WO2018133583A1 - 设备上安全空间的管理方法、装置及系统 - Google Patents

设备上安全空间的管理方法、装置及系统 Download PDF

Info

Publication number
WO2018133583A1
WO2018133583A1 PCT/CN2017/115678 CN2017115678W WO2018133583A1 WO 2018133583 A1 WO2018133583 A1 WO 2018133583A1 CN 2017115678 W CN2017115678 W CN 2017115678W WO 2018133583 A1 WO2018133583 A1 WO 2018133583A1
Authority
WO
WIPO (PCT)
Prior art keywords
identity information
secure space
access device
data
access
Prior art date
Application number
PCT/CN2017/115678
Other languages
English (en)
French (fr)
Inventor
沙爽
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2018133583A1 publication Critical patent/WO2018133583A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H04W12/082—Access security using revocation of authorisation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H04W12/084—Access security using delegated authorisation, e.g. open authorisation [OAuth] protocol
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2141—Access rights, e.g. capability lists, access control lists, access tables, access matrices

Definitions

  • the present disclosure relates to the field of communications, and in particular, to a method, device, and system for managing a secure space on a device.
  • the User Equipment (UE) device As the functions of the User Equipment (UE) device become more and more abundant, more and more information about the user's privacy and office files are saved on the UE (such as a mobile phone), but due to the system on the UE. Open, it is difficult to control access to all applications, and the user's privacy is at risk of being compromised.
  • the currently proposed solution is to divide the ordinary space and the security space inside the UE, wherein the ordinary space is used for storing personal life data, and the security space is used for storing data that needs to be kept confidential related to mobile office or personal privacy. .
  • the system ensures security between the normal space and the secure space through security mechanisms such as mandatory access control. That is, the ordinary space application cannot access the secure space data, and the application of the ordinary space cannot invoke the application of the secure space.
  • Embodiments of the present disclosure provide a method, device, and system for managing a secure space on a device.
  • a method for managing a secure space on a device including: the UE verifying first identity information of the access device; and when the first identity information is legal information, the UE is The access device allocates rights to allow access to the secure space of the UE and establishes a connection with the access device.
  • the UE verifies the first identity information of the access device, including: comparing, by the UE, whether the first identity information is consistent with the pre-configured second identity information, where the second identity information is Identity information of the trusted device of the UE; the UE determines according to the comparison result Whether the first identity information is legal, and when the comparison result indicates that the first identity information is consistent with the second identity information, determining that the first identity information is legal.
  • the rights of the secure space include at least one of: browsing data of the secure space; reading and writing data of the secure space; encrypting data in the secure space; The encrypted data in the secure space is decrypted.
  • the secure space is a physical volume for storing confidential data by the UE at a logical volume management level of a file system.
  • the first identity information includes at least one of the following: a motherboard ID number, a hard disk serial number, a CPU serial number, and a serial device ID number.
  • a method for managing a secure space on a device including: an access device sends first identity information to a UE; and the access device receives the UE to the first identity information.
  • the verification result and when the verification result is that the first identity information is legal information, the access device establishes a connection with the UE; and the access device allocates a secure space according to the UE to allow access.
  • the permissions manage the data in the secure space.
  • the rights of the secure space include at least one of: browsing data of the secure space; reading and writing data of the secure space; encrypting data in the secure space; The encrypted data in the secure space is decrypted.
  • a device for managing a secure space on a device which is applied to a UE, including: a verification module configured to verify first identity information of the access device; and an allocation module configured to be When the first identity information is legal information, the access device is allocated a permission to access the secure space of the UE; and the establishing module is configured to establish a connection with the access device.
  • the verification module is further configured to compare whether the first identity information is consistent with pre-configured second identity information, wherein the second identity information is an identity of the trusted device of the UE And determining, according to the comparison result, whether the first identity information is legal, wherein, when the comparison result indicates that the first identity information is consistent with the second identity information, determining that the first identity information is legal.
  • a management apparatus for a secure space on a device including: a sending module configured to send the first identity information to the user terminal UE, and a receiving module configured to receive a verification result that is sent by the UE to the first identity information;
  • the verification result is that the first identity information is legal information, and the UE establishes a connection;
  • the management module is configured to manage the data of the security space according to the permission of the security space allocated by the UE to allow access.
  • a management system for a secure space on a device comprising: a UE and an access device, wherein the UE is configured to verify first identity information of the access device; When the first identity information is legal information, the access device is allocated a permission to access the secure space of the UE, and establishes a connection with the access device; the access device is configured to send the first identity. Receiving, by the UE, the verification result sent by the UE, and establishing a connection with the UE when the verification result is that the first identity information is legal information; according to the permission of the UE to allow access to the secure space The data of the secure space is managed.
  • a storage medium is also provided.
  • the storage medium is configured to store program code for performing the following steps: the user terminal UE verifies the first identity information of the access device; when the first identity information is legal information, the UE allocates the access device Permission to access the secure space of the UE and establish a connection with the access device.
  • the storage medium is further configured to store program code for performing: comparing, by the UE, whether the first identity information is consistent with pre-configured second identity information, wherein the second identity The information is the identity information of the trusted device of the UE; the UE determines whether the first identity information is legal according to the comparison result, where the comparison result indicates the first identity information and the second identity information When they are consistent, it is determined that the first identity information is legal.
  • the UE authenticates the access device by using the identity information of the device, when determining that the identity information of the access device is legal information, the access device is allocated the right to access the security space of the UE and establishes with the access device.
  • the connection realizes the management of the data of the secure space on the UE by the access device. Therefore, the solution of the present disclosure solves the problem that the data of the secure space on the UE cannot be externally managed, the data of the secure space cannot be released, and the trusted control device is lacking.
  • the data of the secure space on the UE is managed by the access device, so that the data in the secure space can be exported through the external device, and the storage space of the UE is prevented from being occupied in a large amount, thereby realizing the convenient management effect on the data of the secure space on the UE. .
  • 1 is a schematic structural diagram of an independent dual operating system
  • FIG. 2 is a schematic structural diagram of a virtual dual operating system
  • FIG. 3 is a schematic structural diagram of a dual operating system sharing a kernel but not sharing an application running environment
  • FIG. 4 is a hardware structural block diagram of a UE for managing a secure space on a device according to an embodiment of the present disclosure
  • FIG. 5 is a flowchart (1) of a method for managing a secure space on a device according to an embodiment of the present disclosure
  • FIG. 6 is a schematic diagram of storage partitioning for a physical volume in accordance with an embodiment of the present disclosure
  • FIG. 7 is a schematic diagram of data interaction between a UE and a trusted device, in accordance with an embodiment of the present disclosure
  • FIG. 8 is a flowchart of a method of managing a secure space on a device according to an exemplary embodiment of the present disclosure
  • FIG. 9 is a flowchart (2) of a method for managing a secure space on a device according to an embodiment of the present disclosure.
  • FIG. 10 is a structural block diagram (1) of a management apparatus for a secure space on a device according to an embodiment of the present disclosure
  • FIG. 11 is a structural block diagram (2) of a management apparatus for a secure space on a device according to an embodiment of the present disclosure
  • FIG. 12 is a structural block diagram of a management system for a secure space on a device according to an embodiment of the present disclosure.
  • virtual dual operating system As shown in Figure 2, the virtual system is directly implemented on the hardware. Since the two operating systems are mounted on the hardware, the two operating systems do not share the kernel and are completely isolated. Therefore, the two systems can run simultaneously and switch in soft switching mode. , no need to restart when switching.
  • a dual operating system that shares the kernel but does not share the application runtime environment. As shown in FIG. 3, the two operating systems share the same kernel, but the two operating systems use different application running environments, and the mobile phone does not need to be restarted, and the two systems can be seamlessly switched with one button.
  • the above security space isolation technology has the following defects: 1. It is impossible to manage data in a secure space. At present, in the security mode of the UE, the UE is not allowed to connect to the Internet and Bluetooth, and when the access device (such as a computer) is connected through the USB flash drive mode, data for displaying the secure space on the access device is not allowed. Users cannot manage data in a secure space through an access device. 2. The storage space of the UE is occupied by the data of the secure space. Since the data of the secure space is not exported, the storage space of the UE is occupied in a large amount, and the security space cannot be used normally. 3. Lack of trusted control equipment. The UE cannot select a trusted control device, and the data on the secure space cannot be processed on devices other than the UE.
