WO2018000509A1 - 安全操作方法、操作装置及终端 - Google Patents

安全操作方法、操作装置及终端 Download PDF

Info

Publication number
WO2018000509A1
WO2018000509A1 PCT/CN2016/092533 CN2016092533W WO2018000509A1 WO 2018000509 A1 WO2018000509 A1 WO 2018000509A1 CN 2016092533 W CN2016092533 W CN 2016092533W WO 2018000509 A1 WO2018000509 A1 WO 2018000509A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
preset
key
trigger signal
booting
Prior art date
Application number
PCT/CN2016/092533
Other languages
English (en)
French (fr)
Inventor
张充
袁刚
郑礼良
Original Assignee
宇龙计算机通信科技(深圳)有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 宇龙计算机通信科技(深圳)有限公司 filed Critical 宇龙计算机通信科技(深圳)有限公司
Publication of WO2018000509A1 publication Critical patent/WO2018000509A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/575—Secure boot
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H04L9/3231—Biological data, e.g. fingerprint, voice or retina

Definitions

  • the present application relates to the field of terminal technologies, for example, to a safe operation method, a security operation device, and a terminal.
  • the terminal for example, the mobile intelligent terminal also has a technology for unlocking the boot loader (BootLoader), and the third-party software unlocking boot boot program is swiped into a third-party read-only memory image (ROM) to obtain Super user (root) permissions, and then brush, usually in order to brush other third-party system version to do this.
  • the boot security cannot be ensured, the important data information of the user is easily lost and leaked, that is, the unlock boot startup program is not the purpose of safe booting, and other people can easily unlock the boot boot program and then re-brush.
  • the version of the user terminal causes loss to the user.
  • the other third-party system version is brushed on the terminal, which may easily damage the original system configuration.
  • the general manufacturer terminals are not allowed to brush the machine at random.
  • the user decides to unlock the machine separately it means that the terminal on the user's hand no longer has any scope of warranty, that is, all the consequences brought by the brush will not be Included in the warranty, so the risk is very large, you need to carefully consider before brushing, do the end of the bricks.
  • the brushing operation after unlocking the booting program will bring a very poor experience to the user to a certain extent, and it is rare to feel that the unlocking booting boot program brings a good user experience.
  • the present application proposes a safe operation method, an operation device and a terminal, which can effectively improve the security of the decryption start boot program, thereby performing a safe boot, ensuring the security of the terminal operation, and improving the use.
  • User experience proposes a safe operation method, an operation device and a terminal, which can effectively improve the security of the decryption start boot program, thereby performing a safe boot, ensuring the security of the terminal operation, and improving the use.
  • a first aspect of the present application provides a security operation method, including: detecting whether a terminal enters a to-be-on state according to a received preset trigger signal; and determining that the terminal is in the to-be-powered state, determining Whether the verification key input by the user for decrypting the booting boot program matches the preset key; and determining whether to perform the preset terminal operation corresponding to the preset trigger signal according to the determination result.
  • the terminal when the terminal enters a to-be-powered state according to the received preset trigger signal, receiving a verification key input by the user for decrypting the booting boot program, and further matching the preset key according to the verification key. As a result, it is determined whether the preset terminal operation corresponding to the preset trigger signal is performed. Therefore, by setting the key of the decryption booting program, the security of the decryption can be effectively improved, and the loss and leakage of the important data information of the user can be effectively prevented.
  • the user can prevent the illegal operation of the terminal, and perform the corresponding preset terminal operation according to the preset trigger signal, thereby realizing the diversity and security of the terminal operation after decrypting the booting program, thereby improving the user experience.
  • the preset trigger signal and the verification key may be issued by a combination of a button (such as a combination of a power button and a volume up button), a long press of a single button (such as a volume down button), or a click of a start switch.
  • the preset key may be a biometric with a higher security level, such as fingerprint feature recognition, iris feature recognition or face feature recognition.
  • determining whether to perform the preset terminal operation corresponding to the preset trigger signal according to the determining result may include: when determining that the verification key and the preset key are not When the matching is performed, performing a shutdown operation; and, when it is determined that the verification key matches the preset key, and the preset trigger signal is a flash trigger signal, decrypting the booting boot program and performing a terminal flashing operation, Automatically boot into the terminal system operation interface.
  • determining, according to the matching result of the verification key and the preset key, whether to perform a preset terminal operation corresponding to the preset trigger signal includes: if not, controlling the terminal to perform a shutdown operation to ensure the terminal
  • the security of operation prevents the loss and leakage of important data information of the user, prevents others from illegally operating the terminal, etc.; if it matches and when the preset trigger signal is a trigger trigger signal, the corresponding terminal can be executed after decrypting the booting program.
  • Brush operation and automatically boot into the terminal system operation interface after the brush machine is finished for the user to use, thus achieving the safe decryption of the boot boot program and the safe brush operation, thereby realizing the safe boot of the terminal and ensuring a good user experience.
  • the determining, by the determination result, whether to perform the preset terminal operation corresponding to the preset trigger signal includes: when determining the verification key and the preset secret When the key does not match, the shutdown operation is performed; and when it is determined that the verification key matches the preset key, and the preset trigger signal is a restart signal, performing loading of the terminal operating system kernel (Kernel) Start the operation to enter the terminal system operation interface.
  • Kernel terminal operating system kernel
  • determining, according to the matching result of the verification key and the preset key, whether to perform a preset terminal operation corresponding to the preset trigger signal includes: if not, controlling the terminal to perform a shutdown operation to ensure the terminal
  • the security of operation prevents the loss and leakage of important data information of the user, prevents others from illegally operating the terminal, etc.; if it matches and when the preset trigger signal is a restart signal, the corresponding loading can be performed after decrypting the booting program.
  • the boot operation of the terminal operating system kernel is used to enter the terminal system operation interface for the user to use, thus realizing the secure decryption of the boot boot program and the safe boot operation, ensuring a good user experience; wherein the restart signal can be the terminal When the user is in the power-on state, the user chooses to perform the factory reset operation.
  • the method further includes: verifying a screen unlocking key input by the user.
  • the user in order to ensure the security of the terminal operation and ensure the security of the important data of the user stored in the terminal, the user can be authenticated before actually entering the terminal system operation interface after performing the startup operation of the operating system kernel.
  • the legality of the identity that is, verifying whether the screen unlocking key (such as digital key and pattern key) input by the current user is correct. When it is correct, it is allowed to enter the terminal system operation interface to perform related terminal operations. When it is incorrect, it is forbidden to enter.
  • the terminal system operation interface is optional. When the number of errors of the screen unlocking key input by the user reaches a preset number of times (for example, 3 times), the screen unlocking program is locked, and the input of the screen unlocking key is prohibited.
  • the method further includes: setting the preset key, and according to the preset secret The key encrypts the boot loader.
  • the preset booting key used to encrypt the booting program is set in advance, and the booting boot program is encrypted by using the preset key after the setting is completed, thereby improving the decryption security of the booting boot program, thereby Ensure that the terminal is safely powered on.
  • the preset key can have one or more presets. When there are multiple, you can set the usage period of each preset key to be used for recycling. It can also be updated according to user requirements and related operation instructions. The preset key to ensure the security of the terminal operation.
  • a security operation apparatus including: a detection module, configured to detect whether a terminal enters a to-be-powered state according to a received preset trigger signal; When the detecting module detects that the terminal is in the to-be-on state, determining whether the verification key input by the user for decrypting the booting boot program matches the preset key; and the control module is configured to The determination result of the determining module determines whether to perform a preset terminal operation corresponding to the preset trigger signal.
  • the terminal when the terminal enters a to-be-powered state according to the received preset trigger signal, receiving a verification key input by the user for decrypting the booting boot program, and further matching the preset key according to the verification key. As a result, it is determined whether the preset terminal operation corresponding to the preset trigger signal is performed. Therefore, by setting the key of the decryption booting program, the security of the decryption can be effectively improved, and the loss and leakage of the important data information of the user can be effectively prevented.
  • the user can prevent the illegal operation of the terminal, and perform the corresponding preset terminal operation according to the preset trigger signal, thereby realizing the diversity and security of the terminal operation after decrypting the booting program, thereby improving the user experience.
  • the preset trigger signal and the verification key may be issued by a combination of a button (such as a combination of a power button and a volume up button), a long press of a single button (such as a volume down button), or a click of a start switch.
  • the preset key may be a biometric with a higher security level, such as fingerprint feature recognition, iris feature recognition or face feature recognition.
  • control module is configured to: when the determining module determines that the verification key does not match the preset key, control to perform a shutdown operation; when the determining module When it is determined that the verification key matches the preset key, and the preset trigger signal is a flash trigger signal, the control decrypts the booting boot program and performs a terminal flashing operation to automatically boot into the terminal system operation interface.
  • determining, according to the matching result of the verification key and the preset key, whether to perform a preset terminal operation corresponding to the preset trigger signal includes: if not, controlling the terminal to perform a shutdown operation to ensure the terminal
  • the security of operation prevents the loss and leakage of important data information of the user, prevents others from illegally operating the terminal, etc.; if it matches and when the preset trigger signal is a trigger trigger signal, the corresponding terminal can be executed after decrypting the booting program.
  • Brush operation and automatically boot into the terminal system operation interface after the brush machine is finished for the user to use, thus achieving the safe decryption of the boot boot program and the safe brush operation, thereby realizing the safe boot of the terminal and ensuring a good user experience.
  • control module is configured to: when the determining module determines that the verification key does not match the preset key, control to perform a shutdown operation; When the determining module determines that the verification key matches the preset key, and the preset trigger signal is a restart signal, controlling to perform a booting operation of loading the terminal operating system kernel to enter the terminal system operation interface.
  • determining, according to the matching result of the verification key and the preset key, whether to perform a preset terminal operation corresponding to the preset trigger signal includes: if not, controlling the terminal to perform a shutdown operation to ensure the terminal
