WO2024032770A1 - 数据删除方法和电子设备 - Google Patents

数据删除方法和电子设备 Download PDF

Info

Publication number
WO2024032770A1
WO2024032770A1 PCT/CN2023/112560 CN2023112560W WO2024032770A1 WO 2024032770 A1 WO2024032770 A1 WO 2024032770A1 CN 2023112560 W CN2023112560 W CN 2023112560W WO 2024032770 A1 WO2024032770 A1 WO 2024032770A1
Authority
WO
WIPO (PCT)
Prior art keywords
rpmb
target data
data
target
information
Prior art date
Application number
PCT/CN2023/112560
Other languages
English (en)
French (fr)
Inventor
胡志远
贺程
唐欢
刘如一
苏涛
周文涛
Original Assignee
维沃移动通信有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 维沃移动通信有限公司 filed Critical 维沃移动通信有限公司
Publication of WO2024032770A1 publication Critical patent/WO2024032770A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6245—Protecting personal data, e.g. for financial or medical purposes
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
    • G06F3/0601—Interfaces specially adapted for storage systems
    • G06F3/0628—Interfaces specially adapted for storage systems making use of a particular technique
    • G06F3/0646—Horizontal data movement in storage systems, i.e. moving data in between storage devices or systems
    • G06F3/0652—Erasing, e.g. deleting, data cleaning, moving of data to a wastebasket
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
    • G06F3/0601—Interfaces specially adapted for storage systems
    • G06F3/0668—Interfaces specially adapted for storage systems adopting a particular infrastructure
    • G06F3/0671—In-line storage system
    • G06F3/0673—Single storage device
    • G06F3/0679—Non-volatile semiconductor memory device, e.g. flash memory, one time programmable memory [OTP]

Definitions

  • This application belongs to the field of communications, and specifically relates to a kind of data deletion and electronic equipment.
  • the electronic device can be restored to factory settings.
  • the electronic device because the electronic device takes a long time to restore the factory settings and can only be performed while charging, it is not suitable for the application scenario of the mobile phone being lost. In this way, the electronic device processes private data. less efficient and less flexible.
  • the purpose of the embodiments of this application is to provide a data deletion method that can improve the efficiency and flexibility of electronic devices in processing private data.
  • embodiments of the present application provide a data deletion method, which method includes: receiving a first instruction, the first instruction being used to instruct an electronic device to delete target data; the first instruction includes tag information of the target data; responding to The first instruction is to delete the target data from the target storage area according to the tag information in the first instruction; wherein the target storage area includes: replay protection memory block RPMB, or user data partition UDA and replay protection memory block RPMB.
  • embodiments of the present application provide a data deletion device, which includes: a receiving module and a deleting module; a receiving module configured to receive a first instruction, and the first instruction is used to instruct an electronic device to delete target data;
  • the instruction includes tag information of the target data.
  • a deletion module configured to respond to the first instruction received by the receiving module and delete the target data from the target storage area according to the mark information in the first instruction; wherein the target storage area includes: replay protection memory block RPMB, or user Data partition UDA and replay protected memory block RPMB.
  • inventions of the present application provide an electronic device.
  • the electronic device includes a processor and a memory.
  • the memory stores programs or instructions that can be run on the processor.
  • the programs or instructions are processed by the processor.
  • the processor is executed, the steps of the method described in the first aspect are implemented.
  • embodiments of the present application provide a readable storage medium.
  • Programs or instructions are stored on the readable storage medium.
  • the steps of the method described in the first aspect are implemented. .
  • inventions of the present application provide a chip.
  • the chip includes a processor and a communication interface.
  • the communication interface is coupled to the processor.
  • the processor is used to run programs or instructions to implement the first aspect. the method described.
  • embodiments of the present application provide a computer program product, the program product is stored in a storage medium, and the program product is executed by at least one processor to implement the method as described in the first aspect.
  • the electronic device may receive a first instruction, and the first instruction is used to instruct the electronic device to delete the target data; the first instruction includes tag information of the target data; in response to the first instruction, according to the first instruction, Mark information and delete target data from the target storage area; where the target storage area includes: replay preservation protected memory block RPMB, or, user data partition UDA and replay protected memory block RPMB. Because the electronic device can receive the first instruction for instructing the electronic device to delete the target data, and delete the target data from the RPMB or delete the target data from the UDA and the RPMB according to the tag information of the target data included in the first instruction. Therefore, even when the user's electronic device is lost, the private data of the electronic device can be quickly and remotely deleted. This improves the efficiency of the electronic device in processing private data and improves the flexibility of the electronic device in processing private data. .
  • Figure 1 is a storage system architecture diagram of an electronic device provided by an embodiment of the present application.
  • Figure 2 is a flow chart of a data deletion method provided by an embodiment of the present application.
  • Figure 3 is one of the system architecture diagrams of a data storage method provided by an embodiment of the present application.
  • Figure 4 is the second system architecture diagram of a data storage method provided by an embodiment of the present application.
  • Figure 5 is one of the system architecture diagrams of a data deletion method provided by an embodiment of the present application.
  • Figure 6 is the second system architecture diagram of a data deletion method provided by an embodiment of the present application.
  • Figure 7 is a schematic structural diagram of a data deletion device provided by an embodiment of the present application.
  • Figure 8 is one of the schematic diagrams of the hardware structure of an electronic device provided by an embodiment of the present application.
  • FIG. 9 is a second schematic diagram of the hardware structure of an electronic device provided by an embodiment of the present application.
  • first, second, etc. in the description and claims of this application are used to distinguish similar objects and are not used to describe a specific order or sequence. It is to be understood that the figures so used are interchangeable under appropriate circumstances so that the embodiments of the present application can be practiced in orders other than those illustrated or described herein, and that "first,” “second,” etc. are distinguished Objects are usually of one type, and the number of objects is not limited. For example, the first object can be one or multiple.
  • “and/or” in the description and claims indicates at least one of the connected objects, and the character “/" generally indicates that the related objects are in an "or” relationship.
  • a NAND flash memory is generally composed of one or more flash memory chips; a flash memory chip is composed of one or more cores (die) or logical unit number (Logical Unit Number, LUN); a die or LUN is composed of multiple planes (plane) ;A plane is composed of multiple blocks; a block is composed of multiple pages; and a page is composed of multiple cells.
  • cell is the smallest working unit of flash memory that performs data storage tasks.
  • Flash memory is divided into single-level cells (Single Level Cell, SLC) (1bit/cell), multi-level cells (Multi Level Cell, MLC) (2bit/Cell), and triple-level cells (Triple) based on the amount of data that can be stored in each cell.
  • SLC Single Level Cell
  • MLC Multi Level Cell
  • Triple triple-level cells
  • TLC Level Cell
  • QLC Quad-level cells
  • Data in flash memory has three basic operations: read, write and erase. Reading and writing are the smallest operating units of page. Erase is the smallest operation unit of block. A flash memory has a limit on the number of times it can be erased. Theoretically, the number of times a flash memory can be erased is 1,000,000.
  • NAND flash memory usually uses an "off-site update” method to write the updated data to the free storage page instead of the storage page where the original data is located. It just marks the storage page where the original data is located as invalid for subsequent updates. Physical deletion is done only during Garbage Collection (GC). Therefore, before the NAND flash memory is garbage collected, the original old data is still stored in the flash memory, and the attacker can obtain user data through disk reading tools.
  • the "in-place update” operation used by traditional mechanical hard disks (Hard Disk Drive, HDD) that is, the updated data directly overwrites/replaces the original data) is not suitable for NAND flash memory.
  • flash memory can include 4 partitions: BOOT (boot partition), general partition (General Purpose Partition, GPP), replay protected memory block (Replay Protected Memory Block, RPMB) and user partition (User Data Area, UDA).
  • BOOT boot partition
  • general partition General Purpose Partition
  • RPMB replay protected memory block
  • UDA User Data Area
  • GPP is mainly used to store system or user data.
  • GPP usually does not exist when the chip leaves the factory. It needs to be actively configured before it exists. Normally, it is not configured for electronic equipment.
  • GPP and RPMB are mainly used to store security-related data, such as keys, fingerprints, secure payment-related data, etc.;
  • UDA is mainly used to store system and user data.
  • the data deletion method provided by the embodiment of this application is mainly to enable the data in the electronic device to be safely deleted.
  • Data safe deletion means that after the data is deleted, the attacker can neither restore the deleted data nor obtain information about these data. any information.
  • achieving this secure deletion of data is a challenging task due to the complexity of storage systems.
  • Modern storage systems often consist of multiple layers (e.g. Figure 1), and deletion operations performed in one of the layers often cannot completely securely delete data because there may be data leakage in other layers. For example, deleting a selected photo from the Photos app does not guarantee that the deleted photo actually becomes inaccessible.
  • the system can simply modify the metadata in the file system layer (e.g., change the block allocation table and invalidate the deleted data) to make the photo visible has been deleted in the application layer.
  • the actual content is still stored in the physical storage media layer, and attackers can use some tools to recover the data in the physical storage media. Therefore, secure data deletion requires ensuring that the deleted content is inaccessible at every layer of the storage system.
  • the data deletion method provided by the embodiment of this application can delete the UDA partition and RPMB based on the mobile phone. Since the RPMB space is small, the current maximum is only 16M. Therefore, other important sensitive data that cannot be stored will be stored in the UDA area outside the RPMB. For example, use For fingerprint templates used for fingerprint authentication, a small part of the data is stored in the RPMB, and most of the data is stored in the UDA area. Therefore, when the phone is lost or stolen, the key and fingerprint information in the RPMB need to be physically erased, and the important data in the UDA also needs to be physically erased.
  • Figure 1 shows a storage system architecture diagram of an electronic device. As shown in Figure 1, the functions of each layer module in the storage system architecture diagram of an electronic device are as follows:
  • Physical storage media can be used to store data, such as HDD or NAND flash memory, where the physical storage media is always accessed through the controller.
  • the basic function of the controller is to convert the data format (such as voltage) on the physical storage medium into another format (such as binary value) that the upper layer can understand.
  • Controllers can provide standardized and well-defined hardware interfaces, such as Advanced Technology Attachment (ATA) and Small Computer System Interface (SCSI), allowing data to be read from or written to physical storage media.
  • ATA Advanced Technology Attachment
  • SCSI Small Computer System Interface
  • Physical storage media Since HDD uses in-place update, its controller usually changes the logical block address to Consistently mapped to a storage location on the physical storage medium. In contrast, NAND flash is updated off-site for performance reasons and is usually managed through FTL or a flash-specific file system.
  • Device drivers can consolidate access to different types of hardware by exposing a common, simple interface in software.
  • the block device driver interface allows reading and writing blocks at logical addresses.
  • Block device drivers can be used on HDD controlled or NAND flash memory encapsulated by the Flash Translation Layer (FTL).
  • FTL Flash Translation Layer
  • Memory Technology Device is another device driver that can be used to directly access raw NAND flash memory.
  • Memory technology devices allow reading and writing, but blocks must be erased before writing, which occurs at large granularity.
  • Unordered block mirroring is another interface to access flash memory that builds on the memory technology device interface and simplifies some aspects of using raw flash memory.
  • the file system is responsible for organizing the logical sequence of data between the blocks available on the physical storage medium through the interface provided by the device driver.
  • Block file systems built on block devices such as file allocation table (FAT)32, fourth-generation extended file system (Fourth extended file system, EXT4) and new technology file system (New Technology File System, NTFS);
  • Flash file system built on MTD devices such as a file system specially designed for NAND flash memory (Yet Another Flash File System, YAFFS);
  • UBI file system Unsorted Block Image File System (UBIFS) is built on UBI devices.
  • the application layer can provide an interface to users.
  • the first method destroy the storage media
  • the storage medium is melted into liquid metal by smelting, or the storage medium is crushed into small pieces of scrap metal that cannot be reconstructed by crushing, etc., making the data on the storage medium irrecoverable.
  • Solution a Use Android secure erasure function (SecureWipePartition), that is, discard command + overwrite 0.
  • the third method overwrite/replace sensitive data
  • NIST recommends overwriting/replacing the storage media at least 3 times ([T.Grance, M . Stevens, and M. Myers, “Guide to Selecting Information Security Products,” chapter 5.9: Media Sanitizing.
  • NAND flash memory usually uses "off-site update” to write updated data to free storage pages instead of the original data.
