WO2020192447A1 - 一种文件访问权限认证方法及电子设备 - Google Patents

一种文件访问权限认证方法及电子设备 Download PDF

Info

Publication number
WO2020192447A1
WO2020192447A1 PCT/CN2020/079104 CN2020079104W WO2020192447A1 WO 2020192447 A1 WO2020192447 A1 WO 2020192447A1 CN 2020079104 W CN2020079104 W CN 2020079104W WO 2020192447 A1 WO2020192447 A1 WO 2020192447A1
Authority
WO
WIPO (PCT)
Prior art keywords
file
identity information
key
fixed identity
access request
Prior art date
Application number
PCT/CN2020/079104
Other languages
English (en)
French (fr)
Inventor
方习文
魏强
田文渊
王安宇
黎哲
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP20778010.7A priority Critical patent/EP3913516B1/en
Priority to US17/439,467 priority patent/US20220156391A1/en
Publication of WO2020192447A1 publication Critical patent/WO2020192447A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/606—Protecting data by securing the transmission between two devices or processes
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6209—Protecting access to data via a platform, e.g. using keys or access control rules to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6227—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database where protection concerns the structure of data, e.g. records, types, queries
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6281—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database at program execution time, where the protection is within the operating system
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2107—File encryption
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2141—Access rights, e.g. capability lists, access control lists, access tables, access matrices