  • the security of operation prevents the loss and leakage of important data information of the user, prevents others from illegally operating the terminal, etc.; if it matches and when the preset trigger signal is a restart signal, the corresponding loading can be performed after decrypting the booting program.
  • the boot operation of the terminal operating system kernel is used to enter the terminal system operation interface for the user to use, thus realizing the secure decryption of the boot boot program and the safe boot operation, ensuring a good user experience; wherein the restart signal can be the terminal When the user is in the power-on state, the user chooses to perform the factory reset operation.
  • the method further includes: a verification module, configured to: after the control module controls to perform the booting operation of the loading terminal operating system kernel, before entering the terminal system operation interface, to the user Enter the screen unlock key to verify.
  • a verification module configured to: after the control module controls to perform the booting operation of the loading terminal operating system kernel, before entering the terminal system operation interface, to the user Enter the screen unlock key to verify.
  • the user in order to ensure the security of the terminal operation and ensure the security of the important data of the user stored in the terminal, the user can be authenticated before actually entering the terminal system operation interface after performing the startup operation of the operating system kernel.
  • the legality of the identity that is, verifying whether the screen unlocking key (such as digital key and pattern key) input by the current user is correct. When it is correct, it is allowed to enter the terminal system operation interface to perform related terminal operations. When it is incorrect, it is forbidden to enter.
  • the terminal system operation interface can lock the screen unlocking program and prohibit entry of the screen unlocking key when the number of errors of the screen unlocking key input by the user reaches a preset number of times (for example, 3 times).
  • the setting module is configured to: after the detecting module detects whether the terminal enters a to-be-powered state according to the received preset trigger signal, setting the preset key, And encrypting the booting boot program according to the preset key.
  • the preset booting key used to encrypt the booting program is set in advance, and the booting boot program is encrypted by using the preset key after the setting is completed, thereby improving the decryption security of the booting boot program, thereby Ensure that the terminal is safely powered on.
  • the preset key can have one or more presets. When there are multiple, you can set the usage period of each preset key to be used for recycling. It can also be updated according to user requirements and related operation instructions. The preset key to ensure the security of the terminal operation.
  • a terminal comprising: the security operating device according to any one of the preceding aspects.
  • a fourth aspect of the embodiments of the present application provides a non-transitory computer readable storage medium storing computer executable instructions for performing the above method.
  • the security of the decryption booting boot program can be effectively improved, and then the security booting can be performed to ensure the security of the terminal operation and improve the user experience.
  • FIG. 1 is a flow chart showing a safe operation method according to an embodiment of the present application
  • FIG. 2 is a schematic flow chart of a method for performing a corresponding operation according to a matching result of a verification key and a preset key according to the first embodiment of the present application;
  • FIG. 3 is a schematic flowchart of a method for performing a corresponding operation according to a matching result of a verification key and a preset key according to a second embodiment of the present application;
  • FIG. 4 is a schematic diagram showing the overall flow of a secure booting of a decryption booting bootloader according to an embodiment of the present application
  • FIG. 5 is a schematic flowchart showing a secure booting of a decryption booting bootloader according to an embodiment of the present application
  • Figure 6 shows a schematic block diagram of a safety operating device in accordance with an embodiment of the present application
  • FIG. 7 shows a schematic block diagram of a terminal in accordance with an embodiment of the present application.
  • FIG. 8 shows a schematic block diagram of a terminal in accordance with an embodiment of the present application.
  • FIG. 1 shows a flow chart of a safe operation method according to an embodiment of the present application.
  • the security operation method includes:
  • the terminal when the terminal enters a state to be powered according to the received preset trigger signal, Receiving a verification key input by the user for decrypting the booting boot program, and determining, according to the matching result of the verification key and the preset key, whether to perform a preset terminal operation corresponding to the preset trigger signal, and thus, decrypting by setting
  • the key of the booting program can effectively improve the security of decryption, can effectively prevent the loss and leakage of important data information of the user, prevent others from illegally operating the terminal, and perform corresponding preset terminal operations according to the preset trigger signal. It can realize the diversity and security of the terminal operation after decrypting the booting program, thereby improving the user experience.
  • the preset trigger signal may be issued by a combination of a button (such as a combination of a power button and a volume up button), a long press of a single button (such as a volume down button), or a click of a start switch.
  • the verification key and the preset key may be biometrics with higher security level, such as fingerprint feature recognition, iris feature recognition or face feature recognition.
  • the method for performing the corresponding operation according to the matching result of the verification key and the preset key may be implemented by using the following embodiments, and the preset trigger signal is used as the brush trigger signal and the restart signal as an example for description.
  • the preset trigger signal is used as the trigger signal of the brush, and includes:
  • S1410 is executed, that is, when it is determined that the verification key does not match the preset key, the shutdown operation is performed.
  • S1420 is executed, that is, when it is determined that the verification key matches the preset key, and the preset trigger signal is a flash trigger signal, the booting procedure is decrypted. And perform terminal brush operation to automatically boot into the terminal system operation interface.
  • determining, according to the matching result of the verification key and the preset key, whether to perform a preset terminal operation corresponding to the preset trigger signal includes: if not, controlling the terminal to perform a shutdown operation to ensure the terminal
  • the security of operation prevents the loss and leakage of important data information of the user, prevents others from illegally operating the terminal, etc.; if it matches and when the preset trigger signal is a trigger trigger signal, the corresponding terminal can be executed after decrypting the booting program.
  • Brush operation and automatically boot into the terminal system operation interface after the brush machine is finished for the user to use, thus achieving the safe decryption of the boot boot program and the safe brush operation, thereby realizing the safe boot of the terminal and ensuring a good user experience.
  • the preset trigger signal is used as the restart signal, and includes:
  • S1430 is executed, that is, when it is determined that the verification key does not match the preset key, the shutdown operation is performed.
  • S1440 is executed, that is, when it is determined that the verification key matches the preset key, and the preset trigger signal is a restart signal, the loading terminal operation system is executed.
  • the boot operation of the kernel is entered to enter the terminal system operation interface.
  • determining, according to a matching result of the verification key and the preset key, whether to perform a preset terminal operation corresponding to the preset trigger signal including: if not, controlling the terminal to perform a shutdown operation to ensure terminal operation. Security, preventing loss and leakage of important data information of the user, preventing others from illegally operating the terminal, etc.; if matching and when the preset trigger signal is a restart signal, the corresponding loading terminal operation may be performed after decrypting the booting program
  • the booting operation of the system kernel is to enter the terminal system operation interface for the user to use, thus realizing the secure decryption of the booting boot program and the safe booting operation, ensuring a good user experience; wherein, the restart signal can be when the terminal is powered on. In the state, the user chooses to perform the operation of restoring the factory settings.
  • the method further includes: verifying a screen unlocking key input by the user.
  • the user in order to ensure the security of the terminal operation and ensure the security of the important data of the user stored in the terminal, the user can be authenticated before actually entering the terminal system operation interface after performing the startup operation of the operating system kernel.
  • the legality of the identity that is, verifying whether the screen unlocking key (such as digital key and pattern key, etc.) input by the current user is correct, and when it is correct, it is allowed to enter the terminal system operation interface to perform related terminal operations, when the screen input by the user is unlocked. If the key is incorrect, it is forbidden to enter the terminal system operation interface.
  • the number of errors of the screen unlocking key input by the user reaches a preset number of times (for example, 3 times), the screen unlocking program is locked, and the screen unlocking is prohibited. The input of the key.
  • the method further includes: setting the preset key, and according to the preset secret The key encrypts the boot loader.
  • the preset booting key used to encrypt the booting program is set in advance, and the booting boot program is encrypted by using the preset key after the setting is completed, thereby improving the decryption security of the booting boot program, thereby Ensure that the terminal is safely powered on.
  • the preset key can have one or more presets. When there are multiple, you can set the usage period of each preset key to be used for recycling. It can also be updated according to user requirements and related operation instructions. The preset key to ensure the security of the terminal operation.
  • boot loader is a BootLoader.
  • the preset key is fingerprint feature recognition, that is, the fingerprint feature recognition decryption is started.
  • the boot program is safely booted, wherein the fingerprint recognition module is a module that exists independently in the terminal system and can be used independently or by the system.
  • the overall process of the secure booting of the decryption booting program according to the embodiment of the present application includes:
  • the terminal starts the decryption booting boot program.
  • step S440 it is judged whether or not the fingerprint feature recognition is passed, and when it is passed, step S460 is performed, and when the verification is not passed, S4120 is executed.
  • the terminal performs a booting operation.
  • the terminal performs a shutdown operation.
  • the booting program can be decrypted and booted, and then the terminal operating system kernel is loaded into the terminal booting process. After the booting is completed, the system interface can be continued. Operation terminal; if the terminal fingerprint feature recognition fails, it means that the user is not operating, and directly enters the shutdown mode to protect the important data information of the user to prevent leakage.
  • the fingerprint feature setting decrypts the password of the booting boot program.
  • the booting program is started according to the fingerprint feature input.
  • the terminal is in a state to be powered on, and is shut down/restarted.
  • S550 it is judged whether or not the fingerprint feature recognition is passed, and when it is passed, S560 is executed, and when the verification is not passed, S5130 is executed.
  • step S590 clicking to perform the factory reset operation, and returning to execution S540, and when it is determined in S550, S5100 is executed, and if it is not passed, step S5130 is executed.
  • the boot program is decrypted.
  • the terminal operating system kernel is loaded and powered on.
  • the terminal enters a standby or shutdown state.
  • the mobile intelligent terminal can be freely operated, including restoring the factory settings. As shown in S590, the user resets the factory settings and enters the restart process, as in step (30);
  • step (30). If the user presses the power button, volume+, volume-key three-key combination for the smart terminal in the shutdown state, the user will enter the step of re-flashing the version, and then proceeds down the shutdown/restart process, as in step (30). .