  • the storage page where the original data is located only marks the storage page where the original data is located as invalid and is physically deleted for subsequent garbage collection (GC). Therefore, before the NAND flash memory is garbage collected, the original old data is still stored in the flash memory.
  • GC garbage collection
  • attackers can obtain user data through tools. In this way, this overwriting/replacement data method is only applicable to the traditional storage medium of HDD, and is not applicable to the NAND flash memory of current mobile terminals, let alone the application scenario where the mobile phone is lost or stolen.
  • the fourth method Encrypt and store sensitive data
  • this method is not suitable for safe deletion of data in NAND flash memory of current mobile terminals, let alone application scenarios where mobile phones are lost or stolen.
  • the fifth method Encrypt and store sensitive data
  • fscrypt has two ioctl functions (i.e. FS_IOC_REMOVE_ENCRYPTION_KEY and FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS) that can be called by the virtual file system (Virtual File System, VFS) and upper-layer applications to delete the key added to the keyring by the ioctl function FS_IOC_ADD_ENCRYPTION_KEY.
  • VFS Virtual File System
  • the key may not be physically deleted from the storage medium until the storage controller performs garbage collection (GC) of the block where the key is located. . Therefore, this method is not suitable for application scenarios where the mobile phone is lost or stolen, nor is it suitable for application scenarios where the mobile phone is abandoned or transferred.
  • GC garbage collection
  • embodiments of the present application provide a method for secure data deletion. Since sensitive data is stored in plain text, even if it is subsequently encrypted and stored, it cannot be ensured that the original data has not been deleted. The security of encrypted sensitive data, therefore, the user's sensitive data is encrypted and stored at the first time; since the physical erasure of NAND flash data is based on blocks, important information (such as encryption keys) or information related to key generation, file metadata, etc.) are stored in relatively concentrated blocks in the flash memory. In this way, if the phone is stolen or lost, the important information mentioned above can be immediately physically erased.
  • FIG. 2 shows a flow chart of a data deletion method provided by an embodiment of the present application.
  • the data deletion method provided by the embodiment of the present application may include the following steps 201 and 202.
  • Step 201 The electronic device receives the first instruction.
  • the first instruction is used to instruct the electronic device to delete the target data; the first instruction includes tag information of the target data.
  • the electronic device can delete the target data according to the tag information of the target data included in the first instruction.
  • the above-mentioned first instruction may be sent by a target device that is a different device from the electronic device, or the above-mentioned first instruction may be sent by a target device that is the same device as the electronic device, that is, If the user's electronic device is lost or is not accessible to the user, the user can use a target device that is different from the electronic device and log in to the terminal management server to send a first instruction to the electronic device, thereby making the electronic device sensitive to The data performs a remote secure deletion operation (for example, the data secure deletion function of calling the file system provided by the embodiment of this application: fs_secure_deletion(..., flag_I), where flag_I is the tag information of the target data). In order to ensure security, this operation Logical functions are implemented in TEE (for example: secure deletion TA). Alternatively, the user can operate the electronic device (ie, the target device) to trigger the electronic device to perform data security deletion.
  • TEE secure deletion TA
  • the method in the embodiment of the present application is not applicable when the mobile phone is lost or stolen and the mobile phone is not connected to the Internet.
  • the embodiment of the present application requires that when creating and storing encryption keys or information related to key generation in the application layer of the electronic device, Add an attribute tag (mark information of the target data) to the file metadata; and add a data safe deletion logic module to the application layer.
  • Add an attribute tag mark information of the target data
  • add a data safe deletion logic module to the application layer.
  • Flash Translation Layer When storing encryption keys or key generation-related information in the Flash Translation Layer (FTL), it is necessary to add an attribute tag to the corresponding function, add a data security deletion function, add an important information mapping table, and support starting flash memory. Physical deletion command; and can mark physical blocks as blocks that store important information, etc.
  • Step 202 The electronic device responds to the first instruction and deletes the target data from the target storage area according to the tag information in the first instruction.
  • the target storage area includes: replay protection memory block RPMB, or user data partition UDA and replay protection memory block RPMB.
  • the target data also includes: data attribute information.
  • the data attribute information is used to identify attributes of sensitive data.
  • the data attribute information includes at least one of the following: file size, file permissions, file timestamp, extension Attributes and configuration information; data attribute information and key information are stored in the target storage area at the same time.
  • the "delete the target data from the target storage area according to the mark information in the first instruction" in the above step 202 can be specifically performed through the following step 202a Go to step 202c to implement.
  • Step 202a When the target data is stored in RPMB, the electronic device Information, a physical deletion request message is sent to RPMB through a trusted application in a trusted execution environment.
  • the electronic device can send a physical deletion message request to RPMB through the secure deletion TA in the TEE, that is, the RPMB Purge/Sanitizer Enabler Request message.
  • Figure 3 shows a system architecture diagram of a data deletion method provided by an embodiment of the present application. As shown in Figure 3, the data deletion method provided by an embodiment of the present application can delete data through the system architecture shown in Figure 3.
  • Step 202b The electronic device sends the physical deletion message request to the RPMB listener through the RPMB kernel driver and file operation interface.
  • the electronic device can send a physical deletion message request to the RPMB listener (RPMB Listener on the REE side) through the RPMB kernel driver and the file operation interface (REE File Operation Interface).
  • Step 202c The electronic device deletes the target data from the RPMB through the RPMB listener and the control module of the file system UFS.
  • the electronic device can delete the target data from the RPMB through the control module of UFS (ie, eMMC/UFS on the REE side) through the RPMB.
  • UFS ie, eMMC/UFS on the REE side
  • the electronic device can use the RPMB listener to physically delete the target data stored in the RPMB partition in the flash memory through the control module of the file system UFS.
  • the RPMB Purge/Sanitizer Enabler Response message will be returned to the secure deletion TA via the original route.
  • each module that needs to be passed through needs to be enhanced to support the transmission of RPMB Purge/Sanitizer Enabler Request messages and corresponding Response messages.
  • the target data includes first target data and second target data; in the above step 202, "according to the mark information in the first instruction, from the target storage area "Deleting the target data" can be specifically implemented through the following step 202d.
  • Step 202d When the target data is stored in RPMB and UDA, the electronic device deletes the first target data from RPMB and deletes the second target data from UDA according to the tag information in the first instruction.
  • the electronic device needs to delete the first target data from RPMB and delete the second target data from UDA according to the tag information in the first instruction.
  • step 202d "delete the first target data from the RPMB according to the mark information in the first instruction" in the above step 202d can be specifically implemented through the following steps 202d1 to 202d3.
  • Step 202d1 The electronic device sends a physical deletion request message to RPMB through the trusted application in the trusted execution environment according to the tag information in the first instruction.
  • Step 202d2 The electronic device sends the physical deletion message request to the RPMB listener through the RPMB kernel driver and file operation interface.
  • Step 202d3 The electronic device deletes the first target data from the RPMB through the RPMB listener and the control module of the file system UFS.
  • step 202d "Deleting the second target data from the UDA" in the above step 202d can be specifically implemented through the following steps 202d4 and 202d5.
  • Step 202d4 According to the mark information in the first instruction, the electronic device uses the first deletion module of the file system layer and the second deletion module of the device driver layer to delete the second target from the fixed logical page number LPN in the file system layer. Target data is addressed to obtain the target virtual address.
  • the electronic device can delete the file from the fixed logical page number LPN in the file system layer through the first deletion module of the file system layer and the second deletion module of the device driver layer according to the tag information in the first instruction.
  • the second target data is addressed to obtain the target virtual address, so that the electronic device can delete the second target data according to the target virtual address.
  • the electronic device can delete data from the file system through the first deletion function of the file system layer and the second deletion function of the device driver layer according to the tag information in the first instruction.
  • the second target data is addressed in the fixed logical page number LPN in the layer to obtain the target virtual address, so that the electronic device can delete the second target data according to the target virtual address.
  • first deletion module/function and the second deletion module/function include mark information, and the mark information is used to determine the target data block in which the second target data is stored.
  • the electronic device can address all the second files stored in the file system according to the first instruction and the tag information of the target data through the preset deletion function of the file system layer and the preset deletion function of the device driver layer.
  • the fixed logical page number LPN of the target data to obtain the target virtual address.
  • the preset deletion function of the file system layer may be: fs_secure_deletion(..., flag_I); the preset deletion function of the device driver layer may be: block_secure_deletion(..., flag_I).
  • the electronic device can add a logical function module in the trusted execution environment TEE (for example, secure deletion TA).
  • the logical module can receive the TA on the remote server.
  • the safe deletion command allows users to remotely perform safe deletion of important user data by logging into the terminal management server when their mobile phones are lost or stolen.
  • the electronic device can add a system management function (such as the secure deletion client (secure deletion client) provided in the embodiment of the present application) at the application layer to support the user when discarding or transferring the old mobile phone.
  • a system management function such as the secure deletion client (secure deletion client) provided in the embodiment of the present application
  • Step 202d5 The electronic device determines the target data block storing the second target data from the target mapping table of the flash memory conversion layer according to the target virtual address and tag information through the preset deletion module of the flash memory conversion layer, and deletes the target data block. second target data.
  • the electronic device can determine that the second target data is stored in the target mapping table of the flash conversion layer through the preset deletion module of the flash memory conversion layer based on the target virtual address and tag information. target data block and delete the second target data in the target data block.
  • the preset deletion module of the flash conversion layer may be: ftl_secure_deletion(..., flag_I).
  • the third deletion module/function includes tag information.
  • the electronic device can add a new function/module in the file system layer (such as ext4+fscrypt in the embodiment of the present application), the device driver layer, and the flash memory conversion layer, as shown in the embodiment of the present application.
  • a new function/module in the file system layer such as ext4+fscrypt in the embodiment of the present application
  • the device driver layer can add a new function/module in the file system layer (such as ext4+fscrypt in the embodiment of the present application), the device driver layer, and the flash memory conversion layer, as shown in the embodiment of the present application.
  • file system layer deletion function/module fs_secure_deletion(...,flag_I)
  • device driver layer deletion function/module block_secure_deletion(...,flag_I)
  • flash memory translation layer deletion function/module ftl_secure_deletion
  • step 202d5 "Deleting the second target data in the target data block" in the above-mentioned step 202d5 can be specifically implemented through the following step a or step b.
  • Step a The electronic device starts garbage collection through the controller and recycles the target data block.
  • the electronic device can modify the garbage collection (GC) function in the flash memory conversion layer, so that the deletion function (ftl_secure_deletion(..., flag_I)) of the flash memory conversion layer can trigger the GC to actively reclaim the band.
  • GC garbage collection
  • Step b The electronic device calls the hardware physical deletion command through the controller to delete the second target data from the target data block.
  • the electronic device can call the hardware physical deletion command (such as secure erase (secure erase), secure trim (secure trim), sanitize, purge, etc.) at the flash memory conversion layer, so that the delete function (ftl_secure_deletion (..., flag_I)) can actively trigger the call of the flash memory physical delete command according to the target mapping table, so that the second target data can be collectively deleted from the target data block.
  • the hardware physical deletion command such as secure erase (secure erase), secure trim (secure trim), sanitize, purge, etc.
  • the delete function ftl_secure_deletion (..., flag_I)
  • the name of the physical deletion command is related to the flash memory manufacturer and eMMC version).
  • Figure 4 shows a system architecture diagram of a data deletion method provided by an embodiment of the present application. As shown in Figure 4, the data deletion method provided by an embodiment of the present application can delete data through the system architecture diagram shown in Figure 4.
  • the data deletion method provided by the embodiment of the present application can be implemented through the following steps 11 to 14.
  • Step 11 The electronic device adds a logical function module to the TEE. For example, a secure deletion TA is added to the TEE, that is, secure deletion TA.
  • Step 12 The electronic device receives the user's secure deletion operation on the important sensitive data (i.e., the second target data), i.e., the first instruction (secure deletion client), and the first instruction has undergone relevant authentication and authorization (for example: In the case of authentication and authorization in secure deletion TA), according to flag_I in the first instruction, call: fs_secure_deletion(..., flag_I), which is the deletion module of the file system layer.
  • relevant authentication and authorization for example: In the case of authentication and authorization in secure deletion TA
  • flag_I in the first instruction call: fs_secure_deletion(..., flag_I), which is the deletion module of the file system layer.