Definitions

  • This application relates to the field of terminal technology, and in particular, to a file access authority authentication method and electronic equipment.
  • the current file access control of mobile phones relies on the sandbox isolation access mechanism of the operating system.
  • the sandbox isolation access mechanism can ensure that the files of application A cannot be accessed by application B, and each application can only access the files in its own application.
  • the Trojan horse program may obtain the highest access rights. Therefore, the Trojan horse program can break through the sandbox isolation access mechanism and directly obtain files in other applications, such as copying the files in the address book application. Phonebook information, leading to the leakage of user privacy.
  • the present application provides a file access authority authentication method and electronic equipment, which are used to improve the low security problem of file access control in the terminal operating system and enhance the security of the terminal operating system.
  • an embodiment of the present application provides a method for authenticating file access authority.
  • the method is applicable to an electronic device.
  • the method includes: the electronic device receives a file access request, and the file access request is used to request access to the first file in the electronic device.
  • a file the electronic device obtains the first process identification of the file access request, and determines the first fixed identity information corresponding to the first process identification, and then the electronic device determines the first fixed identity information and the legal fixed identity corresponding to the first file Whether the information is consistent, when the two are inconsistent, the electronic device determines that the file access request authentication is not passed; when the two are consistent, the electronic device determines that the file access request authentication is passed.
  • the electronic device uses the fixed identity information of the mobile phone application to authenticate the access authority of the file access request by using the fixed identity information.
  • the authentication method may be by judging whether the fixed identity information corresponding to the process identifier in the access request is consistent with the legal fixed identity information of the accessed file. If they are consistent, the authentication is passed and the file system decrypts the file; otherwise, the authentication fails. In this way, when a malicious application accesses files of other applications, the file system will authenticate the file access request. Because the authentication fails, the malicious application’s access is denied, thus achieving safe access to the files in the file system. Objective to improve the security of the system.
  • the electronic device when the matching is successful, can also use the first fixed identity information to decrypt the ciphertext of the file key.
  • the decryption it is determined that the file access request is authenticated, and when the decryption fails
  • the file key ciphertext is a ciphertext used to encrypt the file key of the first file.
  • the file system can authenticate the file access request.
  • the fixed identity information can be matched, even if the malicious application tampered with the fixed identity information , It will also be detected that the fixed identity information has been tampered with in the process of decrypting the ciphertext of the file key, causing the authentication to fail.
  • This method can effectively improve the current file system access mechanism, combined with the sandbox mechanism to effectively protect privacy.
  • this file access authorization authentication process does not require user participation and is invisible to users, so it not only improves system security, but also effectively simplifies user operations and improves user experience.
  • the electronic device before the electronic device receives the file access request, the electronic device obtains the process identification and fixed identity information of the running application, establishes the corresponding relationship between the process identification and the fixed identity information, and establishes The correspondence between the newly created file and the fixed identity information.
  • the identity management module obtains the fixed identity information of the application from the package management service module, establishes the mapping relationship between the fixed identity information and the file identity, and the correspondence between the process identity of the application to which the file belongs and the fixed identity information relationship. So that the electronic device can compare the fixed identity information when receiving the file access request.
  • the electronic device before the electronic device receives the file access request, performs an encryption on the file of the first file according to the fixed identity information of the first file, the file system master key, and the preset key encryption algorithm.
  • the key is encrypted to generate a file key ciphertext; and the file key of the first file is used to encrypt the first file to generate a ciphertext of the first file, wherein the header of the ciphertext of the first file.
  • the part includes the legal fixed identity information and the file key ciphertext; the electronic device matches the first fixed identity information with the legal fixed identity information corresponding to the first file, including: the electronic device matches the first fixed identity information Match with the legal fixed identity information of the ciphertext header of the first file.
  • the key encryption and decryption module is used to encrypt a file key to generate a file key ciphertext using fixed identity information, and the file key ciphertext is stored in the header of the file ciphertext.
  • the key encryption and decryption module uses the fixed identity information corresponding to the process ID of the file access request to access the file to decrypt the file key ciphertext. If the file key cannot be decrypted, it notifies the authority authentication module The authentication fails, otherwise the authentication is passed, and the file key is obtained by decryption. Then, the file encryption and decryption module uses the file key to decrypt the ciphertext of the file to obtain the plaintext of the file.
  • an embodiment of the present application provides a method for authenticating file access authority, the method is applicable to an electronic device, and the method includes: the electronic device receives a file access request, and the file access request is used to request access to the first file in the electronic device. Then, the electronic device obtains the first process identifier of the file access request, determines the first fixed identity information corresponding to the first process identifier, and then uses the first fixed identity information to decrypt the cipher text of the file key. When it succeeds, it is determined that the authentication of the file access request is passed; when the decryption fails, it is determined that the authentication of the file access request fails.
  • the file key ciphertext is a ciphertext used to encrypt the file key of the first file.
  • the file system can authenticate the file access request. Even if a malicious application tampered with the fixed identity information, it will be detected that the fixed identity information is Tampering, resulting in authentication failure.
  • This method can effectively improve the current file system access mechanism, combined with the sandbox mechanism to effectively protect privacy.
  • this file access authorization authentication process does not require user participation and is invisible to users, so it not only improves system security, but also effectively simplifies user operations and improves user experience.
  • an embodiment of the present application provides an electronic device including a processor and a memory.
  • the memory is used to store one or more computer programs; when the one or more computer programs stored in the memory are executed by the processor, the electronic device can implement any one of the possible design methods in any of the foregoing aspects.
  • an embodiment of the present application further provides a device, which includes a module/unit that executes any one of the possible design methods in any of the foregoing aspects.
  • modules/units can be realized by hardware, or by hardware executing corresponding software.
  • an embodiment of the present application also provides a computer-readable storage medium.
  • the computer-readable storage medium includes a computer program.
  • the computer program runs on an electronic device, the electronic device executes any of the above aspects. Any one of the possible design methods.
  • the embodiments of the present application also provide a method that includes a computer program product, which when the computer program product runs on a terminal, causes the electronic device to perform any one of the possible designs in any of the foregoing aspects.
  • FIG. 1 is a schematic diagram of an interconnection scenario provided by an embodiment of the application
  • FIG. 2 is a schematic structural diagram of a mobile phone provided by an embodiment of this application.
  • FIG. 3 is a schematic structural diagram of an Android operating system provided by an embodiment of the application.
  • 4a to 4c are schematic diagrams of interaction of a group of file access modules provided by an embodiment of the application.
  • FIG. 5 is a schematic flowchart of a method for authenticating file access permissions provided by an embodiment of the application
  • FIG. 6 is a schematic flowchart of another method for authenticating file access authority provided by an embodiment of the application.
  • Figure 7 is a schematic diagram of the file structure provided by an embodiment of the application.
  • FIGS. 8a to 8c are schematic diagrams of a set of key protection levels provided by embodiments of this application.
  • FIG. 9 is a schematic structural diagram of an electronic device provided by an embodiment of the application.
  • File system is a method of storing and organizing computer files and data.
  • file systems including object-based file systems and log-based file systems.
  • the sandbox mechanism is an isolated operating mechanism for programs.
  • applications usually run in an independent sandbox, that is, each application runs in its own process and has one Independent virtual machine instance.
  • the fixed identity information of an application is a fixed identifier of the application.
  • the fixed identity information can be the package name or signature of the application package, or the universally unique identifier (uuid) of the application.
  • All the parameters that can be used to identify the fixed attributes of the application can be used as fixed identity information.
  • the package name of the WeChat application is com.android.weixin
  • the signature of the WeChat application is 184afda9653afe.
  • File system master key used to encrypt file keys, or used to generate file keys, and stored in a trusted execution environment (TEE).
  • TEE trusted execution environment
  • the file system master key can also be stored outside the TEE , This application is not restricted.
  • the file system master key is protected by the hardware key and the lock screen key at the same time, so that the files in the mobile phone cannot be decrypted before the mobile phone is turned on and the lock screen password is input.
  • Encryption algorithms include 3DES, AES, etc.
  • encryption modes include ECB, CBC, etc.
  • other encryption algorithms or encryption modes can also be used, which are not limited here.
  • the mobile phone 100 is connected to another electronic device 200 through a data cable, and the other electronic device 200 may be a public power bank or a public computer.
  • the mobile phone may be subject to illegal attacks.
  • a malicious application or illegal program in a public power bank or a public PC attacks the mobile phone and obtains the highest access permission, namely root (root) permission.
  • the file system only passes The root authority verifies that the file access request is a legitimate request, so malicious applications or illegal programs can obtain files from the file system, resulting in privacy leakage. For example, a malicious application successfully obtains a picture in a mobile phone WeChat application, or a malicious application successfully obtains a phone book in an address book application.
  • an embodiment of the present application provides a file access authority authentication method, which uses fixed identity information to authenticate the access authority of a file access request by combining the fixed identity information of the mobile phone application itself.
  • the authentication method may be by judging whether the fixed identity information corresponding to the process identifier in the access request is consistent with the legal fixed identity information of the accessed file. If they are consistent, the authentication is passed and the file system decrypts the file; otherwise, the authentication fails. In this way, when a malicious application accesses files of other applications, the file system will authenticate the file access request. Because the authentication fails, the malicious application’s access is denied, thus achieving safe access to the files in the file system. Objective to improve the security of the system.
  • the file access permission authentication method provided by the embodiments of this application can be applied to mobile phones, tablet computers, desktops, laptops, notebook computers, ultra-mobile personal computers (UMPC), handheld computers, and netbooks.
  • electronic devices such as personal digital assistants (personal digital assistants, PDAs), wearable electronic devices, and virtual reality devices, the embodiments of the present application do not impose any limitation on this.
  • Fig. 2 shows a schematic structural diagram of the mobile phone.
  • the mobile phone may include a processor 110, an external memory interface 120, an internal memory 121, a USB interface 130, a charging management module 140, a power management module 141, a battery 142, an antenna 1, an antenna 2, a mobile communication module 150, a wireless communication module 160, and audio Module 170, speaker 170A, receiver 170B, microphone 170C, earphone interface 170D, sensor module 180, buttons 190, motor 191, indicator 192, camera 193, display screen 194, SIM card interface 195 and so on.
  • the sensor module 180 may include a gyroscope sensor, an acceleration sensor, a proximity sensor, a fingerprint sensor, etc. (not shown in the figure).
  • the structure illustrated in the embodiment of the present invention does not constitute a specific limitation on the mobile phone 100.
  • the mobile phone 100 may include more or fewer components than shown, or combine certain components, or split certain components, or arrange different components.
  • the illustrated components can be implemented in hardware, software, or a combination of software and hardware.
  • the processor 110 may include one or more processing units.
  • the processor 110 may include an application processor (AP), a modem processor, a graphics processing unit (GPU), and an image signal processor. (image signal processor, ISP), controller, memory, video codec, digital signal processor (digital signal processor, DSP), baseband processor, and/or neural network processor (Neural-network Processing Unit, NPU) Wait.
  • AP application processor
  • ISP image signal processor
  • controller memory
  • video codec digital signal processor
  • DSP digital signal processor
  • baseband processor baseband processor
  • NPU neural network Processing Unit
  • the different processing units may be independent devices or integrated in one or more processors.
  • the controller may be the nerve center and command center of the mobile phone 100. The controller can generate operation control signals according to the instruction operation code and timing signals to complete the control of fetching and executing instructions.
  • a memory may also be provided in the processor 110 to store instructions and data.
  • the memory in the processor 110 is a cache memory.
  • the memory can store instructions or data that have just been used or recycled by the processor 110. If the processor 110 needs to use the instruction or data again, it can be directly called from the memory. Repeated accesses are avoided, the waiting time of the processor 110 is reduced, and the efficiency of the system is improved.
  • the processor 110 may run the file access authority authentication method provided by the embodiment of the present application. The method determines whether the fixed identity information corresponding to the process identifier in the access request is consistent with the fixed identity information of the accessed file. If it is consistent, the authentication is performed. Pass, the file system decrypts the file, otherwise the authentication fails.
  • the processor 110 integrates different devices, such as integrated CPU and GPU, the CPU and GPU can cooperate to execute the file access permission authentication method provided in the embodiment of the present application. For example, some of the algorithms in the method are executed by the CPU, and another part of the algorithms are executed by the GPU. In order to get faster processing efficiency.
  • the display screen 194 is used to display images, videos, etc.
  • the display screen 194 includes a display panel.
  • the display panel can adopt liquid crystal display (LCD), organic light-emitting diode (OLED), active-matrix organic light-emitting diode or active-matrix organic light-emitting diode (active-matrix organic light-emitting diode).
  • LCD liquid crystal display
  • OLED organic light-emitting diode
  • active-matrix organic light-emitting diode active-matrix organic light-emitting diode
  • AMOLED flexible light-emitting diode (FLED), Miniled, MicroLed, Micro-oLed, quantum dot light-emitting diode (QLED), etc.
  • the mobile phone 100 may include one or N display screens 194, and N is a positive integer greater than one.
  • the display screen may use a graphical user interface to display prompt information on the security of file system access, for example, to remind the user that the current phonebook information is illegally accessed, and please disconnect the data line connection.
  • the camera 193 (front camera or rear camera) is used to capture still images or videos.
  • the camera 193 may include photosensitive elements such as a lens group and an image sensor, where the lens group includes a plurality of lenses (convex lens or concave lens) for collecting light signals reflected by the object to be photographed and transmitting the collected light signals to the image sensor .
  • the image sensor generates an original image of the object to be photographed according to the light signal.
  • the internal memory 121 may be used to store computer executable program code, where the executable program code includes instructions.
  • the processor 110 executes various functional applications and data processing of the mobile phone 100 by running instructions stored in the internal memory 121.
  • the internal memory 121 may include a storage program area and a storage data area.
  • the storage program area can store operating system, application program (such as camera application, WeChat application, etc.) codes and so on.
  • the storage data area can store data created during the use of the mobile phone 100 (such as images, videos, and phone books collected by a camera application).
  • the internal memory 121 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one magnetic disk storage device, a flash memory device, a universal flash storage (UFS), etc.
  • a non-volatile memory such as at least one magnetic disk storage device, a flash memory device, a universal flash storage (UFS), etc.
  • the display screen 194 of the mobile phone 100 displays a main interface, and the main interface includes icons of multiple applications (such as a camera application, a WeChat application, etc.).
  • the display screen 194 displays an interface of the camera application, such as a viewfinder interface.
  • the wireless communication function of the mobile phone 100 can be realized by the antenna 1, the antenna 2, the mobile communication module 151, the wireless communication module 152, the modem processor, and the baseband processor.
  • the antenna 1 and the antenna 2 are used to transmit and receive electromagnetic wave signals.
  • Each antenna in the mobile phone 100 can be used to cover a single or multiple communication frequency bands. Different antennas can also be reused to improve antenna utilization.
  • antenna 1 can be multiplexed as a diversity antenna of a wireless local area network.
