after the security save validity period arrives;
- the application permission policy includes: a pre-set processing method of the mobile security application that the user does not have access rights;
- Deleting the mobile security application policy includes: pre-setting the processing manner of the mobile security application when it needs to be deleted or updated;
- the offline access policy includes: a method for processing a mobile security application when the mobile application management server cannot be connected;
- the key management policy includes: an encryption key algorithm of the application data preset.
- a computer readable storage medium storing computer executable instructions that, when executed by a processor, implement the mobile application erasure method.
- the mobile application erasing method of the embodiment of the invention can enable enterprise mobile application data to implement application-level security management and control, without having to restore the factory settings and without customizing the terminal, providing a comparative perspective for data security of enterprise applications and secure mobileization of enterprise applications.
- FIG. 1 is a schematic flow chart showing a method for erasing a mobile application in an embodiment of the present invention
- FIG. 2 is a schematic diagram showing the structure of a mobile terminal in an embodiment of the present invention.
- FIG. 3 shows the interaction between the mobile application base and the mobile application management server in the embodiment of the present invention.
- FIG. 4 is a schematic diagram of a policy information sent by a mobile application base to a mobile security application according to an embodiment of the present invention
- FIG. 5 is a schematic diagram showing the data written by the mobile application base controlling the mobile security application in the embodiment of the present invention.
- FIG. 6 is a schematic diagram showing the data read by the mobile application base controlling the mobile security application in the embodiment of the present invention.
- a method for mobile application erasure includes steps S101 to S104:
- S102 Receive a write data request of the user to the mobile security application, and perform identity verification on the user who issues the write data request. If the user's identity check passes, after the mobile security application writes the data according to the feature information. And recording the feature information of the write data.
- recording the feature information when the application data of the mobile security application is written is the basis for erasing the data of the mobile security application.
- the feature information includes a user identifier, an application flag, a path, a data size, and the like, and the mobile security application corresponding thereto and related data information can be found through the feature information.
- S103 Receive policy information sent by a mobile application management server.
- S104 Perform an erase instruction on the mobile security application according to the policy information, and erase the application data of the mobile security application according to the feature information.
- the mobile security application is generated by performing encryption processing on the read and write operations of the enterprise mobile application to ensure the security of the enterprise mobile application.
- the mobile security application is allowed to write, and the feature information of the written data is recorded.
- the policy information sent by the mobile application management server is received, and the data of the mobile security application is erased according to the feature information.
- step S102 the method further includes:
- the application data of the mobile security application accessed by the user is erased.
- the information indicating that the mobile security application has been modified or copied or otherwise processed does not conform to the record of the previous feature information. Then, the application data of the mobile security application is erased according to the feature information.
- the method further includes: if the identity verification of the user fails, returning a failure.
- S2012 Generate an encryption key according to a key policy, and perform security record on the encryption key.
- the data written by the mobile security application according to the feature information includes:
- the mobile security application encrypts the write data according to the encryption key, and writes the encrypted write data according to the write path and the feature information.
- the step of receiving the policy information sent by the mobile application management server includes:
- the mobile application management server After receiving the user to log in to the mobile application management server, the mobile application management server identifies the user And performing, by the verification result, the certificate that is sent or updated by the mobile application management server after the mobile application management server checks that the certificate needs to be issued or updated; and the mobile application management After the server checks that the policy information needs to be updated, the server receives the new policy information delivered by the mobile application management server.
- the mobile application management server delivers the policy information, and the user can define the policy information as needed.
- the policy information includes an erase command for the mobile security application.
- the advantage of the solution is that the erasure management of the mobile security application of the multiple mobile terminals can be implemented, and the mobile application management server delivers different policy information for the request of different terminals, for the data security of the enterprise application and the secure movement of the enterprise application. Promotion has provided better technical support.
- the policy information includes: an instruction erasure policy, an application data validity period policy, an application permission policy, a deletion mobile security application policy, an offline access policy, and a key management policy;
- the instruction erasure policy includes: a preset erase execution delay time and an instruction to execute the failed process.
- the application data validity period policy includes: a pre-set security save validity period of the application data, and a processing manner of the application data after the security save validity period arrives.
- the application permission policy includes: a preset manner of processing a mobile security application in which the user does not have access rights.
- the deleting the mobile security application policy includes: a preset processing manner of the mobile security application when it needs to be deleted or updated.
- the offline access policy includes: a method for processing a mobile security application when the mobile application management server cannot be connected.
- the key management policy includes: an encryption key algorithm of the application data that is preset.
- the present invention further provides a mobile terminal, including:
- the mobile application data security packager 1 is configured to encrypt and process the read and write operations of the enterprise mobile application 10 to generate the mobile security application 20.
- the mobile application base container 2 is configured to receive a write data request from the user to the mobile security application 20, and perform identity verification on the user who issues the write data request, if the user's identity is verified After the verification, the mobile security application 20 records the characteristic information of the written data after writing the data according to the feature information.
- the mobile application base container 2 is further configured to receive the policy information sent by the mobile application management server 3; and execute an erase command on the mobile security application 20 according to the policy information, and erase the application data of the mobile security application 20 according to the feature information.
- the mobile application data security packager 2 encrypts the read and write operations of the enterprise mobile application to generate a mobile security application, thereby ensuring the security of the enterprise mobile application.
- the mobile application base container 2 successfully verifies the user of the mobile security application, and allows the mobile security application to write, the mobile application base container 2 records the feature information of the written data.
- the mobile application base container receives the policy information transmitted by the mobile application management server 3 and erases the data of the mobile security application based on the feature information.
- the mobile terminal can enable enterprise-level mobile application data to implement application-level security management and control, without having to restore factory settings and without customizing terminals, providing better technical support for data security of enterprise applications and secure mobileization of enterprise applications.
- the mobile application management server is configured to: receive a read data request from the user for the mobile security application, and perform identity verification on the user who issues the read data request.
- the mobile application dock container 2 is also set to:
- the information of the mobile security application data accessed by the user is compared with the feature information.
- the application data of the mobile security application accessed by the user is erased.