  • Step 13 The electronic device calls: block_secure_deletion(..., flag_I) at the file system layer, that is, the deletion module of the device driver layer, and according to flag_I, the second target data is processed from the fixed logical page number LPN in the file system layer. Addressing, get the target virtual address.
  • Step 14 The electronic device calls: ftl_secure_deletion(..., flag_I) in the device driver layer, that is, the deletion module of the flash conversion layer, and determines the target data block storing the second target data in the target mapping table according to flag_I, and Execute on the target data block: initiate garbage collection through the controller to recycle the target data block; alternatively, execute a hardware physical delete command through the controller to delete the second target data from the target data block to convert from software flash memory respectively Layer (software FTL) and hardware flash conversion layer to delete the second target data.
  • ftl_secure_deletion ..., flag_I
  • Execute on the target data block initiate garbage collection through the controller to recycle the target data block; alternatively, execute a hardware physical delete command through the controller to delete the second target data from the target data block to convert from software flash memory respectively Layer (software FTL) and hardware flash conversion layer to delete the second target data.
  • an electronic device can receive a first instruction.
  • the first instruction is used to instruct the electronic device to delete target data; the first instruction includes tag information of the target data; and responds In the first instruction, delete the target data from the target storage area according to the mark information in the first instruction; wherein the target storage area includes: replay protection memory block RPMB, or user data partition UDA and replay protection memory block RPMB .
  • the electronic device can receive the first instruction for instructing the electronic device to delete the target data, and delete the target data from the RPMB or delete the target data from the UDA and the RPMB according to the tag information of the target data included in the first instruction. Therefore, even if the user's electronic device is lost, the private data of the electronic device can be deleted remotely. This improves the efficiency of the electronic device in processing private data and improves the flexibility of the electronic device in processing private data.
  • the target data includes encrypted key information
  • the data deletion method provided by the embodiment of the present application further includes the following steps 301 and 302.
  • Step 301 The electronic device encrypts any one of the encryption key of the sensitive data and the key material used to generate the encryption key to form encrypted key information.
  • existing encryption keys or information related to key generation can be used to generate encryption keys for the sensitive data.
  • Encrypt any of the key material of the key, or a system-related function (such as the key or key material generation process: key/key_material generation process) can generate an encryption key for the sensitive data.
  • Key or information related to key generation (such as random number, initialization vector, timestamp, file identification, etc.).
  • the electronic device can use an existing encryption system, such as fscrypt integrated with ext4/F2FS/UBIFS, or eCryptfs, EncFS, and gocryptfs located between VFS and ext4/F2FS/UBIFS. Encrypt any of the encryption key for sensitive data and the key material used to generate the encryption key.
  • an existing encryption system such as fscrypt integrated with ext4/F2FS/UBIFS, or eCryptfs, EncFS, and gocryptfs located between VFS and ext4/F2FS/UBIFS.
  • the system-related functions of the electronic device obtain the relevant keys for the above-mentioned sensitive data from the Keymaster of the trusted execution environment TEE. Encryption is performed using any one of the encryption key and the key material used to generate the encryption key.
  • Step 302 The electronic device stores the encrypted key information in the target storage area.
  • the key material for generating the encryption key includes at least one of the following: a random number, an initialization vector, a timestamp, and a file identifier.
  • the electronic device may store the encrypted key information in the target storage area.
  • a tag information (attribute tag (such as flag_I)) is added to the encrypted key information.
  • ext4/F2FS/UBIFS+fscrypt (such as the reserved field in the ext4 index node inode data structure) and the device driver layer, and
  • the encrypted key information and attribute labels are stored in memory through FTL.
  • Figure 5 shows a system architecture diagram of a data storage method provided by an embodiment of the present application.
  • the electronic device can encrypt and store the encrypted key information according to the system architecture provided in Figure 5 for subsequent use. Physical deletion can be performed quickly and efficiently.
  • the data storage method provided by the embodiment of the present application can be implemented through the following steps 21 to 26.
  • the electronic device can add a logical function module to the TEE. For example, add a key information storage TA to the TEE, namely: Keymaster TA.
  • Step 22 The electronic device uses system-related functions at the application layer, such as: key/key_material generation process, to obtain any of the encryption keys for sensitive data and the key materials for generating encryption keys from the Keymaster of the TEE.
  • the items are encrypted to form encrypted key information.
  • Step 23 The electronic device uses system-related functions, such as: key/key_material generation process, and generates and calls write_to_fs([encrypted]key/random/IV, ..., flag_I), that is, the first writing module is used to store the encrypted key information.
  • key/key_material generation process and generates and calls write_to_fs([encrypted]key/random/IV, ..., flag_I), that is, the first writing module is used to store the encrypted key information.
  • Step 24 The electronic device generates and calls write_to_block([encrypted]key/random/IV,...,flag_I)) at the file system layer based on flag_I and the preset writing module of the device driver layer, that is: the third write Module to store the encrypted key information and allocate a target virtual address to the encrypted key information from the fixed logical page number LPN according to flag_I.
  • Step 25 In the device driver layer, the electronic device generates and calls write_to_ftl([encrypted]key/random/IV,...,flag_I) according to flag_I and the preset writing module of the flash memory conversion layer, that is, the second writing module , to store the encrypted key information.
  • Step 26 The electronic device establishes a target mapping table in the flash memory conversion layer, and then allocates the target data block to the encrypted key information in the target mapping table according to flag_I, and stores the encrypted key information in the target The target data block in the mapping table.
  • step 301 can be specifically implemented through the following steps 301a to 301c.
  • Step 301a The electronic device starts the corresponding trusted application program of the application layer in the trusted execution environment at the application layer.
  • Trusted Application (for example, the first TA).
  • Figure 6 shows a system architecture diagram of a data storage method provided by an embodiment of the present application.
  • the electronic device can encrypt and store the target data according to the system architecture provided in Figure 6, so that subsequent operations can be performed quickly and efficiently. be physically deleted.
  • Step 301b The electronic device calls the trusted application corresponding to the RPMB based on the corresponding trusted application of the application layer, and sends any one of the encryption key of the sensitive data and the key material for generating the encryption key from the application layer to the RPMB. Trusted application.
  • the electronic device can call a trusted application for reading and writing RPMB (for example, the second TA) through the first TA to transfer the encryption key of the sensitive data and the key material used to generate the encryption key.
  • RPMB for example, the second TA
  • An item is sent from the application layer to RPMB, and then the encryption module can be called by the second TA to calculate and encapsulate the data sent by the first TA, so that any one of the encryption key of the sensitive data and the key material for generating the encryption key can be Items are sent to RPMB's trusted applications.
  • Step 301c The electronic device encrypts any one of the encryption key of the sensitive data and the key material used to generate the encryption key through the trusted application corresponding to RPMB to form encrypted key information.
  • the electronic device after the electronic device receives any one of the encryption key of the sensitive data and the key material for generating the encryption key through the trusted application program of RPMB, the electronic device can use the trusted application program corresponding to RPMB to process the sensitive data. Any one of the encryption key and the key material used to generate the encryption key is encrypted to form encrypted key information, so that the electronic device can store the encrypted key information.
  • the target data is at least partially stored in RPMB, and the above step 302 can be specifically implemented through the following steps 302a to 302c.
  • Step 302a The electronic device sends the encrypted key information and file operating system commands to the RPMB listener through the RPMB kernel driver through the trusted application program corresponding to RPMB.
  • the electronic device can use the trusted application program and file operating system command (REE file operating system command) corresponding to RPMB to pass the encrypted key information and file operating system command through the RPMB kernel.
  • the driver (RPMB kernel driver) is sent to the RPMB listener (RPMB listener) located on the REE side, thereby triggering the electronic device to store the encrypted key information.
  • Step 302b The electronic device sends the encrypted key information and file operating system commands to UFS through the RPMB listener.
  • the electronic device can send the encrypted key information and file through the RPMB listener on the REE side.
  • Operating system commands are forwarded to eMMC/UFS.
  • Step 302c The electronic device uses UFS file-based operating system commands to store the encrypted key information in RPMB.
  • the electronic device after the electronic device receives the encrypted key information and the file operating system command through UFS, it can use UFS based on the file operating system command, thereby triggering the electronic device to transfer the encrypted key information to the file operating system command through UFS.
  • Key information is stored in RPMB
  • the target data is at least partially stored in UDA, and the above step 302 can be specifically implemented through the following steps 302d to 302h.
  • Step 302d The electronic device calls the first writing module according to the tag information and the preset writing module of the file system layer.
  • the first writing module includes tag information.
  • the electronic device when at least part of the target data is stored in UDA, the electronic device can call the first writing module according to the mark information and the default writing module of the file system layer, so that the electronic device writes the target data Transmit at least part of it, that is, transmit the encrypted key information.
  • the electronic device calls the first writing function based on the tag information and the preset writing function of the file system layer.
  • the default write function of the file system layer may be: write_to_fs([encrypted]key/random/IV,).
  • the first write function may be: write_to_fs([encrypted]key/random/IV,...,flag_I).
  • the electronic device can generate a first write function based on the tag information and the preset write function of the file system layer, that is, adding an input parameter: flag_I to the preset function of the file system layer. , to generate the first writing function, so that the first writing function can be distinguished from other data that needs to be stored.
  • Step 302e The electronic device sends the encrypted key information from the application layer to the file system layer through the first writing module.
  • the electronic device can call the first writing module, so that the encrypted key information can be sent from the application layer to the file system layer through the first writing module.
  • the electronic device sends the encrypted key information from the application layer to the file system layer through the first writing function.
  • the system-related functions of the electronic device will call the first writing function/module, that is, based on the tag information and file
  • the write function/module generated by the system's default write function i.e. write_to_fs([encrypted]key/random/IV,...,flag_I)
  • write_to_fs([encrypted]key/random/IV,...,flag_I) sends the encrypted key information from the application layer to the file system layer to store the encrypted key information.
  • Step 302f The electronic device allocates a target virtual address to the encrypted key information from the logical page number LPN in the file system layer based on the tag information.
  • the electronic device can allocate an appropriate virtual address, that is, the target virtual address, to the encrypted key information from the logical page number LPN of the file system layer based on the target record information.
  • the logical page number LPN can be Continuous or non-continuous.
  • the logical page number LPN assigned to the target data by ext4/F2FS/UBIFS+fscrypt through the file system layer is fixed, but the fixed logical page number LPN can be continuous or discontinuous.
  • Step 302g The electronic device sends the encrypted key information and target virtual address from the file system layer to the flash memory conversion layer via the device driver layer.
  • the electronic device after the electronic device allocates a target virtual address to the encrypted key information from the logical page number LPN in the file system layer based on the tag information, the electronic device can combine the encrypted key information and the target virtual address.
  • the target virtual address is sent from the file system layer through the device driver layer to the flash translation layer.
  • the electronic device can send the encrypted key information and target virtual address from the file system layer to the flash memory via the device driver layer according to the tag information and the preset write function of the flash memory conversion layer. Transform layer.
  • step 302g can be specifically implemented through the following steps 302g1 to 302g4.
  • Step 302g1 The electronic device calls the third writing module according to the tag information and the preset writing module of the device driver layer.
  • the third writing module includes tag information.
  • the electronic device calls the third writing module according to the tag information and the preset writing module of the device driver layer, so that the electronic device performs the encrypted key information and the target virtual address. transmission.
  • the electronic device calls the third writing function based on the tag information and the preset writing function of the device driver layer.
  • the electronic device can generate a third writing function based on the tag information and the preset writing function of the device driver layer, that is, adding an input parameter: flag_I to the preset function of the device driver layer. , to generate a third writing function, which can be distinguished from other data that needs to be stored.
  • the preset writing function of the device driver layer can be:
  • the first writing function can be:
  • the system-related functions of the electronic device will call the second writing function/module, that is, based on the tag information and the device
  • the write function/module generated by the default write function of the driver layer i.e. write_to_block([encrypted]key/random/IV,...,flag_I)
  • write_to_block([encrypted]key/random/IV,...,flag_I) will encrypt the key information and target virtual address from the file
  • the system layer sends to the device driver layer to send from the device driver layer to the flash translation layer.
  • Step 302g2 The electronic device sends the encrypted key information and target virtual address from the file system layer to the device driver layer through the third writing module.
  • the encrypted key information and the target virtual address can be transferred to the third writing module through the third writing module. Sent from the file system layer to the device driver layer.