  • the antenna can be used in combination with a tuning switch.
  • the mobile communication module 151 can provide a wireless communication solution including 2G/3G/4G/5G and the like applied to the mobile phone 100.
  • the mobile communication module 151 may include at least one filter, switch, power amplifier, low noise amplifier (LNA), etc.
  • the mobile communication module 151 can receive electromagnetic waves by the antenna 1, filter and amplify the received electromagnetic waves, and transmit them to the modem processor for demodulation.
  • the mobile communication module 150 can also amplify the signal modulated by the modem processor, and convert it into electromagnetic waves for radiation via the antenna 1.
  • at least part of the functional modules of the mobile communication module 151 may be provided in the processor 110.
  • at least part of the functional modules of the mobile communication module 151 and at least part of the modules of the processor 110 may be provided in the same device.
  • the modem processor may include a modulator and a demodulator.
  • the modulator is used to modulate the low frequency baseband signal to be sent into a medium and high frequency signal.
  • the demodulator is used to demodulate the received electromagnetic wave signal into a low-frequency baseband signal. Then the demodulator transmits the demodulated low-frequency baseband signal to the baseband processor for processing.
  • the low-frequency baseband signal is processed by the baseband processor and then passed to the application processor.
  • the application processor outputs a sound signal through an audio device (not limited to the speaker 170A, the receiver 170B, etc.), or displays an image or video through the display screen 194.
  • the modem processor may be an independent device.
  • the modem processor may be independent of the processor 110 and be provided in the same device as the mobile communication module 150 or other functional modules.
  • the wireless communication module 152 can provide applications on the mobile phone 100 including wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) networks), bluetooth (BT), and global navigation satellite systems. (global navigation satellite system, GNSS), frequency modulation (frequency modulation, FM), near field communication technology (near field communication, NFC), infrared technology (infrared, IR) and other wireless communication solutions.
  • WLAN wireless local area networks
  • BT wireless fidelity
  • GNSS global navigation satellite system
  • frequency modulation frequency modulation, FM
  • NFC near field communication technology
  • infrared technology infrared, IR
  • the wireless communication module 152 may be one or more devices integrating at least one communication processing module.
  • the wireless communication module 152 receives electromagnetic waves via the antenna 2, frequency modulates and filters the electromagnetic wave signals, and sends the processed signals to the processor 110.
  • the wireless communication module 152 can also receive the signal to be sent from the processor 110, perform frequency modulation, amplify it, and convert it into electromagnetic wave
  • the mobile phone 100 can implement audio functions through the audio module 170, the speaker 170A, the receiver 170B, the microphone 170C, the earphone interface 170D, and the application processor. For example, music playback, recording, etc.
  • the mobile phone 100 can receive the key 190 input, and generate key signal input related to the user settings and function control of the mobile phone 100.
  • the mobile phone 100 can use the motor 191 to generate a vibration notification (such as an incoming call vibration notification).
  • the indicator 192 in the mobile phone 100 can be an indicator light, which can be used to indicate the charging status, power change, and can also be used to indicate messages, missed calls, notifications, and so on.
  • the SIM card interface 195 in the mobile phone 100 is used to connect to the SIM card.
  • the SIM card can be connected to and separated from the mobile phone 100 by inserting into the SIM card interface 195 or pulling out from the SIM card interface 195.
  • the mobile phone 100 may include more or less components than those shown in FIG. 1, which is not limited in the embodiment of the present application.
  • the software system of the electronic device to which the embodiment of the present application is applied may adopt a layered architecture, an event-driven architecture, a micro-core architecture, a micro-service architecture, or a cloud architecture.
  • the embodiment of the present application takes an Android system with a layered architecture as an example to illustrate the software structure of an electronic device.
  • FIG. 3 is a block diagram of the software structure of the mobile phone 100 according to an embodiment of the present application.
  • the layered architecture divides the software into several layers, and each layer has a clear role and division of labor. Communication between layers through software interface.
  • the Android system is divided into four layers, from top to bottom, the application layer, the application framework layer, the Android runtime and system library, and the kernel layer.
  • the application layer can include a series of application packages. As shown in Figure 3, the application package can include applications such as contacts, camera, gallery, calendar, call, map, navigation, Bluetooth, music, video, short message, etc.
  • the application framework layer provides application programming interfaces (application programming interface, API) and programming frameworks for applications in the application layer.
  • the application framework layer includes some predefined functions.
  • the application framework layer can include a window manager, a content provider, a view system, a phone manager, a resource manager, a notification manager, and a package management service module.
  • the window manager is used to manage window programs.
  • the window manager can obtain the size of the display, determine whether there is a status bar, lock the screen, take a screenshot, etc.
  • the content provider is used to store and retrieve data and make these data accessible to applications.
  • the data may include video, image, audio, phone calls made and received, browsing history and bookmarks, phone book, etc.
  • the view system includes visual controls, such as controls that display text and controls that display pictures.
  • the view system can be used to build applications.
  • the display interface can be composed of one or more views.
  • a display interface that includes a short message notification icon may include a view that displays text and a view that displays pictures.
  • the phone manager is used to provide the communication function of the mobile phone 100. For example, the management of the call status (including connecting, hanging up, etc.).
  • the resource manager provides various resources for the application, such as localized strings, icons, pictures, layout files, video files, etc.
  • the notification manager enables the application to display notification information in the status bar, which can be used to convey notification-type messages, and it can disappear automatically after a short stay without user interaction.
  • the notification manager is used to notify the download completion, message reminder, etc.
  • the notification manager can also be a notification that appears in the status bar at the top of the system in the form of a chart or scroll bar text, such as a notification of an application running in the background, or a notification that appears on the screen in the form of a dialog window.
  • text messages are displayed in the status bar, prompt sounds, electronic devices vibrate, and indicator lights flash.
  • the package management service module is used to obtain fixed identity information of the application, such as the package name and signature of the application, when the application is started.
  • Android Runtime includes core libraries and virtual machines. Android runtime is responsible for the scheduling and management of the Android system.
  • the core library consists of two parts: one part is the function functions that the java language needs to call, and the other part is the core library of Android.
  • the application layer and the application framework layer run in a virtual machine.
  • the virtual machine executes the java files of the application layer and the application framework layer as binary files.
  • the virtual machine is used to perform functions such as object life cycle management, stack management, thread management, security and exception management, and garbage collection.
  • the system library can include multiple functional modules. For example: surface manager (surface manager), media library (Media Libraries), three-dimensional graphics processing library (for example: OpenGL ES), 2D graphics engine (for example: SGL), etc.
  • the surface manager is used to manage the display subsystem and provides a combination of 2D and 3D layers for multiple applications.
  • the media library supports playback and recording of a variety of commonly used audio and video formats, as well as still image files.
  • the media library can support multiple audio and video encoding formats, such as: MPEG4, H.264, MP3, AAC, AMR, JPG, PNG, etc.
  • the 3D graphics processing library is used to realize 3D graphics drawing, image rendering, synthesis, and layer processing.
  • the 2D graphics engine is a drawing engine for 2D drawing.
  • the kernel layer is the layer between hardware and software.
  • the kernel layer includes at least a display driver, a camera driver, an audio driver, a sensor driver, etc., which are not limited in the embodiment of the present application.
  • the kernel layer also includes a file system (for example, F2FS), where the file system includes a file encryption and decryption module, which is used to encrypt and decrypt files.
  • F2FS file system
  • the file system includes a file encryption and decryption module, which is used to encrypt and decrypt files.
  • the kernel layer also includes a rights authentication module and an identity management module.
  • the identity management module is used to obtain the legal fixed identity information of the application from the package management service module, establish the mapping relationship between the legal fixed identity information and the file identity, and the corresponding relationship between the process identity of the application to which the file belongs and the legal fixed identity information .
  • the reason why the identity management module needs to generate the above-mentioned correspondence is that due to the hierarchical structure of the operating system, the file system is at the kernel layer and cannot directly obtain the legal fixed identity information of the application from the application layer, so the identity management module is required to store this correspondence relationship.
  • the legal fixed identity information refers to the fixed identity information of the application itself, which is obtained from the package management service module.
  • the legal fixed identity information is stored in the identity management module, and it may be tampered with by malicious applications, but the file system will still regard the tampered fixed identity information as legal fixed identity information for checking access rights Certification.
  • the legal fixed identity information in the embodiments of the present application may be composed of all or part of the package name, signature, and uuid, or obtained by hashing all or part of the package name, signature, and uuid.
  • the legal fixed identity information of the WeChat application in the embodiment of this application may be a splicing of the package name and signature of the WeChat application, that is, com.android.weixin184afda9653afe.
  • the fixed identity information of the WeChat application can be the result of hashing the package name and signature of the WeChat application, that is, HASH (com.android.weixin184afda9653afe).
  • the authorization authentication module is used to determine whether the legal fixed identity information corresponding to the process identifier of the file access request for the current file access is consistent with the legal fixed identity information corresponding to the file. If they are consistent, the authentication is passed, otherwise the authentication is not passed.
  • the kernel layer may also include a key encryption and decryption module.
  • the key encryption and decryption module is used to encrypt a file key to generate a file key ciphertext using legal fixed identity information, and the file key ciphertext is stored At the head of the ciphertext of the file.
  • the key encryption and decryption module uses the first fixed identity information corresponding to the process ID of the file access request to access the file to decrypt the file key ciphertext. If the file key cannot be decrypted, it will notify the authority The authentication module does not pass the authentication, otherwise the authentication passes, and the file key is obtained by decryption. Then, the file encryption and decryption module uses the file key to decrypt the ciphertext of the file to obtain the plaintext of the file.
  • the identity management module when the first application or the second application is started, the identity management module obtains the legal fixed identity information of the application through the package management service module, and then establishes the legal fixed identity information of the application The first corresponding relationship with the process ID to which the application belongs.
  • the identity management module obtains the identity of the created file, and establishes a second correspondence between the file and the legal fixed identity information.
  • the second correspondence relationship may be stored in the identity management module in the form of a mapping table, or fixed identity information may be directly added to the header of the created file to realize the correspondence between the two.
  • the key encryption and decryption module obtains the legal fixed identity information from the identity management module, and then uses the legal fixed identity information to encrypt the file key of the created file to obtain the file key ciphertext.
  • the file system encryption and decryption module uses the file key to encrypt the created file to generate a file ciphertext, where the header of the file ciphertext carries legal fixed identity information and the file key ciphertext. Then the file encryption and decryption module saves the encrypted file cipher text in the storage medium.
  • the identity management module obtains the fixed identity information of the second application and the process identification of the application from the package service management module, and establishes the second application’s Fix the correspondence between identity information and process identification.
  • the permission authentication module first searches the identity management module to determine the fixed identity information corresponding to the process ID of the file access request, and searches and The legal fixed identity information corresponding to the identifier of the accessed file. If the two fixed identity information are consistent, the authentication is passed, otherwise the authentication fails. Then the authentication result is sent to the file encryption and decryption module, and the file encryption and decryption module determines whether to decrypt the file.
  • the file system encryption and decryption module obtains the ciphertext of the file from the storage medium, and uses the file key to decrypt the ciphertext of the file to obtain the plaintext of the file.
  • the file system encryption and decryption module refuses to decrypt the file.
  • the file encryption and decryption module may also carry the legal fixed identity information of the file in the encrypted file ciphertext.
  • the authority authentication module first obtains it from the identity management module Find the first correspondence to determine the first fixed identity information corresponding to the process identifier of the file access request, and then match the first fixed identity information with the fixed identity information in the ciphertext of the file obtained from the storage medium, and if the matching is successful , The authentication is passed, otherwise the authentication is not passed.
  • the key encryption and decryption module can search for the legal fixed identity information corresponding to the accessed file from the identity management module, and use the legal fixed identity information to encrypt the file key of the file to obtain the file secret.
  • Key ciphertext and store the file key ciphertext at the head of the file ciphertext. If the authority authentication module is authenticated, the key encryption and decryption module first calls the first fixed identity information corresponding to the process ID of the file access request to decrypt the file key. If it cannot be decrypted, it notifies the authority authentication module that the authentication has failed, otherwise the decryption gets the file secret. Then, the file encryption and decryption module uses the file key to decrypt the cipher text of the file.
  • the authority authentication module and the identity management module can be independent of the file system, or can be integrated in the file system together with the file encryption and decryption module and the key encryption and decryption module.
  • the functions of the authority authentication module and the identity management module are implemented in different modules, and the communication between different modules belongs to inter-process communication.
  • the function of the authorization authentication module and the function of the identity management module can also be integrated in one module. When integrated in one module, the call to fixed identity information belongs to in-process communication.
  • an embodiment of the present application provides a file access authority authentication method. Referring to the flow shown in FIG. 5, the method is executed by an electronic device, and the method includes the following steps.
  • Step 501 The electronic device receives a file access request, where the file access request is used to request access to the first file in the electronic device.
  • the file system of the electronic device receives a file access request from a second application module in the application layer.
  • the second application may be the application to which the accessed file belongs, or it may be connected to the electronic device. Malicious applications in other electronic devices.
  • Step 502 The electronic device obtains the first process identifier of the file access request, and determines the first fixed identity information corresponding to the first process identifier.
  • the operating system of the electronic device when it receives a file access request, it will automatically assign a unique first process identifier to the request. And the identity management module will obtain the first fixed identity information of the application to which the process belongs from the package management service module, and generate a mapping relationship between the first process identity and the first fixed identity information. Therefore, the authorization authentication module in the kernel layer can find the first fixed identity information corresponding to the first process identifier from the identity management module.
  • Step 503 The electronic device determines whether the first fixed identity information is consistent with the legal fixed identity information corresponding to the first file.
  • the first possible implementation is that the permission authentication module in the file system first obtains the legal fixed identity information corresponding to the first file from the identity management module, and then compares the two.
  • the second possible implementation is that the file system obtains the ciphertext of the first file from the storage medium, where the ciphertext header of the first file carries legal fixed identity information, so the permission authentication module first obtains the ciphertext header The legal fixed identity information is then compared with the legal fixed identity information.
  • Step 504 When the two are inconsistent, the electronic device determines that the file access request authentication is not passed.
  • the file encryption and decryption module in the file system refuses to decrypt the file.
  • step 505 when the two are consistent, the electronic device determines that the file access request is authenticated.
  • the file encryption and decryption module of the file system can obtain the ciphertext of the first file from the storage medium, and decrypt the ciphertext using the file key to obtain the first file, and then feed back the first file To the side that sends the file access request.