- the mobile application base container 2 detects that the mobile security application is maliciously accessed, that is, the application information accessed by the user does not conform to the feature information, the application data of the mobile security application is erased. Thereby preventing application data of the mobile security application from being changed or data leakage caused by the backrest.
- the feature information is used to perform legal check, that is, when the application information accessed by the user is consistent with the feature information, and the key is passed, the key is returned.
- the mobile application base container 2 returns a read request from the mobile security application 20, and the mobile security application 20 can now perform a secure read.
- the mobile application data security packager is further configured to: if the identity verification of the user fails, returning a failure;
- the write path is allocated according to the user and the write data request, and the write path is securely recorded;
- the mobile security application writing data according to the feature information includes:
- the mobile security application encrypts the write data according to the encryption key, and writes the encrypted write data according to the write path and the feature information.
- the process of initiating a write data request from the user to the mobile application base container 2 storing the feature information of the data written by the mobile security application 20 includes steps S201 to S208:
- the mobile application base container 2 receives a write data request initiated by the user to the mobile security application 20.
- the mobile application base container 2 performs a legal check on the application information and the user accessed by the user, and returns a failure if the identity verification of the user fails.
- the mobile application base container 2 generates an encryption key according to a key policy, and records the security securely.
- the mobile application base container 2 returns the data information (including the write path and the encryption key) required for secure writing to the mobile security application 20.
- the mobile security application encrypts the write data according to the encryption key, and writes the encrypted write data according to the write path and the feature information.
- the mobile application base container 2 records the feature information of the written data after the mobile security application 20 writes the data.
- the mobile security application 20 After receiving the written data information, the mobile security application 20 encrypts and writes the data securely without retaining the key. At this time, the writing method can be customized, and in order to prevent other abnormal copying and the like, it can be divided into several parts to write, here No specific restrictions are imposed.
- the security application After the security application writes the data, notify the pedestal container.
- the base container records application data feature information, including: user identifier, application flag, path, data size, and the like.
- the mobile application base container receiving the policy information sent by the mobile application management server includes:
- the mobile application management server After receiving the user login to the mobile application management server, the mobile application management server verifies the result returned by the user identity.
- the mobile application management server After the mobile application management server checks that the policy information needs to be updated, the new policy information delivered by the mobile application management server is received.
- the interaction between the mobile application base container 2 and the mobile application management server 3 includes, but is not limited to, steps S301 to S303:
- the user accesses the mobile application base container 2 and logs in, and carries the local user certificate information, policy update information, and the like when logging in. After logging in to the mobile application management server 3, the user receives the verification return of the user identity by the mobile application management server 3, and returns a failure if the verification fails;
- the mobile application management server 3 checks whether the certificate needs to be issued or the certificate is updated. If it is checked that the certificate needs to be issued or the certificate is updated, the mobile application base container 2 receives the certificate issued by the mobile application management server 3 or updates the certificate;
- the mobile application management server 3 checks whether the policy information needs to be updated. If it is checked that the policy information needs to be updated, the mobile application base container 2 receives the new policy information delivered by the mobile application management server 3.
- the mobile terminal in which the mobile application base container 2 is located receives different user accesses, manages different mobile security applications, and performs cluster control through the mobile application management server 3.
- the mobile application management server 3 selects whether to issue a certificate and deliver policy information to the mobile application base container 2 according to different login users and requests, wherein the content for the policy information is definable according to the user and the request, and is convenient for each mobile.
- the data of the terminal is controlled.
- the mobile application base container 2 controls the operation of the mobile security application 20 through the policy information 21, and the policy information 21 includes: an instruction erasure policy, an application data validity period policy, an application permission policy, a deletion mobile security application policy, and offline. Access policy and key management policy.
- the instruction erasure policy includes: a preset erase execution delay time and an instruction to perform a failed process (such as an alarm, suspend application access, etc.).
- the application data validity period policy includes: a pre-set security saving expiration date of the application data, and a processing manner of the application data (such as automatic deletion, etc.) after the security saving expiration date arrives;
- the application of the permission policy pre-sets the way the mobile security application does not have access rights. It can be set to delete the user's application data immediately or delayed, and does not allow the user to access the data. Generally, it is set to delay deletion, in case the user rights are not changed in time;
- Deleting the mobile security application policy includes: pre-setting the processing manner of the mobile security application when it needs to be deleted or updated;
- the offline access policy includes a method of processing the mobile security application when the mobile application management server cannot be connected. For example, you can define a periodic connection requirement policy, if not, perform cleanup of all application data, and prohibit launching any enterprise application.
- the key management policy includes: the pre-set encryption key algorithm of the application data.
- the mobile application base container will perform the above policy by periodically checking the security application data of the mobile terminal.
- the mobile application base container and the mobile application data security packager of the mobile terminal can be implemented by software so as to be executed by various types of processors.
- a mobile application base container can include one or more physical or logical blocks of computer instructions, which can be constructed, for example, as objects, procedures, or functions. Nonetheless, the executable code of the mobile application dock container need not be physically located together, but may include different instructions stored in different bits that, when logically combined, constitute and implement the mobile application The stated purpose of the pedestal container or mobile application data security packager.
- the mobile application base container can be a single instruction or a number of instructions, and can even be distributed over multiple different code segments, distributed among different programs, and distributed across multiple memory devices.
- operational data may be identified within the modules and may be implemented in any suitable form and organized within any suitable type of data structure. The operational data may be collected as a single data set, or may be distributed at different locations (including on different storage devices), and may at least partially exist as an electronic signal on a system or network.
- the hardware circuit includes conventional very large scale integration (VLSI) circuits or gate arrays and existing semiconductors such as logic chips, transistors, or other discrete components.
- VLSI very large scale integration
- the mobile application dock container and the mobile application data secure packer can also be implemented with programmable hardware devices such as field programmable gate arrays, programmable array logic, programmable logic devices, and the like.
- a computer readable storage medium storing computer executable instructions that, when executed by a processor, implement the mobile application erasure method.
- all or part of the steps of the above embodiments may also be implemented by using an integrated circuit. These steps may be separately fabricated into individual integrated circuit modules, or multiple modules or steps may be fabricated into a single integrated circuit module. achieve.