  • Step 302g3 The electronic device calls the second writing module according to the tag information and the preset writing module of the flash memory conversion layer.
  • the electronic device after the electronic device sends the encrypted key information and the target virtual address from the file system layer to the device driver layer through the third writing module, it can use the tag information and the presets of the flash conversion layer to The writing module calls the second writing module.
  • the electronic device calls the second writing function based on the tag information and the preset writing function of the flash memory conversion layer.
  • the electronic device can generate a second write function based on the tag information and the preset write function of the flash memory conversion layer, that is, add an input parameter: flag_I to the preset function of the flash memory conversion layer. , to generate the second write function.
  • Step 302g4 The electronic device sends the encrypted key information and target virtual address from the device driver layer to the flash memory conversion layer through the second writing module.
  • the electronic device calls the preset writing module based on the tag information and the flash memory conversion layer. After the second writing module, the encrypted key information and the target virtual address can be sent from the device driver layer to the flash conversion layer through the second writing module.
  • the system-related functions of the electronic device will call the second writing function/module, that is, based on the tag information and the flash memory
  • the second write function/module write_to_ftl([encrypted]key/random/IV,...,flag_I)) generated by the default write function of the translation layer, and encrypts the processed key information and target virtual address from the device
  • the driver layer sends it to the flash translation layer to store the encrypted key information and target virtual address.
  • Step 302h The electronic device establishes a target mapping table in the flash memory conversion layer, and stores the encrypted key information in the target data block in the target mapping table through the second writing module.
  • the second writing module is a writing module corresponding to the flash memory conversion layer, and the second writing module includes tag information; the tag information is used to determine the target data block.
  • the electronic device can establish a target mapping table in the flash memory conversion layer, and store the received encrypted key information in the target data block in the target mapping table through the second writing module, To store the encrypted key information.
  • a target mapping table is established in the flash memory conversion layer of the electronic device, and the encrypted key information is stored in the target data block in the target mapping table through the second writing function.
  • the electronic device can establish a target mapping table in the flash memory conversion layer according to the flag_I in the second writing function/module for managing all sensitive data stored in the flash memory (such as the first data and first information), the target information mapping table includes at least one of the following: logical page number (Logical Page Number, LPN), logical block number (Logical Block Number, LBN), Physical block number (Physical Block Number, PBN), target data tag information (flag_I), etc.
  • LPN Logical Page Number
  • LBN Logical Block Number
  • PBN Physical Block Number
  • target data tag information flag_I
  • the target mapping table can be stored in the flash memory, which can be called a physical block or an important information physical block (it is a map block, and there are several other physical blocks such as data/ log/free/dirty blocks).
  • FTL is in the target mapping table according to flag_I written in the second writing function/module (for example, write_to_ftl([encrypted]key/random/IV,...,flag_I)).
  • flag_I written in the second writing function/module
  • find the appropriate physical block block and then write new data or update existing data according to the existing method; if the address of the physical block changes, the new physical block number needs to be synchronized to the target mapping table, and the new physical block number needs to be synchronized to the target mapping table.
  • the metadata status value of the new physical block is changed to flag_I.
  • the status value of the physical block (block) metadata is increased by one, that is, the attribute label flag_I (other existing status values are: regular, sequentially written, randomly written, and other systems automatically defined system specific purposes).
  • hybrid FTL the address mapping of FTL adopts hybrid mode (hybrid FTL)
  • the information included in the target mapping table will be different when the FTL is page-level or block-level.
  • the execution subject may be a data deletion device.
  • the data deletion device performing the data deletion method is used as an example to illustrate the data deletion device provided by the embodiment of the present application.
  • Figure 7 shows a possible structural diagram of the data deletion device involved in the embodiment of the present application.
  • the data deletion device 40 may include: a receiving module 41 and a deletion module 42 .
  • the receiving module 41 is used to receive a first instruction, and the first instruction is used to instruct the electronic device to delete the target data; the first instruction includes tag information of the target data.
  • the deletion module 42 is configured to respond to the first instruction received by the receiving module 41 and delete the target data from the target storage area according to the mark information in the first instruction; wherein the target storage area includes: replay protection memory block RPMB, or , user data partition UDA and replay protected memory block RPMB.
  • Embodiments of the present application provide a data deletion device. Since the electronic device can receive a first instruction for instructing the electronic device to delete target data, and delete the target data from the RPMB according to the tag information of the target data included in the first instruction, Or delete target data from UDA and RPMB. Therefore, even when the user's electronic device is lost, the private data of the electronic device can be deleted. This improves the efficiency of the electronic device in processing private data and improves the flexibility of the electronic device in processing private data.
  • the target data includes encrypted key information;
  • the data deletion device 40 further includes: an encryption module and a storage module.
  • the encryption module is used to encrypt any of the encryption key of sensitive data and the key material used to generate the encryption key to form encrypted key information.
  • the storage module is used to store the encrypted key information in the target storage area.
  • the key material for generating the encryption key includes at least one of the following: a random number, an initialization vector, a timestamp, and a file identifier.
  • the deletion module 42 is specifically configured to, when the target data is stored in the RPMB, send physical data to the RPMB through a trusted application program in the trusted execution environment according to the tag information in the first instruction. Delete request message; send the physical delete message request to the RPMB listener through the RPMB kernel driver and file operation interface; delete the target data from RPMB through the RPMB listener through the control module of the file system UFS.
  • the deletion module 42 is specifically configured to delete the first target data from the RPMB according to the tag information in the first instruction, and delete the first target data from the UDA when the target data is stored in the RPMB and the UDA. Delete the secondary target data.
  • the deletion module 42 is specifically configured to send a physical deletion request message to RPMB through a trusted application in a trusted execution environment according to the tag information in the first instruction; through the RPMB kernel driver and The file operation interface sends the physical deletion message request to the RPMB listener; through the RPMB listener, the first target data is deleted from the RPMB through the control module of the file system UFS.
  • the deletion module 42 is specifically configured to delete the file from the file system layer through the first deletion module 42 of the file system layer and the second deletion module 42 of the device driver layer according to the mark information in the first instruction. Address the second target data in the fixed logical page number LPN in the LPN to obtain the target virtual address; through the preset deletion module 42 of the flash memory translation layer, according to the target virtual address and tag information, from the target mapping table of the flash memory translation layer Determine the target data block in which the second target data is stored, and delete the second target data in the target data block.
  • the deletion module 42 is specifically configured to start garbage collection through the controller and recycle the target data block; or, call the hardware physical deletion command through the controller to delete the second data block from the target data block. target data.
  • the encryption module is specifically used to start the corresponding trusted application program of the application layer in the trusted execution environment at the application layer; based on the corresponding trusted application program of the application layer, the corresponding trusted application program of the RPMB is called.
  • the application sends any of the encryption key of sensitive data and the key material used to generate the encryption key from the application layer to the trusted application of RPMB; the encryption key of sensitive data is processed through the trusted application corresponding to RPMB. , encrypt any item of the key material used to generate the encryption key to form encrypted key information;
  • the target data is at least partially stored in the RPMB storage module, which is specifically used to pass the encrypted key information and file operating system commands through the RPMB kernel driver through the trusted application program corresponding to the RPMB.
  • the target data is at least partially stored in the UDA.
  • the storage module is specifically configured to call the first writing module according to the mark information and the preset writing module of the file system layer.
  • the first writing module includes Mark information; send the encrypted key information from the application layer to the file system layer through the first writing module; according to the mark information, obtain the encrypted key from the logical page number LPN in the file system layer information distribution Target virtual address; send the encrypted key information and target virtual address from the file system layer to the flash conversion layer via the device driver layer; establish a target mapping table in the flash conversion layer, and pass the encrypted
  • the processed key information is stored in the target data block in the target mapping table.
  • the second writing module is the writing module corresponding to the flash conversion layer.
  • the second writing module includes tag information; the tag information is used to determine the target data. piece.
  • the storage module is specifically configured to call a third writing module based on the tag information and a preset writing module of the device driver layer.
  • the third writing module includes the tag information; through the third writing module module, which sends the encrypted key information and target virtual address from the file system layer to the device driver layer; calls the second writing module according to the mark information and the preset writing module of the flash conversion layer; through the second writing Module that sends the encrypted key information and target virtual address from the device driver layer to the flash conversion layer.
  • the target data also includes: data attribute information.
  • the data attribute information is used to identify attributes of sensitive data.
  • the data attribute information includes at least one of the following: file size, file permissions, file timestamp, and extended attributes. , configuration information; data attribute information and key information are stored in the target storage area at the same time.
  • the data deletion device in the embodiment of the present application may be an electronic device or a component in the electronic device, such as an integrated circuit or a chip.
  • the electronic device may be a terminal or other devices other than the terminal.
  • the electronic device can be a mobile phone, a tablet computer, a notebook computer, a handheld computer, a vehicle-mounted electronic device, a mobile internet device (Mobile Internet Device, MID), or augmented reality (AR)/virtual reality (VR).
  • the data deletion device in the embodiment of the present application may be a device with an operating system.
  • the operating system can be an Android operating system, an ios operating system, or other possible operating systems, which are not specifically limited in the embodiments of this application.
  • the data deletion device provided by the embodiments of the present application can implement various processes implemented by the method embodiments of Figures 1 to 6. To avoid duplication, they will not be described again here.
  • this embodiment of the present application also provides an electronic device 500, including a processor 501 and a memory 502.
  • the memory 502 stores programs or instructions that can be run on the processor 501.
  • each step of the above-mentioned data deletion method embodiment is implemented, and the same technical effect can be achieved. To avoid duplication, the details will not be described here.
  • the electronic devices in the embodiments of the present application include the above-mentioned mobile electronic devices and non-mobile electronic devices.
  • FIG. 9 is a schematic diagram of the hardware structure of an electronic device implementing an embodiment of the present application.
  • the electronic device 100 includes but is not limited to: radio frequency unit 101, network module 102, audio output unit 103, input unit 104, sensor 105, display unit 106, user input unit 107, interface unit 108, memory 109, processor 110, etc. part.
  • the electronic device 100 may also include a power supply (such as a battery) that supplies power to various components.
  • the power supply may be logically connected to the processor 110 through a power management system, thereby managing charging, discharging, and function through the power management system. Consumption management and other functions.
  • the structure of the electronic device shown in Figure 9 does not constitute a limitation on the electronic device.
  • the electronic device may include more or less components than shown in the figure, or combine certain components, or arrange different components, which will not be described again here. .
  • the processor 110 is used to receive a first instruction, and the first instruction is used to instruct the electronic device to delete the target data; the first instruction includes the tag information of the target data, and in response to the first instruction, according to the tag in the first instruction Information, delete the target data from the target storage area; where the target storage area includes: replay protection memory Block RPMB, alternatively, user data partition UDA and replay protected memory block RPMB.
  • Embodiments of the present application provide an electronic device, because the electronic device can receive a first instruction for instructing the electronic device to delete target data, and delete the target data from the RPMB according to the tag information of the target data included in the first instruction, or Remove target data from UDA and RPMB. Therefore, even when the user's electronic device is lost, the private data of the electronic device can be deleted. This improves the efficiency of the electronic device in processing private data and improves the flexibility of the electronic device in processing private data.
  • the target data includes encrypted key information
  • the processor 110 is configured to encrypt any one of the encryption key of the sensitive data and the key material for generating the encryption key. , to form the encrypted key information.
  • the memory 109 is used to store the encrypted key information in the target storage area.
  • the key material for generating the encryption key includes at least one of the following: a random number, an initialization vector, a timestamp, and a file identification.
  • the processor 110 is specifically configured to send the target data to the RPMB through a trusted application program in the trusted execution environment according to the tag information in the first instruction when the target data is stored in the RPMB.
  • Physical deletion request message ; send the physical deletion message request to the RPMB listener through the RPMB kernel driver and file operation interface; delete the target data from RPMB through the RPMB listener through the control module of the file system UFS.
  • the processor 110 is specifically configured to, when the target data is stored in RPMB and UDA, delete the first target data from the RPMB according to the tag information in the first instruction, and delete the first target data from the UDA. Delete the second target data.
  • the processor 110 is specifically configured to send a physical deletion request message to RPMB through a trusted application in a trusted execution environment according to the tag information in the first instruction; through the RPMB kernel driver The physical deletion message request is sent to the RPMB listener through the file operation interface; the first target data is deleted from the RPMB through the RPMB listener through the control module of the file system UFS.