  • the file encryption and decryption module of the file system uses the file key to decrypt the ciphertext to obtain the first file, and then feeds the first file back to the side sending the file access request.
  • the malicious application may tamper with the legal fixed identity information in the file ciphertext header to the first fixed identity information corresponding to the malicious application itself, or the malicious application may change the legal identity corresponding to the first file in the identity management module.
  • the fixed identity information is tampered with to the first fixed identity information corresponding to the malicious application itself, which causes the above authentication method to become invalid. Therefore, in another possible embodiment, when the two are consistent, the electronic device may continue to perform step 506 to step 507, that is, perform the second authentication, and the specific steps are as follows.
  • Step 506 The electronic device uses the first fixed identity information to decrypt the file key ciphertext of the first file.
  • the key encryption and decryption module has previously used the legal fixed identity information of the first file and the file system master key to encrypt the first file key to generate the file key ciphertext, where the ciphertext of the first file The ciphertext of the file key is carried in the text. After the first fixed identity information is successfully matched with the legal fixed identity information, the key encryption and decryption module continues to use the first fixed identity information and the file system key to decrypt the file key cipher text in the header of the first file.
  • step 507 the electronic device determines whether the decryption is successful, if it is unsuccessful, it returns to step 504, and if it is successful, it performs step 508.
  • Step 508 When the decryption is successful, the electronic device uses the decrypted file key to decrypt the ciphertext of the first file to obtain the first file.
  • the identity management module obtains the legal fixed identity information of the WeChat application through the package management service module (assuming it is com.android.weixin184afda9653afe), and establishes the first correspondence between the process identifier of the WeChat application and the legal fixed identity information. For example, as shown in Table 1.
  • the identity management module obtains the identification of the file, and establishes a connection between the identification of the first file and the legal fixed identity information of the WeChat application to which the file belongs.
  • the second correspondence For example, as shown in Table 2.
  • the identity management module when the WeChat application creates the first file (such as saving a picture), the identity management module obtains the legal fixed identity information of the WeChat application to which the file belongs, and then inserts the legal fixed identity information into the ciphertext of the first file Head.
  • the file structure is shown in Table 3.
  • the identity management module obtains the legal fixed identity information of the WeChat application to which the file belongs, and then inserts the legal fixed identity information into the ciphertext of the first file head.
  • the key encryption and decryption module uses the file system master key and fixed identity information to encrypt the file key to obtain the file key ciphertext, and save the file key ciphertext in the ciphertext header of the file.
  • the file structure is shown in Table 4.
  • the file system obtains the first process ID of the file access request, for example, 1111, and then finds the corresponding first fixed identity information through the identity management module to be com.android.weixin184afda9653afe, so the first fixed identity information is compared with Table 2
  • the legal fixed identity information corresponding to the first file accessed is compared, and the authentication is passed because they are consistent.
  • compare the first fixed identity information with the legal fixed identity information in the header of the ciphertext of the first file and because they are consistent, the authentication is passed.
  • the file system obtains the first process identifier of the file access request, for example, 2222, and then finds that the corresponding first fixed identity information is NULL through the identity management module, so the first fixed identity information is compared with Table 2
  • the legal fixed identity information corresponding to the first file accessed is compared, and the authentication fails because of inconsistencies.
  • the authentication fails because of inconsistencies.
  • the malicious application directly tampers the legal fixed identity information in the ciphertext header of the first file of WeChat into the first fixed identity information of the malicious application itself (for example, it is changed to empty).
  • the file system obtains the first process identifier of the file access request, for example, 2222, and then uses the identity management module to find that the corresponding first fixed identity information is NULL, so the first fixed identity information is compared with the current first
  • the legal fixed identity information corresponding to the file is compared and it is found that the two are consistent.
  • the file encryption and decryption module uses the first fixed identity information to decrypt the file key ciphertext in the ciphertext header of the first file, and finds that the decryption fails, so it notifies the permission authentication module that the authentication has failed, and refuses to access the first file.
  • the ciphertext is decrypted.
  • the file encryption and decryption module monitors whether the fixed identity information used is consistent with the first fixed identity information when decrypting the ciphertext of the file key. If they are different, the authority authentication module is notified that the authentication has failed, and the ciphertext of the first file is rejected. Decrypt.
  • the file system can authenticate the file access request.
  • the file access request comes from the application to which the file belongs, it can match the legal fixed identity information corresponding to the file, even if the malicious application fixes the file legally. If the identity information is tampered with, it will be detected that the legal fixed identity information has been tampered with during the decryption of the ciphertext of the file key, resulting in authentication failure.
  • This method can effectively improve the current file system access mechanism, combined with the sandbox mechanism to effectively protect privacy.
  • this file access authorization authentication process does not require user participation and is invisible to users, so it not only improves system security, but also effectively simplifies user operations and improves user experience.
  • the embodiment of the present application provides another method for authenticating file access authority. Referring to the flow shown in FIG. 6, the method is executed by an electronic device, and the method includes the following steps.
  • Step 601 The electronic device receives a file access request, where the file access request is used to request access to a first file in the electronic device.
  • the file system of the electronic device receives a file access request from a second application module in the application layer.
  • the second application may be the application to which the accessed file belongs, or it may be connected to the electronic device. Malicious applications in other electronic devices.
  • Step 602 The electronic device obtains the first process identifier of the file access request, and determines the first fixed identity information corresponding to the first process identifier.
  • the operating system of the electronic device when it receives a file access request, it will automatically assign a unique first process identifier to the request. And the identity management module will obtain the first fixed identity information of the application to which the process belongs from the package management service module, and generate a mapping relationship between the first process identity and the first fixed identity information. Therefore, the authorization authentication module in the kernel layer can find the first fixed identity information corresponding to the first process identifier from the identity management module.
  • Step 603 The electronic device uses the first fixed identity information to decrypt the ciphertext of the file key.
  • the electronic device will use the file key to encrypt the first file in advance, and use the legal fixed identity information corresponding to the first file and the system master key to encrypt the file key, generate the file key ciphertext, and encrypt the file key ciphertext And the legal fixed identity information is stored in the ciphertext head of the first file.
  • the key encryption and decryption module in the file system uses the first fixed identity information to decrypt the ciphertext of the file key in the ciphertext of the first file. If the first fixed identity information is consistent with the fixed identity information corresponding to the first file, then The preset decryption algorithm can decrypt successfully, otherwise the decryption fails.
  • step 604 the electronic device judges whether the decryption is successful.
  • the key encryption and decryption module in the file system determines whether the file key ciphertext is successfully decrypted by using the first fixed identity information and other key parameters (such as the file system master key and random parameters).
  • Step 605 If the decryption is unsuccessful, it is determined that the authentication of the file access request is not passed.
  • unsuccessful decryption means that the first fixed identity information is inconsistent with the legal fixed identity information of the first file, which means that the file access request may come from a malicious application or an illegal program, so the file encryption and decryption module in the file system refuses to decrypt file.
  • step 606 if the decryption is successful, it is determined that the file access request is authenticated.
  • the successful decryption indicates that the first fixed identity information is consistent with the legal fixed identity information of the first file, and that the file access request may come from the application to which the first file belongs.
  • the file encryption and decryption module of the file system uses the file key to decrypt the ciphertext to obtain the first file, and then feeds the first file back to the side that sends the file access request.
  • the identity management module obtains the legal fixed identity information of the WeChat application through the package management service module (assuming it is com.android.weixin184afda9653afe), and establishes the first correspondence between the process identifier of the WeChat application and the legal fixed identity information. For example, as shown in Table 1.
  • the key encryption and decryption module obtains the legal fixed identity information and the file system master key of the WeChat application to which the file belongs from the identity management module, and uses the file system master key and The fixed identity information encrypts the file key of the first file to obtain the file key ciphertext. Then the file encryption and decryption module uses the file key to encrypt the first file, and saves the file key ciphertext and legal fixed identity information in the ciphertext header of the first file.
  • the file system obtains the first process identifier of the file access request, for example, 1111, and then finds the corresponding legal fixed identity information through the identity management module is com.android.weixin184afda9653afe, so it will use the legal fixed identity information and other key parameters (Such as the file system master key, random parameters), decrypt the file key cipher text at the head of the cipher text of the first file according to the preset key decryption algorithm, and the decryption is successful, the key encryption and decryption module notifies the authority
  • the authentication module passed the authentication.
  • the file system obtains the first process ID of the file access request, for example, 2222, and then finds the corresponding first fixed identity information through the identity management module to be com.android.hook184afda9653afe(NULL), so the first fixed identity information will be used And other key parameters (such as the file system master key, random parameters), decrypt the file key cipher text at the head of the cipher text of the first file according to the preset key decryption algorithm, because the first fixed identity information It is different from the fixed identity information of the encrypted file key in Table 1, so the decryption fails, and the key encryption and decryption module notifies the authority authentication module that the authentication fails.
  • the file system can authenticate the file access request.
  • the authentication will fail.
  • This method can improve the current file system access mechanism, and combined with the sandbox mechanism can effectively protect file security.
  • this file access authorization authentication process does not require user participation and is invisible to users, so it not only improves system security, but also effectively simplifies user operations and improves user experience.
  • the key encryption and decryption module can use key parameters and a preset key encryption algorithm to encrypt the file key to obtain the file key ciphertext.
  • file key ciphertext ENC-AEAD (file system master key, file key, application fixed identity information).
  • ENC-AEAD is a collective term for authentication encryption methods, including but not limited to, AES-GCM, AES-CCM, combined applications of AES encryption and HMAC authentication.
  • ciphertext AES-GCM-ENC (key, plaintext, AAD, IV).
  • the key in the algorithm can refer to the file system master key; the plain text refers to the file key; AAD refers to fixed identity information; IV refers to a designated random number (for example, 16byte Long random number).
  • the ciphertext is the ciphertext of the file key.
  • the embodiments of the present application may also use other authentication encryption algorithms, such as AES-CCM, AES-CBC+HMAC, and the principles are similar, so they will not be listed here.
  • the file key ciphertext generated according to the above method is bound to fixed identity information. If the fixed identity information used in decryption is not the fixed identity information used in encryption, the file key ciphertext cannot be decrypted.
  • the file system can write the file key ciphertext and key parameters (random number parameters, fixed identity information) into the header of the file (metadata), and the file generated by the Metadata and the file key encryption
  • the ciphertext content constitutes the ciphertext of the file. As shown in Figure 7.
  • the key encryption and decryption module can use key parameters and a preset key decryption algorithm to decrypt the cipher text of the file key to obtain the file key (plain text). That is, the key encryption and decryption module first obtains the file system master key from the trusted execution environment, and then decrypts the file key ciphertext using the key parameter in the file header.
  • file key DEC-AEAD (file system master key, file key ciphertext, fixed identity information).
  • ENC-AEAD is a general term for authentication encryption methods, including but not limited to, AES-GCM, AES-CCM, and AES-HMAC.
  • the key in the algorithm can refer to the file system master key;
  • the cipher text refers to the file key cipher text obtained from the file header;
  • AAD is the fixed identity information (which can be The fixed identity information corresponding to the process ID of the file access request can also be obtained from the file header);
  • IV refers to the random number obtained from the file header.
  • file keys used to encrypt a file there may be one or more file keys used to encrypt a file, and the embodiment of the present application may encrypt any one or more file keys used to encrypt the file.
  • the commonly used key levels may be as follows, examples are as follows.
  • the file system master key is used as the file key, and the file system master key is used to encrypt each file in the file system.
  • the key encryption and decryption module can use fixed parameter information and a preset key encryption algorithm to encrypt the file system master key to obtain the file key ciphertext.
  • each file has a corresponding file key
  • the file key is used to encrypt the corresponding file
  • the file system master key is used to encrypt the file key.
  • file key 1 is used to encrypt file 1
  • file key 2 is used to encrypt file 2
  • file key n is used to encrypt file n
  • the file system master key is used to encrypt file key 1.
  • the key encryption and decryption module can use fixed parameter information, the file system master key, and a preset key encryption algorithm to encrypt the file key to obtain the file key ciphertext.
  • each file has two corresponding file keys, the file key is used to encrypt the corresponding file, the intermediate key is used to encrypt the file key, and the file system master The key is used to encrypt the intermediate key.
  • file key 1 is used to encrypt file 1
  • file key 2 is used to encrypt file 2
  • file key n is used to encrypt file n
  • intermediate key 1 is used to encrypt file key 1
  • intermediate key 2 Used to encrypt file key 2
  • intermediate key n is used to encrypt file key n
  • the file system master key is used to encrypt intermediate key 1, intermediate key 2, and so on.
  • the key encryption and decryption module can use fixed parameter information, the file system master key, and a preset key encryption algorithm to encrypt the intermediate key or the file key to obtain the file key ciphertext.
  • the intermediate key can also have multiple levels.
  • the next level using the intermediate key 1 is the intermediate key 11.
  • the intermediate key 11 then encrypts the file key 1.
  • the intermediate key and the next The level key may not be limited to a one-to-one relationship. For example, there may be n intermediate keys and m next-level intermediate keys (or m file keys), where n can be less than m and one of n The key can encrypt multiple keys in m, which will not be listed here.
  • the embodiment of the present application also provides a method for generating a file key.
  • the file system uses fixed identity information, the file system master key and a preset derivative algorithm to generate the file key.
  • KDF file system master key, application fixed identity
  • KDF is a general term for derived algorithms, such as HKDF, NIST800-108 HMACKDF, and there is no restriction here.
  • the method of generating a file key can also be used to generate an intermediate key of any layer of the key hierarchy in the above example. In this method, the fixed identity information and the file system master key used to generate the file key are not easily obtained, and the security of the generated file key can be improved.
  • an embodiment of the present application discloses an electronic device, including: a touch screen 901, the touch screen 901 includes a touch-sensitive surface 906 and a display screen 907; one or more processors 902; a memory 903; a communication module 908
  • One or more application programs (not shown); and one or more computer programs 904, each of the above-mentioned devices may be connected through one or more communication buses 905.
  • the one or more computer programs 904 are stored in the aforementioned memory 903 and are configured to be executed by the one or more processors 902, and the one or more computer programs 904 include instructions, which can be used to execute the aforementioned implementations.
  • Each step in the example for example, the instruction can be used to execute each step shown in FIG. 5 and FIG. 6.
  • the functional units in the various embodiments of the embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit can be implemented in the form of hardware or software functional unit.
  • the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium.
  • a computer readable storage medium includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) or a processor to execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage media include: flash memory, mobile hard disk, read-only memory, random access memory, magnetic disk or optical disk and other media that can store program codes.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Health & Medical Sciences (AREA)
  • Health & Medical Sciences (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Bioethics (AREA)
  • Databases & Information Systems (AREA)
  • Telephone Function (AREA)
  • Storage Device Security (AREA)