  • Access device A device that the UE accesses through wireless or wired form.
  • Example 1 of the present disclosure may be executed in a mobile terminal, a computer terminal, or the like.
  • 4 is a block diagram of a hardware structure of a UE for managing a secure space on a device according to an embodiment of the present disclosure.
  • UE 40 may include one or more (only one shown) processor 402 (processor 402 may include, but is not limited to, a processing device such as a microprocessor MCU or a programmable logic device FPGA), A memory 404 for storing data, and a transmission device 406 for communication functions.
  • processor 402 may include, but is not limited to, a processing device such as a microprocessor MCU or a programmable logic device FPGA), A memory 404 for storing data, and a transmission device 406 for communication functions.
  • FIG. 4 is merely illustrative, and does not limit the structure of the above electronic device. set.
  • UE 40 may also include more or fewer components than shown in FIG. 4, or have a different configuration than that shown in FIG.
  • the memory 404 can be used to store software programs and modules of the application software, such as program instructions/modules corresponding to the management method of the secure space on the device in the embodiment of the present disclosure, and the processor 402 runs the software program and the module stored in the memory 404. Thereby performing various functional applications and data processing, that is, implementing the above method.
  • Memory 404 can include high speed random access memory and can also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid state memory.
  • memory 404 can also include memory remotely located relative to processor 402, which can be connected to UE 40 over a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.
  • Transmission device 406 is for receiving or transmitting data via a network.
  • the network instance described above may include a wireless network provided by a communication provider of the UE 40.
  • transmission device 406 includes a Network Interface Controller (NIC) that can be connected to other network devices through a base station to communicate with the Internet.
  • NIC Network Interface Controller
  • the transmission device 406 can be a Radio Frequency (RF) module for communicating with the Internet wirelessly.
  • RF Radio Frequency
  • FIG. 5 is a flowchart (1) of a method for managing a secure space on a device according to an embodiment of the present disclosure. As shown in 5, the process includes the following steps:
  • Step S502 the UE verifies the first identity information of the access device.
  • Step S504 When the first identity information is legal information, the UE allocates the permission for the access device to access the secure space of the UE, and establishes a connection with the access device.
  • the foregoing UE may be a mobile terminal including a mobile phone, and the access device may include a data processing device such as a computer, but is not limited thereto.
  • the UE authenticates the access device by using the identity information of the device.
  • the identity information of the access device is determined to be legal information
  • the access device is allocated the right to access the security space of the UE and is established with the access device.
  • the connection implements the management of the data of the secure space on the UE by the access device. Therefore, the solution of the present disclosure solves that the data of the secure space on the UE cannot be externally Management, the data in the secure space cannot be released and the problem of the trusted control device is lacking.
  • the data of the secure space on the UE is managed by the access device, so that the data on the secure space can be exported through the external device, preventing the storage space of the UE from being A large number of occupations achieve the effect of convenient management of data in a secure space on the UE.
  • the foregoing step S502 may be implemented by the UE comparing whether the first identity information is consistent with the pre-configured second identity information, where the second identity information is identity information of the trusted device of the UE.
  • the UE determines whether the first identity information is legal according to the comparison result, and determines that the first identity information is legal when the comparison result indicates that the first identity information is consistent with the second identity information.
  • the second identity information is the identity information of the trusted device configured in advance on the UE, where the trusted device may be a device that can be securely accessed by the UE through authentication or authentication, etc., but Not limited to this.
  • the UE compares whether the first identity information and the second identity information are consistent, whether to verify whether the second identity information is stored on the UE, and when determining that the UE does not pre-configure the second identity information, configure the second identity information, that is, And directly obtaining the identity information of the currently connected access device, and storing the identity information of the access device as the second identity information when receiving the user confirming that the access device is a trusted device.
  • the UE determines whether the first identity information is legal by comparing the first identity information with the pre-configured second identity information, and enables the UE to quickly determine the trusted device, and provides a connection between the UE and the trusted access device. Guarantee.
  • the security space has at least one of the following: browsing data of the secure space; reading and writing data of the secure space; encrypting data in the secure space; and performing encrypted data in the secure space Decrypt.
  • the security space is a physical volume for the UE to store confidential data at a logical volume management level of the file system.
  • the physical volume and the secure space may be partitioned from the logical volume management layer of the file system, so that when the access device that does not have the legal identity information is connected to the UE, The logical volume corresponding to the security space is automatically shielded; when the access device with the legal identity information is connected to the UE, the logical volume corresponding to the secure space is displayed.
  • the first identity information includes at least one of the following information: Motherboard ID number, hard disk serial number, CPU serial number, serial device ID number.
  • the authentication module for authentication is installed on the security space of the UE and the access device.
  • An authentication program is installed.
  • the authentication program of the access device sends the hardware information of the device to the UE, including: the motherboard ID number, the hard disk serial number, the CPU serial number, the serial device ID number, and the like.
  • the authentication program on the UE is responsible for verifying and matching the trusted device, and binding the information to save the above information as a basis for judging whether the connected access device is a trusted device.
  • the UE determines that the identity information of the access device is legal information, that is, the access device is a trusted device, allowing the access device to access data in the secure space, when the UE determines that the identity information of the access device is illegal, that is, If the access device is not a trusted device, the data in the secure space is automatically blocked.
  • FIG. 7 is a schematic diagram of data interaction between a UE and a trusted device according to an embodiment of the present disclosure.
  • a trusted device authentication device 72 is installed in a secure space of the UE.
  • the trusted device authentication device 72 includes a trusted device identity verification module 74, a trusted device information display module 76, a trusted device setting module 78, and a data pipeline control module 710.
  • the trusted device is installed with a trusted device authentication device. 712, wherein the trusted device authentication device 712 includes a trusted device identity verification module 714.
  • the specific functions of each module are as follows:
  • the trusted device authentication module 74 is configured to perform identity verification of the access device with the trusted device authentication module 714. After the verification succeeds, the access device is determined to be a trusted device, and a one-to-one matching is established with the trusted device. relationship;
  • the trusted device information display module 76 is configured to display information on the UE that allows access to the trusted device of the secure space;
  • the trusted device setting module 78 is configured to edit the name of the trusted device or delete the trusted device;
  • the data pipeline control module 710 is configured to notify the data transmission pipeline 716 of the data transmission pipeline 716 according to the verification result of the identity information of the access device by the trusted device identity verification module 74 to allow or disallow the access device to access data of the secure space on the UE, where the data is Transmission pipeline 716 is configured to establish a data connection with data transmission pipeline 718 on the trusted device and to transfer data between the UE and the trusted device after the connection is established, including encryption and decryption of the data.
  • FIG. 8 is a flowchart of a method for managing a secure space on a device according to an exemplary embodiment of the present disclosure.
  • the UE is a mobile phone
  • the access device is a computer and combined with the device shown in FIG. 7 . :
  • Step S802 the mobile phone and the computer are connected by a data line;
  • step S804 the mobile phone detects whether the security space has been pre-configured with the identity information of the trusted device.
  • step S806 is performed, when the secure space is pre-configured with the identity information of the trusted device. Go to step S812;
  • Step S806 the trusted device identity verification module 74 acquires the device information sent by the computer;
  • step S808 the trusted device information display module 76 displays the device information of the computer on the screen of the mobile phone and determines whether the user selects to set the trusted device.
  • step S810 is performed, and when the user selects not to set, When the device is trusted, step S824 is performed;
  • Step S810 the trusted device setting module 78 saves the device information of the computer, and performs step S818;
  • Step S812 the trusted device identity verification module 74 reads the identity information of the pre-configured trusted device and obtains the device information sent by the computer;
  • Step S814 the trusted device identity verification module 74 compares the device information sent by the computer with the identity information of the trusted device. When the information is inconsistent, step S816 is performed, and when the information is consistent, step S818 is performed;
  • Step S816, the data pipeline control module 710 notifies the data transmission pipeline 716 that the computer does not allow access to the data in the secure space on the mobile phone; the mobile phone shields the security space data from being invisible to the computer, and performs step S824;
  • Step S818, the data pipeline control module 710 notifies the data transmission pipeline 716 to allow the computer to access the data of the secure space on the mobile phone; the mobile phone releases the data of the secure space and is visible to the computer;