- the devices/function modules/functional units in the above embodiments may be implemented by a general-purpose computing device, which may be centralized on a single computing device or distributed over a network of multiple computing devices.
- the device/function module/functional unit in the above embodiment When the device/function module/functional unit in the above embodiment is implemented in the form of a software function module and sold or used as a stand-alone product, it can be stored in a computer readable storage medium.
- the above mentioned computer readable storage medium may be a read only memory, a magnetic disk or an optical disk or the like.
- the read/write operation of the enterprise mobile application is encrypted to generate a mobile security application; the user writes a data request to the mobile security application, and if the identity verification of the user passes, the mobile device is moved.
- the security application writes the data according to the feature information
- the feature information of the written data is recorded;
- the policy information sent by the mobile application management server is received;
- the erasure instruction is executed on the mobile security application according to the policy information, and the application of the mobile security application according to the feature information is performed.
- Data Erase It can enable enterprise-level mobile application data to achieve application-level security management and control, without having to restore factory settings and without customizing terminals, providing better technical support for data security of enterprise applications and secure mobileization of enterprise applications.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Databases & Information Systems (AREA)
- Mobile Radio Communication Systems (AREA)
- Storage Device Security (AREA)
Abstract
一种移动应用擦除的方法和移动终端。该方法包括：将企业移动应用的读写操作进行加密处理，生成移动安全应用；接收用户对移动安全应用的写入数据请求，如果所述用户的身份校验通过，则在移动安全应用根据特征信息写入数据后，记录写入数据的该特征信息；接收移动应用管理服务器发送的策略信息；根据策略信息对移动安全应用执行擦除指令，根据特征信息对移动安全应用的应用数据进行擦除。
Description
本申请涉及但不限于移动通信技术领域，尤其涉及一种移动应用擦除的方法、移动终端和计算机可读存储介质。
移动化趋势在最近几年来非常明显，设备商、软件开发商等都在关注这个市场的变化，也在挖掘企业市场应用的新机会。
目前智能终端的处理能力越来越强，完全可以满足商务需求；每个智能设备厂商不断推出处理能力更强的智能终端。无线通讯技术的发展为移动终端应用体验提供了保障。
目前，政府、企业实现移动化进程越来越快，每种开发技术和平台也日趋完善，快速化已经不成问题。目前在移动设备管理中，企业应用数据安全擦除早已作为一种基本功能以保障数据安全，但在安卓系统中，由于本身接口和权限的安全限制，并不能实现较好的擦除。主要的企业数据擦除方法主要由两种：
(1)通过恢复出厂设置，做到清除应用。
(2)通过定制接口实现应用空间的私有数据擦除。
上述两种方法，一定程度上可以保障数据安全，但还是存在很多不足之处。一般只有手机丢失、报废或回收等该个人用户暂时不再使用的情况可以使用恢复出厂设置策略。恢复出厂设置不足之处主要表现在：
(1)如果是用户离开公司或者原先岗位，一般只需要清除相应权限的应用数据即可，不应该清除用户个人应用和数据以及其它新岗位也有权限的应用和数据，用户使用体验和效率较差。
(2)如果应用存储的数据可以保存在其它非私有目录下，如存放在外置TF卡上，则该部分数据无法知晓并删除。
通过定制接口实现的数据擦除，可以实现应用自己私有数据的擦除，但一般还是解决不了如下问题：
(1)非私有目录的应用数据，如外置TF卡上的应用数据或者文档，无法知晓并删除。
(2)定制接口不统一或不开放，每个厂家的智能手机不兼容，无法做到通用。
鉴于上述问题，亟待一种针对企业应用数据安全擦除的方法。
发明内容
以下是对本文详细描述的主题的概述。本概述并非是为了限制权利要求的保护范围。
一种移动应用擦除的方法，包括：
将企业移动应用的读写操作进行加密处理，生成移动安全应用；
接收用户对所述移动安全应用的写入数据请求，并对发出写入数据请求的用户进行身份校验，如果所述用户的身份校验通过，则在所述移动安全应用根据特征信息写入数据后，记录所述写入数据的所述特征信息；
接收移动应用管理服务器发送的策略信息；
根据所述策略信息对所述移动安全应用执行擦除指令，根据所述特征信息对所述移动安全应用的应用数据进行擦除。
可选地，所述方法还包括：
接收用户对所述移动安全应用的读取数据请求，并对发出读取数据请求的用户进行身份校验，如果所述用户的身份校验通过，则将所述用户访问的移动安全应用的应用数据的应用信息与所述特征信息进行比较；
如果所述用户访问的所述移动安全应用的应用数据的信息与所述特征信息不一致，则将所述用户访问的所述移动安全应用的应用数据进行擦除。
可选地，
所述方法还包括：如果所述用户的身份校验未通过，则返回失败；