Abstract

一种文件访问权限认证方法及电子设备，涉及通信技术领域，可在访问系统中的文件访问请求进行权限认证，提高电子设备的系统的安全性，保护用户数据。该方法包括：电子设备接收文件访问请求（501），其中，文件访问请求用于请求访问电子设备中的第一文件，然后获取文件访问请求的第一进程标识和确定与第一进程标识对应的第一固定身份信息（502），最终将第一固定身份信息与第一文件对应的合法固定身份信息进行匹配（503），当匹配成功时，则确定文件访问请求认证通过（505）。

Description

一种文件访问权限认证方法及电子设备
本申请要求在2019年3月22日提交中国国家知识产权局、申请号为201910220920.7、发明名称为“一种文件访问权限认证方法及电子设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及终端技术领域，尤其涉及一种文件访问权限认证方法及电子设备。
背景技术
近年来，随着电子产业和通信技术的飞速发展，目前智能终端设备越来越多，例如手机，智能音箱、智能手环等，人们的生活变得越来越智能化。由于手机的便携性，且可以从应用商店上下载各种功能的应用软件，所以手机已经成为人们日常生活中必不可少的必备品。
当前手机的文件访问控制依赖于操作系统的沙箱隔离访问机制，沙箱隔离访问机制可以保证应用A的文件无法被应用B访问，每个应用仅能够访问自身应用中的文件。但是当手机的操作系统被木马程序攻击时，木马程序可能会获取到最高的访问权限，因此木马程序可以突破沙箱隔离访问机制，直接获取其它应用中的文件，例如复制了通讯录应用中的电话本信息，导致用户的隐私发生泄露。
发明内容
本申请提供一种文件访问权限认证方法及电子设备，用以改善终端操作系统中文件访问控制存在安全性低的问题，增强终端的操作系统的安全性。
第一方面，本申请实施例提供了一种文件访问权限认证方法，所述方法适用于电子设备，该方法包括：电子设备接收文件访问请求，该文件访问请求用于请求访问电子设备中的第一文件，然后电子设备获取该文件访问请求的第一进程标识，并确定与第一进程标识对应的第一固定身份信息，接着电子设备判断第一固定身份信息与第一文件对应的合法固定身份信息是否一致，当二者不一致时，电子设备则确定该文件访问请求认证不通过；当二者一致时，电子设备则确定该文件访问请求认证通过。
本申请实施例中，电子设备通过结合利用手机应用自身的固定身份信息，利用固定身份信息对文件访问请求的访问权限进行认证。认证方法可以是通过判断访问请求中的进程标识对应的固定身份信息，是否与被访问的文件的合法固定身份信息一致，若一致，则认证通过，文件系统解密该文件，否则认证不通过。这样，当恶意应用对其它应用的文件进行文件访问时，文件系统会对该文件访问请求进行认证，因认证不通过，所以拒绝恶意应用的访问，因此达到对文件系统中的文件进行安全访问的目的，提高了系统的安全性。
在一种可能的设计中，当匹配成功时，电子设备还可以利用所述第一固定身份信息解密文件密钥密文，当解密成功时，则确定所述文件访问请求认证通过，当解密失败时，确定所述文件访问请求认证失败。其中，所述文件密钥密文是用于加密所述第一文件的文件密钥的密文。
本申请实施例中通过上述方法，文件系统可以对文件访问请求进行权限认证，当文件访 问请求是来自文件所属应用时，才能给完成固定身份信息的匹配，即使恶意应用将固定身份信息进行了篡改，也会在文件密钥密文解密这一过程被监测出固定身份信息被篡改，导致认证失败。该方法可以有效地完善当前的文件系统访问机制，再结合沙箱机制有效地保护隐私安全。且这一文件访问权限认证过程并不需要用户参与，对用户是不可见的，所以既提高了系统安全，也有效地简化用户操作，提高了用户体验。
在一种可能的设计中，在电子设备接收文件访问请求之前，电子设备获取运行的应用程序的进程标识和固定身份信息，并建立所述进程标识和固定身份信息之间的对应关系，以及建立新创建的文件和固定身份信息之间的对应关系。
本申请实施例中，身份管理模块从包管理服务模块获取应用的固定身份信息，建立固定身份信息与文件标识之间的映射关系，以及该文件所属应用的进程标识和固定身份信息之间的对应关系。以便于电子设备在收到文件访问请求时，可以对比固定身份信息。
在一种可能的设计中，在电子设备接收文件访问请求之前，电子设备根据第一文件的固定身份信息、文件系统主密钥和预设的密钥加密算法，对所述第一文件的文件密钥进行加密，生成文件密钥密文；并利用第一文件的文件密钥对所述第一文件进行加密，生成第一文件的密文，其中，所述第一文件的密文的头部包括合法固定身份信息和文件密钥密文；所述电子设备将所述第一固定身份信息与所述第一文件对应的合法固定身份信息进行匹配，包括：电子设备将第一固定身份信息与第一文件的密文头部的合法固定身份信息进行匹配。
本申请实施例中，密钥加解密模块用于利用固定身份信息将文件密钥加密生成文件密钥密文，该文件密钥密文被存储在文件密文的头部。当权限认证模块认证通过之后，密钥加解密模块利用访问文件的文件访问请求的进程标识所对应的固定身份信息解密该文件密钥密文，若无法解密得到文件密钥，则通知权限认证模块认证不通过，否则认证通过，解密得到文件密钥。接着，文件加解密模块利用该文件密钥解密文件密文得到文件明文。
第二方面，本申请实施例提供了一种文件访问权限认证方法，所述方法适用于电子设备，该方法包括：电子设备接收文件访问请求，该文件访问请求用于请求访问电子设备中的第一文件，然后电子设备获取该文件访问请求的第一进程标识，并确定与第一进程标识对应的第一固定身份信息，接着利用所述第一固定身份信息解密文件密钥密文，当解密成功时，则确定所述文件访问请求认证通过；当解密失败时，确定所述文件访问请求认证失败。其中，所述文件密钥密文是用于加密所述第一文件的文件密钥的密文。
本申请实施例中通过上述方法，文件系统可以对文件访问请求进行权限认证，即使恶意应用将固定身份信息进行了篡改，也会在文件密钥密文解密这一过程被监测出固定身份信息被篡改，导致认证失败。该方法可以有效地完善当前的文件系统访问机制，再结合沙箱机制有效地保护隐私安全。且这一文件访问权限认证过程并不需要用户参与，对用户是不可见的，所以既提高了系统安全，也有效地简化用户操作，提高了用户体验。
第三方面，本申请实施例提供一种电子设备，包括处理器和存储器。其中，存储器用于存储一个或多个计算机程序；当存储器存储的一个或多个计算机程序被处理器执行时，使得该电子设备能够实现上述任一方面的任意一种可能的设计的方法。
第四方面，本申请实施例还提供一种装置，该装置包括执行上述任一方面的任意一种可能的设计的方法的模块/单元。这些模块/单元可以通过硬件实现，也可以通过硬件执行相应的软件实现。
第五方面，本申请实施例中还提供一种计算机可读存储介质，所述计算机可读存储介质包括计算机程序，当计算机程序在电子设备上运行时，使得所述电子设备执行上述任一方面 的任意一种可能的设计的方法。
第六方面，本申请实施例还提供一种包含计算机程序产品，当所述计算机程序产品在终端上运行时，使得所述电子设备执行上述任一方面的任意一种可能的设计的方法。
本申请的这些方面或其他方面在以下实施例的描述中会更加简明易懂。
附图说明
图1为本申请实施例提供的一种互联场景示意图；
图2为本申请实施例提供的一种手机的结构示意图；
图3为本申请实施例提供的安卓操作系统结构示意图；
图4a至图4c为本申请实施例提供的一组文件访问模块的交互示意图；
图5为本申请实施例提供的一种文件访问权限认证方法流程示意图；
图6为本申请实施例提供的另一种文件访问权限认证方法流程示意图；
图7为本申请实施例提供的文件结构示意图；
图8a至图8c为本申请实施例提供的一组密钥保护层级示意图；
图9为本申请实施例提供的一种电子设备结构示意图。
具体实施方式
为了便于理解，示例的给出了部分与本申请实施例相关概念的说明以供参考。
文件系统(file system，FS)是存储和组织计算机文件和数据的方法。文件系统的种类繁多，有基于对象的文件系统；有基于日志的文件系统。
沙箱(Sandbox)机制是一种程序的隔离运行机制，在安卓操作系统中，应用通常都在一个独立的沙箱中运行，即每一个应用程序都在它自己的进程中运行，都拥有一个独立的虚拟机实例。
应用程序的固定身份信息是应用程序的一种固定标识，固定身份信息可以是应用程序的程序包的包名或签名，也可以应用程序的通用唯一识别码(universally unique identifier，uuid)，一般地，可以用来标识应用程序的固定属性的参数均可以作为固定身份信息。例如，微信应用的包名(packagename)是com.android.weixin，微信应用的签名(signature)是184afda9653afe。
文件系统主密钥，用于对文件密钥进行加密，或者用于生成文件密钥，存储于可信执行环境(trusted execution environment，TEE)中，当然文件系统主密钥也允许存储在TEE外，本申请不作限制。一般地，文件系统主密钥同时被硬件密钥、锁屏密钥两个因子保护，使得手机开机输入锁屏密码之前，手机中的文件无法解密。
文件密钥，用于对文件进行加密。加密算法包括3DES，AES等，加密模式包括ECB,CBC等，还可以使用其它加密算法或者加密模式，此处不做限定。
如背景技术所述，当前手机的沙箱机制仍然存在安全隐患。例如图1所示的场景中，手机100通过数据线连接其它电子设备200，该其它电子设备200可以是公共充电宝或者公共电脑。其它电子设备200中可能存在恶意应用或者非法程序，当手机连接公共充电宝进行充电时，或者当手机连接公共的PC(个人电脑)充电或者传输数据时，手机均有可能遭受到非法攻击。假设公共充电宝或者公共PC中的恶意应用或者非法程序攻击手机，获得最高访问权限，即root(根)权限，当恶意应用或者非法程序向手机的文件系统发送文件访问请求时，文件系统仅通过root权限认证该文件访问请求是合法请求，因此恶意应用或者非法程序可以从文件系统中获取文件，导致发生隐私泄露。例如恶意应用成功获取手机微信应用中的图片， 或者是恶意应用成功获取通讯录应用中的电话本。
为此，本申请实施例提供一种文件访问权限认证方法，该方法通过结合利用手机应用自身的固定身份信息，利用固定身份信息对文件访问请求的访问权限进行认证。认证方法可以是通过判断访问请求中的进程标识对应的固定身份信息，是否与被访问的文件的合法固定身份信息一致，若一致，则认证通过，文件系统解密该文件，否则认证不通过。这样，当恶意应用对其它应用的文件进行文件访问时，文件系统会对该文件访问请求进行认证，因认证不通过，所以拒绝恶意应用的访问，因此达到对文件系统中的文件进行安全访问的目的，提高了系统的安全性。
本申请实施例所提供的一种文件访问权限认证方法可应用于手机、平板电脑、桌面型、膝上型、笔记本电脑、超级移动个人计算机(ultra-mobile personal computer，UMPC)、手持计算机、上网本、个人数字助理(personal digital assistant，PDA)、可穿戴电子设备、虚拟现实设备等电子设备中，本申请实施例对此不做任何限制。
以电子设备是手机为例，图2示出了手机的结构示意图。
手机可以包括处理器110，外部存储器接口120，内部存储器121，USB接口130，充电管理模块140，电源管理模块141，电池142，天线1，天线2，移动通信模块150，无线通信模块160，音频模块170，扬声器170A，受话器170B，麦克风170C，耳机接口170D，传感器模块180，按键190，马达191，指示器192，摄像头193，显示屏194，以及SIM卡接口195等。其中传感器模块180可以包括陀螺仪传感器，加速度传感器，接近光传感器、指纹传感器等(图中未示出)。
可以理解的是，本发明实施例示意的结构并不构成对手机100的具体限定。在本申请另一些实施例中，手机100可以包括比图示更多或更少的部件，或者组合某些部件，或者拆分某些部件，或者不同的部件布置。图示的部件可以以硬件，软件或软件和硬件的组合实现。
处理器110可以包括一个或多个处理单元，例如：处理器110可以包括应用处理器(application processor，AP)，调制解调处理器，图形处理器(graphics processing unit，GPU)，图像信号处理器(image signal processor,ISP)，控制器，存储器，视频编解码器，数字信号处理器(digital signal processor,DSP)，基带处理器，和/或神经网络处理器(Neural-network Processing Unit,NPU)等。其中，不同的处理单元可以是独立的器件，也可以集成在一个或多个处理器中。其中，控制器可以是手机100的神经中枢和指挥中心。控制器可以根据指令操作码和时序信号，产生操作控制信号，完成取指令和执行指令的控制。
处理器110中还可以设置存储器，用于存储指令和数据。在一些实施例中，处理器110中的存储器为高速缓冲存储器。该存储器可以保存处理器110刚用过或循环使用的指令或数据。如果处理器110需要再次使用该指令或数据，可从所述存储器中直接调用。避免了重复存取，减少了处理器110的等待时间，因而提高了系统的效率。
处理器110可以运行本申请实施例提供的文件访问权限认证方法，该方法通过判断访问请求中的进程标识对应的固定身份信息，是否与被访问的文件的固定身份信息一致，若一致，则认证通过，文件系统解密该文件，否则认证不通过。当处理器110集成不同的器件，比如集成CPU和GPU时，CPU和GPU可以配合执行本申请实施例提供的文件访问权限认证方法，比如方法中部分算法由CPU执行，另一部分算法由GPU执行，以得到较快的处理效率。
显示屏194用于显示图像，视频等。显示屏194包括显示面板。显示面板可以采用液晶显示屏(liquid crystal display，LCD)，有机发光二极管(organic light-emitting diode，OLED)，有源矩阵有机发光二极体或主动矩阵有机发光二极体(active-matrix organic light emitting diode的， AMOLED)，柔性发光二极管(flex light-emitting diode，FLED)，Miniled，MicroLed，Micro-oLed，量子点发光二极管(quantum dot light emitting diodes，QLED)等。在一些实施例中，手机100可以包括1个或N个显示屏194，N为大于1的正整数。
在本申请实施例中，显示屏可以利用图形用户界面对文件系统访问的安全性显示提示信息，例如提醒用户当前电话本信息被非法访问，请断开数据线连接。
摄像头193(前置摄像头或者后置摄像头)用于捕获静态图像或视频。通常，摄像头193可以包括感光元件比如镜头组和图像传感器，其中，镜头组包括多个透镜(凸透镜或凹透镜)，用于采集待拍摄物体反射的光信号，并将采集的光信号传递给图像传感器。图像传感器根据所述光信号生成待拍摄物体的原始图像。
内部存储器121可以用于存储计算机可执行程序代码，所述可执行程序代码包括指令。处理器110通过运行存储在内部存储器121的指令，从而执行手机100的各种功能应用以及数据处理。内部存储器121可以包括存储程序区和存储数据区。其中，存储程序区可存储操作系统，应用程序(比如相机应用，微信应用等)的代码等。存储数据区可存储手机100使用过程中所创建的数据(比如相机应用采集的图像、视频、电话本)等。