  • Step S820 establishing a data connection between the data transmission pipeline 716 and the data transmission pipeline 718 on the computer;
  • Step S822 the mobile phone receives the encrypted data sent by the computer via the data transmission pipeline 718 and decrypts and displays the encrypted data in the secure space; and/or the mobile phone receives the request for data access sent by the computer, and sends the encryption via the data transmission pipeline 716. Data, the computer receives the encrypted data and decrypts and displays it;
  • the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware, but in many cases, the former is The usual implementation.
  • the solution of the present disclosure may be embodied in the form of a software product stored in a storage medium (such as a ROM/RAM, a magnetic disk, an optical disk), and includes a plurality of instructions for making one
  • the terminal device (which may be a cell phone, computer, server, or network device, etc.) performs the methods described in various embodiments of the present disclosure.
  • FIG. 9 is a flowchart (2) of a method for managing a secure space on a device according to an embodiment of the present disclosure. As shown in FIG. 9, the flow includes the following steps. :
  • Step S902 the access device sends the first identity information to the UE;
  • Step S904 the access device receives the verification result of the first identity information by the UE, and when the verification result is that the first identity information is legal information, the access device establishes a connection with the UE.
  • Step S906 the access device manages data of the secure space according to the right of the secure space allocated by the UE to allow access.
  • the access device manages the data of the secure space on the UE. Therefore, the solution of the present disclosure solves the problem that the data of the secure space on the UE cannot be externally managed, the data of the secure space cannot be released, and the trusted control device is lacking.
  • the problem is that the user manages the data in the secure space on the UE through the access device, so that the data in the secure space can be exported through the external device, preventing the storage space of the UE from being occupied in a large amount, and realizing convenient management of the data in the secure space on the UE. Effect.
  • the security space has at least one of the following: browsing data of the secure space; reading and writing data of the secure space; encrypting data in the secure space; and performing encrypted data in the secure space Decryption.
  • the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course It can be through hardware, but in many cases the former is the usual implementation.
  • the solution of the present disclosure may be embodied in the form of a software product stored in a storage medium (such as a ROM/RAM, a magnetic disk, an optical disk), and includes a plurality of instructions for making one
  • the terminal device (which may be a cell phone, computer, server, or network device, etc.) performs the methods described in various embodiments of the present disclosure.
  • module may implement a combination of software and/or hardware of a predetermined function.
  • devices described in the following embodiments are typically implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.
  • the device includes a verification module 102 configured to verify first identity information of an access device;
  • the establishing module 106 is configured to establish a connection with the access device, when the first identity information is legal information, and the access device is configured to allow access to the secure space of the UE.
  • the verification module 102 is further configured to compare whether the first identity information is consistent with the pre-configured second identity information, where the second identity information is a trusted device of the UE. And determining, according to the comparison result, whether the first identity information is legal, wherein, when the comparison result indicates that the first identity information is consistent with the second identity information, determining that the first identity information is legal .
  • Example 1 differs from Example 1 in the partitioning of modules.
  • the verification module 102 in this example is similar to the trusted device authentication module 74 in Example 1, but with some new functional features added; the allocation module 104 and the example 1
  • the data pipeline control module 710 is similar, but with some new functional features added; the setup module 106 is similar to the data transmission pipeline 716, but with some new functional features added.
  • Each of the above modules can be implemented by software or hardware. For the latter, The following manners are implemented, but are not limited thereto: the above modules are all located in the same processor; or, the above modules are respectively located in different processors in any combination.
  • module may implement a combination of software and/or hardware of a predetermined function.
  • devices described in the following embodiments are typically implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.
  • the device includes a sending module 112 configured to send first identity information to a user terminal UE, and a receiving module. 114.
  • the method is configured to receive a verification result that is sent by the UE to the first identity information, and the establishing module 116 is configured to establish a connection with the UE when the verification result is that the first identity information is legal information;
  • the module 118 is configured to manage data of the secure space according to the right of the security space allocated by the UE to allow access.
  • the above modules may be implemented by software or hardware.
  • the foregoing may be implemented by, but not limited to, the above modules are all located in the same processor; or, the above modules are respectively located in different combinations. In the processor.
  • Also provided in this example is a management system for a secure space on the device, which is used to implement the previous examples and exemplary embodiments, which have not been described again.
  • FIG. 12 is a structural block diagram of a management system for a secure space on a device according to an embodiment of the present disclosure.
  • the management system of the secure space on the device includes a UE 122 and an access device 124.
  • the UE 122 is configured to verify the first identity information of the access device; and when the first identity information is legal information, assign the access device permission to access the secure space of the UE, and
  • the access device establishes a connection;
  • the access device 124 is configured to send the first identity information to the UE; receive the verification result sent by the UE, and when the verification result is the first
  • a connection is established with the UE; and the data of the secure space is managed according to the authority of the secure space allocated by the UE to allow access.
  • Embodiments of the present disclosure also provide a storage medium.
  • the above storage medium may be configured to store program code for performing the following steps: S11, the user terminal UE verifies the first identity information of the access device; S12, when the first identity information is legal information And the UE allocates, to the access device, permission to access a secure space of the UE, and establishes a connection with the access device.
  • the storage medium may be further configured to store program code for performing the following steps: S21, the UE compares whether the first identity information is consistent with pre-configured second identity information, wherein the The second identity information is identity information of the trusted device of the UE; S22, the UE determines, according to the comparison result, whether the first identity information is legal, where the comparison result indicates the first identity information and the When the second identity information is consistent, determining that the first identity information is legal
  • Embodiments of the present disclosure also provide a storage medium.
  • the above storage medium may be configured to store program code for performing the following steps: S31, the access device transmits the first identity information to the user terminal UE; S32, the access device receives the UE pair Determining a result of the verification of the first identity information, and when the verification result is that the first identity information is legal information, the access device establishes a connection with the UE; S33, the access device according to the UE The assigned security space of the access allowed manages the data of the secure space.
  • the foregoing storage medium may include, but is not limited to, a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk. Or a variety of media such as optical discs that can store program code.
  • the functional modules/units in the system, device, and device can be implemented as software, firmware, hardware, and suitable combinations thereof.
  • the division between functional modules/units mentioned in the above description does not necessarily correspond to the division of physical components; for example, one physical component may have multiple functions, or one function or step may be composed of several physical The components work together.
  • Some or all of the components may be implemented as software executed by a processor, such as a digital signal processor or microprocessor, or as hardware, or as an integrated circuit, such as an application specific integrated circuit.
  • Such software may be distributed on a computer readable medium, which may include computer storage media (or non-transitory media) and communication media (or transitory media).
  • computer storage medium includes volatile and nonvolatile, implemented in any method or technology for storing information, such as computer readable instructions, data structures, program modules or other data. Sex, removable and non-removable media.
  • Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridge, magnetic tape, magnetic disk storage or other magnetic storage device, or may Any other medium used to store the desired information and that can be accessed by the computer.
  • communication media typically includes computer readable instructions, data structures, program modules, or other data in a modulated data signal, such as a carrier wave or other transport mechanism, and can include any information delivery media. .
  • the UE authenticates the access device by using the identity information of the device, when determining that the identity information of the access device is legal information, the access device is allocated the right to access the security space of the UE and establishes with the access device.
  • the connection realizes the management of the data of the secure space on the UE by the access device. Therefore, the solution of the present disclosure solves the problem that the data of the secure space on the UE cannot be externally managed, the data of the secure space cannot be released, and the trusted control device is lacking.
  • the data of the secure space on the UE is managed by the user through the access device, so that the data on the secure space can pass through the outside world.
  • the device is exported to prevent the storage space of the UE from being occupied in a large amount, and the effect of convenient management of data in the secure space on the UE is achieved.
  • the present disclosure therefore has industrial applicability.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Theoretical Computer Science (AREA)
  • Computing Systems (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Storage Device Security (AREA)