如果所述用户的身份校验通过，则根据所述用户和写入数据请求分配写入路径，并对所述写入路径进行安全记录；
根据密钥策略，产生加密密钥，并对所述加密密钥进行安全记录；
将安全写入所需的所述写入路径和所述加密密钥返回给所述移动安全
应用。
所述移动安全应用根据所述特征信息写入数据包括：
所述移动安全应用根据所述加密密钥对所述写入数据进行加密，并根据所述写入路径和所述特征信息写入加密后的所述写入数据。
可选地，所述接收移动应用管理服务器发送的策略信息包括：
接收用户登录移动应用管理服务器后移动应用管理服务器对用户身份进行校验返回的结果；
根据所述返回的结果，在所述移动应用管理服务器检查出需要下发证书或更新证书后，接收所述移动应用管理服务器下发或更新的证书；和/或，
在所述移动应用管理服务器检查出需要更新策略信息后，接收所述移动应用管理服务器下发的新的策略信息。
可选地，所述策略信息包括：指令擦除策略、应用数据有效期策略、应用权限策略、删除移动安全应用策略、离线访问策略和密钥管理策略。
指令擦除策略包括：预先设置的擦除执行延迟时间以及执行失败的处理的指令；
应用数据有效期策略包括：预先设置的所述应用数据的安全保存有效期，以及所述安全保存有效期到达后所述应用数据的处理方式；
应用权限策略包括：预先设置的用户没有访问权限的移动安全应用的处理方式；
删除移动安全应用策略包括：预先设置的所述移动安全应用在需要删除或者更新时的处理方式；
离线访问策略包括：不能连接所述移动应用管理服务器时移动安全应用的处理方法；
密钥管理策略包括：预先设置的所述应用数据的加密密钥算法。
一种移动终端，包括：
移动应用数据安全打包器，设置为将企业移动应用的读写操作进行加密处理，生成移动安全应用；
移动应用基座容器，设置为接收用户对所述移动安全应用的写入数据请求，并在对发出写入数据请求的用户进行身份校验后，如果所述用户的身份
校验通过，则在所述移动安全应用根据特征信息写入数据后，记录所述写入数据的所述特征信息；
所述移动应用基座容器，还设置为接收移动应用管理服务器发送的策略信息；并根据所述策略信息对所述移动安全应用执行擦除指令，根据特征信息对所述移动安全应用的应用数据进行擦除。
可选地，
所述移动应用管理服务器设置为：接收用户对所述移动安全应用的读取数据请求，并对发出读取数据请求的用户进行身份校验。
所述移动应用基座容器，还设置为：
如果所述用户的身份校验通过，则将所述用户访问的移动安全应用数据的应用信息与所述特征信息进行比较；
如果所述用户访问的所述移动安全应用的应用数据的信息与所述特征信息不一致，则将所述用户访问的所述移动安全应用的应用数据进行擦除。
可选地，
所述移动应用数据安全打包器还设置为：如果所述用户的身份校验未通过，则返回失败；
如果所述用户的身份校验通过，则根据所述用户和写入数据请求分配写入路径，并对所述写入路径进行安全记录；
根据密钥策略，产生加密密钥，并对所述加密密钥进行安全记录；
将安全写入所需的所述写入路径和所述加密密钥返回给所述移动安全应用。
所述移动安全应用根据所述特征信息写入数据包括：
所述移动安全应用根据所述加密密钥对所述写入数据进行加密，并根据所述写入路径和所述特征信息写入加密后的所述写入数据。
可选地，所述移动应用基座容器接收移动应用管理服务器发送的策略信息包括：
接收用户登录移动应用管理服务器后移动应用管理服务器对用户身份进行校验返回的结果；
根据所述返回的结果，在所述移动应用管理服务器检查出需要下发证书
或更新证书后，接收所述移动应用管理服务器下发或更新的证书；
在所述移动应用管理服务器检查出需要更新策略信息后，接收所述移动应用管理服务器下发的新的策略信息。
可选地，所述策略信息包括：指令擦除策略、应用数据有效期策略、应用权限策略、删除移动安全应用策略、离线访问策略和密钥管理策略。
指令擦除策略包括：预先设置的擦除执行延迟时间以及执行失败的处理的指令；
应用数据有效期策略包括：预先设置的所述应用数据的安全保存有效期，以及所述安全保存有效期到达后所述应用数据的处理方式；
应用权限策略，包括：预先设置的用户没有访问权限的移动安全应用的处理方式；
删除移动安全应用策略包括：预先设置的所述移动安全应用在需要删除或者更新时的处理方式；
所述离线访问策略包括：不能连接所述移动应用管理服务器时移动安全应用的处理方法；
密钥管理策略包括：预先设置的所述应用数据的加密密钥算法。
一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令被处理器执行时实现所述的移动应用擦除方法。
通过本发明实施例的移动应用擦除方法，可以让企业移动应用数据实现应用级安全管控，无需恢复出厂设置、无需定制终端，为企业应用的数据安全和企业应用的安全移动化推广提供了较好的技术支撑。可广泛的用于政企移动应用中，适合不同行业、领域快速安全地实现应用移动化，保障政企应用数据的安全。
附图概述
图1表示本发明实施例中移动应用擦除的方法的流程示意图；
图2表示本发明实施例中移动终端的构成示意图；
图3表示本发明实施例中移动应用基座和移动应用管理服务器的交互
示意图；
图4表示本发明实施例中移动应用基座向移动安全应用下发策略信息示意图；
图5表示本发明实施例中移动应用基座控制移动安全应用写入数据示意图；
图6表示本发明实施例中移动应用基座控制移动安全应用读取数据示意图。
下面结合附图对本发明的实施方式进行描述。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互任意组合。
实施例1，
参照图1所示，一种移动应用擦除的方法，包括步骤S101～S104：
S101，将企业移动应用的读写操作进行加密处理，生成移动安全应用；
S102，接收用户对移动安全应用的写入数据请求，并对发出写入数据请求的用户进行身份校验，如果所述用户的身份校验通过，则在移动安全应用根据特征信息写入数据后，记录所述写入数据的所述特征信息。
在本发明实施例中，记录移动安全应用的应用数据写入时的特征信息，是对移动安全应用的数据进行擦除的依据。特征信息包括用户标识、应用标志、路径、数据大小等，通过特征信息可以找到与之对应的移动安全应用及其有关的数据信息。
S103，接收移动应用管理服务器发送的策略信息。
S104，根据策略信息对移动安全应用执行擦除指令，根据所述特征信息对移动安全应用的应用数据进行擦除。
本发明实施例的方法中，通过将企业移动应用的读写操作进行加密处理生成移动安全应用，来保证企业移动应用的安全性。另外，当所述用户的身份校验成功，允许移动安全应用写入时，记录写入数据的特征信息。当需要擦除写入的信息时，通过接收移动应用管理服务器发送的策略信息，并根据该特征信息对移动安全应用的数据进行擦除。该方法可以让企业移动应用数
据实现应用级安全管控，无需恢复出厂设置、无需定制终端，为企业应用的数据安全和企业应用的安全移动化推广提供了较好的技术支撑。
实施例2，
可选地，步骤S102之后还包括：
接收用户对移动安全应用的读取数据请求，并对发出读取数据请求的用户进行身份校验，如果所述用户的身份校验通过，则将所述用户访问的移动安全应用的应用数据的信息与所述特征信息进行比较；
如果所述用户访问的所述移动安全应用的应用数据的信息与所述特征信息不一致，则将所述用户访问的所述移动安全应用的应用数据进行擦除。
如果用户访问读取时，用户访问的应用数据的信息与该特征信息不同时，证明移动安全应用的信息已经被更改或拷贝或进行其他处理，与之前特征信息的记录不符合。则根据特征信息对该移动安全应用的应用数据进行擦除。
实施例3，
可选地，该方法还包括：如果所述用户的身份校验未通过，则返回失败。
如果所述用户的身份校验通过，则完成以下步骤S2011～S2013的操作：
S2011、根据所述用户和写入数据请求分配写入路径，并对所述写入路径进行安全记录.