  • the embodiment provides a method for performing a secure booting by the terminal by means of the feature recognition and decryption booting program, and greatly satisfies the user's protection of the terminal private information.
  • the booting program is booted by fingerprint feature recognition and decryption to perform secure booting, and the privacy of the user is well protected in the system unlocking step. If the user's terminal is lost, there is no need to worry about the leakage of important information of the terminal. Even if someone else performs shortcut keys or key combination on the terminal to restore the factory-set erase/data/partition data, fingerprint feature recognition is required for verification.
  • Figure 6 shows a schematic block diagram of a safety operating device in accordance with an embodiment of the present application
  • the security operation device 600 includes: a detection module 602, a determination module 604, and a control module 606.
  • the detecting module 602 is configured to detect whether the terminal enters a to-be-on state according to the received preset trigger signal.
  • the determining module 604 is configured to determine, when the detecting module 602 detects that the terminal is in the to-be-powered state. Whether the verification key used by the user to decrypt the startup boot program matches the preset key; the control module 606 is configured to determine whether to execute the preset corresponding to the preset trigger signal according to the determination result of the determining module 604 Terminal operation.
  • the terminal when the terminal enters a to-be-powered state according to the received preset trigger signal, receiving a verification key input by the user for decrypting the booting boot program, and further matching the preset key according to the verification key. As a result, it is determined whether the preset terminal operation corresponding to the preset trigger signal is performed. Therefore, by setting the key of the decryption booting program, the security of the decryption can be effectively improved, and the loss and leakage of the important data information of the user can be effectively prevented.
  • the user can prevent the illegal operation of the terminal, and perform the corresponding preset terminal operation according to the preset trigger signal, thereby realizing the diversity and security of the terminal operation after decrypting the booting program, thereby improving the user experience.
  • the preset trigger signal and the verification key may be issued by a combination of a button (such as a combination of a power button and a volume up button), a long press of a single button (such as a volume down button), or a click of a start switch.
  • the preset key may be a biometric with a higher security level, such as fingerprint feature recognition, iris feature recognition or face feature recognition.
  • control module 606 is configured to: when the determining module 604 determines that the verification key does not match the preset key, control to perform a shutdown operation; When the determining module 604 determines that the verification key matches the preset key, and the preset trigger signal is a flash trigger signal, the control decrypts the booting boot program and performs a terminal flashing operation to automatically boot into the terminal. System operation interface.
  • determining, according to the matching result of the verification key and the preset key, whether to perform a preset terminal operation corresponding to the preset trigger signal includes: if not, controlling the terminal to perform a shutdown operation to ensure the terminal
  • the security of operation prevents the loss and leakage of important data information of the user, prevents others from illegally operating the terminal, etc.; if it matches and when the preset trigger signal is a trigger trigger signal, the corresponding terminal can be executed after decrypting the booting program.
  • Brush operation and automatically boot into the terminal system operation interface after the brush machine is finished for the user to use, thus achieving the safe decryption of the boot boot program and the safe brush operation, thereby realizing the safe boot of the terminal and ensuring a good user experience.
  • the control module 606 is configured to: when the determining module 604 determines that the verification key does not match the preset key, control to perform a shutdown operation; and when the determining module 604 determines the verification password When the key matches the preset key, and the preset trigger signal is a restart signal, the control performs a boot operation of loading the terminal operating system kernel to enter the terminal system operation interface.
  • determining, according to the matching result of the verification key and the preset key, whether to perform a preset terminal operation corresponding to the preset trigger signal includes: if not, controlling the terminal to perform a shutdown operation to ensure the terminal
  • the security of operation prevents the loss and leakage of important data information of the user, prevents others from illegally operating the terminal, etc.; if it matches and when the preset trigger signal is a restart signal, the corresponding loading can be performed after decrypting the booting program.
  • the boot operation of the terminal operating system kernel is used to enter the terminal system operation interface for the user to use, thus realizing the secure decryption of the boot boot program and the safe boot operation, ensuring a good user experience; wherein the restart signal can be the terminal When the user is in the power-on state, the user chooses to perform the factory reset operation.
  • the verification module 608 is configured to: after the control module 606 controls to perform the booting operation of the loading terminal operating system kernel, before entering the terminal system operation interface, The screen unlock key entered by the user is verified.
  • the user in order to ensure the security of the terminal operation and ensure the security of the important data of the user stored in the terminal, the user can be authenticated before actually entering the terminal system operation interface after performing the startup operation of the operating system kernel.
  • the legality of the identity that is, verifying whether the screen unlocking key (such as digital key and pattern key) input by the current user is correct. When it is correct, it is allowed to enter the terminal system operation interface to perform related terminal operations. When it is incorrect, it is forbidden to enter.
  • the terminal system operation interface is optional. When the number of errors of the screen unlocking key input by the user reaches a preset number of times (for example, 3 times), the screen unlocking program is locked, and the input of the screen unlocking key is prohibited.
  • the method further includes: a setting module 610, configured to set the preset density before the detecting module 602 detects whether the terminal enters a to-be-powered state according to the received preset trigger signal. Key, and encrypting the boot loader according to the preset key.
  • the preset booting key used to encrypt the booting program is set in advance, and the booting boot program is encrypted by using the preset key after the setting is completed, thereby improving the decryption security of the booting boot program, thereby Ensure that the terminal is safely powered on.
  • the preset key can have one or more presets. When there are multiple, you can set the usage period of each preset key to be used for recycling. It can also be updated according to user requirements and related operation instructions. The preset key to ensure the security of the terminal operation.
  • FIG. 7 shows a schematic block diagram of a terminal in accordance with an embodiment of the present application.
  • the terminal 700 includes: the security operation device 600 according to any one of the foregoing technical solutions, and therefore, the terminal 700 has any one of the foregoing technical solutions. All the beneficial effects of the safe operation device 600 will not be described herein.
  • FIG. 8 is a schematic structural diagram of a mobile terminal disclosed in an embodiment of the present application.
  • the mobile terminal in the embodiment of the present application may be any device with a touch display screen, such as a tablet computer, a mobile phone, an e-reader, a remote controller, a personal computer (PC), a notebook computer, an in-vehicle device, and a network television. And wearable devices, etc.
  • the mobile terminal in the embodiment of the present application includes: at least one processor 801, such as a CPU, at least one receiver 803, and at least one memory 804.
  • At least one transmitter 805 and at least one communication bus 802 can also be included. Among them, the communication bus 802 is used to implement connection communication between these components.
  • the receiver 803 and the transmitter 805 of the device in this embodiment may be wired transmission ports, or may be wireless devices, for example, including antenna devices, for performing signaling or data communication with other node devices.
  • the memory 804 may be a high speed RAM memory or a non-volatile memory such as at least one disk memory.
  • the memory 804 can also optionally be at least one storage device located remotely from the aforementioned processor 801.
  • a set of program code is stored in memory 804, and said processor 801 can invoke code stored in memory 804 via communication bus 802 to perform related functions.
  • the mobile terminal also includes an input/output device.
  • the processor 801 is configured to detect whether the terminal enters a to-be-on state according to the received preset trigger signal.
  • the processor 801 is further configured to determine, according to the determination result, whether to perform a preset terminal operation corresponding to the preset trigger signal, including:
  • the preset trigger signal is a flash trigger signal
  • the processor 801 is further configured to determine, according to the determination result, whether to perform a preset terminal operation corresponding to the preset trigger signal, including:
  • the preset trigger signal is a restart signal, performing a boot operation of loading the terminal operating system kernel to enter the terminal system operation interface.
  • the processor 801 is further configured to: after performing the booting operation system kernel booting operation and before entering the terminal system operation interface, further comprising:
  • the screen unlock key entered by the user is verified.
  • the processor 801 is further configured to: before the detecting the terminal enters a to-be-on state according to the received preset trigger signal, the method further includes:
  • determining, according to a matching result of the verification key and the preset key, whether to perform a preset terminal operation corresponding to the preset trigger signal includes: If the mismatch does not match, the control terminal performs a shutdown operation to ensure the security of the terminal operation, prevent the loss and leakage of important data information of the user, prevent others from illegally operating the terminal, and the like; if it matches and when the preset trigger signal is a trigger trigger signal, Then, after the booting boot program is decrypted, the corresponding terminal flashing operation is performed, and after the brushing is finished, the terminal system operating interface is automatically booted into the terminal system operation interface for the user to use, thus realizing the secure decryption of the booting boot program and the safe brushing operation, thereby realizing The safe booting of the terminal ensures a good user experience.
  • the embodiment of the present application further provides a non-transitory computer readable storage medium storing computer executable instructions for executing a part including any one of the security operation methods described in the foregoing method embodiments or All steps.
  • the technical solution of the present application is described in detail with reference to the accompanying drawings.
  • the technical solution of the present application can effectively improve the security of the decryption booting boot program, thereby performing secure booting, ensuring the security of the terminal operation, and improving the user experience.
  • the security operation method, the operation device and the terminal provided by the embodiment of the present application can effectively improve the security of decryption by setting a key for decrypting and starting the boot program, and can effectively prevent loss and leakage of important data information of the user and prevent others from being connected to the terminal.
  • Illegal operation, etc., according to the preset trigger signal Performing the corresponding preset terminal operation can realize the diversity and security of the terminal operation after decrypting the booting program, thereby improving the user experience.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Biodiversity & Conservation Biology (AREA)
  • Biomedical Technology (AREA)
  • General Health & Medical Sciences (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Stored Programmes (AREA)
  • Telephone Function (AREA)
  • Lock And Its Accessories (AREA)