此外，内部存储器121可以包括高速随机存取存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件，闪存器件，通用闪存存储器(universal flash storage，UFS)等。
示例性的，手机100的显示屏194显示主界面，主界面中包括多个应用(比如相机应用、微信应用等)的图标。用户通过触摸传感器180K点击主界面中相机应用的图标，触发处理器110启动相机应用，打开摄像头193。显示屏194显示相机应用的界面，例如取景界面。
手机100的无线通信功能可以通过天线1，天线2，移动通信模块151，无线通信模块152，调制解调处理器以及基带处理器等实现。
天线1和天线2用于发射和接收电磁波信号。手机100中的每个天线可用于覆盖单个或多个通信频带。不同的天线还可以复用，以提高天线的利用率。例如：可以将天线1复用为无线局域网的分集天线。在另外一些实施例中，天线可以和调谐开关结合使用。
移动通信模块151可以提供应用在手机100上的包括2G/3G/4G/5G等无线通信的解决方案。移动通信模块151可以包括至少一个滤波器，开关，功率放大器，低噪声放大器(low noise amplifier，LNA)等。移动通信模块151可以由天线1接收电磁波，并对接收的电磁波进行滤波，放大等处理，传送至调制解调处理器进行解调。移动通信模块150还可以对经调制解调处理器调制后的信号放大，经天线1转为电磁波辐射出去。在一些实施例中，移动通信模块151的至少部分功能模块可以被设置于处理器110中。在一些实施例中，移动通信模块151的至少部分功能模块可以与处理器110的至少部分模块被设置在同一个器件中。
调制解调处理器可以包括调制器和解调器。其中，调制器用于将待发送的低频基带信号调制成中高频信号。解调器用于将接收的电磁波信号解调为低频基带信号。随后解调器将解调得到的低频基带信号传送至基带处理器处理。低频基带信号经基带处理器处理后，被传递给应用处理器。应用处理器通过音频设备(不限于扬声器170A，受话器170B等)输出声音信号，或通过显示屏194显示图像或视频。在一些实施例中，调制解调处理器可以是独立的器件。在另一些实施例中，调制解调处理器可以独立于处理器110，与移动通信模块150或其他功能模块设置在同一个器件中。
无线通信模块152可以提供应用在手机100上的包括无线局域网(wireless local area networks，WLAN)(如无线保真(wireless fidelity，Wi-Fi)网络)，蓝牙(bluetooth，BT)，全球导航卫星系统(global navigation satellite system，GNSS)，调频(frequency modulation，FM)，近距 离无线通信技术(near field communication，NFC)，红外技术(infrared，IR)等无线通信的解决方案。无线通信模块152可以是集成至少一个通信处理模块的一个或多个器件。无线通信模块152经由天线2接收电磁波，将电磁波信号调频以及滤波处理，将处理后的信号发送到处理器110。无线通信模块152还可以从处理器110接收待发送的信号，对其进行调频，放大，经天线2转为电磁波辐射出去。
另外，手机100可以通过音频模块170，扬声器170A，受话器170B，麦克风170C，耳机接口170D，以及应用处理器等实现音频功能。例如音乐播放，录音等。手机100可以接收按键190输入，产生与手机100的用户设置以及功能控制有关的键信号输入。手机100可以利用马达191产生振动提示(比如来电振动提示)。手机100中的指示器192可以是指示灯，可以用于指示充电状态，电量变化，也可以用于指示消息，未接来电，通知等。手机100中的SIM卡接口195用于连接SIM卡。SIM卡可以通过插入SIM卡接口195，或从SIM卡接口195拔出，实现和手机100的接触和分离。
应理解，在实际应用中，手机100可以包括比图1所示的更多或更少的部件，本申请实施例不作限定。
本申请实施例所适用的电子设备的软件系统可以采用分层架构，事件驱动架构，微核架构，微服务架构，或云架构。本申请实施例以分层架构的Android(安卓)系统为例，示例性说明电子设备的软件结构。
图3是本申请实施例的手机100的软件结构框图。
分层架构将软件分成若干个层，每一层都有清晰的角色和分工。层与层之间通过软件接口通信。在一些实施例中，将Android系统分为四层，从上至下分别为应用程序层，应用程序框架层，安卓运行时(Android runtime)和系统库，以及内核层。
应用程序层可以包括一系列应用程序包。如图3所示，应用程序包可以包括通信录，相机，图库，日历，通话，地图，导航，蓝牙，音乐，视频，短信息等应用程序。
应用程序框架层为应用程序层的应用程序提供应用编程接口(application programming interface，API)和编程框架。应用程序框架层包括一些预先定义的函数。
如图3所示，应用程序框架层可以包括窗口管理器，内容提供器，视图系统，电话管理器，资源管理器，通知管理器、包管理服务模块等。
窗口管理器用于管理窗口程序。窗口管理器可以获取显示屏大小，判断是否有状态栏，锁定屏幕，截取屏幕等。
内容提供器用来存放和获取数据，并使这些数据可以被应用程序访问。所述数据可以包括视频，图像，音频，拨打和接听的电话，浏览历史和书签，电话簿等。
视图系统包括可视控件，例如显示文字的控件，显示图片的控件等。视图系统可用于构建应用程序。显示界面可以由一个或多个视图组成的。例如，包括短信通知图标的显示界面，可以包括显示文字的视图以及显示图片的视图。
电话管理器用于提供手机100的通信功能。例如通话状态的管理(包括接通，挂断等)。
资源管理器为应用程序提供各种资源，比如本地化字符串，图标，图片，布局文件，视频文件等等。
通知管理器使应用程序可以在状态栏中显示通知信息，可以用于传达告知类型的消息，可以短暂停留后自动消失，无需用户交互。比如通知管理器被用于告知下载完成，消息提醒等。通知管理器还可以是以图表或者滚动条文本形式出现在系统顶部状态栏的通知，例如后台运行的应用程序的通知，还可以是以对话窗口形式出现在屏幕上的通知。例如在状态栏提 示文本信息，发出提示音，电子设备振动，指示灯闪烁等。
包管理服务模块，用于在应用启动时，获取应用的固定身份信息，例如应用的包名和签名等。
Android Runtime包括核心库和虚拟机。Android runtime负责安卓系统的调度和管理。
核心库包含两部分：一部分是java语言需要调用的功能函数，另一部分是安卓的核心库。
应用程序层和应用程序框架层运行在虚拟机中。虚拟机将应用程序层和应用程序框架层的java文件执行为二进制文件。虚拟机用于执行对象生命周期的管理，堆栈管理，线程管理，安全和异常的管理，以及垃圾回收等功能。
系统库可以包括多个功能模块。例如：表面管理器(surface manager)，媒体库(Media Libraries)，三维图形处理库(例如：OpenGL ES)，2D图形引擎(例如：SGL)等。
表面管理器用于对显示子系统进行管理，并且为多个应用程序提供了2D和3D图层的融合。
媒体库支持多种常用的音频，视频格式回放和录制，以及静态图像文件等。媒体库可以支持多种音视频编码格式，例如:MPEG4，H.264，MP3，AAC，AMR，JPG，PNG等。
三维图形处理库用于实现三维图形绘图，图像渲染，合成，和图层处理等。2D图形引擎是2D绘图的绘图引擎。
内核层是硬件和软件之间的层。内核层至少包含显示驱动，摄像头驱动，音频驱动，传感器驱动等，本申请实施例对此不做任何限制。
在本申请实施例中，内核层还包括文件系统(例如F2FS)，其中，文件系统中包括文件加解密模块，该模块用于对文件进行加密和解密。
另外，在本申请实施例中，内核层还包括权限认证模块和身份管理模块。
身份管理模块用于从包管理服务模块获取应用的合法固定身份信息，建立合法固定身份信息与文件标识之间的映射关系，以及该文件所属应用的进程标识和合法固定身份信息之间的对应关系。之所以身份管理模块需要生成上述对应关系，是因为受操作系统的分层结构制约，文件系统处于内核层，无法直接从应用层获取应用的合法固定身份信息，因此需要身份管理模块存储这一对应关系。需要说明的是，合法固定身份信息指的是应用本身的固定身份信息，是从包管理服务模块获取的。本申请实施例中，合法固定身份信息被保存在身份管理模块，有可能会被恶意应用篡改，但文件系统仍会把篡改后的固定身份信息看作合法固定身份信息，用于对访问权限的认证。本申请实施例中的合法固定身份信息可以是由包名、签名和uuid中的全部或者部分拼接组成的，或者对包名、签名和uuid中的全部或者部分进行哈希运算得到的。例如，本申请实施例中微信应用的合法固定身份信息可以是微信应用的包名与签名的拼接，即com.android.weixin184afda9653afe。再比如，微信应用的固定身份信息可以对微信应用的包名与签名进行哈希运算的结果，即HASH(com.android.weixin184afda9653afe)。
权限认证模块用于判断当前访问文件的文件访问请求的进程标识所对应的合法固定身份信息，是否与该文件对应的合法固定身份信息一致，若一致，则认证通过，否则认证不通过。
在本申请实施例中，内核层还可以包括密钥加解密模块，密钥加解密模块用于利用合法固定身份信息将文件密钥加密生成文件密钥密文，该文件密钥密文被存储在文件密文的头部。当权限认证模块认证通过之后，密钥加解密模块利用访问文件的文件访问请求的进程标识所对应的第一固定身份信息解密该文件密钥密文，若无法解密得到文件密钥，则通知权限认证模块认证不通过，否则认证通过，解密得到文件密钥。接着，文件加解密模块利用该文件密钥解密文件密文得到文件明文。
阶段1
示例性地，如图4a和图4b所示，第一应用程序或者第二应用程序在启动时，身份管理模块通过包管理服务模块获取应用的合法固定身份信息，然后建立应用的合法固定身份信息和应用所属的进程标识之间的第一对应关系。另外，当第一应用程序向文件系统发送创建文件指令时，身份管理模块获取被创建的文件的标识，并建立该文件与合法固定身份信息之间的第二对应关系。
需要说明的是，第二对应关系可以以映射表的形式存储在身份管理模块中，也可以直接在所创建的文件的头部添加固定身份信息，以实现二者的对应。
接着，密钥加解密模块从身份管理模块获取合法固定身份信息，然后利用该合法固定身份信息对创建的文件的文件密钥进行加密，得到文件密钥密文。文件系统加解密模块利用文件密钥对创建的文件进行加密，生成文件密文，其中文件密文的头部携带有合法固定身份信息、文件密钥密文。然后文件加解密模块将加密后的文件密文保存在存储介质中。
阶段2
示例性地，如图4c所示，当第二应用程序启动时，身份管理模块从包服务管理模块获取第二应用程序的固定身份信息和获取该应用的进程标识，并建立第二应用程序的固定身份信息和进程标识的对应关系。当第二应用程序向内核层的文件系统发送文件访问请求时，权限认证模块先从身份管理模块中查找确定与该文件访问请求的进程标识对应的固定身份信息，以及从身份管理模块中查找与被访问的文件的标识对应的合法固定身份信息，若两个固定身份信息一致，则认证通过，否则认证不通过。然后将认证结果发送至文件加解密模块，由文件加解密模块确定是否解密文件。一种情况是，认证通过，文件系统加解密模块从存储介质中获取文件密文，并利用文件密钥解密文件密文，得到文件明文。另一种情况是，认证失败，文件系统加解密模块拒绝解密文件。
在一种可能的实施例中，文件加解密模块还可以在加密后的文件密文中携带该文件的合法固定身份信息，当文件系统接收到文件访问请求时，权限认证模块先从身份管理模块中查找第一对应关系确定与该文件访问请求的进程标识对应的第一固定身份信息，然后将该第一固定身份信息与从存储介质中获取的文件密文中的固定身份信息进行匹配，若匹配成功，则认证通过，否则认证不通过。
在一种可能的实施例中，密钥加解密模块可以从身份管理模块查找与被访问文件对应的合法固定身份信息，利用该合法固定身份信息对该文件的文件密钥进行加密，得到文件密钥密文，并将该文件密钥密文存储在文件密文的头部。若权限认证模块认证通过，密钥加解密模块先调用该文件访问请求的进程标识对应的第一固定身份信息解密文件密钥，若无法解密，则通知权限认证模块认证失败，否则解密得到文件密钥，接着，文件加解密模块利用该文件密钥解密文件密文。
需要说明的是，权限认证模块和身份管理模块可以独立于文件系统，也可以与文件加解密模块和密钥加解密模块一起集成在文件系统中。如图4a所示，权限认证模块的功能和身份管理模块的功能分别在不同的模块中实现，不同模块之间的通信属于进程间通信。另外权限认证模块的功能和身份管理模块的功能也可以集成在一个模块中实现，当集成在一个模块中，对固定身份信息的调用则属于进程内通信。
基于图3所示的软件结构，本申请实施例提供一种文件访问权限认证方法，参见图5所示的流程，该方法是由电子设备执行，该方法包括如下步骤。
步骤501，电子设备接收文件访问请求，该文件访问请求用于请求访问电子设备中的第一文件。
结合图4a来说，电子设备的文件系统接收来自应用层中的第二应用程序模块的文件访问请求，该第二应用程序可能是被访问的文件所属的应用程序，也可能是电子设备所连接的其它电子设备中的恶意应用。
步骤502，电子设备获取该文件访问请求的第一进程标识，并确定与第一进程标识对应的第一固定身份信息。
需要说明的是，电子设备的操作系统在接收到文件访问请求时，会自动为该请求分配唯一的第一进程标识。且身份管理模块会从包管理服务模块获取该进程所属应用的第一固定身份信息，并生成该第一进程标识和第一固定身份信息之间的映射关系。因此，内核层中的权限认证模块可以从身份管理模块中查找到与第一进程标识对应的第一固定身份信息。
步骤503，电子设备判断第一固定身份信息与第一文件对应的合法固定身份信息是否一致。
具体地，第一种可能的实现是，文件系统中的权限认证模块先从身份管理模块中获取该第一文件对应的合法固定身份信息，然后二者进行比较。第二种可能的实现是，文件系统从存储介质中获取第一文件的密文，其中第一文件的密文头部中携带有合法固定身份信息，因此权限认证模块先从密文头部获取合法固定身份信息，然后将第一固定身份信息与合法固定身份信息进行比较。
步骤504，当二者不一致时，电子设备则确定该文件访问请求认证不通过。
也就是说，若第一固定身份信息与合法固定身份信息匹配不成功，则说明该文件访问请求可能是来自恶意应用或者非法程序，因此文件系统中的文件加解密模块拒绝解密文件。
步骤505，当二者一致时，电子设备则确定该文件访问请求认证通过。
之后，在一种可能实现中，文件系统的文件加解密模块可以从存储介质中获取第一文件的密文，并利用文件密钥解密该密文，得到第一文件，进而将第一文件反馈至发送文件访问请求的一侧。在第二种可能的实现中，文件系统的文件加解密模块利用文件密钥解密该密文，得到第一文件，进而将第一文件反馈至发送文件访问请求的一侧。
考虑到，恶意应用可能会把文件密文头部的合法固定身份信息篡改为恶意应用自身对应的第一固定身份信息，或者是，恶意应用可能会把身份管理模块中与第一文件对应的合法固定身份信息篡改为恶意应用自身对应的第一固定身份信息，这样就导致上述认证方法失效。因此在另一种可能的实施例中，当二者一致时，电子设备还可以继续执行步骤506至步骤507，也就是执行第二次认证，具体步骤如下。
步骤506，电子设备利用第一固定身份信息解密第一文件的文件密钥密文。