S2012、根据密钥策略，产生加密密钥，并对所述加密密钥进行安全记录。
S2013、将安全写入所需的所述写入路径和所述加密密钥返回给所述移动安全应用。
其中，所述移动安全应用根据所述特征信息写入数据包括：
所述移动安全应用根据所述加密密钥对所述写入数据进行加密，并根据所述写入路径和所述特征信息写入加密后的所述写入数据。
实施例4，
可选地，接收移动应用管理服务器发送的策略信息步骤包括：
接收用户登录移动应用管理服务器后移动应用管理服务器对用户身份
进行校验返回的结果；根据返回的结果，在所述移动应用管理服务器检查出需要下发证书或更新证书后，接收所述移动应用管理服务器下发或更新的证书；在所述移动应用管理服务器检查出需要更新策略信息后，接收所述移动应用管理服务器下发的新的策略信息。
其中，移动应用管理服务器下发策略信息，用户可以根据需要定义该策略信息。该策略信息中包括对移动安全应用的擦除指令。该方案的优势在于，可以实现多个移动终端的移动安全应用的擦除管理，针对不同终端的请求，移动应用管理服务器下发不同的策略信息，为企业应用的数据安全和企业应用的安全移动化推广提供了较好的技术支撑。可选地，所述策略信息包括：指令擦除策略、应用数据有效期策略、应用权限策略、删除移动安全应用策略、离线访问策略和密钥管理策略；
所述指令擦除策略包括：预先设置的擦除执行延迟时间以及执行失败的处理的指令。
所述应用数据有效期策略包括：预先设置的所述应用数据的安全保存有效期，以及所述安全保存有效期到达后所述应用数据的处理方式。
所述应用权限策略包括：预先设置的用户没有访问权限的移动安全应用的处理方式。
所述删除移动安全应用策略包括：预先设置的所述移动安全应用在需要删除或者更新时的处理方式。
所述离线访问策略包括：不能连接所述移动应用管理服务器时移动安全应用的处理方法。
所述密钥管理策略包括：预先设置的所述应用数据的加密密钥算法。
实施例5，
参照图2所示，对应上述移动应用擦除的方法，本文还提供了一种移动终端，包括：
移动应用数据安全打包器1，设置为将企业移动应用10的读写操作进行加密处理，生成移动安全应用20。
移动应用基座容器2，设置为接收用户对移动安全应用20的写入数据请求，并对发出写入数据请求的用户进行身份校验，如果所述用户的身份校
验通过，则移动安全应用20根据特征信息写入数据后，记录所述写入数据的所述特征信息。
移动应用基座容器2，还设置为接收移动应用管理服务器3发送的策略信息；并根据策略信息对移动安全应用20执行擦除指令，根据特征信息对移动安全应用20的应用数据进行擦除。
该移动终端中，通过移动应用数据安全打包器2将企业移动应用的读写操作进行加密处理生成移动安全应用，来保证企业移动应用的安全性。另外，移动应用基座容器2对移动安全应用的用户校验成功，允许移动安全应用写入时，移动应用基座容器2记录写入数据的特征信息。当需要擦除写入的信息时，移动应用基座容器通过接收移动应用管理服务器3发送的策略信息，并根据特征信息对移动安全应用的数据进行擦除。该移动终端可以让企业移动应用数据实现应用级安全管控，无需恢复出厂设置、无需定制终端，为企业应用的数据安全和企业应用的安全移动化推广提供了较好的技术支撑。
实施例6，
所述移动应用管理服务器设置为：接收用户对所述移动安全应用的读取数据请求，并对发出读取数据请求的用户进行身份校验。
移动应用基座容器2，还设置为：
如果所述用户的身份校验通过，则将所述用户访问的移动安全应用数据的信息与所述特征信息进行比较。
如果所述用户访问的所述移动安全应用的应用数据的信息与特征信息不一致，则将所述用户访问的移动安全应用的应用数据进行擦除。
在本发明实施例中，如果移动应用基座容器2检测到移动安全应用被恶意访问，即用户访问的应用信息与特征信息不符合，对该移动安全应用的应用数据进行擦除。从而防止移动安全应用的应用数据被更改或是靠背造成的数据泄露。
需要说明的是，参照图6所示，当读取过程中，利用特征信息进行合法检查通过，即用户访问的应用信息与特征信息一致时，并且检查密钥通过后，返回密钥。移动应用基座容器2返回移动安全应用20的读取申请，移动安全应用20此时可以进行安全读取。
实施例7，
可选地，所述移动应用数据安全打包器还设置为：如果所述用户的身份校验未通过，则返回失败；
如果所述用户的身份校验通过，则根据所述用户和写入数据请求分配写入路径，并对所述写入路径进行安全记录；
根据密钥策略，产生加密密钥，并对所述加密密钥进行安全记录；
将安全写入所需的所述写入路径和所述加密密钥返回给所述移动安全应用。
所述移动安全应用根据所述特征信息写入数据包括：
所述移动安全应用根据所述加密密钥对所述写入数据进行加密，并根据所述写入路径和所述特征信息写入加密后的所述写入数据。
参照图5所示，从用户发起写入数据请求，到移动应用基座容器2保存移动安全应用20写入数据的特征信息的过程包括步骤S201～S208：
S201、移动应用基座容器2接收用户对移动安全应用20发起的写入数据请求。
S202、移动应用基座容器2对用户访问的应用信息和用户进行合法检查，如果所述用户的身份校验未通过则返回失败。
S203、所述用户的身份校验通过，移动应用基座容器2则根据用户和写入数据请求分配写入路径，并安全记录。
S204、移动应用基座容器2根据密钥策略，产生加密密钥，并安全记录。
S205、移动应用基座容器2将安全写入所需的数据信息(包括写入路径和加密秘钥)返回给移动安全应用20。
S207、所述移动安全应用根据所述加密密钥对所述写入数据进行加密，并根据所述写入路径和所述特征信息写入加密后的所述写入数据。
S208、移动应用基座容器2在移动安全应用20写完数据后，记录写入数据的特征信息。
移动安全应用20在收到写入数据信息后，加密安全写入数据，不保留密钥，此时写入方法可以自定义，为了防止其他异常拷贝等安全，可以分成几个部分来写，这里不做具体限制。动安全应用写完数据后，通知基座容器，
基座容器记录应用数据特征信息，该特征信息包括：用户标识、应用标志、路径、数据大小等。
实施例8，
所述移动应用基座容器接收移动应用管理服务器发送的策略信息包括：
接收用户登录移动应用管理服务器后移动应用管理服务器对用户身份进行校验返回的结果。
根据所述返回的结果，在所述移动应用管理服务器检查出需要下发证书或更新证书后，接收所述移动应用管理服务器下发或更新的证书。
在所述移动应用管理服务器检查出需要更新策略信息后，接收所述移动应用管理服务器下发的新的策略信息。
在本发明实施例中，参照图3所示，移动应用基座容器2与移动应用管理服务器3的交互包括但不限于步骤S301～S303：
S301、用户访问移动应用基座容器2，并登录，登录时携带本机用户证书信息，策略更新信息等。用户登录移动应用管理服务器3后，接收移动应用管理服务器3对用户身份进行的校验返回，如果校验失败则返回失败；
S302、移动应用管理服务器3检查是否需要下发证书或更新证书，如果检查出需要下发证书或更新证书，移动应用基座容器2则接收移动应用管理服务器3下发或更新证书；
S303、移动应用管理服务器3检查是否需要更新策略信息，如果检查出需要更新策略信息，移动应用基座容器2则接收移动应用管理服务器3下发的新的策略信息。