  • the processor 110 is specifically configured to obtain data from the file system through the first processor 110 of the file system layer and the second processor 110 of the device driver layer according to the tag information in the first instruction. Address the second target data in the fixed logical page number LPN in the layer to obtain the target virtual address; through the preset processor 110 of the flash memory conversion layer, according to the target virtual address and tag information, the target mapping table of the flash memory conversion layer is Determine the target data block in which the second target data is stored, and delete the second target data in the target data block.
  • the processor 110 is specifically configured to start garbage collection through the controller and recycle the target data block; or, call the hardware physical deletion command through the controller to delete the third data block from the target data block. 2. Target data.
  • the processor 110 is specifically configured to start the corresponding trusted application program of the application layer in the trusted execution environment at the application layer; based on the corresponding trusted application program of the application layer, call the corresponding trusted application program of RPMB.
  • the trusted application sends any of the encryption key of sensitive data and the key material for generating the encryption key from the application layer to the trusted application of RPMB; the sensitive data is encrypted through the trusted application corresponding to RPMB. Any one of the key and the key material used to generate the encryption key is encrypted to form the encrypted key information;
  • the target data is at least partially stored in the RPMB memory 109, which is specifically used to pass the encrypted key information and file operating system commands through the RPMB kernel driver through the trusted application program corresponding to the RPMB.
  • the program is sent to the RPMB listener; through the RPMB listener, the encrypted key information and file operating system commands are sent to UFS; through UFS based on file operating system commands, the encrypted key information is stored in RPMB.
  • the target data is at least partially stored in the UDA memory 109, which is specifically used to call the first writing module according to the mark information and the preset writing module of the file system layer. Bag including the mark information; through the first writing module, the encrypted key information is sent from the application layer to the file system layer; according to the mark information, the encrypted key information is obtained from the logical page number LPN in the file system layer.
  • the key information is allocated to the target virtual address; the encrypted key information and the target virtual address are sent from the file system layer to the flash memory conversion layer via the device driver layer; a target mapping table is established in the flash memory conversion layer and passed through the second writing module , store the encrypted key information in the target data block in the target mapping table, the second writing module is the writing module corresponding to the flash conversion layer, the second writing module includes tag information; the tag information is used Determine the target data block.
  • the memory 109 is specifically used to call the third writing module according to the mark information and the preset writing module of the device driver layer, and the third writing module includes the mark information; through the third writing module The writing module sends the encrypted key information and target virtual address from the file system layer to the device driver layer; calls the second writing module according to the mark information and the preset writing module of the flash conversion layer; through the second The writing module sends the encrypted key information and target virtual address from the device driver layer to the flash conversion layer.
  • the target data also includes: data attribute information.
  • the data attribute information is used to identify attributes of sensitive data.
  • the data attribute information includes at least one of the following: file size, file permissions, file timestamp, extension Attributes and configuration information; data attribute information and key information are stored in the target storage area at the same time.
  • the input unit 104 may include a graphics processor (Graphics Processing Unit, GPU) 1041 and a microphone 1042.
  • the graphics processor 1041 is responsible for the image capture device (GPU) in the video capture mode or the image capture mode. Process the image data of still pictures or videos obtained by cameras (such as cameras).
  • the display unit 106 may include a display panel 1061, which may be configured in the form of a liquid crystal display, an organic light emitting diode, or the like.
  • the user input unit 107 includes a touch panel 1071 and at least one of other input devices 1072 .
  • Touch panel 1071 is also called a touch screen.
  • the touch panel 1071 may include two parts: a touch detection device and a touch controller.
  • Other input devices 1072 may include, but are not limited to, physical keyboards, function keys (such as volume control keys, switch keys, etc.), trackballs, mice, and joysticks, which will not be described again here.
  • Memory 109 may be used to store software programs as well as various data.
  • the memory 109 may mainly include a first storage area for storing programs or instructions and a second storage area for storing data, wherein the first storage area may store an operating system, an application program or instructions required for at least one function (such as a sound playback function, Image playback function, etc.) etc.
  • memory 109 may include volatile memory or nonvolatile memory, or memory 109 may include both volatile and nonvolatile memory.
  • non-volatile memory can be read-only memory (Read-Only Memory, ROM), programmable read-only memory (Programmable ROM, PROM), erasable programmable read-only memory (Erasable PROM, EPROM), electrically removable memory.
  • Volatile memory can be random access memory (Random Access Memory, RAM), static random access memory (Static RAM, SRAM), dynamic random access memory (Dynamic RAM, DRAM), synchronous dynamic random access memory (Synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (Double Data Rate SDRAM, DDRSDRAM), enhanced synchronous dynamic random access memory (Enhanced SDRAM, ESDRAM), synchronous link dynamic random access memory (Synch link DRAM) , SLDRAM) and direct memory bus random access memory (Direct Rambus RAM, DRRAM).
  • RAM Random Access Memory
  • SRAM static random access memory
  • DRAM dynamic random access memory
  • DRAM synchronous dynamic random access memory
  • SDRAM double data rate synchronous dynamic random access memory
  • Double Data Rate SDRAM Double Data Rate SDRAM
  • DDRSDRAM double data rate synchronous dynamic random access memory