Abstract

提供了一种设备上安全空间的管理方法、装置及系统，其中该方法包括：用户终端UE验证接入设备的第一身份信息；当第一身份信息为合法信息时，UE为接入设备分配允许访问UE的安全空间的权限，并与接入设备建立连接。

Description

设备上安全空间的管理方法、装置及系统 技术领域
本公开涉及通信领域，具体而言，涉及一种设备上安全空间的管理方法、装置及系统。
背景技术
随着用户终端(User Equipment，简称为UE)设备的功能越来越丰富，越来越多的涉及用户隐私的信息和办公文件会保存在UE(如手机)上，但是由于UE上的系统的开放性，很难控制所有应用程序的访问权限，用户的隐私存在被泄露的风险。基于上述问题，目前提出的方案是在UE的内部划分出普通空间与安全空间，其中，普通空间用于保存个人生活数据，而安全空间用于保存与移动办公或者个人隐私相关的需要保密的数据。系统通过强制访问控制等安全机制来确保普通空间与安全空间之间相互隔离，即，普通空间应用无法访问安全空间数据，普通空间的应用无法调用安全空间的应用。
发明内容
以下是对本文详细描述的主题的概述。本概述并非是为了限制权利要求的保护范围。
本公开实施例提供了一种设备上安全空间的管理方法、装置及系统。
根据本公开的一个实施例，提供了一种设备上安全空间的管理方法，包括：UE验证接入设备的第一身份信息；当所述第一身份信息为合法信息时，所述UE为所述接入设备分配允许访问所述UE的安全空间的权限，并与所述接入设备建立连接。
在示例性实施例中，UE验证接入设备的第一身份信息，包括：所述UE比较所述第一身份信息与预先配置的第二身份信息是否一致，其中，所述第二身份信息为所述UE的可信设备的身份信息；所述UE依据比较结果确定 所述第一身份信息是否合法，其中，在所述比较结果指示所述第一身份信息与所述第二身份信息一致时，确定所述第一身份信息合法。
在示例性实施例中，所述安全空间的权限包括至少以下之一：浏览所述安全空间的数据；读写所述安全空间的数据；对所述安全空间中的数据进行加密；对所述安全空间中的加密数据进行解密。
在示例性实施例中，所述安全空间为所述UE在文件系统的逻辑卷管理层面划分的用于存储保密数据的物理卷。
在示例性实施例中，所述第一身份信息包括至少以下之一：主板ID号、硬盘序列号，CUP序列号、串口设备ID号。
根据本公开的另一个实施例，提供了一种设备上安全空间的管理方法，包括：接入设备发送第一身份信息到UE；所述接入设备接收所述UE对所述第一身份信息的验证结果，并当所述验证结果为所述第一身份信息为合法信息时，所述接入设备与所述UE建立连接；所述接入设备按照所述UE分配的允许访问的安全空间的权限对所述安全空间的数据进行管理。
在示例性实施例中，所述安全空间的权限包括至少以下之一：浏览所述安全空间的数据；读写所述安全空间的数据；对所述安全空间中的数据进行加密；对所述安全空间中的加密数据进行解密。
根据本公开的另一个实施例，提供了一种设备上安全空间的管理装置，应用于UE，包括：验证模块，配置为验证接入设备的第一身份信息；分配模块，配置为当所述第一身份信息为合法信息时，为所述接入设备分配允许访问所述UE的安全空间的权限；建立模块，配置为与所述接入设备建立连接。
在示例性实施例中，所述验证模块还配置为比较所述第一身份信息与预先配置的第二身份信息是否一致，其中，所述第二身份信息为所述UE的可信设备的身份信息；以及依据比较结果确定所述第一身份信息是否合法，其中，在所述比较结果指示所述第一身份信息与所述第二身份信息一致时，确定所述第一身份信息合法。
根据本公开的另一个实施例，提供了一种设备上安全空间的管理装置， 应用于接入设备，包括：发送模块，配置为发送第一身份信息到用户终端UE；接收模块，配置为接收所述UE对所述第一身份信息发送的验证结果；建立模块，配置为当所述验证结果为所述第一身份信息为合法信息时与所述UE建立连接；管理模块，配置为按照所述UE分配的允许访问的安全空间的权限对所述安全空间的数据进行管理。
根据本公开的另一个实施例，提供了一种设备上安全空间的管理系统，包括：UE和接入设备，其中，所述UE配置为验证所述接入设备的第一身份信息；以及当所述第一身份信息为合法信息时，为所述接入设备分配允许访问所述UE的安全空间的权限，并与所述接入设备建立连接；所述接入设备配置为发送第一身份信息到所述UE；接收所述UE发送的验证结果，并当验证结果为所述第一身份信息为合法信息时与所述UE建立连接；按照所述UE分配的允许访问的安全空间的权限对所述安全空间的数据进行管理。
根据本公开的另一个实施例，还提供了一种存储介质。该存储介质设置为存储用于执行以下步骤的程序代码：用户终端UE验证接入设备的第一身份信息；当所述第一身份信息为合法信息时，所述UE为所述接入设备分配允许访问所述UE的安全空间的权限，并与所述接入设备建立连接。
在示例性实施例中，存储介质还设置为存储用于执行以下步骤的程序代码：所述UE比较所述第一身份信息与预先配置的第二身份信息是否一致，其中，所述第二身份信息为所述UE的可信设备的身份信息；所述UE依据比较结果确定所述第一身份信息是否合法，其中，在所述比较结果指示所述第一身份信息与所述第二身份信息一致时，确定所述第一身份信息合法。
通过本公开，由于UE通过设备的身份信息对于接入设备进行验证，当确定接入设备的身份信息为合法信息时，为该接入设备分配访问UE的安全空间的权限并与接入设备建立连接，实现了接入设备对于UE上安全空间的数据的管理，因此，本公开的方案解决了UE上安全空间的数据无法外部管理，安全空间的数据无法释放且缺乏可信的控制设备的问题，达到用户通过接入设备管理UE上安全空间的数据，使得安全空间上的数据可以通过外界设备导出，防止UE的存储空间被大量占用，实现了对于UE上安全空间的数据的便捷管理的效果。
在阅读并理解了附图和详细描述后，可以明白其他方面。
附图说明
图1是独立的双操作系统的结构示意图；
图2是虚拟双操作系统的结构示意图；
图3是共享内核但不共享应用运行环境的双操作系统的结构示意图；
图4是本公开实施例的一种设备上安全空间的管理方法的UE的硬件结构框图；
图5是根据本公开实施例的设备上安全空间的管理方法的流程图(一)；
图6是根据本公开实施例的对于物理卷进行存储划分的示意图；
图7是根据本公开实施例的UE与可信设备进行数据交互的示意图；
图8是根据本公开示例性实施例的设备上安全空间的管理方法的流程图；
图9是根据本公开实施例的设备上安全空间的管理方法的流程图(二)；
图10是根据本公开实施例的设备上安全空间的管理装置的结构框图(一)；
图11是根据本公开实施例的设备上安全空间的管理装置的结构框图(二)；