不同移动应用基座容器2所在的移动终端接收不同的用户的访问，管理不同的移动安全应用，通过移动应用管理服务器3进行集群控制。移动应用管理服务器3根据不同的登录用户和请求选择是否对移动应用基座容器2下发证书及下发策略信息，其中针对策略信息的内容是根据用户和请求是可以定义的，方便对各个移动终端的数据进行控制。
参照图4所示，移动应用基座容器2通过策略信息21控制移动安全应用20的操作，策略信息21包括：指令擦除策略、应用数据有效期策略、应用权限策略、删除移动安全应用策略、离线访问策略和密钥管理策略。
指令擦除策略包括：预先设置的擦除执行延迟时间以及执行失败的处理的指令(如告警，暂停应用访问等)。
应用数据有效期策略包括：预先设置的所述应用数据的安全保存有效期，以及所述安全保存有效期到达后所述应用数据的处理方式(如自动删除等)；
应用权限策略预先设置的用户没有访问权限的移动安全应用的处理方式。可以设置为立刻或延迟删除该用户的应用数据，并不允许用户访问数据。一般是设置为延迟删除，以防用户权限未及时变更等问题；
删除移动安全应用策略包括：预先设置的所述移动安全应用在需要删除或者更新时的处理方式；
离线访问策略包括：不能连接所述移动应用管理服务器时移动安全应用的处理方法。如可以定义定期连接要求策略，如果不满足则执行清理所有应用数据，并禁止启动任何企业应用
密钥管理策略包括：所述预先设置的所述应用数据的加密密钥算法。
移动应用基座容器将对移动终端的安全应用数据定时检查执行上述策略。
本发明实施例中，移动终端的移动应用基座容器和移动应用数据安全打包器可以用软件实现，以便由各种类型的处理器执行。举例来说，一个移动应用基座容器可以包括计算机指令的一个或多个物理或者逻辑块，举例来说，其可以被构建为对象、过程或函数。尽管如此，移动应用基座容器的可执行代码无需物理地位于一起，而是可以包括存储在不同位里上的不同的指令，当这些指令逻辑上结合在一起时，其构成并且实现该移动应用基座容器或移动应用数据安全打包器的规定目的。
实际上，移动应用基座容器可以是单条指令或者是许多条指令，并且甚至可以分布在多个不同的代码段上，分布在不同程序当中，以及跨越多个存储器设备分布。同样地，操作数据可以在模块内被识别，并且可以依照任何适当的形式实现并且被组织在任何适当类型的数据结构内。所述操作数据可以作为单个数据集被收集，或者可以分布在不同位置上(包括在不同存储设备上)，并且至少部分地可以仅作为电子信号存在于系统或网络上。
在移动应用基座容器和移动应用数据安全打包器可以利用软件实现时，考虑到现有硬件工艺的水平，在不考虑成本的情况下，本领域技术人员都可以搭建对应的硬件电路来实现对应的功能，所述硬件电路包括常规的超大规模集成(VLSI)电路或者门阵列以及诸如逻辑芯片、晶体管之类的现有半导体或者是其它分立的元件。移动应用基座容器和移动应用数据安全打包器还可以用可编程硬件设备，诸如现场可编程门阵列、可编程阵列逻辑、可编程逻辑设备等实现。
一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令被处理器执行时实现所述的移动应用擦除方法。
本领域普通技术人员可以理解上述实施例的全部或部分步骤可以使用计算机程序流程来实现，所述计算机程序可以存储于一计算机可读存储介质中，所述计算机程序在相应的硬件平台上(如系统、设备、装置、器件等)执行，在执行时，包括方法实施例的步骤之一或其组合。
可选地，上述实施例的全部或部分步骤也可以使用集成电路来实现，这些步骤可以被分别制作成一个个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。
上述实施例中的装置/功能模块/功能单元可以采用通用的计算装置来实现，它们可以集中在单个的计算装置上，也可以分布在多个计算装置所组成的网络上。
上述实施例中的装置/功能模块/功能单元以软件功能模块的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。上述提到的计算机可读取存储介质可以是只读存储器，磁盘或光盘等。
通过本发明实施例的方案，将企业移动应用的读写操作进行加密处理，生成移动安全应用；接收用户对移动安全应用的写入数据请求，如果所述用户的身份校验通过，则在移动安全应用根据特征信息写入数据后，记录写入数据的该特征信息；接收移动应用管理服务器发送的策略信息；根据策略信息对移动安全应用执行擦除指令，根据特征信息对移动安全应用的应用数据
进行擦除。能够使得企业移动应用数据实现应用级安全管控，无需恢复出厂设置、无需定制终端，为企业应用的数据安全和企业应用的安全移动化推广提供了较好的技术支撑。
Claims (11)
- 一种移动应用擦除的方法，包括：将企业移动应用的读写操作进行加密处理，生成移动安全应用；接收用户对所述移动安全应用的写入数据请求，并对发出写入数据请求的用户进行身份校验，如果所述用户的身份校验通过，则在所述移动安全应用根据特征信息写入数据后，记录所述写入数据的所述特征信息；接收移动应用管理服务器发送的策略信息；根据所述策略信息对所述移动安全应用执行擦除指令，根据所述特征信息对所述移动安全应用的应用数据进行擦除。
- 如权利要求1所述的移动应用擦除的方法，所述方法还包括：接收用户对所述移动安全应用的读取数据请求，并对发出读取数据请求的用户进行身份校验，如果所述用户的身份校验通过，则将所述用户访问的移动安全应用的应用数据的信息与所述特征信息进行比较；如果所述用户访问的所述移动安全应用的应用数据的信息与所述特征信息不一致，则将所述用户访问的所述移动安全应用的应用数据进行擦除。
- 如权利要求1所述的移动应用擦除的方法，所述方法还包括：如果所述用户的身份校验未通过，则返回失败；如果所述用户的身份校验通过，则根据所述用户和写入数据请求分配写入路径，并对所述写入路径进行安全记录；根据密钥策略，产生加密密钥，并对所述加密密钥进行安全记录；将安全写入所需的所述写入路径和所述加密密钥返回给所述移动安全应用；所述移动安全应用根据所述特征信息写入数据包括：所述移动安全应用根据所述加密密钥对所述写入数据进行加密，并根据所述写入路径和所述特征信息写入加密后的所述写入数据。
- 如权利要求1所述的移动应用擦除的方法，其中，所述接收移动应用管理服务器发送的策略信息包括：接收用户登录移动应用管理服务器后移动应用管理服务器对用户身份 进行校验返回的结果；根据所述返回的结果，在所述移动应用管理服务器检查出需要下发证书或更新证书后，接收所述移动应用管理服务器下发或更新的证书；和/或，在所述移动应用管理服务器检查出需要更新策略信息后，接收所述移动应用管理服务器下发的新的策略信息。
- 如权利要求1所述的移动应用擦除的方法，其中，所述策略信息包括：指令擦除策略、应用数据有效期策略、应用权限策略、删除移动安全应用策略、离线访问策略和密钥管理策略；所述指令擦除策略包括：预先设置的擦除执行延迟时间以及执行失败的处理的指令；所述应用数据有效期策略包括：预先设置的所述应用数据的安全保存有效期，以及所述安全保存有效期到达后所述应用数据的处理方式；所述应用权限策略包括：预先设置的用户没有访问权限的移动安全应用的处理方式；所述删除移动安全应用策略包括：预先设置的所述移动安全应用在需要删除或者更新时的处理方式；所述离线访问策略包括：不能连接所述移动应用管理服务器时移动安全应用的处理方法；所述密钥管理策略包括：预先设置的所述应用数据的加密密钥算法。