Abstract

一种安全操作方法、安全操作装置和终端，其中，所述安全操作方法包括：检测终端是否根据接收到的预设触发信号进入待开机状态；当检测到所述终端处于所述待开机状态时，判断用户输入的用于解密启动引导程序的验证密钥是否与预设密钥匹配；根据判断结果确定是否执行与所述预设触发信号对应的预设终端操作。

Description

安全操作方法、操作装置及终端
本申请要求于2016年6月29日提交中国专利局，申请号为201610493561.9、发明名称为“安装操作方法及操作装置、终端”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及终端技术领域，例如涉及一种安全操作方法、一种安全操作装置和一种终端。
背景技术
目前，为了刷机，终端(比如，移动智能终端)也有解锁启动引导程序(BootLoader)的技术，通过第三方软件解锁启动引导程序刷入第三方只读存储器镜像(Read Only Memory image，ROM)，获取超级用户(root)权限，再进行刷机，一般都是为了刷其他第三方系统版本进行此操作。而且，当无法确保开机安全的情况下，会导致用户重要数据信息很容易丢失、泄漏，即解锁启动引导程序也不是进行安全开机的目的，另外，其他人也很容易解锁启动引导程序后重新刷用户终端的版本，给用户造成损失。
上述相关技术方案在解锁启动引导程序后，在终端上刷其他第三方系统版本导致容易破坏原来的系统配置。一般的厂商终端都是不允许私自随意进行刷机的，当用户决定单独进行刷机解锁也就意味用户手上的终端不再具有任何范围内的保修资格，即刷机所带来的一切后果将不会包含在保修范围内，所以说风险是非常的大，刷机之前需要谨慎考虑，做好终端变砖的打算。综上，解锁启动引导程序后的刷机操作在一定程度上会给用户带来非常差的体验，很少会感觉到解锁启动引导程序带来好的用户体验。
因此，如何提高解密启动引导程序的安全性，进而进行安全开机，确保终端操作的安全性，提升用户体验，成为解决的问题。
发明内容
本申请提出了一种安全操作方法、操作装置及终端，可以有效地提高解密启动引导程序的安全性，进而进行安全开机，确保终端操作的安全性，提升用 户体验。
本申请实施例的第一方面，提出了一种安全操作方法，包括：检测终端是否根据接收到的预设触发信号进入待开机状态；当检测到所述终端处于所述待开机状态时，判断用户输入的用于解密启动引导程序的验证密钥是否与预设密钥匹配；以及，根据判断结果确定是否执行与所述预设触发信号对应的预设终端操作。
在该技术方案中，当终端根据接收到的预设触发信号进入待开机状态时，接收用户输入的用于解密启动引导程序的验证密钥，进而根据该验证密钥与预设密钥的匹配结果确定是否执行与上述预设触发信号对应的预设终端操作，如此，通过设置解密启动引导程序的密钥可以有效地提高解密的安全性，可以有效地防止用户重要数据信息的丢失、泄漏，防止他人对终端进行非法操作等，同时根据预设触发信号执行对应的预设终端操作，可以实现解密启动引导程序后的终端操作的多样性和安全性，从而提升了用户体验。
其中，可以通过组合按键(比如电源键与音量增键的组合)的形式、长按单键(比如音量减键)的形式或者单击启动开关的形式发出该预设触发信号以及验证密钥和预设密钥可以为安全级别较高的生物特征识别，比如，指纹特征识别、虹膜特征识别或人脸特征识别等。
在上述技术方案中，可选的，所述根据判断结果确定是否执行与所述预设触发信号对应的预设终端操作，可以包括：当判定所述验证密钥与所述预设密钥不匹配时，执行关机操作；以及，当判定所述验证密钥与所述预设密钥匹配、且所述预设触发信号为刷机触发信号时，解密所述启动引导程序并执行终端刷机操作，以自动开机进入终端系统操作界面。
在该技术方案中，根据验证密钥与预设密钥的匹配结果确定是否执行与预设触发信号对应的预设终端操作，一方面包括：如果不匹配则控制终端执行关机操作，以确保终端操作的安全性，防止用户重要数据信息的丢失、泄漏，防止他人对终端进行非法操作等；如果匹配且当预设触发信号为刷机触发信号时，则可以在解密启动引导程序后执行对应的终端刷机操作，并在刷机结束后自动开机进入终端系统操作界面以供用户使用，如此，实现了启动引导程序的安全解密和安全的刷机操作，进而实现终端的安全开机，确保了用户良好的体验。
在上述任一技术方案中，可选的，所述根据判断结果确定是否执行与所述预设触发信号对应的预设终端操作，包括：当判定所述验证密钥与所述预设密 钥不匹配时，执行关机操作；以及，当判定所述验证密钥与所述预设密钥匹配、且所述预设触发信号为重新启动信号时，执行加载终端操作系统内核(Kernel)的开机操作，以进入终端系统操作界面。
在该技术方案中，根据验证密钥与预设密钥的匹配结果确定是否执行与预设触发信号对应的预设终端操作，一方面包括：如果不匹配则控制终端执行关机操作，以确保终端操作的安全性，防止用户重要数据信息的丢失、泄漏，防止他人对终端进行非法操作等；如果匹配且当预设触发信号为重新启动信号时，则可以在解密启动引导程序后执行对应的加载终端操作系统内核的开机操作，以进入终端系统操作界面供用户使用，如此，实现了启动引导程序的安全解密和安全的开机操作，确保了用户良好的体验；其中，重新启动信号可以为当终端处于开机状态下，用户选择进行恢复出厂设置的操作后发出的。
在上述任一技术方案中，可选的，在执行所述加载终端操作系统内核的开机操作之后、进入所述终端系统操作界面之前，还包括：对用户输入的屏幕解锁密钥进行验证。
在该技术方案中，为了确保终端操作的安全性，同时确保终端中存储的用户重要数据的安全性，可以在加载操作系统内核的开机操作之后真正进入终端系统操作界面进行相关终端操作之前验证用户身份的合法性，即验证当前用户输入的屏幕解锁密钥(比如数字密钥及图案密钥等)是否正确，当正确则允许进入终端系统操作界面进行相关终端操作，当不正确，则禁止进入终端系统操作界面，可选的，可以在用户输入的屏幕解锁密钥的错误次数累计达到预设次数(比如3次)时，锁定屏幕解锁程序，禁止进入屏幕解锁密钥的输入。
在上述任一技术方案中，可选的，在所述检测终端是否根据接收到的预设触发信号进入待开机状态之前，还包括：设置所述预设密钥，并根据所述预设密钥加密所述启动引导程序。
在该技术方案中，通过预先设置用于加密启动引导程序的预设密钥，并在设置完成后使用该预设密钥对启动引导程序进行加密，以提高启动引导程序的解密安全性，从而确保终端的安全开机，其中，预设密钥可以有一个或多个，当有多个时可以设置每个预设密钥的使用周期进行循环使用，还可以根据用户的需求和相关操作指令更新该预设密钥，以确保终端操作的安全性。
根据本申请的第二方面，提出了一种安全操作装置，包括：检测模块，设置为检测终端是否根据接收到的预设触发信号进入待开机状态；判断模块，设 置为当所述检测模块检测到所述终端处于所述待开机状态时，判断用户输入的用于解密启动引导程序的验证密钥是否与预设密钥匹配；以及，控制模块，设置为根据所述判断模块的判断结果确定是否执行与所述预设触发信号对应的预设终端操作。
在该技术方案中，当终端根据接收到的预设触发信号进入待开机状态时，接收用户输入的用于解密启动引导程序的验证密钥，进而根据该验证密钥与预设密钥的匹配结果确定是否执行与上述预设触发信号对应的预设终端操作，如此，通过设置解密启动引导程序的密钥可以有效地提高解密的安全性，可以有效地防止用户重要数据信息的丢失、泄漏，防止他人对终端进行非法操作等，同时根据预设触发信号执行对应的预设终端操作，可以实现解密启动引导程序后的终端操作的多样性和安全性，从而提升了用户体验。