图12是根据本公开实施例的设备上安全空间的管理系统的结构框图。
具体实施方式
常用的安全空间隔离技术，主要包括以下几种方案：
1、独立的双操作系统。如图1所示，UE上安装有两套操作系统，该两套操作系统直接安装在系统的不同的分区上且相互独立，两个操作系统不共享系统内核或没有共同的内核，两个系统不能同时运行，只有重启才能切换到另一个操作系统，如手机上的Android+Windows Phone，或Android+Firefox OS。
2、虚拟双操作系统。如图2所示，直接在硬件上做虚拟系统，由于硬件上搭载两个操作系统，该两个操作系统不共享内核且完全隔离，因此，两个系统可以同时运行并且采用软切换模式进行切换，切换时不用重启。
3、共享内核但不共享应用运行环境的双操作系统。如图3所示，两个操作系统共享同一内核，但是该两个操作系统采用不同的应用运行环境，使用时无需重启手机，可一键实现两个系统的无缝切换。
但是上述安全空间隔离技术存在如下缺陷:1、无法管理安全空间的数据。由于目前，在UE的安全模式下，UE是不允许连接因特网和蓝牙的，以及在通过U盘模式连接接入设备(如电脑)时，不允许接入设备上显示安全空间的数据。用户无法通过接入设备来管理安全空间的数据。2、UE的存储空间被安全空间的数据大量占用。由于安全空间的数据没有途径导出，导致UE的存储空间被大量占用，最终导致安全空间无法正常使用。3、缺乏可信的控制设备。UE无法选择信任的控制设备，导致无法在UE以外的设备上对于安全空间上的数据进行处理。
下文中将参考附图并结合实施例来详细说明本公开。
本公开的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。
为便于理解本公开实施例，以下对本公开实施例中所涉及的技术术语解释如下：
接入设备：UE通过无线或有线的形式所接入的设备。
示例1
本公开示例1所提供的方法实施例可以在移动终端、计算机终端或者类似的运算装置中执行。以运行在UE上为例，图4是本公开实施例的一种设备上安全空间的管理方法的UE的硬件结构框图。如图4所示，UE 40可以包括一个或多个(图中仅示出一个)处理器402(处理器402可以包括但不限于微处理器MCU或可编程逻辑器件FPGA等的处理装置)、用于存储数据的存储器404、以及用于通信功能的传输装置406。本领域普通技术人员可以理解，图4所示的结构仅为示意，其并不对上述电子装置的结构造成限 定。例如，UE 40还可包括比图4中所示更多或者更少的组件，或者具有与图4所示不同的配置。
存储器404可用于存储应用软件的软件程序以及模块，如本公开实施例中的设备上安全空间的管理方法对应的程序指令/模块，处理器402通过运行存储在存储器404内的软件程序以及模块，从而执行各种功能应用以及数据处理，即实现上述的方法。存储器404可包括高速随机存储器，还可包括非易失性存储器，如一个或者多个磁性存储装置、闪存、或者其他非易失性固态存储器。在一些实例中，存储器404可还包括相对于处理器402远程设置的存储器，这些远程存储器可以通过网络连接至UE 40。上述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网及其组合。
传输装置406用于经由一个网络接收或者发送数据。上述的网络实例可包括UE 40的通信供应商提供的无线网络。在一个实例中，传输装置406包括一个网络适配器(Network Interface Controller，NIC)，其可通过基站与其他网络设备相连从而可与互联网进行通讯。在一个实例中，传输装置406可以为射频(Radio Frequency，RF)模块，其用于通过无线方式与互联网进行通讯。
在本示例中提供了一种运行于图4所示的UE的设备上安全空间的管理方法，图5是根据本公开实施例的设备上安全空间的管理方法的流程图(一)，如图5所示，该流程包括如下步骤：
步骤S502，UE验证接入设备的第一身份信息；
步骤S504，当第一身份信息为合法信息时，UE为接入设备分配允许访问UE的安全空间的权限，并与接入设备建立连接。
在本示例中，上述UE可以为包括手机在内的移动终端，接入设备可以包括电脑在内的数据处理设备，但是并不限于此。
通过上述步骤，由于UE通过设备的身份信息对于接入设备进行验证，当确定接入设备的身份信息为合法信息时，为该接入设备分配访问UE的安全空间的权限并与接入设备建立连接，实现了接入设备对于UE上安全空间的数据的管理，因此，本公开的方案解决了UE上安全空间的数据无法外部 管理，安全空间的数据无法释放且缺乏可信的控制设备的问题，达到用户通过接入设备管理UE上安全空间的数据，使得安全空间上的数据可以通过外界设备导出，防止UE的存储空间被大量占用，实现了对于UE上安全空间的数据的便捷管理的效果。
在一个示例性的实施例中，上述步骤S502可以通过如下方式实现：UE比较第一身份信息与预先配置的第二身份信息是否一致，其中，第二身份信息为UE的可信设备的身份信息；UE依据比较结果确定第一身份信息是否合法，其中，在比较结果指示第一身份信息与第二身份信息一致时，确定第一身份信息合法。
在本示例中，上述第二身份信息为预先在UE上配置的可信设备的身份信息，其中，可信设备可以为UE通过认证或者鉴权等方式确定的可进行安全访问的设备，但是并不限于此。在UE比较第一身份信息与第二身份信息是否一致之前，要验证UE上是否存储有第二身份信息，当判断UE没有预先配置第二身份信息时，要对于第二身份信息进行配置，即，直接获取当前连接的接入设备的身份信息并在接收到用户确认该接入设备为可信设备时将上述接入设备的身份信息作为第二身份信息进行存储。UE通过比较第一身份信息与预先配置的第二身份信息是否一致的方法确定第一身份信息是否合法，能够使得UE快速地确定可信设备，为UE与可信的接入设备建立连接提供了保证。
在一个示例性的实施例中，上述安全空间的权限包括至少以下之一：浏览安全空间的数据；读写安全空间的数据；对安全空间中的数据进行加密；对安全空间中的加密数据进行解密。
在一个示例性的实施例中，上述安全空间为UE在文件系统的逻辑卷管理层面划分的用于存储保密数据的物理卷。
在本示例中，如图6所示，可以从文件系统的逻辑卷管理层面对物理卷进行普通空间和安全空间的存储划分，这样可以实现当不具备合法身份信息的接入设备与UE连接时，自动屏蔽安全空间对应的逻辑卷；当具有合法身份信息的接入设备与UE连接是，则显示安全空间对应的逻辑卷。
在一个示例性的实施例中，上述第一身份信息包括至少以下之一信息： 主板ID号、硬盘序列号，CUP序列号、串口设备ID号。