也就是说，密钥加解密模块预先已利用第一文件的合法固定身份信息，以及文件系统主密钥对第一文件密钥进行加密，生成文件密钥密文，其中，第一文件的密文中携带有该文件密钥密文。当第一固定身份信息与合法固定身份信息匹配成功之后，密钥加解密模块继续利用第一固定身份信息和文件系统密钥去解密第一文件的头部的文件密钥密文。
步骤507，电子设备判断解密是否成功，若不成功，则返回执行步骤504，若成功，则执行步骤508。
步骤508，当解密成功，电子设备利用解密得到的文件密钥去解密第一文件的密文，得到第一文件。
如下以手机运行微信运行为例，举例说明上述文件访问权限认证过程。
需要说明的是，在微信应用接收文件访问请求之前，需要先执行如下过程。
微信应用启动时，身份管理模块通过包管理服务模块获取微信应用的合法固定身份信息(假设是com.android.weixin184afda9653afe)，建立微信应用的进程标识和合法固定身份信息之间的第一对应关系。例如表1所示。
表1
进程标识 固定身份信息
1111 com.android.weixin184afda9653afe
另外，一种实施例中，当微信应用创建第一文件时(例如保存图片)，身份管理模块获取文件的标识，并建立第一文件的标识和该文件所属微信应用的合法固定身份信息之间的第二对应关系。例如表2所示。
表2
文件标识 固定身份信息
aaa com.android.weixin184afda9653afe
另一种实施例中，当微信应用创建第一文件时(例如保存图片)，身份管理模块获取文件所属微信应用的合法固定身份信息，然后将该合法固定身份信息插入到第一文件的密文的头部。例如文件结构如表3所示。
表3
文件头 文件体
合法固定身份信息 第一文件的密文内容
另一种实施例中，微信应用创建第一文件时(例如保存图片)，身份管理模块获取文件所属微信应用的合法固定身份信息，然后将该合法固定身份信息插入到第一文件的密文的头部。另外，密钥加解密模块利用文件系统主密钥和固定身份信息加密文件密钥，得到文件密钥密文，并将文件密钥密文保存在文件的密文头部。例如文件结构如表4所示。
表4
Figure PCTCN2020079104-appb-000001
进一步地，微信应用接收文件访问请求之后，可能存在如下几种认证场景。
场景一
文件系统获取文件访问请求的第一进程标识，例如是1111，然后通过身份管理模块查找与之对应的第一固定身份信息是com.android.weixin184afda9653afe，因此将该第一固定身份信息与表2中被访问的第一文件对应的合法固定身份信息比较，因一致，所以认证通过。或者将第一固定身份信息与第一文件的密文的头部中的合法固定身份信息比较，因一致，所以认证通过。
场景二
文件系统获取文件访问请求的第一进程标识，例如是2222，然后通过身份管理模块查找与之对应的第一固定身份信息是空(NULL)，因此将该的第一固定身份信息与表2中被访问的第一文件对应的合法固定身份信息比较，因不一致，所以认证不通过。或者将该第一固定身份信息与第一文件的密文的头部中的合法固定身份信息比较，因不一致，所以认证不通过。
场景三
假设文件访问请求来自恶意应用，该恶意应用将微信的第一文件的密文的头部中的合法固定身份信息直接篡改为恶意应用自身的第一固定身份信息(例如改为空)。这样文件系统获取文件访问请求的第一进程标识，例如是2222，然后通过身份管理模块查找与之对应的第一固定身份信息是空(NULL)，因此将该第一固定身份信息与当前第一文件对应的合法固定身份信息比较，发现二者一致。进一步地文件加解密模块利用第一固定身份信息对第一文件的密文的头部中的文件密钥密文进行解密，发现解密失败，因此通知权限认证模块认证失败，拒绝对第一文件的密文进行解密。或者，文件加解密模块在解密文件密钥密文时监测所使用的固定身份信息与第一固定身份信息是否一致，若不同，则通知权限认证模块认证失败，拒绝对第一文件的密文进行解密。
可见，通过上述方法，文件系统可以对文件访问请求进行权限认证，当文件访问请求是来自文件所属应用时，才能给完成与文件对应的合法固定身份信息的匹配，即使恶意应用将文件的合法固定身份信息进行了篡改，也会在文件密钥密文解密这一过程被监测出合法固定身份信息被篡改，导致认证失败。该方法可以有效地完善当前的文件系统访问机制，再结合沙箱机制有效地保护隐私安全。且这一文件访问权限认证过程并不需要用户参与，对用户是不可见的，所以既提高了系统安全，也有效地简化用户操作，提高了用户体验。
本申请实施例提供另一种文件访问权限认证方法，参见图6所示的流程，该方法是由电子设备执行，该方法包括如下步骤。
步骤601，电子设备接收文件访问请求，该文件访问请求用于请求访问电子设备中的第一文件。
结合图4a来说，电子设备的文件系统接收来自应用层中的第二应用程序模块的文件访问请求，该第二应用程序可能是被访问的文件所属的应用程序，也可能是电子设备所连接的其它电子设备中的恶意应用。
步骤602，电子设备获取该文件访问请求的第一进程标识，并确定与第一进程标识对应的第一固定身份信息。
需要说明的是，电子设备的操作系统在接收到文件访问请求时，会自动为该请求分配唯一的第一进程标识。且身份管理模块会从包管理服务模块获取该进程所属应用的第一固定身份信息，并生成该第一进程标识和第一固定身份信息之间的映射关系。因此，内核层中的权限认证模块可以从身份管理模块中查找到与第一进程标识对应的第一固定身份信息。
步骤603，电子设备利用第一固定身份信息解密文件密钥密文。
其中，电子设备预先会利用文件密钥加密第一文件，且利用第一文件对应的合法固定身份信息和系统主密钥加密文件密钥，生成文件密钥密文，并将文件密钥密文和合法固定身份信息保存在第一文件的密文的头部。
具体地，文件系统中的密钥加解密模块利用第一固定身份信息解密第一文件的密文中文件密钥密文，若第一固定身份信息与第一文件对应的固定身份信息一致，则按照预设的解密算法可以解密成功，否则解密失败。
步骤604，电子设备判断解密是否成功，若不成功，则执行步骤605，否则执行步骤606。
即文件系统中的密钥加解密模块判断利用第一固定身份信息和其它密钥参数(例如文件系统主密钥和随机参数)解密文件密钥密文是否成功。
步骤605，若解密不成功，则确定该文件访问请求认证不通过。
也就是说，解密不成功说明第一固定身份信息与第一文件的合法固定身份信息不一致，则说明该文件访问请求可能是来自恶意应用或者非法程序，因此文件系统中的文件加解密模 块拒绝解密文件。
步骤606，若解密成功，则确定该文件访问请求认证通过。
也就是说，解密成功说明第一固定身份信息与第一文件的合法固定身份信息一致，则说明该文件访问请求可能是来第一文件所属应用。之后，文件系统的文件加解密模块利用文件密钥解密该密文，得到第一文件，进而将第一文件反馈至发送文件访问请求的一侧。
如下仍以手机运行微信为例，举例说明上述文件访问权限认证过程。
需要说明的是，在微信应用接收文件访问请求之前，需要先执行如下过程。
微信应用启动时，身份管理模块通过包管理服务模块获取微信应用的合法固定身份信息(假设是com.android.weixin184afda9653afe)，建立微信应用的进程标识和合法固定身份信息之间的第一对应关系。例如表1所示。
另外，当微信应用创建第一文件时(例如保存图片)时，密钥加解密模块从身份管理模块获取文件所属微信应用的合法固定身份信息和文件系统主密钥，利用文件系统主密钥和固定身份信息对第一文件的文件密钥进行加密，得到文件密钥密文。然后文件加解密模块利用文件密钥对第一文件进行加密，并将文件密钥密文和合法固定身份信息保存在第一文件的密文的头部。
进一步地，微信应用接收文件访问请求之后，可能存在如下几种认证场景。
场景一
文件系统获取文件访问请求的第一进程标识，例如是1111，然后通过身份管理模块查找与之对应的合法固定身份信息是com.android.weixin184afda9653afe，因此将利用该合法固定身份信息以及其它密钥参数(例如文件系统主密钥、随机参数)，按照预设的密钥解密算法对第一文件的密文的头部的文件密钥密文进行解密，并且解密成功，密钥加解密模块通知权限认证模块认证通过。
场景二
文件系统获取文件访问请求的第一进程标识，例如是2222，然后通过身份管理模块查找与之对应的第一固定身份信息是com.android.hook184afda9653afe(NULL)，因此将利用该第一固定身份信息以及其它密钥参数(例如文件系统主密钥、随机参数)，按照预设的密钥解密算法对第一文件的密文的头部的文件密钥密文进行解密，因第一固定身份信息与表1中加密文件密钥的固定身份信息不同，所以解密失败，密钥加解密模块通知权限认证模块认证不通过。
可见，通过上述方法，文件系统可以对文件访问请求进行权限认证，当文件访问请求的进程标识所对应的第一固定身份信息无法完成文件密钥密文的解密时，将导致认证失败。该方法可以完善当前的文件系统访问机制，再结合沙箱机制可以有效地保护文件安全。且这一文件访问权限认证过程并不需要用户参与，对用户是不可见的，所以既提高了系统安全，也有效地简化用户操作，提高了用户体验。
本申请实施例中，一方面，密钥加解密模块可以采用密钥参数和预设的密钥加密算法，对文件密钥进行加密，得到文件密钥密文。例如，文件密钥密文＝ENC-AEAD(文件系统主密钥，文件密钥，应用固定身份信息)。其中ENC-AEAD为认证加密类方法的统称，包括不限于，AES-GCM，AES-CCM，AES加密与HMAC认证的组合应用。
以AES-GCM算法为例，算法原型参数为：密文＝AES-GCM-ENC(密钥，明文，AAD，IV)。在本申请实施例中，该算法中的密钥可以指的是文件系统主密钥；明文指的是文件密钥；AAD指的是固定身份信息；IV指的是指定的随机数(例如16byte长的随机数)。而密文即文 件密钥密文。当然，本申请实施例也可以使用其他认证加密算法，如AES-CCM，AES-CBC+HMAC，原理类似，此处不再一一列举。
可见，按照上述方法所生成的文件密钥密文是固定身份信息绑定的，如果在解密时使用的固定身份信息并非加密时所使用的固定身份信息，将无法解密该文件密钥密文。
另外，本申请实施例中，文件系统可以将文件密钥密文和密钥参数(随机数参数、固定身份信息)写入文件的头部(metadata)，Metadata与文件密钥加密所生成的文件密文内容组成文件密文。如图7所示。
另一方面，密钥加解密模块可以采用密钥参数和预设的密钥解密算法，对文件密钥密文进行解密，得到文件密钥(明文)。即密钥加解密模块先从可信执行环境中获取文件系统主密钥，然后结合利用文件头部的密钥参数对文件密钥密文进行解密。例如，文件密钥＝DEC-AEAD(文件系统主密钥，文件密钥密文，固定身份信息)。其中ENC-AEAD为认证加密类方法的统称，包括不限于，AES-GCM，AES-CCM，AES-HMAC。
以AES-GCM算法为例，算法原型参数为：明文＝AES-GCM-DEC(密钥，密文，AAD，IV)。其中，在本申请实施例中，该算法中的密钥可以指的是文件系统主密钥；密文指的是从文件头部获取的文件密钥密文；AAD为固定身份信息(可以是从文件头部获取的，也可以文件访问请求的进程标识所对应的固定身份信息)；IV指的是从文件头部获取的随机数。
基于上述方法，因文件密钥的加解密过程与固定身份信息绑定，所以即使文件头部的固定身份信息被篡改，也会因无法解密文件密钥密文，导致该文件访问请求认证失败。
需要说明的是，用于加密文件的文件密钥可能是一个，也可能是多个，本申请实施例可以对用于加密该文件中的任意一个或者多个文件密钥进行加密。具体来说，常用的密钥层级可能有如下几种，示例如下。
如图8a所示，文件系统主密钥即作为文件密钥，文件系统主密钥被用来加密文件系统中的各个文件。针对这一示例，密钥加解密模块可以采用固定参数信息和预设的密钥加密算法，对文件系统主密钥进行加密，得到文件密钥密文。
如图8b所示，有一个文件系统主密钥，每个文件均有一个对应的文件密钥，文件密钥用来加密对应的文件，文件系统主密钥用来加密文件密钥。也就是说，文件密钥1用来加密文件1，文件密钥2用来加密文件2，文件密钥n用来加密文件n，文件系统主密钥则用来加密文件密钥1、文件密钥2等等。针对这一示例，密钥加解密模块可以采用固定参数信息、文件系统主密钥和预设的密钥加密算法，对文件密钥进行加密，得到文件密钥密文。
如图8c所示，有一个文件系统主密钥，每个文件均有两个对应的文件密钥，文件密钥用来加密对应的文件，中间密钥用来加密文件密钥，文件系统主密钥用来加密中间密钥。也就是说，文件密钥1用来加密文件1，文件密钥2用来加密文件2，文件密钥n用来加密文件n，中间密钥1用来加密文件密钥1，中间密钥2用来加密文件密钥2，中间密钥n用来加密文件密钥n，文件系统主密钥则用来加密中间密钥1、中间密钥2等等。针对这一示例，密钥加解密模块可以采用固定参数信息、文件系统主密钥和预设的密钥加密算法，对中间密钥或者文件密钥进行加密，得到文件密钥密文。需要说明是，中间密钥还可以有多个层级，利用中间密钥1的下一级别是中间密钥11，中间密钥11再对文件密钥1进行加密，另外，中间密钥和下一层级密钥也可以不限定为1对1的关系，例如可以有n个中间密钥，m个下一级中间密钥(或m个文件密钥)，其中n可以小于m，n中的一个密钥可以加密m中的多个密钥，此处不再一一列举。
本申请实施例中还提供一种生成文件密钥的方法，在该方法中，文件系统利用固定身份 信息、文件系统主密钥和预设的派生算法，生成文件密钥。例如，KDF(文件系统主密钥，应用固定身份)＝文件密钥，其中KDF为派生算法的统称，例如HKDF,NIST800-108HMACKDF，此处不做限制。该生成文件密钥的方法也可以用于生成上述示例的密钥层级的任意一层的中间密钥。该方法中用来生成文件密钥的固定身份信息、文件系统主密钥不易被获取，可提高生成的文件密钥的安全性。
如图9所示，本申请实施例公开了一种电子设备，包括：触摸屏901，所述触摸屏901包括触敏表面906和显示屏907；一个或多个处理器902；存储器903；通信模块908；一个或多个应用程序(未示出)；以及一个或多个计算机程序904，上述各器件可以通过一个或多个通信总线905连接。其中该一个或多个计算机程序904被存储在上述存储器903中并被配置为被该一个或多个处理器902执行，该一个或多个计算机程序904包括指令，该指令可以用于执行上述实施例中的各个步骤，例如，该指令可以用于执行图5和图6中所示的各个步骤。
通过以上的实施方式的描述，所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将装置的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。上述描述的系统，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请实施例各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请实施例的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)或处理器执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：快闪存储器、移动硬盘、只读存储器、随机存取存储器、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请实施例的具体实施方式，但本申请实施例的保护范围并不局限于此，任何在本申请实施例揭露的技术范围内的变化或替换，都应涵盖在本申请实施例的保护范围之内。因此，本申请实施例的保护范围应以所述权利要求的保护范围为准。