其中，可以通过组合按键(比如电源键与音量增键的组合)的形式、长按单键(比如音量减键)的形式或者单击启动开关的形式发出该预设触发信号以及验证密钥和预设密钥可以为安全级别较高的生物特征识别，比如，指纹特征识别、虹膜特征识别或人脸特征识别等。
在上述技术方案中，可选的，所述控制模块是设置为：当所述判断模块判定所述验证密钥与所述预设密钥不匹配时，控制执行关机操作；当所述判断模块判定所述验证密钥与所述预设密钥匹配、且所述预设触发信号为刷机触发信号时，控制解密所述启动引导程序并执行终端刷机操作，以自动开机进入终端系统操作界面。
在该技术方案中，根据验证密钥与预设密钥的匹配结果确定是否执行与预设触发信号对应的预设终端操作，一方面包括：如果不匹配则控制终端执行关机操作，以确保终端操作的安全性，防止用户重要数据信息的丢失、泄漏，防止他人对终端进行非法操作等；如果匹配且当预设触发信号为刷机触发信号时，则可以在解密启动引导程序后执行对应的终端刷机操作，并在刷机结束后自动开机进入终端系统操作界面以供用户使用，如此，实现了启动引导程序的安全解密和安全的刷机操作，进而实现终端的安全开机，确保了用户良好的体验。
在上述任一技术方案中，可选的，所述控制模块是设置为：当所述判断模块判定所述验证密钥与所述预设密钥不匹配时，控制执行关机操作；当所述判断模块判定所述验证密钥与所述预设密钥匹配、且所述预设触发信号为重新启动信号时，控制执行加载终端操作系统内核的开机操作，以进入终端系统操作 界面。
在该技术方案中，根据验证密钥与预设密钥的匹配结果确定是否执行与预设触发信号对应的预设终端操作，一方面包括：如果不匹配则控制终端执行关机操作，以确保终端操作的安全性，防止用户重要数据信息的丢失、泄漏，防止他人对终端进行非法操作等；如果匹配且当预设触发信号为重新启动信号时，则可以在解密启动引导程序后执行对应的加载终端操作系统内核的开机操作，以进入终端系统操作界面供用户使用，如此，实现了启动引导程序的安全解密和安全的开机操作，确保了用户良好的体验；其中，重新启动信号可以为当终端处于开机状态下，用户选择进行恢复出厂设置的操作后发出的。
在上述任一技术方案中，可选的，还包括：验证模块，设置为在所述控制模块控制执行所述加载终端操作系统内核的开机操作之后、进入所述终端系统操作界面之前，对用户输入的屏幕解锁密钥进行验证。
在该技术方案中，为了确保终端操作的安全性，同时确保终端中存储的用户重要数据的安全性，可以在加载操作系统内核的开机操作之后真正进入终端系统操作界面进行相关终端操作之前验证用户身份的合法性，即验证当前用户输入的屏幕解锁密钥(比如数字密钥及图案密钥等)是否正确，当正确则允许进入终端系统操作界面进行相关终端操作，当不正确，则禁止进入终端系统操作界面，可以在用户输入的屏幕解锁密钥的错误次数累计达到预设次数(比如3次)时，锁定屏幕解锁程序，禁止进入屏幕解锁密钥的输入。
在上述任一技术方案中，可选的，还包括：设置模块，设置为在所述检测模块检测终端是否根据接收到的预设触发信号进入待开机状态之前，设置所述预设密钥，并根据所述预设密钥加密所述启动引导程序。
在该技术方案中，通过预先设置用于加密启动引导程序的预设密钥，并在设置完成后使用该预设密钥对启动引导程序进行加密，以提高启动引导程序的解密安全性，从而确保终端的安全开机，其中，预设密钥可以有一个或多个，当有多个时可以设置每个预设密钥的使用周期进行循环使用，还可以根据用户的需求和相关操作指令更新该预设密钥，以确保终端操作的安全性。
根据本申请的第三方面，提出了一种终端，包括：如上述技术方案中任一项所述的安全操作装置。
本申请实施例的第四方面，提供一种非瞬时性计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令用于执行上述方法。
通过本申请的技术方案，可以有效地提高解密启动引导程序的安全性，进而进行安全开机，确保终端操作的安全性，提升用户体验。
附图说明
图1示出了根据本申请的实施例的安全操作方法的流程示意图；
图2示出了根据本申请的第一实施例的根据验证密钥与预设密钥的匹配结果执行相应操作的方法流程示意图；
图3示出了根据本申请的第二实施例的根据验证密钥与预设密钥的匹配结果执行相应操作的方法流程示意图；
图4示出了根据本申请的实施例的解密启动引导程序安全开机的整体流程示意图；
图5示出了根据本申请的实施例的解密启动引导程序安全开机的流程示意图；
图6示出了根据本申请的实施例的安全操作装置的示意框图；
图7示出了根据本申请的实施例的终端的示意框图；
图8示出了根据本申请的实施例的终端的示意框图。
具体实施方式
下面结合附图和实施方式对本申请进行描述。需要说明的是，在不冲突的情况下，本申请的实施例及实施例中的特征可以相互组合。
在下面的描述中阐述了很多细节以便于充分理解本申请，但是，本申请还可以采用其他不同于在此描述的其他方式来实施，因此，本申请的保护范围并不受下面公开的实施例的限制。
图1示出了根据本申请的实施例的安全操作方法的流程示意图。
如图1所示，根据本申请的实施例的安全操作方法，包括：
在S120中，检测终端是否根据接收到的预设触发信号进入待开机状态。
在S140中，当检测到所述终端处于所述待开机状态时，判断用户输入的用于解密启动引导程序的验证密钥是否与预设密钥匹配。
在S160中，根据判断结果确定是否执行与所述预设触发信号对应的预设终端操作。
在该技术方案中，当终端根据接收到的预设触发信号进入待开机状态时， 接收用户输入的用于解密启动引导程序的验证密钥，进而根据该验证密钥与预设密钥的匹配结果确定是否执行与上述预设触发信号对应的预设终端操作，如此，通过设置解密启动引导程序的密钥可以有效地提高解密的安全性，可以有效地防止用户重要数据信息的丢失、泄漏，防止他人对终端进行非法操作等，同时根据预设触发信号执行对应的预设终端操作，可以实现解密启动引导程序后的终端操作的多样性和安全性，从而提升了用户体验。
其中，可以通过组合按键(比如电源键与音量增键的组合)的形式、长按单键(比如音量减键)的形式或者单击启动开关的形式发出该预设触发信号。验证密钥和预设密钥可以为安全级别较高的生物特征识别，比如，指纹特征识别、虹膜特征识别或人脸特征识别等。
而对于上述S160，根据验证密钥与预设密钥的匹配结果执行相应操作的方法可以通过以下实施例实现，分别以预设触发信号为刷机触发信号和重新启动信号为例进行说明。
实施例一，如图2所示，以预设触发信号为刷机触发信号为例，包括：
当S140的判断结果为否时，则执行S1410，即：当判定所述验证密钥与所述预设密钥不匹配时，执行关机操作。
当S140的判断结果为是时，则执行S1420，即：当判定所述验证密钥与所述预设密钥匹配、且所述预设触发信号为刷机触发信号时，解密所述启动引导程序并执行终端刷机操作，以自动开机进入终端系统操作界面。
在该技术方案中，根据验证密钥与预设密钥的匹配结果确定是否执行与预设触发信号对应的预设终端操作，一方面包括：如果不匹配则控制终端执行关机操作，以确保终端操作的安全性，防止用户重要数据信息的丢失、泄漏，防止他人对终端进行非法操作等；如果匹配且当预设触发信号为刷机触发信号时，则可以在解密启动引导程序后执行对应的终端刷机操作，并在刷机结束后自动开机进入终端系统操作界面以供用户使用，如此实现了启动引导程序的安全解密和安全的刷机操作，进而实现终端的安全开机，确保了用户良好的体验。
实施例二，如图3所示，以预设触发信号为重新启动信号为例，包括：
当S140的判断结果为否时，则执行S1430，即：当判定所述验证密钥与所述预设密钥不匹配时，执行关机操作。
当S140的判断结果为是时，则执行S1440，即：当判定所述验证密钥与所述预设密钥匹配、且所述预设触发信号为重新启动信号时，执行加载终端操作系 统内核的开机操作，以进入终端系统操作界面。