在一个示例性的实施例中，在UE与接入设备建立连接以后，会通过数据传输管道进行数据的传输，UE的安全空间和接入设备上均会安装有进行身份验证的认证模块且分别安装有认证程序。当接入设备与UE的安全空间通过数据线连接时，接入设备的认证程序会将其设备硬件信息发给UE，包括：主板ID号、硬盘序列号、CPU序列号、串口设备ID号等，由UE上的认证程序负责检验和匹配可信设备，并进行绑定，将绑定后的上述信息保存下来，作为后续判断所连接的接入设备是否为可信设备的依据。当UE确定接入设备的身份信息为合法信息时，即，接入设备为可信设备，允许该接入设备访问安全空间的数据，当UE确定接入设备的身份信息为非法信息时，即，接入设备不是可信设备，则自动屏蔽安全空间的数据。
当接入设备为可信设备时，图7是根据本公开实施例的UE与可信设备进行数据交互的示意图，如图7所示，UE的安全空间上安装有可信设备认证装置72，其中，上述可信设备认证装置72包括可信设备身份验证模块74、可信设备信息显示模块76、可信设备设置模块78和数据管道控制模块710；可信设备上安装有可信设备认证装置712，其中，上述可信设备认证装置712包括可信设备身份验证模块714。各个模块具体功能如下：
可信设备身份验证模块74配置为与可信设备认证模块714之间进行接入设备的身份验证，在验证成功后确定该接入设备为可信设备，与可信设备建立一对一的匹配关系；
可信设备信息显示模块76配置为在UE上显示允许访问安全空间的可信设备的信息；
可信设备设置模块78配置为编辑可信设备的名称或者删除该可信设备；
数据管道控制模块710配置为根据可信设备身份验证模块74对于接入设备的身份信息的验证结果通知数据传输管道716允许或不允许该接入设备访问UE上安全空间的数据，其中，上述数据传输管道716配置为与可信设备上的数据传输管道718之间建立数据连接，并在建立连接后在UE和可信设备之间传输数据，包括对数据的加密和解密。
图8是根据本公开示例性实施例的设备上安全空间的管理方法的流程图，如图8所示，UE为手机，接入设备为电脑且结合图7所示的装置，该方法流程如下：
步骤S802，手机和电脑通过数据线连接；
步骤S804，手机检测安全空间是否已经预先配置有可信设备的身份信息，当安全空间没有预先配置可信设备的身份信息时，执行步骤S806，当安全空间预先配置有可信设备的身份信息时，执行步骤S812；
步骤S806，可信设备身份验证模块74获取上述电脑发送的设备信息；
步骤S808，可信设备信息显示模块76将电脑的设备信息在手机屏幕上进行显示并判断用户是否选择设置可信设备，当用户选择设置可信设备时，执行步骤S810，当用户选择不设置可信设备时，执行步骤S824；
步骤S810，可信设备设置模块78保存电脑的设备信息，执行步骤S818；
步骤S812，可信设备身份验证模块74读取预先配置的可信设备的身份信息并获取电脑发送的设备信息；
步骤S814，可信设备身份验证模块74比较电脑发送的设备信息与可信设备的身份信息是否一致，当信息不一致时，执行步骤S816，当信息一致时，执行步骤S818；
步骤S816，数据管道控制模块710通知数据传输管道716不允许该电脑访问手机上安全空间的数据；手机屏蔽安全空间数据，对电脑不可见，执行步骤S824；
步骤S818，数据管道控制模块710通知数据传输管道716允许该电脑访问手机上安全空间的数据；手机放开安全空间的数据并对电脑可见；
步骤S820，数据传输管道716与电脑上的数据传输管道718之间建立数据连接；
步骤S822，手机接收电脑经由数据传输管道718发送的加密数据并在安全空间上对于加密数据进行解密以及显示；和/或手机接收到电脑发送的数据访问的请求后，经由数据传输管道716发送加密数据，电脑接收该加密数据并进行解密以及显示；
步骤S824，结束流程。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到根据上述实施例的方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是通常采用的实施方式。基于这样的理解，本公开的方案本质上可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端设备(可以是手机，计算机，服务器，或者网络设备等)执行本公开各个实施例所述的方法。
示例2
在本示例中提供了一种设备上安全空间的管理方法，图9是根据本公开实施例的设备上安全空间的管理方法的流程图(二)，如图9所示，该流程包括如下步骤：
步骤S902，接入设备发送第一身份信息到UE；
步骤S904，接入设备接收UE对第一身份信息的验证结果，并当验证结果为第一身份信息为合法信息时，接入设备与UE建立连接；
步骤S906，接入设备按照UE分配的允许访问的安全空间的权限对安全空间的数据进行管理。
通过上述步骤，实现了接入设备对于UE上安全空间的数据的管理，因此，本公开的方案解决了UE上安全空间的数据无法外部管理，安全空间的数据无法释放且缺乏可信的控制设备的问题，达到用户通过接入设备管理UE上安全空间的数据，使得安全空间上的数据可以通过外界设备导出，防止UE的存储空间被大量占用，实现了对于UE上安全空间的数据的便捷管理的效果。
在一个示例性的实施例中，上述安全空间的权限包括至少以下之一：浏览安全空间的数据；读写安全空间的数据；对安全空间中的数据进行加密；对安全空间中的加密数据进行解密.
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到根据上述实施例的方法可借助软件加必需的通用硬件平台的方式来实现，当然也 可以通过硬件，但很多情况下前者是通常采用的实施方式。基于这样的理解，本公开的方案本质上可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端设备(可以是手机，计算机，服务器，或者网络设备等)执行本公开各个实施例所述的方法。
示例3
在本示例中还提供了一种设备上安全空间的管理装置，该装置用于实现之前示例及示例性实施方式，已经进行过说明的不再赘述。如以下所使用的，术语“模块”可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置通常以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。
图10是根据本公开实施例的设备上安全空间的管理装置的结构框图(一)，如图10所示，该装置包括验证模块102，配置为验证接入设备的第一身份信息；分配模块104，配置为当所述第一身份信息为合法信息时，为所述接入设备分配允许访问所述UE的安全空间的权限；建立模块106，配置为与所述接入设备建立连接。