  • Enhanced SDRAM, ESDRAM synchronous dynamic random access memory
  • Synch link DRAM synchronous link dynamic random access memory
  • SLDRAM direct memory
  • the processor 110 may include one or more processing units; optionally, the processor 110 integrates an application processor and a modem processor, where the application processor mainly handles operations related to the operating system, user interface, application programs, etc., Modem processors mainly process wireless communication signals, such as baseband processors. It can be understood that the above modem processor may not be integrated into the processor 110 .
  • Embodiments of the present application also provide a readable storage medium, with programs or instructions stored on the readable storage medium.
  • the program or instructions are executed by a processor, each process of the above data deletion method embodiment is implemented, and the same can be achieved. The technical effects will not be repeated here to avoid repetition.
  • the processor is the processor in the electronic device described in the above embodiment.
  • the readable storage medium Quality including computer-readable storage media, such as computer read-only memory ROM, random access memory RAM, magnetic disks or optical disks, etc.
  • An embodiment of the present application further provides a chip.
  • the chip includes a processor and a communication interface.
  • the communication interface is coupled to the processor.
  • the processor is used to run programs or instructions to implement the above data deletion method embodiment. Each process can achieve the same technical effect. To avoid duplication, it will not be described again here.
  • chips mentioned in the embodiments of this application may also be called system-on-chip, system-on-a-chip, system-on-a-chip or system-on-chip, etc.
  • Embodiments of the present application provide a computer program product.
  • the program product is stored in a storage medium.
  • the program product is executed by at least one processor to implement each process of the above data deletion method embodiment, and can achieve the same technical effect. , to avoid repetition, we will not go into details here.
  • the methods of the above embodiments can be implemented by means of software plus the necessary general hardware platform. Of course, it can also be implemented by hardware, but in many cases the former is better. implementation.
  • the technical solution of the present application can be embodied in the form of a computer software product that is essentially or contributes to the existing technology.
  • the computer software product is stored in a storage medium (such as ROM/RAM, disk , optical disk), including several instructions to cause a terminal (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in various embodiments of this application.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Health & Medical Sciences (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • Human Computer Interaction (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Databases & Information Systems (AREA)
  • Medical Informatics (AREA)
  • Storage Device Security (AREA)

Abstract

本申请公开了一种数据删除方法，属于通信领域。该方法包括：接收第一指令，第一指令用于指示电子设备删除目标数据；第一指令中包括目标数据的标记信息；响应于第一指令，根据第一指令中的标记信息，从目标存储区域中删除目标数据；其中，目标存储区域包括：重放保护内存块RPMB，或者，用户数据分区UDA和重放保护内存块RPMB。

Description

数据删除方法和电子设备
相关申请的交叉引用
本申请主张在2022年08月12日在中国提交的申请号为202210969912.4的中国专利的优先权，其全部内容通过引用包含于此。
技术领域
本申请属于通信领域，具体涉及一种数据删除和电子设备。
背景技术
目前，电子设备(例如手机)中存储了大量的隐私数据，若用户的手机遗失或弃用时，则需求将用户的隐私数据进行删除，以防用户隐私数据泄露。
因此，为了解决上述问题，可以通过对电子设备进行恢复出厂设置处理。
然而，上述方法中，由于电子设备在进行恢复出厂设置处理时所需时间较长，且仅限在充电时才能进行，因此，并不适用与手机遗失的应用场景，如此，电子设备处理隐私数据的效率较低且灵活性较差。
发明内容
本申请实施例的目的是提供一种数据删除，能够提升电子设备处理隐私数据的效率和灵活性。
第一方面，本申请实施例提供了一种数据删除方法，该方法包括：接收第一指令，第一指令用于指示电子设备删除目标数据；第一指令中包括目标数据的标记信息；响应于第一指令，根据第一指令中的标记信息，从目标存储区域中删除目标数据；其中，目标存储区域包括：重放保护内存块RPMB，或者，用户数据分区UDA和重放保护内存块RPMB。
第二方面，本申请实施例提供了一种数据删除装置，该装置包括：接收模块和删除模块；接收模块，用于接收第一指令，第一指令用于指示电子设备删除目标数据；第一指令中包括目标数据的标记信息。删除模块，用于响应于接收模块接收的第一指令，根据第一指令中的标记信息，从目标存储区域中删除目标数据；其中，目标存储区域包括：重放保护内存块RPMB，或者，用户数据分区UDA和重放保护内存块RPMB。
第三方面，本申请实施例提供了一种电子设备，该电子设备包括处理器和存储器，所述存储器存储可在所述处理器上运行的程序或指令，所述程序或指令被所述处理器执行时实现如第一方面所述的方法的步骤。
第四方面，本申请实施例提供了一种可读存储介质，所述可读存储介质上存储程序或指令，所述程序或指令被处理器执行时实现如第一方面所述的方法的步骤。
第五方面，本申请实施例提供了一种芯片，所述芯片包括处理器和通信接口，所述通信接口和所述处理器耦合，所述处理器用于运行程序或指令，实现如第一方面所述的方法。
第六方面，本申请实施例提供一种计算机程序产品，该程序产品被存储在存储介质中，该程序产品被至少一个处理器执行以实现如第一方面所述的方法。
在本申请实施例中，电子设备可以接收第一指令，第一指令用于指示电子设备删除目标数据；第一指令中包括目标数据的标记信息；响应于第一指令，根据第一指令中的标记信息，从目标存储区域中删除目标数据；其中，目标存储区域包括：重放保 护内存块RPMB，或者，用户数据分区UDA和重放保护内存块RPMB。由于电子设备可以接收用于指示电子设备删除目标数据的第一指令，并根据第一指令中包括的目标数据的标记信息，从RPMB中删除目标数据，或者从UDA和RPMB中删除目标数据。因此，即使在用户的电子设备丢失的情况下，也可以对电子设备的隐私数据进行快速地远程删除处理，如此，提升了电子设备处理隐私数据的效率，提升了电子设备处理隐私数据的灵活性。
附图说明
图1是本申请实施例提供的一种电子设备的存储系统架构图；
图2是本申请实施例提供的一种数据删除方法的流程图；
图3是本申请实施例提供的一种数据存储方法系统架构图之一；
图4是本申请实施例提供的一种数据存储方法系统架构图之二；
图5是本申请实施例提供的一种数据删除方法系统架构图之一；
图6是本申请实施例提供的一种数据删除方法系统架构图之二；
图7是本申请实施例提供的一种数据删除装置的结构示意图
图8是本申请实施例提供的一种电子设备的硬件结构示意图之一；
图9是本申请实施例提供的一种电子设备的硬件结构示意图之二。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚地描述，显然，所描述的实施例是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员获得的所有其他实施例，都属于本申请保护的范围。
本申请的说明书和权利要求书中的术语“第一”、“第二”等是用于区别类似的对象，而不用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便本申请的实施例能够以除了在这里图示或描述的那些以外的顺序实施，且“第一”、“第二”等所区分的对象通常为一类，并不限定对象的个数，例如第一对象可以是一个，也可以是多个。此外，说明书以及权利要求中“和/或”表示所连接对象的至少其中之一，字符“/”，一般表示前后关联对象是一种“或”的关系。
下面结合附图，通过具体的实施例及其应用场景对本申请实施例提供的数据删除方法进行详细地说明。
当用户的电子设备(例如手机)丢失或被盗时，如何能在第一时间快速、高效且安全的远程删除手机上的敏感信息，或者，在用户的手机需求弃用或转让时，如何确保用户的敏感信息已经安全删除，从而使得即使在其他用户获得该手机之后，也无法获取其中的用户敏感信息是急需解决的问题。
然而，目前多数电子设备(移动终端)使用NAND闪存。一个NAND闪存一般由一个或多个闪存芯片组成；一个闪存芯片由一个或多个核心(die)或逻辑单元号(Logical Unit Number，LUN)组成；一个die或LUN由多个平面(plane)组成；一个plane由多个块(block)组成；一个block由多个page组成；一个page由多个单元(cell)组成。其中，cell是闪存执行数据存储的任务的最小工作单位。闪存根据每个cell内可存储的数据量分成单层单元(Single Level Cell，SLC)(1bit/cell)、多层单元((Multi Level Cell，MLC)(2bit/Cell)、三层单元(Triple Level Cell，TLC)(3bit/Cell)和4层单元(Quad-level cells，QLC)(4bit/Cell)，成本依次降低，容量依次增大，耐用度也依次降低。
闪存中的数据具有三种基本操作：读、写和擦除。读写是page的最小操作单位， 擦除是block的最小操作单元。一个闪存有擦除次数限制，理论上，一个闪存的擦除次数为1,000,000。出于性能考虑，NAND闪存通常采用“异地更新”的方式将更新后的数据写入空闲存储页面，而不是原始数据所在的存储页面，只是将原始数据所在的存储页面标记为无效，供后续的垃圾回收(Garbage Collection，GC)时才做物理删除。因此，在NAND闪存做垃圾回收之前，原来的旧数据仍然是存储在闪存上的，攻击者可以通过磁盘读取工具获得用户数据。而传统机械硬盘(Hard Disk Drive，HDD)采用的“就地更新”操作(即将更新后的数据直接覆写(overwrite)/替换原始数据)，其并不适合NAND闪存。
然而，NAND闪存的“异地更新”会在闪存上生成许多无效数据，从而导致更严重的安全威胁，因此，研究NAND闪存上的数据安全删除尤为重要。
目前，闪存可以包括4个分区：BOOT(boot分区)、通用分区(General Purpose Partition，GPP)、重放保护内存块(Replay Protected Memory Block，RPMB)和用户分区(User Data Area，UDA)。
其中，BOOT主要用于系统启动，GPP主要用于存储系统或者用户数据但是，GPP在芯片出厂时，通常不存在，需要主动进行配置后，才会存在，通常情况下，不会为电子设备配置GPP，RPMB主要用于保存安全相关的数据，如密钥、指纹、安全支付相关等数据；UDA主要用于存储系统和用户数据。
本申请实施例提供的数据删除方法主要为了使得电子设备中的数据可以进行数据安全删除，数据安全删除是指：数据删除后，攻击者既不能恢复已删除的数据，也不能获得有关这些数据的任何信息。然而，由于存储系统的复杂性，实现这种数据安全删除是一项具有挑战性的任务。现代存储系统通常由多层组成(例如图1)，在其中一层中执行删除操作通常无法完全安全删除数据，因为可能会在其他层中存在数据泄漏。例如，从应用“照片”里删除一张选定的照片，该删除操作并不能保证所删除的照片真的变得不可访问。在接收到应用“照片”(属于应用层)发出的删除请求后，系统可以简单地修改文件系统层中的元数据(例如，更改块分配表并使被删除的数据无效)，以使照片看起来已经在应用层中被删除。然而，实际内容仍然保存在物理存储介质层中，攻击者可以通过一些工具来恢复物理存储介质中的数据。因此，数据安全删除要求确保所删除的内容在存储系统的每一层都不可访问。
本申请实施例提供的数据删除方法可以基于手机删除UDA分区和RPMB，由于RPMB空间小，目前最大只有16M，因此，其他无法存放的重要敏感数据将会存储在RPMB以外的UDA区，例如，用于指纹认证的指纹模板，其小部分的数据存储在RPMB，而大部分数据存储在UDA区。因此，在手机丢失或被盗时，需要对RPMB中的密钥和指纹等信息进行物理擦除，同时还需要对UDA中的重要数据进行物理擦除。