在该技术方案中，根据验证密钥与预设密钥的匹配结果确定是否执行与预设触发信号对应的预设终端操作，包括：如果不匹配则控制终端执行关机操作，以确保终端操作的安全性，防止用户重要数据信息的丢失、泄漏，防止他人对终端进行非法操作等；如果匹配且当预设触发信号为重新启动信号时，则可以在解密启动引导程序后执行对应的加载终端操作系统内核的开机操作，以进入终端系统操作界面供用户使用，如此，实现了启动引导程序的安全解密和安全的开机操作，确保了用户良好的体验；其中，重新启动信号可以为当终端处于开机状态下，用户选择进行恢复出厂设置的操作后发出的。
在上述任一技术方案中，可选的，在执行所述加载终端操作系统内核的开机操作之后、进入所述终端系统操作界面之前，还包括：对用户输入的屏幕解锁密钥进行验证。
在该技术方案中，为了确保终端操作的安全性，同时确保终端中存储的用户重要数据的安全性，可以在加载操作系统内核的开机操作之后真正进入终端系统操作界面进行相关终端操作之前验证用户身份的合法性，即验证当前用户输入的屏幕解锁密钥(比如数字密钥及图案密钥等)是否正确，当正确则允许进入终端系统操作界面进行相关终端操作，当用户输入的屏幕解锁密钥不正确，则禁止进入终端系统操作界面，可选的，可以在用户输入的屏幕解锁密钥的错误次数累计达到预设次数(比如3次)时，锁定屏幕解锁程序，禁止进入屏幕解锁密钥的输入。
在上述任一技术方案中，可选的，在所述检测终端是否根据接收到的预设触发信号进入待开机状态之前，还包括：设置所述预设密钥，并根据所述预设密钥加密所述启动引导程序。
在该技术方案中，通过预先设置用于加密启动引导程序的预设密钥，并在设置完成后使用该预设密钥对启动引导程序进行加密，以提高启动引导程序的解密安全性，从而确保终端的安全开机，其中，预设密钥可以有一个或多个，当有多个时可以设置每个预设密钥的使用周期进行循环使用，还可以根据用户的需求和相关操作指令更新该预设密钥，以确保终端操作的安全性。
下面结合图4和图5对本申请的实施例进行说明，其中，启动引导程序为BootLoader。
在该实施例中，预设密钥为指纹特征识别，即通过指纹特征识别解密启动 引导程序进行安全开机，其中，指纹识别模块是一个独立存在于终端系统中的模块，可以独立使用也可以被系统调用。
如图4所示，根据本申请的实施例的解密启动引导程序安全开机的整体流程，包括：
在S420中，终端启动解密启动引导程序。
在S440中，判断指纹特征识别是否验证通过，当通过则执行步骤S460，当验证未通过，执行S4120。
在S460中，解密启动引导程序。
在S480中，终端执行开机操作。
在S4100中，进入系统界面操作终端。
在S4120中，终端执行关机操作。
在操作终端的过程中会有提示进行指纹特征识别，如果指纹特征识别成功，则可以进行解密启动引导程序的操作，然后加载终端操作系统内核进入终端开机流程，完全开机后就可以进入系统界面继续操作终端；如果终端指纹特征识别失败，说明不是用户本人在进行操作，则直接进入关机模式，对用户的重要数据信息进行保护以防止泄露。
流程如图5所示，包括：
在S510中，录入指纹特征设置解密启动引导程序的密码。
在S520中，根据录入的指纹特征加密启动引导程序。
在S530中，接收到长按电源(Power)键/音量加(减)键组合的触发操作。
在S540中，终端处于待开机状态，关机/重启。
在S550中，判断指纹特征识别是否验证通过，当通过，则执行S560，当验证没通过，则执行S5130。
在S560中，执行刷机操作。
在S570中，刷机完成后，终端自动开机。
在S580中，进入终端操作界面，以对终端进行操作。
在S590中，点击进行恢复出厂设置操作，并返回执行S540，并在S550判定通过时，执行S5100，没通过，则执行步骤S5130。
在S5100中，解密启动引导程序。
在S5110中，加载终端操作系统内核开机。
在S5120中，验证屏幕解锁密码/图案是否正确，当是，可以执行S580，当不 正确，则执行S5130。
在S5130中，终端进入待机或关机状态。
在上述实施例中：
(10)在开机状态对终端录入指纹特征并设置解密启动引导程序的密码；
(20)使用指纹特征加密启动引导程序；
(30)接下来对终端进行关机或者重启，然后进行指纹特征识别；
(40)如果指纹特征识别成功，可以分别进行如下两个操作：
(一)可以进行重刷版本，然后自动开机，进入正常系统界面，如S560～S580所示；
(二)在终端开机之前解密启动引导程序，接着加载终端操作系统内核进入开机流程，终端完全开机后需要验证解锁密码或图案，如果解锁成功，则可以进入正常系统界面，解锁不成功，则终端会处于待机或者关机状态，如5100～S5130和S580所示；
(50)在(30)后，如果指纹特征识别失败，则终端进入待机/关机状态；
(60)用户进入正常系统界面后，就可以对移动智能终端进行随意操作，包括恢复出厂设置等，如S590所示，用户对终端进行恢复出厂设置又会进入重启流程，如步骤(30)；
其中，如果用户对处于关机状态的智能终端长按Power键、音量+、音量-键三键组合，则会进入重刷版本的步骤，则顺着关机/重启流程往下走，如步骤(30)。
综上，本实施例提供了一种在终端通过指特征识别解密启动引导程序进行安全开机的方法，极大限度的满足用户对终端私密信息的保护。开机过程中通过指纹特征识别解密启动引导程序来进行安全开机，在系统解锁步骤中很好的保护用户的隐私。如果用户的终端丢失，根本不用担心终端重要信息泄露，即使别人对终端进行快捷键或者按键组合恢复出厂设置擦除/数据(data)/分区数据，也需要指纹特征识别进行验证，才可以走正常恢复出厂设置的流程；如果其他人想通过重刷版本使用用户遗失的终端，刷版本之前还是需要进行指纹特征识别。所以此种方案，具有较强的实用性，可以非常有效的提升用户使用终端过程中隐私保护方法。如此，用户在操作终端的过程中，可以深刻体会到指纹特征识别进行安全开机的优点，同时可以防止用户重要数据信息的丢失、泄露，防止他人窃取用户终端的重要私密信息和重刷版本，可以增加用户对终端使用的安全体验的满意度。
图6示出了根据本申请的实施例的安全操作装置的示意框图；
如图6所示，根据本申请的实施例的安全操作装置600，包括：检测模块602、判断模块604和控制模块606。
其中，检测模块602，设置为检测终端是否根据接收到的预设触发信号进入待开机状态；判断模块604，设置为当所述检测模块602检测到所述终端处于所述待开机状态时，判断用户输入的用于解密启动引导程序的验证密钥是否与预设密钥匹配；控制模块606，设置为根据所述判断模块604的判断结果确定是否执行与所述预设触发信号对应的预设终端操作。
在该技术方案中，当终端根据接收到的预设触发信号进入待开机状态时，接收用户输入的用于解密启动引导程序的验证密钥，进而根据该验证密钥与预设密钥的匹配结果确定是否执行与上述预设触发信号对应的预设终端操作，如此，通过设置解密启动引导程序的密钥可以有效地提高解密的安全性，可以有效地防止用户重要数据信息的丢失、泄漏，防止他人对终端进行非法操作等，同时根据预设触发信号执行对应的预设终端操作，可以实现解密启动引导程序后的终端操作的多样性和安全性，从而提升了用户体验。
其中，可以通过组合按键(比如电源键与音量增键的组合)的形式、长按单键(比如音量减键)的形式或者单击启动开关的形式发出该预设触发信号以及验证密钥和预设密钥可以为安全级别较高的生物特征识别，比如，指纹特征识别、虹膜特征识别或人脸特征识别等。