在一个示例性的实施例中，上述验证模块102还配置为比较所述第一身份信息与预先配置的第二身份信息是否一致，其中，所述第二身份信息为所述UE的可信设备的身份信息；以及依据比较结果确定所述第一身份信息是否合法，其中，在所述比较结果指示所述第一身份信息与所述第二身份信息一致时，确定所述第一身份信息合法。
本示例在模块的划分上与示例1存在不同，在本示例中的验证模块102与示例1中的可信设备身份验证模块74类似，但增加了一些新的功能特征；分配模块104与示例1中的数据管道控制模块710类似，但增加了一些新的功能特征；建立模块106与数据传输管道716类似，但增加了一些新的功能特征。
上述各个模块是可以通过软件或硬件来实现的，对于后者，可以通过以 下方式实现，但不限于此：上述模块均位于同一处理器中；或者，上述各个模块以任意组合的形式分别位于不同的处理器中。
示例4
在本示例中还提供了一种设备上安全空间的管理装置，该装置用于实现之前示例及示例性实施方式，已经进行过说明的不再赘述。如以下所使用的，术语“模块”可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置通常以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。
图11是根据本公开实施例的设备上安全空间的管理装置的结构框图(二)，如图11所示，该装置包括发送模块112，配置为发送第一身份信息到用户终端UE；接收模块114，配置为接收所述UE对所述第一身份信息发送的验证结果；建立模块116，配置为当所述验证结果为所述第一身份信息为合法信息时与所述UE建立连接；管理模块118，配置为按照所述UE分配的允许访问的安全空间的权限对所述安全空间的数据进行管理。
上述各个模块是可以通过软件或硬件来实现的，对于后者，可以通过以下方式实现，但不限于此：上述模块均位于同一处理器中；或者，上述各个模块以任意组合的形式分别位于不同的处理器中。
示例5
在本示例中还提供了一种设备上安全空间的管理系统，该系统用于实现之前示例及示例性实施方式，已经进行过说明的不再赘述。
图12是根据本公开实施例的设备上安全空间的管理系统的结构框图，如图12所示，上述设备上安全空间的管理系统包括UE122和接入设备124。所述UE122配置为验证所述接入设备的第一身份信息；以及当所述第一身份信息为合法信息时，为所述接入设备分配允许访问所述UE的安全空间的权限，并与所述接入设备建立连接；所述接入设备124配置为发送第一身份信息到所述UE；接收所述UE发送的验证结果，并当验证结果为所述第一 身份信息为合法信息时与所述UE建立连接；按照所述UE分配的允许访问的安全空间的权限对所述安全空间的数据进行管理。
示例6
本公开的实施例还提供了一种存储介质。在本示例中，上述存储介质可以被设置为存储用于执行以下步骤的程序代码：S11，用户终端UE验证接入设备的第一身份信息；S12，当所述第一身份信息为合法信息时，所述UE为所述接入设备分配允许访问所述UE的安全空间的权限，并与所述接入设备建立连接。
在本示例中，存储介质还可以被设置为存储用于执行以下步骤的程序代码：S21，所述UE比较所述第一身份信息与预先配置的第二身份信息是否一致，其中，所述第二身份信息为所述UE的可信设备的身份信息；S22，所述UE依据比较结果确定所述第一身份信息是否合法，其中，在所述比较结果指示所述第一身份信息与所述第二身份信息一致时，确定所述第一身份信息合法
本公开的实施例还提供了一种存储介质。在本示例中，上述存储介质可以被设置为存储用于执行以下步骤的程序代码：S31，接入设备发送第一身份信息到用户终端UE；S32，所述接入设备接收所述UE对所述第一身份信息的验证结果，并当所述验证结果为所述第一身份信息为合法信息时，所述接入设备与所述UE建立连接；S33，所述接入设备按照所述UE分配的允许访问的安全空间的权限对所述安全空间的数据进行管理。
在本示例中，上述存储介质可以包括但不限于：U盘、只读存储器(Read-Only Memory，简称为ROM)、随机存取存储器(Random Access Memory，简称为RAM)、移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。
本示例中的具体实施方式可以参考之前示例及示例性实施方式，在此不再赘述。
本领域普通技术人员可以理解，上文中所公开方法中的全部或某些步 骤、系统、装置中的功能模块/单元可以被实施为软件、固件、硬件及其适当的组合。在硬件实施方式中，在以上描述中提及的功能模块/单元之间的划分不一定对应于物理组件的划分；例如，一个物理组件可以具有多个功能，或者一个功能或步骤可以由若干物理组件合作执行。某些组件或所有组件可以被实施为由处理器，如数字信号处理器或微处理器执行的软件，或者被实施为硬件，或者被实施为集成电路，如专用集成电路。这样的软件可以分布在计算机可读介质上，计算机可读介质可以包括计算机存储介质(或非暂时性介质)和通信介质(或暂时性介质)。如本领域普通技术人员公知的，术语计算机存储介质包括在用于存储信息(诸如计算机可读指令、数据结构、程序模块或其他数据)的任何方法或技术中实施的易失性和非易失性、可移除和不可移除介质。计算机存储介质包括但不限于RAM、ROM、EEPROM、闪存或其他存储器技术、CD-ROM、数字多功能盘(DVD)或其他光盘存储、磁盒、磁带、磁盘存储或其他磁存储装置、或者可以用于存储期望的信息并且可以被计算机访问的任何其他的介质。此外，本领域普通技术人员公知的是，通信介质通常包含计算机可读指令、数据结构、程序模块或者诸如载波或其他传输机制之类的调制数据信号中的其他数据，并且可包括任何信息递送介质。
以上所述仅为本公开的示例性实施例而已，并不用于限制本公开，对于本领域的技术人员来说，本公开可以有各种更改和变化。凡在本公开的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本公开的保护范围之内。
工业实用性
通过本公开，由于UE通过设备的身份信息对于接入设备进行验证，当确定接入设备的身份信息为合法信息时，为该接入设备分配访问UE的安全空间的权限并与接入设备建立连接，实现了接入设备对于UE上安全空间的数据的管理，因此，本公开的方案解决了UE上安全空间的数据无法外部管理，安全空间的数据无法释放且缺乏可信的控制设备的问题，达到用户通过接入设备管理UE上安全空间的数据，使得安全空间上的数据可以通过外界 设备导出，防止UE的存储空间被大量占用，实现了对于UE上安全空间的数据的便捷管理的效果。因此本公开具有工业实用性。