图1示出了一种电子设备的存储系统架构图，如图1所示，电子设备的存储系统架构图中的各层模块功能如下：
物理存储介质(物理介质)
物理存储介质可以用于存储数据，例如HDD或NAND闪存，其中，物理存储介质始终通过控制器访问。
控制器
控制器的基本功能是将物理存储介质上的数据格式(如电压)转换为上层可以理解的另一种格式(如二进制值)。控制器可以提供标准化且定义明确的硬件接口，例如集成设备电路(Advanced Technology Attachment，ATA)和小型计算机系统接口(Small Computer System Interface，SCSI)，允许从物理存储介质读取数据或将数据写入物理存储介质。由于HDD采用就地更新，因此其控制器通常会将逻辑块地址一 致地映射到物理存储介质上的某个存储位置。相反，由于NAND闪存出于性能考虑，采用异地更新，通常通过FTL或特定于闪存的文件系统进行管理。
设备驱动程序
设备驱动程序可以通过以软件的形式公开一个通用的简单接口来整合对不同类型硬件的访问。块设备驱动程序接口允许读取和写入逻辑地址中的块。块设备驱动程序可以在HDD控制或由闪存转换层(Flash Translation Layer，FTL)封装的NAND闪存上使用。
内存技术设备(Memory Technology Device，MTD)
内存技术设备是另一种设备驱动程序，可以用于直接访问原始NAND闪存。内存技术设备允许读取和写入，但在写入之前必须擦除块，这是在大粒度下发生的。
非排序的块镜像(Unsorted block images，UBI)
非排序的块镜像是另一个访问闪存的接口，它构建在内存技术设备接口之上，可以对使用原始闪存的部分方面进行简化。
文件系统
文件系统负责通过设备驱动程序提供的接口组织物理存储介质上可用块之间的逻辑数据序列。其中包括：(1)构建在块设备之上的块文件系统，例如文件分配表(File allocation table，FAT)32、第四代扩展文件系统(Fourth extended filesystem，EXT4)和新技术文件系统(New Technology File System，NTFS)；(2)建立在MTD设备之上的闪存文件系统，例如，专门为NAND闪存设计的文件系统(Yet Another Flash File System，YAFFS)；(3)UBI文件系统(Unsorted Block Image File System，UBIFS)构建在UBI设备之上。
应用层
应用层可以为用户提供一个界面。
目前，为了确保用户手机中的敏感数据可以进行安全删除，多通过以下五种方式进行实现：
第一种方法：销毁存储介质
例如通过熔炼将存储介质熔化成液态金属，或通过粉碎将存储介质粉碎成无法重建的小块废金属等，使得存储介质上的数据无法恢复。
然而，该方法仅适用于用户弃用手机的应用场景，但并不适用于用户的手机转让、手机丢失或被盗的应用场景。
第二种方法：恢复出厂设置
针对恢复出厂设置的方法，目前包括两种方案
方案a、使用Android安全擦除功能(SecureWipePartition)，即discard命令+覆写0。
然而，通过方案a对手机进行恢复出厂设置时，实测128GB手机恢复出产设置耗时10分钟。
方案b、使用通用闪存存储(Universal Flash Storage，UFS)提供的purge功能实现purge操作安全擦除。
然而，通过方案b对手机进行恢复出厂设置时，其物理擦除耗时较长；且使用该功能需要修改UFS一个全局配置，并且该配置对整个存储系统稳定性可能造成影响，因此，目前该技术领域并不多用purge进行数据安全擦除操作。
由于对手机进行恢复出厂设置的方法的操作时间较长，甚至还限制只有在手机充电情况下才能进行该操作，因此其不适用于手机被盗或丢失的应用场景。
第三种方法：覆写(overwrite)/替换敏感数据
例如将敏感数据生成随机数，并将该随机数写入敏感数据的存储空间，以实现覆 写/替换敏感数据，进而无法从存储介质上恢复敏感数据；不同组织对覆写/替换次数有不同的标准，例如NIST建议至少对存储介质进行覆写/替换3次([T.Grance,M.Stevens,and M.Myers,“Guide to Selecting Information Security Products,”chapter 5.9:Media Sanitizing.National Institute of Standards and Technology(NIST),October 2003])，而Peter Gutmann开发了一种35次数据覆写/替换方案([P.Gutmann,“Secure Deletion of Data from Magnetic and Solid-StateMemory,”In Proceedings of the Sixth USENIX UNIX Security Symposium,pages 77–90,San Jose,CA,July 1996.USENIX Association.])。
然而，由于HDD是基于磁性并能支持“就地更新”的性质，而因为出于性能考虑，NAND闪存通常采用“异地更新”的方式将更新后的数据写入空闲存储页面，而不是原始数据所在的存储页面，只是将原始数据所在的存储页面标记为无效，供后续的垃圾回收(GC)时才做物理删除，因此，在NAND闪存做垃圾回收之前，原来的旧数据仍然是存储在闪存上的，攻击者可以通过工具获得用户数据。如此，该覆写/替换数据方法仅适用于HDD的传统存储介质，并不适用于目前移动终端的NAND闪存，更不适用于手机丢失或被盗的应用场景。
第四种方法：对敏感数据进行加密存储
例如在需要删除指定的敏感数据时，只需要覆写/替换加密敏感数据所对应的密钥即可。
然而，与上述第三种方法相同，该方法不适用于目前移动终端NAND闪存的数据安全删除，更不适用于手机丢失或被盗的应用场景。
第五种方法：对敏感数据进行加密存储
例如在需要删除指定的敏感数据时，仅取消与加密敏感数据所对应密钥的关联。
然而，目前针对手机上的闪存，Android系统所使用的基于文件的加密(File Based Encryption，FBE)就是采用该方案。基于fscrypt的FBE，fscrypt有两个ioctl函数(即FS_IOC_REMOVE_ENCRYPTION_KEY和FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS)可供虚拟文件系统(Virtual File System，VFS)及上层应用调用，用于删除由ioctl函数FS_IOC_ADD_ENCRYPTION_KEY添加到keyring的密钥，但是该函数所删除的密钥并不一定立即从物理存储介质中删除，而是需要等到存储控制器进行垃圾回收(GC)该密钥所在的块时，该密钥才可能从存储介质中进行物理删除。因此，该方法不适用于手机丢失或被盗的应用场景，也不适用于手机弃用或转让的应用场景。
为了实现手机丢失或被盗时可以立即安全删除用户敏感信息，本申请实施例提供了一种数据安全删除方法，由于敏感数据以明文存储后，即使后续对其进行加密存储，也不能确保原来未加密的敏感数据的安全性，因此，对用户敏感数据在第一时间进行加密存储；由于NAND闪存数据的物理擦除是基于块(block)进行操作的，因此，将重要信息(如加密密钥或与密钥生成相关的信息、文件元数据等)存储到闪存里相对比较集中的块，如此，在手机被盗或丢失的情况下，可以立即物理擦除存有上面提到的重要信息的块，由于重要信息所占空间较小，物理擦除时所需的时间也少；因此，在无法获得正确的解密密钥，即使其他攻击者获得了用户手机，也不能解密得到用户敏感信息；并且在弃用或转让手机时，用户除了物理擦除重要信息外，还可以对整个闪存进行恢复出厂设置甚至物理擦除。
因此，在手机被盗或丢失的情况下，由于用户敏感数据已经进行加密存储，为了高效、快速地远程销毁用户敏感数据，可以立即物理删除上面提到的包括敏感数据的加密密钥、或与加密密钥生成相关的信息等重要信息，因此，由于不能获得正确的解密密钥，攻击者即使获得了用户手机，也不能解密得到用户的敏感信息。同时，若用 户需求弃用或转让手机时，用户可以通过电子设备对敏感数据的加密密钥、或与加密密钥生成相关的信息等重要信息进行物理删除，还可以对整个闪存进行恢复出厂设置甚至物理删除闪存上的所有数据。
本申请实施例提供一种数据删除方法，应用于电子设备，图2示出了本申请实施例提供的一种数据删除方法的流程图。如图2所示，本申请实施例提供的数据删除方法可以包括下述的步骤201和步骤202。
步骤201、电子设备接收第一指令。
本申请实施例中，第一指令用于指示电子设备删除目标数据；第一指令中包括目标数据的标记信息。
本申请实施例中，若电子设备接收到用户在目标设备发送的删除目标数据的第一指令，则电子设备可以根据第一指令中包括的目标数据的标记信息，对目标数据进行删除。
可选地，本申请实施例中，上述第一指令可以为与电子设备为不同设备的目标设备发送的，或者，上述第一指令可以为与电子设备为同一个设备的目标设备发送的，即若用户的电子设备丢失或不在用户可获取范围内，则用户可以通过与电子设备为不同设备的目标设备，并登陆终端管理服务器，以向电子设备发送第一指令，从而可以使得电子设备对敏感数据执行远程安全删除操作(例如本申请实施例提供的调用文件系统的数据安全删除函数：fs_secure_deletion(...,flag_I)，其中flag_I为目标数据的标记信息)，为了确保安全性，该操作的逻辑功能在TEE中实现(例如：secure deletion TA)。或者，用户可以对电子设备(即目标设备)进行操作，以触发电子设备进行数据安全删除。
需要说明的是，本申请实施例的方法不适用于手机丢失或被盗时且手机不联网的情况。
本申请实施例中，为了快速、高效且安全地删除闪存上的用户敏感数据，本申请实施例在电子设备的应用层中在创建和存储加密密钥或与密钥生成相关的信息时，需要在文件元数据中增加一个属性标签(目标数据的标记信息)；并在应用层增加数据安全删除逻辑模块。在文件系统层进行存储加密密钥或与密钥生成相关的信息时，需要在相应的函数上增加一个属性标签、同时分配固定的存储逻辑地址；并需增加一个数据安全删除函数。在设备驱动层进行存储加密密钥或与密钥生成相关的信息时，需要在相应的函数上增加一个标记信息；并需增加一个数据安全删除函数。在闪存转换层(FTL)进行存储加密密钥或与密钥生成相关的信息时，需要在相应的函数上增加一个属性标签、需增加一个数据安全删除函数、增加重要信息映射表、支持出发闪存物理删除的命令；并能标记物理块为存储重要信息的块等。
步骤202、电子设备响应于第一指令，根据第一指令中的标记信息，从目标存储区域中删除目标数据。
其中，目标存储区域包括：重放保护内存块RPMB，或者，用户数据分区UDA和重放保护内存块RPMB。
可选地，本申请实施例中，目标数据还包括：数据属性信息，数据属性信息用于标识敏感数据的属性，数据属性信息包括以下至少一项：文件大小、文件权限、文件时间戳、扩展属性、配置信息；数据属性信息与密钥信息同时存储于目标存储区域。
可选地，在本申请实施例提供的第一种实现方式中，上述步骤202中的“根据第一指令中的标记信息，从目标存储区域中删除目标数据”具体可以通过下述的步骤202a至步骤202c实现。
步骤202a、在目标数据存储于RPMB的情况下，电子设备根据第一指令中的标记 信息，通过可信执行环境中的可信应用程序向RPMB发送物理删除请求消息。
本申请实施例中，电子设备可以通过TEE中的secure deletion TA向RPMB发送物理删除消息请求，即RPMB Purge/Sanitizer Enabler Request消息。
需要说明的是，UFS4.0及以后的协议使用Purge命令，eMMC5.1及以后的协议使用Sanitizer命令。
图3示出了一种本申请实施例提供的数据删除方法系统架构图，如图3所示，本申请实施例提供的数据删除方法可以通过图3示出的系统架构对数据进行删除。
步骤202b、电子设备通过RPMB内核驱动程序和文件操作接口将物理删除消息请求发送给RPMB监听器。
本申请实施例中，电子设备可以通过RPMB内核驱动程序(即RPMB kernel driver)和文件操作接口(即REE File Operation Interface)将物理删除消息请求发送到RPMB监听器(即REE侧的RPMB Listener)。
步骤202c、电子设备通过RPMB监听器经由文件系统UFS的控制模块，从RPMB中删除目标数据。
本申请实施例中，电子设备可以通过RPMB经由UFS(即REE侧的eMMC/UFS)的控制模块，从RPMB中删除目标数据。
可选地，本申请实施例中，电子设备可以通过RPMB监听器经由文件系统UFS的控制模块，将闪存中的RPMB分区中存储的目标数据进行物理删除。
可选地，本申请实施例中，在RPMB分区完成物理删除目标数据后，会将RPMB Purge/Sanitizer Enabler Response消息经由原路返回到secure deletion TA。
需要说明的是，上述整个操作过程中，需要经由的各个模块都需增强，从而支持传输RPMB Purge/Sanitizer Enabler Request消息和相应的Response消息。
可选地，在本申请实施例提供的第二种实现方式中，目标数据包括第一目标数据和第二目标数据；上述步骤202中的“根据第一指令中的标记信息，从目标存储区域中删除目标数据”具体可以通过下述的步骤202d实现。
步骤202d、在目标数据存储于RPMB和UDA的情况下，电子设备根据第一指令中的标记信息，从RPMB中删除第一目标数据，并从UDA中删除第二目标数据。
本申请实施例中，若目标数据存储于RPMB和UDA的情况下，电子设备需要根据第一指令中的标记信息，分别从RPMB中删除第一目标数据，并从UDA中删除第二目标数据。
可选地，本申请实施例中，上述步骤202d中的“根据第一指令中的标记信息，从RPMB中删除第一目标数据”具体可以通过下述的步骤202d1至步骤202d3实现。
步骤202d1、电子设备根据第一指令中的标记信息，通过可信执行环境中的可信应用程序向RPMB发送物理删除请求消息。
步骤202d2、电子设备通过RPMB内核驱动程序和文件操作接口将物理删除消息请求发送给RPMB监听器。
步骤202d3、电子设备通过RPMB监听器经由文件系统UFS的控制模块，从RPMB中删除第一目标数据。
需要说明的是，步骤201d1至步骤202d3的具体实现过程可以参考上述步骤202a至步骤202c，此处不再赘述。
可选地，本申请实施例中，上述步骤202d中的“从UDA中删除第二目标数据”具体可以通过下述的步骤202d4和步骤202d5实现。
步骤202d4、电子设备根据第一指令中的标记信息，通过文件系统层的第一删除模块和设备驱动层的第二删除模块，从文件系统层中的固定逻辑页号LPN中对第二目 标数据进行寻址，得到目标虚拟地址。
本申请实施例中，电子设备可以根据第一指令中的标记信息，通过文件系统层的第一删除模块和设备驱动层的第二删除模块，从文件系统层中的固定逻辑页号LPN中对第二目标数据进行寻址，得到目标虚拟地址，从而使得电子设备可以根据目标虚拟地址对第二目标数据进行删除。
可选地，本申请实施例中，本申请实施例中，电子设备可以根据第一指令中的标记信息，通过文件系统层的第一删除函数和设备驱动层的第二删除函数，从文件系统层中的固定逻辑页号LPN中对第二目标数据进行寻址，得到目标虚拟地址，从而使得电子设备可以根据目标虚拟地址对第二目标数据进行删除。
需要说明的是，第一删除模块/函数和第二删除模块/函数中包括标记信息，该标记信息用于确定存储有第二目标数据的目标数据块。
可选地，本申请实施例中，电子设备可以通过文件系统层的预设删除函数和设备驱动层的预设删除函数，根据第一指令和目标数据的标记信息，寻址所有存有第二目标数据的固定逻辑页号LPN，以得到目标虚拟地址。
示例性地，文件系统层的预设删除函数可以为：fs_secure_deletion(...,flag_I)；设备驱动层的预设删除函数可以为：block_secure_deletion(...,flag_I)。
可选地，本申请实施例中，电子设备可以在可信执行环境TEE中增加一个逻辑功能模块，(例如安全删除可信应用程序(secure deletion TA))，该逻辑模块能接收远程服务器上的安全删除指令，以支持用户在丢失手机或手机被盗时，用户通过登录终端管理服务器，远程地执行用户重要数据的安全删除操作。
需要说明的是，该远程执行安全删除需要电子设备处于联网状态。