- 一种移动终端，包括：移动应用数据安全打包器，设置为将企业移动应用的读写操作进行加密处理，生成移动安全应用；移动应用基座容器，设置为接收用户对所述移动安全应用的写入数据请求，并在对发出写入数据请求的用户进行身份校验后，如果所述用户的身份校验通过，则在所述移动安全应用根据特征信息写入数据后，记录所述写入数据的所述特征信息；所述移动应用基座容器，还设置为接收移动应用管理服务器发送的策略信息；并根据所述策略信息对所述移动安全应用执行擦除指令，根据特征信息对所述移动安全应用的应用数据进行擦除。
- 如权利要求6所述的移动终端，其中，所述移动应用管理服务器设置 为：接收用户对所述移动安全应用的读取数据请求，并对发出读取数据请求的用户进行身份校验；所述移动应用基座容器，还设置为：如果所述用户的身份校验通过，则将所述用户访问的移动安全应用数据的应用信息与所述特征信息进行比较；如果所述用户访问的所述移动安全应用的应用数据的信息与所述特征信息不一致，则将所述用户访问的所述移动安全应用的应用数据进行擦除。
- 如权利要求6所述的移动终端，所述移动应用数据安全打包器还设置为：如果所述用户的身份校验未通过，则返回失败；如果所述用户的身份校验通过，则根据所述用户和写入数据请求分配写入路径，并对所述写入路径进行安全记录；根据密钥策略，产生加密密钥，并对所述加密密钥进行安全记录；将安全写入所需的所述写入路径和所述加密密钥返回给所述移动安全应用；所述移动安全应用根据所述特征信息写入数据包括：所述移动安全应用根据所述加密密钥对所述写入数据进行加密，并根据所述写入路径和所述特征信息写入加密后的所述写入数据。
- 如权利要求6所述的移动终端，其中，所述移动应用基座容器接收移动应用管理服务器发送的策略信息包括：接收用户登录移动应用管理服务器后移动应用管理服务器对用户身份进行校验返回的结果；根据所述返回的结果，在所述移动应用管理服务器检查出需要下发证书或更新证书后，接收所述移动应用管理服务器下发或更新的证书；在所述移动应用管理服务器检查出需要更新策略信息后，接收所述移动应用管理服务器下发的新的策略信息。
- 如权利要求6所述的移动终端，其特征在于，所述策略信息包括：指令擦除策略、应用数据有效期策略、应用权限策略、删除移动安全应用策略、离线访问策略和密钥管理策略；所述指令擦除策略包括：预先设置的擦除执行延迟时间以及执行失败的处理的指令；所述应用数据有效期策略包括：预先设置的所述应用数据的安全保存有效期，以及所述安全保存有效期到达后所述应用数据的处理方式；所述应用权限策略包括：预先设置的用户没有访问权限的移动安全应用的处理方式；所述删除移动安全应用策略包括：预先设置的所述移动安全应用在需要删除或者更新时的处理方式；所述离线访问策略包括：不能连接所述移动应用管理服务器时移动安全应用的处理方法；所述密钥管理策略包括：预先设置的所述应用数据的加密密钥算法。
- 一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令被处理器执行时实现如权利要求1-5任意一项所述的移动应用擦除方法。
Applications Claiming Priority (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510487539.9 | 2015-08-10 | ||
| CN201510487539.9A CN106454803A (zh) | 2015-08-10 | 2015-08-10 | 一种移动应用擦除的方法和移动终端 |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| WO2017024820A1 true WO2017024820A1 (zh) | 2017-02-16 |
Family
ID=57984549
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| PCT/CN2016/080778 WO2017024820A1 (zh) | 2015-08-10 | 2016-04-29 | 一种移动应用擦除的方法、移动终端和计算机可读存储介质 |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN106454803A (zh) |
| WO (1) | WO2017024820A1 (zh) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109922471A (zh) * | 2019-02-15 | 2019-06-21 | 广州供电局有限公司 | 应用数据远程删除方法、装置、计算机设备和存储介质 |
| CN113779601B (zh) * | 2021-09-10 | 2023-10-10 | 百融至信(北京)科技有限公司 | 一种数据保密方法及系统 |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102984215A (zh) * | 2011-11-09 | 2013-03-20 | 微软公司 | 用于在移动设备上应用并共享远程策略的技术 |
| US20140109174A1 (en) * | 2012-10-15 | 2014-04-17 | Citrix Systems, Inc. | Providing Virtualized Private Network Tunnels |
| CN103873666A (zh) * | 2012-12-17 | 2014-06-18 | 中国电信股份有限公司 | 移动终端及其数据擦除方法、装置和企业应用安装方法 |
| US20140189781A1 (en) * | 2012-12-31 | 2014-07-03 | Verizon Patent And Licensing Inc. | Mobile enterprise server and client device interaction |
| US20140282460A1 (en) * | 2013-03-15 | 2014-09-18 | Microsoft Corporation | Enterprise device unenrollment |
| US20140331285A1 (en) * | 2013-03-29 | 2014-11-06 | Citrix Systems, Inc. | Mobile Device Locking with Context |
-
2015
- 2015-08-10 CN CN201510487539.9A patent/CN106454803A/zh active Pending
-
2016
- 2016-04-29 WO PCT/CN2016/080778 patent/WO2017024820A1/zh active Application Filing
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102984215A (zh) * | 2011-11-09 | 2013-03-20 | 微软公司 | 用于在移动设备上应用并共享远程策略的技术 |