根据本申请的实施例，所述控制模块606一方面是设置为：当所述判断模块604判定所述验证密钥与所述预设密钥不匹配时，控制执行关机操作；以及，当所述判断模块604判定所述验证密钥与所述预设密钥匹配、且所述预设触发信号为刷机触发信号时，控制解密所述启动引导程序并执行终端刷机操作，以自动开机进入终端系统操作界面。
在该技术方案中，根据验证密钥与预设密钥的匹配结果确定是否执行与预设触发信号对应的预设终端操作，一方面包括：如果不匹配则控制终端执行关机操作，以确保终端操作的安全性，防止用户重要数据信息的丢失、泄漏，防止他人对终端进行非法操作等；如果匹配且当预设触发信号为刷机触发信号时，则可以在解密启动引导程序后执行对应的终端刷机操作，并在刷机结束后自动开机进入终端系统操作界面以供用户使用，如此，实现了启动引导程序的安全解密和安全的刷机操作，进而实现终端的安全开机，确保了用户良好的体验。
所述控制模块606一方面是设置为：当所述判断模块604判定所述验证密钥与所述预设密钥不匹配时，控制执行关机操作；当所述判断模块604判定所述验证密钥与所述预设密钥匹配、且所述预设触发信号为重新启动信号时，控制执行加载终端操作系统内核的开机操作，以进入终端系统操作界面。
在该技术方案中，根据验证密钥与预设密钥的匹配结果确定是否执行与预设触发信号对应的预设终端操作，一方面包括：如果不匹配则控制终端执行关机操作，以确保终端操作的安全性，防止用户重要数据信息的丢失、泄漏，防止他人对终端进行非法操作等；如果匹配且当预设触发信号为重新启动信号时，则可以在解密启动引导程序后执行对应的加载终端操作系统内核的开机操作，以进入终端系统操作界面供用户使用，如此，实现了启动引导程序的安全解密和安全的开机操作，确保了用户良好的体验；其中，重新启动信号可以为当终端处于开机状态下，用户选择进行恢复出厂设置的操作后发出的。
在上述任一技术方案中，可选的，还包括：验证模块608，设置为在所述控制模块606控制执行所述加载终端操作系统内核的开机操作之后、进入所述终端系统操作界面之前，对用户输入的屏幕解锁密钥进行验证。
在该技术方案中，为了确保终端操作的安全性，同时确保终端中存储的用户重要数据的安全性，可以在加载操作系统内核的开机操作之后真正进入终端系统操作界面进行相关终端操作之前验证用户身份的合法性，即验证当前用户输入的屏幕解锁密钥(比如数字密钥及图案密钥等)是否正确，当正确则允许进入终端系统操作界面进行相关终端操作，当不正确，则禁止进入终端系统操作界面，可选的，可以在用户输入的屏幕解锁密钥的错误次数累计达到预设次数(比如3次)时，锁定屏幕解锁程序，禁止进入屏幕解锁密钥的输入。
在上述任一技术方案中，可选的，还包括：设置模块610，设置为在所述检测模块602检测终端是否根据接收到的预设触发信号进入待开机状态之前，设置所述预设密钥，并根据所述预设密钥加密所述启动引导程序。
在该技术方案中，通过预先设置用于加密启动引导程序的预设密钥，并在设置完成后使用该预设密钥对启动引导程序进行加密，以提高启动引导程序的解密安全性，从而确保终端的安全开机，其中，预设密钥可以有一个或多个，当有多个时可以设置每个预设密钥的使用周期进行循环使用，还可以根据用户的需求和相关操作指令更新该预设密钥，以确保终端操作的安全性。
图7示出了根据本申请的实施例的终端的示意框图。
如图7所示，根据本申请的实施例的终端700，包括：如上述技术方案中任一项所述的安全操作装置600，因此，该终端700具有如上述技术方案中任一项所述的安全操作装置600的所有有益效果，在此不再赘述。
如图8所示，图8是本申请实施例公开的一种移动终端的结构示意图。本申请实施例中的移动终端可以是任何具备触控显示屏的设备，例如：平板电脑、手机、电子阅读器、遥控器、个人计算机(Personal Computer，PC)、笔记本电脑、车载设备、网络电视以及可穿戴设备等。如图8所示，本申请实施例中的移动终端包括：至少一个处理器801，例如CPU，至少一个接收器803，至少一个存储器804。还可以包括至少一个发送器805和至少一个通信总线802。其中，通信总线802用于实现这些组件之间的连接通信。其中，本申请实施例中装置的接收器803和发送器805可以是有线发送端口，也可以为无线设备，例如包括天线装置，用于与其他节点设备进行信令或数据的通信。存储器804可以是高速RAM存储器，也可以是非不稳定的存储器(non-volatile memory)，例如至少一个磁盘存储器。存储器804可选的还可以是至少一个位于远离前述处理器801的存储装置。存储器804中存储一组程序代码，且所述处理器801可通过通信总线802，调用存储器804中存储的代码以执行相关的功能。
所述移动终端还包括输入/输出装置。
所述处理器801，用于检测终端是否根据接收到的预设触发信号进入待开机状态；
当检测到所述终端处于所述待开机状态时，判断用户输入的用于解密启动引导程序的验证密钥是否与预设密钥匹配；以及，
根据判断结果确定是否执行与所述预设触发信号对应的预设终端操作。
所述处理器801，还用于所述根据判断结果确定是否执行与所述预设触发信号对应的预设终端操作，包括：
当判定所述验证密钥与所述预设密钥不匹配时，执行关机操作；以及，
当判定所述验证密钥与所述预设密钥匹配、且所述预设触发信号为刷机触发信号时，解密所述启动引导程序并执行终端刷机操作，以自动开机进入终端系统操作界面。
所述处理器801，还用于所述根据判断结果确定是否执行与所述预设触发信号对应的预设终端操作，包括：
当判定所述验证密钥与所述预设密钥不匹配时，执行关机操作；以及，
当判定所述验证密钥与所述预设密钥匹配、且所述预设触发信号为重新启动信号时，执行加载终端操作系统内核的开机操作，以进入终端系统操作界面。
所述处理器801，还用于在执行所述加载终端操作系统内核开机操作之后、进入所述终端系统操作界面之前，还包括：
对用户输入的屏幕解锁密钥进行验证。
可选的，所述处理器801，还用于在所述检测终端是否根据接收到的预设触发信号进入待开机状态之前，还包括：
设置所述预设密钥，并根据所述预设密钥加密所述启动引导程序。可选的，上述各个模块的实现可参考图1至图5对应实施例中相关步骤的描述，在此不赘述。
可以看出，本申请实施例技术方案中，在该技术方案中，根据验证密钥与预设密钥的匹配结果确定是否执行与预设触发信号对应的预设终端操作，一方面包括：如果不匹配则控制终端执行关机操作，以确保终端操作的安全性，防止用户重要数据信息的丢失、泄漏，防止他人对终端进行非法操作等；如果匹配且当预设触发信号为刷机触发信号时，则可以在解密启动引导程序后执行对应的终端刷机操作，并在刷机结束后自动开机进入终端系统操作界面以供用户使用，如此，实现了启动引导程序的安全解密和安全的刷机操作，进而实现终端的安全开机，确保了用户良好的体验。
本申请实施例还提供一种非瞬时性计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令用于执行包括上述方法实施例中记载的任何一种安全操作方法的部分或全部步骤。
以上结合附图详细说明了本申请的技术方案，通过本申请的技术方案，可以有效地提高解密启动引导程序的安全性，进而进行安全开机，确保终端操作的安全性，提升用户体验。
以上所述仅为本申请的可选实施例而已，并不用于限制本申请，对于本领域的技术人员来说，本申请可以有各种更改和变化。
工业实用性
本申请实施例提供的安全操作方法、操作装置及终端，通过设置解密启动引导程序的密钥可以有效地提高解密的安全性，可以有效地防止用户重要数据信息的丢失、泄漏，防止他人对终端进行非法操作等，同时根据预设触发信号 执行对应的预设终端操作，可以实现解密启动引导程序后的终端操作的多样性和安全性，从而提升了用户体验。