Claims (9)

  1. 一种文件访问权限认证方法，应用于电子设备，其特征在于，所述方法包括：
    接收文件访问请求，所述文件访问请求用于请求访问电子设备中的第一文件；
    获取所述文件访问请求的第一进程标识和确定与所述第一进程标识对应的第一固定身份信息；
    将所述第一固定身份信息与所述第一文件对应的合法固定身份信息进行匹配，当匹配成功时，则确定所述文件访问请求认证通过。
  2. 根据权利要求1所述的方法，其特征在于，所述当匹配成功时，则确定所述文件访问请求认证通过，包括：
    当匹配成功时，利用所述第一固定身份信息解密文件密钥密文，当解密成功时，则确定所述文件访问请求认证通过，其中，所述文件密钥密文是用于加密所述第一文件的文件密钥的密文。
  3. 根据权利要求2所述的方法，其特征在于，还包括：
    当解密失败时，确定所述文件访问请求认证失败。
  4. 根据权利要求1或2所述的方法，其特征在于，在电子设备接收文件访问请求之前，还包括：
    获取运行的应用程序的进程标识和固定身份信息，并建立所述进程标识和固定身份信息之间的对应关系，以及建立新创建的文件和固定身份信息之间的对应关系。
  5. 根据权利要求2所述的方法，其特征在于，在电子设备接收文件访问请求之前，还包括：
    根据第一文件的固定身份信息、文件系统主密钥和预设的密钥加密算法，对所述第一文件的文件密钥进行加密，生成文件密钥密文；
    并利用第一文件的文件密钥对所述第一文件进行加密，生成第一文件的密文，其中，所述第一文件的密文的头部包括合法固定身份信息和文件密钥密文；
    所述电子设备将所述第一固定身份信息与所述第一文件对应的合法固定身份信息进行匹配，包括：
    将所述第一固定身份信息与所述第一文件的密文头部的合法固定身份信息进行匹配。
  6. 一种文件访问权限认证方法，应用于电子设备，其特征在于，所述方法包括：
    接收文件访问请求，所述文件访问请求用于请求访问电子设备中的第一文件；
    获取所述文件访问请求的第一进程标识和确定与所述第一进程标识对应的第一固定身份信息；
    利用所述第一固定身份信息解密文件密钥密文，当解密成功时，则确定所述文件访问请求认证通过，其中，所述文件密钥密文是用于加密所述第一文件的文件密钥的密文。
  7. 根据权利要求6所述的方法，其特征在于，还包括：
    当解密失败时，确定所述文件访问请求认证失败。
  8. 一种电子设备，包括存储器，处理器以及存储在所述存储器上并可在所述处理器上运行的计算机程序，其特征在于，所述处理器执行所述计算机程序时使得所述计算机设备实现如权利要求1至7任一项所述的方法。
  9. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质包括计算机程序，当计算机程序在电子设备上运行时，使得所述电子设备执行如权利要求1至7任一项所述的方法。
PCT/CN2020/079104 2019-03-22 2020-03-13 一种文件访问权限认证方法及电子设备 WO2020192447A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP20778010.7A EP3913516B1 (en) 2019-03-22 2020-03-13 File access authority authentication method and electronic device
US17/439,467 US20220156391A1 (en) 2019-03-22 2020-03-13 File access right authentication method and electronic device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910220920.7A CN110059499A (zh) 2019-03-22 2019-03-22 一种文件访问权限认证方法及电子设备
CN201910220920.7 2019-03-22

Publications (1)

Publication Number Publication Date
WO2020192447A1 true WO2020192447A1 (zh) 2020-10-01

Family

ID=67315897

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/079104 WO2020192447A1 (zh) 2019-03-22 2020-03-13 一种文件访问权限认证方法及电子设备

Country Status (4)

Country Link
US (1) US20220156391A1 (zh)
EP (1) EP3913516B1 (zh)
CN (1) CN110059499A (zh)
WO (1) WO2020192447A1 (zh)

Families Citing this family (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110059499A (zh) * 2019-03-22 2019-07-26 华为技术有限公司 一种文件访问权限认证方法及电子设备
CN110519380B (zh) * 2019-08-29 2022-06-21 北京旷视科技有限公司 一种数据访问方法、装置、存储介质及电子设备
CN110602121B (zh) * 2019-09-20 2021-06-08 腾讯科技（深圳）有限公司 一种网络密钥获取方法、装置和计算机可读存储介质
TWI783189B (zh) * 2019-11-08 2022-11-11 精品科技股份有限公司 位元鎖磁碟管理系統
CN110889125B (zh) * 2019-11-15 2024-01-23 珠海豹趣科技有限公司 一种文件保护方法、装置及电子设备
CN113094718A (zh) * 2019-12-23 2021-07-09 华为数字技术（苏州）有限公司 一种文件加密方法及相关装置
CN113343253B (zh) * 2021-05-28 2024-04-16 湖南哥禄安科技有限公司 一种基于加密和认证机制的文件管理系统
CN115426122A (zh) * 2021-05-31 2022-12-02 华为技术有限公司 基于权限适配的访问控制方法、相关装置及系统
CN114595455A (zh) * 2022-03-17 2022-06-07 西安电子科技大学 基于区块链的微服务间访问控制策略自动生成方法和系统
CN114626079A (zh) * 2022-03-22 2022-06-14 深圳壹账通智能科技有限公司 基于用户权限的文件查看方法、装置、设备及存储介质
CN115150142A (zh) * 2022-06-24 2022-10-04 深圳市北科瑞声科技股份有限公司 一种数据访问处理方法、系统、设备及存储介质
CN115019348A (zh) * 2022-06-27 2022-09-06 北京睿家科技有限公司 一种生物特征识别处理方法、装置、系统、设备及介质
CN115174109B (zh) * 2022-06-30 2024-07-30 中国联合网络通信集团有限公司 企业员工身份认证方法、装置、设备及存储介质
CN115758420B (zh) * 2022-11-29 2023-06-09 北京天融信网络安全技术有限公司 文件访问控制方法、装置、设备及介质
CN116738485B (zh) * 2023-06-21 2023-12-05 江苏克胜集团股份有限公司 一种基于数字化信息传输的安全管理系统
CN117371032B (zh) * 2023-10-10 2024-03-08 吉林大学 一种高效的文件访问安全方法、系统、设备及介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130062401A1 (en) * 2011-09-09 2013-03-14 Microsoft Corporation Pervasive Package Identifiers
CN104281814A (zh) * 2013-07-03 2015-01-14 钟丹东 文件防泄密系统及其工作方法
CN104869569A (zh) * 2015-03-31 2015-08-26 小米科技有限责任公司 应用程序的网络权限控制方法及装置
CN108985095A (zh) * 2018-07-05 2018-12-11 深圳市网心科技有限公司 一种非公开文件访问方法、系统及电子设备和存储介质
CN110059499A (zh) * 2019-03-22 2019-07-26 华为技术有限公司 一种文件访问权限认证方法及电子设备

Family Cites Families (23)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5870477A (en) * 1993-09-29 1999-02-09 Pumpkin House Incorporated Enciphering/deciphering device and method, and encryption/decryption communication system
ES2184066T3 (es) * 1996-10-25 2003-04-01 Schlumberger Systems & Service Uso de un lenguaje de programacion de alto nivel con microcontrolador.
EP1154348B9 (en) * 2000-05-11 2007-06-13 Matsushita Electric Industrial Co., Ltd. File management apparatus
US7340603B2 (en) * 2002-01-30 2008-03-04 Sony Corporation Efficient revocation of receivers
JP4007873B2 (ja) * 2002-07-09 2007-11-14 富士通株式会社 データ保護プログラムおよびデータ保護方法
JP2005182470A (ja) * 2003-12-19 2005-07-07 Matsushita Electric Ind Co Ltd メモリ割り当て装置
CN1938983A (zh) * 2004-03-30 2007-03-28 松下电器产业株式会社 用于密码系统的更新系统
US8150816B2 (en) * 2005-12-29 2012-04-03 Nextlabs, Inc. Techniques of optimizing policies in an information management system
US8127316B1 (en) * 2006-11-30 2012-02-28 Quest Software, Inc. System and method for intercepting process creation events
US8589541B2 (en) * 2009-01-28 2013-11-19 Headwater Partners I Llc Device-assisted services for protecting network capacity
CN101719210B (zh) * 2009-12-25 2012-02-15 武汉大学 基于linux平台数字版权管理的文件使用控制方法
JP5867190B2 (ja) * 2012-03-13 2016-02-24 日本電気株式会社 情報処理装置、ファイル暗号化判定方法、権限決定方法およびプログラム
RU2601834C2 (ru) * 2012-11-22 2016-11-10 Хуавей Текнолоджиз Ко., Лтд. Способ распределения приложения, терминал и сервер
CN104123506B (zh) * 2013-04-28 2018-03-09 北京壹人壹本信息科技有限公司 数据访问方法、装置、数据加密、存储及访问方法、装置
JP6292045B2 (ja) * 2014-06-16 2018-03-14 富士通株式会社 ソフトウェア情報管理プログラム、ソフトウェア情報管理装置およびソフトウェア情報管理方法
EP3198786B1 (en) * 2014-09-26 2019-03-06 British Telecommunications public limited company Secure object access
US9659170B2 (en) * 2015-01-02 2017-05-23 Senteon LLC Securing data on untrusted devices
US9998434B2 (en) * 2015-01-26 2018-06-12 Listat Ltd. Secure dynamic communication network and protocol
US10158623B2 (en) * 2015-09-30 2018-12-18 International Business Machines Corporation Data theft deterrence
CN109923548B (zh) * 2016-10-11 2022-06-10 佰倬信息科技有限责任公司 通过监管进程访问加密数据实现数据保护的方法、系统及计算机程序产品
EP3619636B1 (en) * 2017-05-03 2022-06-29 Visa International Service Association System and method for software module binding
US10778651B2 (en) * 2017-11-15 2020-09-15 Nicira, Inc. Performing context-rich attribute-based encryption on a host
CN108228770A (zh) * 2017-12-27 2018-06-29 青岛海信移动通信技术股份有限公司 一种应用文件来源查询的方法及装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130062401A1 (en) * 2011-09-09 2013-03-14 Microsoft Corporation Pervasive Package Identifiers
CN104281814A (zh) * 2013-07-03 2015-01-14 钟丹东 文件防泄密系统及其工作方法
CN104869569A (zh) * 2015-03-31 2015-08-26 小米科技有限责任公司 应用程序的网络权限控制方法及装置
CN108985095A (zh) * 2018-07-05 2018-12-11 深圳市网心科技有限公司 一种非公开文件访问方法、系统及电子设备和存储介质
CN110059499A (zh) * 2019-03-22 2019-07-26 华为技术有限公司 一种文件访问权限认证方法及电子设备

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3913516A4

Also Published As

Publication number Publication date
EP3913516B1 (en) 2024-02-14
EP3913516A4 (en) 2022-04-13
EP3913516A1 (en) 2021-11-24
US20220156391A1 (en) 2022-05-19
CN110059499A (zh) 2019-07-26

Similar Documents

Publication Publication Date Title
WO2020192447A1 (zh) 一种文件访问权限认证方法及电子设备
WO2021159765A1 (zh) 一种账号数据共享方法及电子设备
US20140258734A1 (en) Data security method and electronic device implementing the same
CN112262548B (zh) 一种文件处理方法及终端设备
US20220335107A1 (en) Method for Processing Application Program and Related Product
WO2022156443A1 (zh) 车机连接方法及装置
EP3921749A1 (en) Device and method for authenticating application in execution environment in trust zone
CN114661501A (zh) 一种开机异常的修复方法及装置
KR20140112399A (ko) 어플리케이션 접근 제어 방법 및 이를 구현하는 전자 장치
CN113468606A (zh) 一种应用程序的访问方法及电子设备
CN110602689B (zh) 一种设备安全操作的方法和装置
CN115544586B (zh) 用户数据的安全存储方法、电子设备及存储介质
CN117492636A (zh) 数据存储方法和电子设备
CN117668933A (zh) 数据存储方法和电子设备
CN113850633B (zh) 信息推送方法和装置
CN117707753B (zh) 资源更新控制方法、电子设备及芯片系统
CN116049812B (zh) 访问硬件资源的方法和电子设备
WO2022143136A1 (zh) 一种密码重置的方法、装置和电子设备
WO2024141008A1 (zh) 验证方法、相关装置及通信系统
CN117131481B (zh) 用户登录方法和电子设备
CN117278323B (zh) 第三方信息的获取方法、电子设备及可读存储介质
CN117131533A (zh) 打开文件的方法和电子设备
WO2023169545A1 (zh) 离线设备控制方法及相关装置
CN117492634A (zh) 数据存储方法和电子设备
CN117492635A (zh) 数据存储方法和电子设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20778010

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2020778010

Country of ref document: EP

Effective date: 20210818

NENP Non-entry into the national phase

Ref country code: DE