| US20140109174A1 (en) * | 2012-10-15 | 2014-04-17 | Citrix Systems, Inc. | Providing Virtualized Private Network Tunnels |
| CN103873666A (zh) * | 2012-12-17 | 2014-06-18 | 中国电信股份有限公司 | 移动终端及其数据擦除方法、装置和企业应用安装方法 |
| US20140189781A1 (en) * | 2012-12-31 | 2014-07-03 | Verizon Patent And Licensing Inc. | Mobile enterprise server and client device interaction |
| US20140282460A1 (en) * | 2013-03-15 | 2014-09-18 | Microsoft Corporation | Enterprise device unenrollment |
| US20140331285A1 (en) * | 2013-03-29 | 2014-11-06 | Citrix Systems, Inc. | Mobile Device Locking with Context |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109922471A (zh) * | 2019-02-15 | 2019-06-21 | 广州供电局有限公司 | 应用数据远程删除方法、装置、计算机设备和存储介质 |
| CN113779601B (zh) * | 2021-09-10 | 2023-10-10 | 百融至信(北京)科技有限公司 | 一种数据保密方法及系统 |
Also Published As
| Publication number | Publication date |
|---|---|
| CN106454803A (zh) | 2017-02-22 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US10404708B2 (en) | System for secure file access | |
| USRE46023E1 (en) | Memory device upgrade | |
| US9443112B2 (en) | Secure media container | |
| TWI451773B (zh) | 用以分配和儲存電子存取用戶之設備及方法 | |
| US11368299B2 (en) | Self-encryption drive (SED) | |
| US20150081644A1 (en) | Method and system for backing up and restoring a virtual file system | |
| US20100058066A1 (en) | Method and system for protecting data | |
| US20080184035A1 (en) | System and Method of Storage Device Data Encryption and Data Access | |
| US10650158B2 (en) | System and method for secure file access of derivative works | |
| US9432369B2 (en) | Secure data containers | |
| KR20110097802A (ko) | 저장 장치의 어드레스 범위에 대한 액세스 관리 방법 | |
| US9830099B1 (en) | Secure erase of storage devices | |
| US20090177895A1 (en) | Controller for controlling logical volume-related settings | |
| CN102495986A (zh) | 计算机系统中实现避免加密数据被盗用的调用控制方法 | |
| EP2263174A2 (en) | System and method for enforcing data encryption on removable media devices | |
| US9152505B1 (en) | Verified hardware-based erasure of data on distributed systems | |
| WO2017024820A1 (zh) | 一种移动应用擦除的方法、移动终端和计算机可读存储介质 | |
| US9430674B2 (en) | Secure data access | |
| US8738935B1 (en) | Verified erasure of data implemented on distributed systems | |
| WO2010021975A2 (en) | Memory device upgrade | |
| US9305142B1 (en) | Buffer memory protection unit | |
| CN116089327A (zh) | 数据保护方法及相关设备 | |
| US9519759B2 (en) | Secure access to programming data | |
| US10999310B2 (en) | Endpoint security client embedded in storage drive firmware | |
| US10831916B2 (en) | Method for blocking access of malicious application and storage device implementing the same |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| 121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 16834445 Country of ref document: EP Kind code of ref document: A1 |
|
| NENP | Non-entry into the national phase |
Ref country code: DE |
|
| 122 | Ep: pct application non-entry in european phase |
Ref document number: 16834445 Country of ref document: EP Kind code of ref document: A1 |