Claims (12)

  1. 一种安全操作方法，包括：
    检测终端是否根据接收到的预设触发信号进入待开机状态；
    当检测到所述终端处于所述待开机状态时，判断用户输入的用于解密启动引导程序的验证密钥是否与预设密钥匹配；以及，
    根据判断结果确定是否执行与所述预设触发信号对应的预设终端操作。
  2. 根据权利要求1所述的安全操作方法，其中，所述根据判断结果确定是否执行与所述预设触发信号对应的预设终端操作，包括：
    当判定所述验证密钥与所述预设密钥不匹配时，执行关机操作；以及，
    当判定所述验证密钥与所述预设密钥匹配、且所述预设触发信号为刷机触发信号时，解密所述启动引导程序并执行终端刷机操作，以自动开机进入终端系统操作界面。
  3. 根据权利要求1所述的安全操作方法，其中，所述根据判断结果确定是否执行与所述预设触发信号对应的预设终端操作，包括：
    当判定所述验证密钥与所述预设密钥不匹配时，执行关机操作；以及，
    当判定所述验证密钥与所述预设密钥匹配、且所述预设触发信号为重新启动信号时，执行加载终端操作系统内核的开机操作，以进入终端系统操作界面。
  4. 根据权利要求3所述的安全操作方法，其中，在执行所述加载终端操作系统内核开机操作之后、进入所述终端系统操作界面之前，还包括：
    对用户输入的屏幕解锁密钥进行验证。
  5. 根据权利要求1至4中任一项所述的安全操作方法，其中，在所述检测终端是否根据接收到的预设触发信号进入待开机状态之前，还包括：
    设置所述预设密钥，并根据所述预设密钥加密所述启动引导程序。
  6. 一种安全操作装置，包括：
    检测模块，设置为检测终端是否根据接收到的预设触发信号进入待开机状态；
    判断模块，设置为当所述检测模块检测到所述终端处于所述待开机状态时，判断用户输入的用于解密启动引导程序的验证密钥是否与预设密钥匹配；以及，
    控制模块，设置为根据所述判断模块的判断结果确定是否执行与所述预设触发信号对应的预设终端操作。
  7. 根据权利要求6所述的安全操作装置，其中，所述控制模块是设置为：
    当所述判断模块判定所述验证密钥与所述预设密钥不匹配时，控制执行关 机操作；以及，
    当所述判断模块判定所述验证密钥与所述预设密钥匹配、且所述预设触发信号为刷机触发信号时，控制解密所述启动引导程序并执行终端刷机操作，以自动开机进入终端系统操作界面。
  8. 根据权利要求6所述的安全操作装置，其中，所述控制模块是设置为：
    当所述判断模块判定所述验证密钥与所述预设密钥不匹配时，控制执行关机操作；以及，
    当所述判断模块判定所述验证密钥与所述预设密钥匹配、且所述预设触发信号为重新启动信号时，控制执行加载终端操作系统内核的开机操作，以进入终端系统操作界面。
  9. 根据权利要求8所述的安全操作装置，，还包括：
    验证模块，设置为在所述控制模块控制执行所述加载终端操作系统内核的开机操作之后、进入所述终端系统操作界面之前，对用户输入的屏幕解锁密钥进行验证。
  10. 根据权利要求6至9中任一项所述的安全操作装置，还包括：
    设置模块，设置为在所述检测模块检测终端是否根据接收到的预设触发信号进入待开机状态之前，设置所述预设密钥，并根据所述预设密钥加密所述启动引导程序。
  11. 一种终端，，包括：如权利要求6至10中任一项所述的安全操作装置。
  12. 一种非瞬时性计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令设置为执行权利要求1-5任一项的方法。
PCT/CN2016/092533 2016-06-29 2016-07-31 安全操作方法、操作装置及终端 WO2018000509A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610493561.9A CN106203124A (zh) 2016-06-29 2016-06-29 安装操作方法及操作装置、终端
CN201610493561.9 2016-06-29

Publications (1)

Publication Number Publication Date
WO2018000509A1 true WO2018000509A1 (zh) 2018-01-04

Family

ID=57461302

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/092533 WO2018000509A1 (zh) 2016-06-29 2016-07-31 安全操作方法、操作装置及终端

Country Status (2)

Country Link
CN (1) CN106203124A (zh)
WO (1) WO2018000509A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115221492A (zh) * 2022-09-20 2022-10-21 深圳市磐鼎科技有限公司 基于硬件秘钥的认证方法、装置、电子设备及存储介质

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108446545A (zh) * 2017-02-16 2018-08-24 中兴通讯股份有限公司 一种刷机验证方法及终端
CN107169328A (zh) * 2017-05-15 2017-09-15 青岛海信移动通信技术股份有限公司 安全启动功能的设置方法及装置
CN110688663A (zh) * 2019-09-23 2020-01-14 深圳市网心科技有限公司 一种执行命令保护方法、装置及安卓设备和存储介质
CN110659477A (zh) * 2019-09-23 2020-01-07 深圳市网心科技有限公司 安卓设备的防刷机保护方法、系统及安卓设备和存储介质
CN112818304A (zh) * 2019-11-15 2021-05-18 鹤壁天海电子信息系统有限公司 一种解锁方法及装置

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104317668A (zh) * 2014-11-18 2015-01-28 深圳市汇顶科技股份有限公司 移动终端中恶意操作的识别方法和装置
CN105184117A (zh) * 2015-08-28 2015-12-23 深圳Tcl数字技术有限公司 终端启动方法及装置
CN105608347A (zh) * 2015-07-29 2016-05-25 宇龙计算机通信科技(深圳)有限公司 操作系统切换方法、操作系统切换装置和终端
CN105631259A (zh) * 2015-04-28 2016-06-01 宇龙计算机通信科技(深圳)有限公司 开机验证方法、开机验证装置和终端
CN105787349A (zh) * 2016-02-29 2016-07-20 宇龙计算机通信科技(深圳)有限公司 一种安全刷机的方法及装置

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9230112B1 (en) * 2013-02-23 2016-01-05 Xilinx, Inc. Secured booting of a field programmable system-on-chip including authentication of a first stage boot loader to mitigate against differential power analysis
CN103955648B (zh) * 2014-05-15 2017-02-01 乐视致新电子科技（天津）有限公司 校验系统镜像合法性的方法及装置
CN105354050B (zh) * 2015-09-30 2019-05-17 深圳市九洲电器有限公司 一种智能终端的应用软件调用方法
CN105631254B (zh) * 2015-12-26 2018-12-25 小米科技有限责任公司 解锁方法及解锁装置
CN105550009A (zh) * 2016-02-05 2016-05-04 北京奇虎科技有限公司 移动终端的处理方法和装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104317668A (zh) * 2014-11-18 2015-01-28 深圳市汇顶科技股份有限公司 移动终端中恶意操作的识别方法和装置
CN105631259A (zh) * 2015-04-28 2016-06-01 宇龙计算机通信科技(深圳)有限公司 开机验证方法、开机验证装置和终端
CN105608347A (zh) * 2015-07-29 2016-05-25 宇龙计算机通信科技(深圳)有限公司 操作系统切换方法、操作系统切换装置和终端
CN105184117A (zh) * 2015-08-28 2015-12-23 深圳Tcl数字技术有限公司 终端启动方法及装置
CN105787349A (zh) * 2016-02-29 2016-07-20 宇龙计算机通信科技(深圳)有限公司 一种安全刷机的方法及装置

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115221492A (zh) * 2022-09-20 2022-10-21 深圳市磐鼎科技有限公司 基于硬件秘钥的认证方法、装置、电子设备及存储介质

Also Published As

Publication number Publication date
CN106203124A (zh) 2016-12-07

Similar Documents

Publication Publication Date Title
WO2018000509A1 (zh) 安全操作方法、操作装置及终端
US10826882B2 (en) Network-based key distribution system, method, and apparatus
US8321916B2 (en) Method, apparatus and system for remote management of mobile devices
CN101796764B (zh) 生物特征认证设备、生物特征认证系统和方法
US8181031B2 (en) Biometric authentication device and system
US20090037742A1 (en) Biometric authentication device, system and method of biometric authentication
WO2013182119A1 (zh) 屏幕解锁的方法、装置及终端
WO2015117332A1 (zh) 一种usb调试模式接口启动的方法、装置及终端
US20110276807A1 (en) Remote update method for firmware
EP4322464A1 (en) Information transmission method, storage medium and electronic device
US10474804B2 (en) Login mechanism for operating system
CN108256302B (zh) 数据安全访问方法及装置
CN103514392A (zh) 一种计算机操作系统登录认证装置和方法
WO2011127697A1 (zh) 一种移动终端的安全管理方法及移动终端
WO2017000351A1 (zh) 一种身份验证方法及装置
WO2013182103A2 (zh) 加密、解密终端及应用于终端的加密和解密方法
US20170201528A1 (en) Method for providing trusted service based on secure area and apparatus using the same
US9210134B2 (en) Cryptographic processing method and system using a sensitive data item
CN111557003A (zh) 利用安全终端的存储装置的数据安全管理系统及方法
CN112668032B (zh) 加解密计算机的方法及系统、计算机、服务器和移动设备
EP2985712B1 (en) Application encryption processing method, apparatus, and terminal
WO2017193517A1 (zh) 一种用户终端的解密方法及系统
WO2016180234A1 (zh) 一种安全环境构建方法和装置
KR20210029967A (ko) 보안단말기를 이용한 저장장치의 데이터 보안 관리 시스템 및 방법
CN108319848B (zh) 开机控制方法和装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16906907

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16906907

Country of ref document: EP

Kind code of ref document: A1