Claims (13)

  1. 一种设备上安全空间的管理方法，包括：
    用户终端UE验证接入设备的第一身份信息；
    当所述第一身份信息为合法信息时，所述UE为所述接入设备分配允许访问所述UE的安全空间的权限，并与所述接入设备建立连接。
  2. 根据权利要求1所述的方法，其中，UE验证接入设备的第一身份信息，包括：
    所述UE比较所述第一身份信息与预先配置的第二身份信息是否一致，其中，所述第二身份信息为所述UE的可信设备的身份信息；
    所述UE依据比较结果确定所述第一身份信息是否合法，其中，在所述比较结果指示所述第一身份信息与所述第二身份信息一致时，确定所述第一身份信息合法。
  3. 根据权利要求1所述的方法，其中，所述安全空间的权限包括至少以下之一：
    浏览所述安全空间的数据；
    读写所述安全空间的数据；
    对所述安全空间中的数据进行加密；
    对所述安全空间中的加密数据进行解密。
  4. 根据权利要求1所述的方法，其中，所述安全空间为所述UE在文件系统的逻辑卷管理层面划分的用于存储保密数据的物理卷。
  5. 根据权利要求1至4中任一项所述的方法，其中，所述第一身份信息包括至少以下之一：主板ID号、硬盘序列号，CUP序列号、串口设备ID号。
  6. 一种设备上安全空间的管理方法，包括：
    接入设备发送第一身份信息到用户终端UE；
    所述接入设备接收所述UE对所述第一身份信息的验证结果，并当所述验证结果为所述第一身份信息为合法信息时，所述接入设备与所述UE建立 连接；
    所述接入设备按照所述UE分配的允许访问的安全空间的权限对所述安全空间的数据进行管理。
  7. 根据权利要求6所述的方法，其中，所述安全空间的权限包括至少以下之一：
    浏览所述安全空间的数据；
    读写所述安全空间的数据；
    对所述安全空间中的数据进行加密；
    对所述安全空间中的加密数据进行解密。
  8. 一种设备上安全空间的管理装置，应用于用户设备UE，所述管理装置包括：
    验证模块(102)，配置为验证接入设备的第一身份信息；
    分配模块(104)，配置为当所述第一身份信息为合法信息时，为所述接入设备分配允许访问所述UE的安全空间的权限；
    建立模块(106)，配置为与所述接入设备建立连接。
  9. 根据权利要求8所述的装置，其中，所述验证模块(102)还配置为比较所述第一身份信息与预先配置的第二身份信息是否一致，其中，所述第二身份信息为所述UE的可信设备的身份信息；以及依据比较结果确定所述第一身份信息是否合法，其中，在所述比较结果指示所述第一身份信息与所述第二身份信息一致时，确定所述第一身份信息合法。
  10. 一种设备上安全空间的管理装置，应用于接入设备，所述管理装置包括：
    发送模块(112)，配置为发送第一身份信息到用户终端UE；
    接收模块(114)，配置为接收所述UE对所述第一身份信息发送的验证结果；
    建立模块(116)，配置为当所述验证结果为所述第一身份信息为合法信息时与所述UE建立连接；
    管理模块(118)，配置为按照所述UE分配的允许访问的安全空间的权限对所述安全空间的数据进行管理。
  11. 一种设备上安全空间的管理系统，包括：用户终端UE(122)和接入设备(124)，其中，
    所述UE(122)配置为验证所述接入设备的第一身份信息；以及当所述第一身份信息为合法信息时，为所述接入设备分配允许访问所述UE的安全空间的权限，并与所述接入设备建立连接；
    所述接入设备(124)配置为发送第一身份信息到所述UE；接收所述UE发送的验证结果，并当验证结果为所述第一身份信息为合法信息时与所述UE建立连接；按照所述UE分配的允许访问的安全空间的权限对所述安全空间的数据进行管理。
  12. 一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令被处理器执行时实现权利要求1-5中任一项所述的方法。
  13. 一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令被处理器执行时实现权利要求6-7中任一项所述的方法。
PCT/CN2017/115678 2017-01-18 2017-12-12 设备上安全空间的管理方法、装置及系统 WO2018133583A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710038049.X 2017-01-18
CN201710038049.XA CN108322910A (zh) 2017-01-18 2017-01-18 设备上安全空间的管理方法、装置及系统

Publications (1)

Publication Number Publication Date
WO2018133583A1 true WO2018133583A1 (zh) 2018-07-26

Family

ID=62892959

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/115678 WO2018133583A1 (zh) 2017-01-18 2017-12-12 设备上安全空间的管理方法、装置及系统

Country Status (2)

Country Link
CN (1) CN108322910A (zh)
WO (1) WO2018133583A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110572825A (zh) * 2019-09-04 2019-12-13 广东轻工职业技术学院 一种可穿戴设备认证装置及认证加密方法
CN111125666A (zh) * 2019-12-25 2020-05-08 四川英得赛克科技有限公司 一种基于可信计算体系的可信控制方法及系统
CN111680309A (zh) * 2020-05-25 2020-09-18 数篷科技(深圳)有限公司 数据处理方法、装置、终端及存储介质

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2021146838A1 (en) * 2020-01-20 2021-07-29 Qualcomm Incorporated Two-level synchronization point design for load based equipment mode

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101997689A (zh) * 2010-11-19 2011-03-30 吉林大学 基于声纹识别的usb身份认证方法及其系统
US20120149330A1 (en) * 2010-12-14 2012-06-14 Watson Alexander C System and method to dynamically authenticate mobile devices
US20120281594A1 (en) * 2011-05-04 2012-11-08 Motorola Mobility, Inc. Method and apparatus for providing user equipment access to tv white space resources by a broadband cellular network
CN103124308A (zh) * 2011-11-21 2013-05-29 比亚迪股份有限公司 一种运行应用的方法、系统及移动终端
US20140282933A1 (en) * 2013-03-13 2014-09-18 Uniloc Luxembourg, S.A. Device authentication using device environment information
CN106332066A (zh) * 2015-06-15 2017-01-11 数据通信科学技术研究所 移动终端间的身份认证方法及系统

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101997689A (zh) * 2010-11-19 2011-03-30 吉林大学 基于声纹识别的usb身份认证方法及其系统
US20120149330A1 (en) * 2010-12-14 2012-06-14 Watson Alexander C System and method to dynamically authenticate mobile devices
US20120281594A1 (en) * 2011-05-04 2012-11-08 Motorola Mobility, Inc. Method and apparatus for providing user equipment access to tv white space resources by a broadband cellular network
CN103124308A (zh) * 2011-11-21 2013-05-29 比亚迪股份有限公司 一种运行应用的方法、系统及移动终端
US20140282933A1 (en) * 2013-03-13 2014-09-18 Uniloc Luxembourg, S.A. Device authentication using device environment information
CN106332066A (zh) * 2015-06-15 2017-01-11 数据通信科学技术研究所 移动终端间的身份认证方法及系统

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110572825A (zh) * 2019-09-04 2019-12-13 广东轻工职业技术学院 一种可穿戴设备认证装置及认证加密方法
CN111125666A (zh) * 2019-12-25 2020-05-08 四川英得赛克科技有限公司 一种基于可信计算体系的可信控制方法及系统
CN111680309A (zh) * 2020-05-25 2020-09-18 数篷科技(深圳)有限公司 数据处理方法、装置、终端及存储介质

Also Published As

Publication number Publication date
CN108322910A (zh) 2018-07-24

Similar Documents

Publication Publication Date Title
JP6802233B2 (ja) 複数の操作モードを有するアプリケーションのデータ管理
US10666440B2 (en) Authentication method, device, server, and system, and storage medium
US20210218797A1 (en) Data Management for an Application with Multiple Operation Modes
US9882909B2 (en) System and method for application usage controls through policy enforcement
EP2909786B1 (en) Controlling mobile device access to secure data
TWI475899B (zh) 用以儲存電子存取用戶之設備及方法
WO2018133583A1 (zh) 设备上安全空间的管理方法、装置及系统
KR102281782B1 (ko) 무선 통신 시스템에서 단말의 어플리케이션을 원격으로 관리하는 방법 및 장치
CA3113049C (en) Systems and methods for maintaining and transferring saas session state
US20150020180A1 (en) Wireless two-factor authentication, authorization and audit system with close proximity between mass storage device and communication device
US9331988B2 (en) System and method for provisioning secrets to an application (TA) on a device
EP3899771B1 (en) Secure offline streaming of content
JP2023552421A (ja) ハードウェア・セキュリティ・モジュールのリモート管理
EP2680180A1 (en) System and method for securely allocating a virtualised space
KR101730984B1 (ko) 다수의 동작 모드들을 가진 애플리케이션용 데이터 관리
KR102400471B1 (ko) Sdp 기반의 접속 제어 장치 및 방법
CN110633584B (zh) 数据存储装置的控制
US11829505B2 (en) High security one-time encryption
CN114244573B (zh) 数据传输管控方法、装置、计算机设备和存储介质
EP2680181A1 (en) System and method of securely creating and controlling access to a virtualised space
CN117827475A (zh) 用于进程间通信的方法、装置、电子设备和介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17893171

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17893171

Country of ref document: EP

Kind code of ref document: A1