可选地，本申请实施例中，电子设备可以在应用层增加一个系统管理功能(例如本申请实施例提供的安全删除客户端(secure deletion Client))，以支持用户在弃用或转让旧手机时，可以执行其重要数据的安全删除操作，同时在执行此操作时，需要通过TEE中的secure deletion TA的认证和授权，以防止对敏感数据的误删。
步骤202d5、电子设备通过闪存转换层的预设删除模块，根据目标虚拟地址和标记信息，从闪存转换层的目标映射表中确定存储有第二目标数据的目标数据块，并删除目标数据块中的第二目标数据。
本申请实施例中，电子设备在得到目标虚拟地址之后，可以通过闪存转换层的预设删除模块，根据目标虚拟地址和标记信息，从闪存转换层的目标映射表中确定存储有第二目标数据的目标数据块，并删除目标数据块中的第二目标数据。
示例性地，闪存转换层的预设删除模块可以为：ftl_secure_deletion(...,flag_I)。
需要说明的是，第三删除模块/函数中包括标记信息。
可选地，本申请实施例中，电子设备可以分别在文件系统层(例如本申请实施例的ext4+fscrypt)、设备驱动层、闪存转换层各新增一个函数/模块，如本申请实施例提供的文件系统层的删除函数/模块(fs_secure_deletion(...,flag_I))、设备驱动层的删除函数/模块(block_secure_deletion(...,flag_I))、闪存转换层的删除函数/模块(ftl_secure_deletion(...,flag_I))，从而使得电子设备可以根据新增的删除模块，对第二目标数据进行删除。
可选地，本申请实施例中，上述步骤202d5中的“删除目标数据块中的第二目标数据”具体可以通过下述的步骤a或步骤b实现。
步骤a、电子设备通过控制器启动垃圾回收，并对目标数据块进行回收。
可选地，本申请实施例中，电子设备可以在闪存转换层修改垃圾回收(GC)功能，使得闪存转换层的删除函数(ftl_secure_deletion(...,flag_I))可以触发GC主动回收带 有标记信息的目标数据块。
步骤b、电子设备通过控制器调用硬件物理删除命令，从目标数据块中删除第二目标数据。
可选地，本申请实施例中，电子设备可以在闪存转换层调用硬件物理删除命令(例如安全擦除(secure erase)，安全删除(secure trim)，sanitize,purge等)，使得删除函数(ftl_secure_deletion(...,flag_I))能根据目标映射表主动触发闪存物理删除命令的调用，从而可以从目标数据块汇总删除第二目标数据。
需要说明的是，物理删除命令的名称，与闪存的厂家、eMMC的版本相关)。
图4示出了一种本申请实施例提供的数据删除方法系统架构图，如图4所示，本申请实施例提供的数据删除方法可以通过图4示出的系统架构图对数据进行删除。
如图4所示，本申请实施例提供的数据删除方法可以通过下述的步骤11至步骤14实现。
步骤11、电子设备在TEE中增加一个逻辑功能模块，示例性地，在TEE中增加安全删除TA，即：在secure deletion TA。
步骤12、在电子设备接收到用户对重要敏感数据(即：第二目标数据)执行安全删除操作，即：第一指令(secure deletion Client)，且该第一指令经过相关认证和授权(例如：authentication and authorization in secure deletion TA)的情况下，根据第一指令中的flag_I，调用：fs_secure_deletion(...,flag_I)，即文件系统层的删除模块。
步骤13、电子设备在文件系统层调用：block_secure_deletion(...,flag_I)，即设备驱动层的删除模块，并根据flag_I，从文件系统层中的固定逻辑页号LPN中对第二目标数据进行寻址，得到目标虚拟地址。
步骤14、电子设备在设备驱动层调用：ftl_secure_deletion(...,flag_I)，即闪存转换层的删除模块，并根据flag_I，在目标映射表中确定存储有第二目标数据的目标数据块，并对目标数据块执行：通过控制器启动垃圾回收，以对目标数据块进行回收；或者，执行通过控制器调用硬件物理删除命令，从目标数据块中删除第二目标数据，以分别从软件闪存转换层(software FTL)和硬件闪存转换层对第二目标数据进行删除。
本申请实施例提供一种数据删除方法，在本申请实施例中，电子设备可以接收第一指令，第一指令用于指示电子设备删除目标数据；第一指令中包括目标数据的标记信息；响应于第一指令，根据第一指令中的标记信息，从目标存储区域中删除目标数据；其中，目标存储区域包括：重放保护内存块RPMB，或者，用户数据分区UDA和重放保护内存块RPMB。由于电子设备可以接收用于指示电子设备删除目标数据的第一指令，并根据第一指令中包括的目标数据的标记信息，从RPMB中删除目标数据，或者从UDA和RPMB中删除目标数据。因此，即使在用户的电子设备丢失的情况下，也可以对电子设备的隐私数据进行远程删除处理，如此，提升了电子设备处理隐私数据的效率，提升了电子设备处理隐私数据的灵活性。
可选地，本申请实施例中，目标数据包括加密处理后的密钥信息；本申请实施例提供的数据删除方法还包括下述的步骤301和步骤302。
步骤301、电子设备对敏感数据的加密密钥、生成加密密钥的密钥素材中的任何一项进行加密，以形成加密处理后的密钥信息。
可选地，本申请实施例中，在电子设备的敏感数据第一次产生的情况下，可以采用已有的加密密钥或与密钥生成相关的信息对敏感数据的加密密钥、生成加密密钥的密钥素材中的任何一项进行加密，或者，系统相关功能(如密钥或密钥素材生成功能：key/key_material generation process)可以会为该敏感数据的加密密钥生成一个加密密钥或与密钥生成相关的信息(如随机数、初始化向量、时间戳、文件标识等)。
可选地，本申请实施例中，电子设备可以采用已有的加密系统，例如与ext4/F2FS/UBIFS集成在一起的fscrypt、或者位于VFS和ext4/F2FS/UBIFS之间的eCryptfs、EncFS、gocryptfs等对敏感数据的加密密钥、生成加密密钥的密钥素材中的任何一项进行加密。
可选地，本申请实施例中，电子设备的系统相关功能(如密钥或密钥素材生成功能：key/key_material generation process)从可信执行环境TEE的Keymaster获得相关密钥对上述敏感数据的加密密钥、生成加密密钥的密钥素材中的任何一项进行加密。
需要说明的是，由于目前的加密文件系统，并不支持文件的元数据加密，因此，在此只能对敏感数据的加密密钥、生成加密密钥的密钥素材中的任何一项等进行加密。
步骤302、电子设备将加密处理后的密钥信息存储在目标存储区域。
其中，生成加密密钥的密钥素材包括以下至少一项：一个随机数，初始化向量、时间戳以及文件标识。
本申请实施例中，在生成加密处理后的密钥信息之后，电子设备可以将加密处理后的密钥信息存储在目标存储区域。
可选地，本申请实施例中，在电子设备需求将加密处理后的密钥信息以文件方式进行存储时，在加密处理后的密钥信息中增加一个标记信息(属性标签(如flag_I))，并通过ext4/F2FS/UBIFS+fscrypt(例如ext4索引节点inode数据结构中的预留字段)和设备驱动层将加密处理后的密钥信息传递到闪存转换层(Flash Translation Layer，FTL)，并通过FTL将加密处理后的密钥信息和属性标签存储在内存中。
图5示出了一种本申请实施例提供的数据存储方法系统架构图，如图5所示，电子设备可以将加密处理后的密钥信息按照图5提供的系统架构进行加密存储，以便后续能进行快速、高效地进行物理删除。
如图5所示，本申请实施例提供的数据存储方法可以通过下述的步骤21至步骤26实现。
步骤21、电子设备可以在TEE中增加一个逻辑功能模块，示例性地，在TEE中增加密钥信息存储TA，即：Keymaster TA。
步骤22、电子设备在应用层通过系统相关功能，例如：key/key_material generation process，从TEE的Keymaster中获取相关密钥对敏感数据的加密密钥、生成加密密钥的密钥素材中的任何一项进行加密，以形成加密处理后的密钥信息。
步骤23、电子设备通过系统相关功能，例如：key/key_material generation process，根据flag_I(即标记信息)和文件系统层的预设写入模块，生成并调用write_to_fs([encrypted]key/random/IV，...，flag_I)，即：第一写入模块，以对加密处理后的密钥信息进行存储。
步骤24、电子设备在文件系统层根据flag_I和设备驱动层的预设写入模块，生成并调用write_to_block([encrypted]key/random/IV,...,flag_I))，即：第三写入模块，以对加密处理后的密钥信息进行存储，并根据flag_I，从固定的逻辑页号LPN中为加密处理后的密钥信息分配目标虚拟地址。
步骤25、电子设备在设备驱动层根据flag_I和闪存转换层的预设写入模块，生成并调用write_to_ftl([encrypted]key/random/IV,...,flag_I)，即：第二写入模块，以对加密处理后的密钥信息进行存储。
步骤26、电子设备在闪存转换层中建立目标映射表，然后根据flag_I，在目标映射表中，为加密处理后的密钥信息分配目标数据块，并将加密处理后的密钥信息存储在目标映射表中的目标数据块。
需要说明的是，上述加密处理后的密钥信息均采用图5提供的系统架构图进行存 储。
本申请实施例中，由于敏感数据以明文存储后，即使后续对其进行加密存储，也不能确保原来未加密的敏感数据的安全性；因此，在用户敏感数据第一时间产生时便立即进行加密，得到加密处理后的密钥信息，并将加密处理后的密钥信息存储至目标存储区域，从而可以提升数据存储的安全性，并在用户需求删除数据时，快速高效地对敏感数据进行物理删除。
可选地，在本申请实施例提供的第一种实现方式中，上述步骤301具体可以通过下述的步骤301a至步骤301c实现。
步骤301a、电子设备在应用层启动可信执行环境中的应用层的对应的可信应用程序。
本申请实施例中，若一个应用程序(例如APP1)需求将与其关联的密钥信息、敏感数据等重要信息存储在RPMB，则可以启动可信执行环境(Trusted Execution Environment，TEE)中对应的可信应用程序(Trusted Application，TA)(例如第一TA)。
图6示出了一种本申请实施例提供的数据存储方法系统架构图，如图6所示，电子设备可以将目标数据按照图6提供的系统架构进行加密存储，以便后续能进行快速、高效地进行物理删除。
步骤301b、电子设备基于应用层的对应可信应用程序调用RPMB对应的可信应用程序，将敏感数据的加密密钥、生成加密密钥的密钥素材中任何一项从应用层发送至RPMB的可信应用程序。
本申请实施例中，电子设备可以通过第一TA调用用于读写RPMB的可信应用程序(例如第二TA)，以将敏感数据的加密密钥、生成加密密钥的密钥素材中任何一项从应用层发送至RPMB，然后可以通过第二TA调用加密模块对第一TA发送的数据进行计算封装，从而可以将敏感数据的加密密钥、生成加密密钥的密钥素材中任何一项发送至RPMB的可信应用程序。
步骤301c、电子设备通过RPMB对应的可信应用程序对敏感数据的加密密钥、生成加密密钥的密钥素材中的任何一项进行加密，以形成加密处理后的密钥信息。
本申请实施例中，电子设备在RPMB的可信应用程序接收到敏感数据的加密密钥、生成加密密钥的密钥素材中任何一项之后，可以通过RPMB对应的可信应用程序对敏感数据的加密密钥、生成加密密钥的密钥素材中的任何一项进行加密，以形成加密处理后的密钥信息，从而电子设备可以对加密处理后的密钥信息进行存储。
可选地，在本申请实施例提供的第一种实现方式中，目标数据至少部分存储于RPMB，上述步骤302具体可以通过下述的步骤302a至步骤302c实现。
步骤302a、电子设备通过RPMB对应的可信应用程序，将加密处理后的密钥信息和文件操作系统命令通过RPMB内核驱动程序发送给RPMB监听器。
可选地，本申请实施例中，电子设备可以通过RPMB对应的可信应用程序和文件操作系统命令(REE文件操作系统命令)，将加密处理后的密钥信息和文件操作系统命令通过RPMB内核驱动程序(即RPMB kernel driver)发送给位于REE侧的RPMB监听器(即RPMB listener)，从而触发电子设备对加密处理后的密钥信息进行存储。
步骤302b、电子设备通过RPMB监听器，将加密处理后的密钥信息和文件操作系统命令发送给UFS。
可选地，本申请实施例中，电子设备在通过RPMB监听器接收到加密处理后的密钥信息和文件操作系统命令之后，可以通过REE侧的RPMB listener将加密处理后的密钥信息和文件操作系统命令转发给eMMC/UFS。
步骤302c、电子设备通过UFS基于文件操作系统命令，将加密处理后的密钥信息存储至RPMB。
可选地，本申请实施例中，电子设备在通过UFS接收到加密处理后的密钥信息以及文件操作系统命令之后，可以通过UFS基于文件操作系统命令，从而触发电子设备将加密处理后的密钥信息存储至RPMB
可选地，在本申请实施例提供的第一种实现方式中，目标数据至少部分存储于UDA，上述步骤302具体可以通过下述的步骤302d至步骤302h实现。
步骤302d、电子设备根据标记信息和文件系统层的预设写入模块，调用第一写入模块。
其中，第一写入模块包括标记信息。
本申请实施例中，在目标数据的至少部分存储于UDA的情况下，电子设备可以根据标记信息和文件系统层的预设写入模块，调用第一写入模块，以使得电子设备将目标数据的至少部分进行传输，即对加密处理后的密钥信息进行传输。
可选地，本申请实施例中，电子设备根据标记信息和文件系统层的预设写入函数，调用第一写入函数。
示例性地，文件系统层的预设写入函数可以为：write_to_fs([encrypted]key/random/IV,…)。
示例性地，第一写入函数可以为：write_to_fs([encrypted]key/random/IV,…,flag_I)。
可选地，本申请实施例中，电子设备可以根据标记信息和文件系统层的预设写入函数，生成第一写入函数，即在文件系统层的预设函数中增加一个输入参数：flag_I，以生成第一写入函数，使得该第一写入函数可以与其他需要存储的数据进行区分。
步骤302e、电子设备通过第一写入模块，将加密处理后的密钥信息，从应用层发送至文件系统层。
本申请实施例中，电子设备可以调用第一写入模块，从而可以通过第一写入模块，将加密处理后的密钥信息，从应用层发送至文件系统层。
可选地，本申请实施例中，电子设备通过第一写入函数，将加密处理后的密钥信息，从应用层发送至文件系统层。
可选地，本申请实施例中，电子设备的系统相关功能(例如：密钥或密钥素材生成功能，key/key_material generation process)会调用第一写入函数/模块，即基于标记信息与文件系统的预设写入函数生成的写入函数/模块(即write_to_fs([encrypted]key/random/IV,...,flag_I))，将加密处理后的密钥信息从应用层发送至文件系统层，以对加密处理后的密钥信息进行存储。
步骤302f、电子设备根据标记信息，从文件系统层中的逻辑页号LPN中为加密处理后的密钥信息分配目标虚拟地址。
本申请实施例中，电子设备可以根据目标记信息，从文件系统层的逻辑页号LPN中为加密处理后的密钥信息分配合适的虚拟地址，即目标虚拟地址，该逻辑页号LPN可以是连续的，也可以是非连续的。
可选地，本申请实施例中，ext4/F2FS/UBIFS+fscrypt通过文件系统层分配给目标数据的逻辑页号LPN是固定的，但固定的逻辑页号LPN可以是连续，也可以是不连续。
步骤302g、电子设备将加密处理后的密钥信息和目标虚拟地址从文件系统层经由设备驱动层发送至闪存转换层。
本申请实施例中，电子设备在根据标记信息，从文件系统层中的逻辑页号LPN中为加密处理后的密钥信息分配目标虚拟地址之后，可以将加密处理后的密钥信息和目 标虚拟地址从文件系统层经由设备驱动层发送至闪存转换层。
可选地，本申请实施例中，电子设备可以根据标记信息和闪存转换层的预设写入函数，将加密处理后的密钥信息和目标虚拟地址从文件系统层经由设备驱动层发送至闪存转换层。
可选地，本申请实施例中，上述步骤302g具体可以通过下述的步骤302g1至步骤302g4实现。
步骤302g1、电子设备根据标记信息和设备驱动层的预设写入模块，调用第三写入模块。
其中，第三写入模块包括标记信息。
可选地，本申请实施例中，电子设备根据标记信息和设备驱动层的预设写入模块，调用第三写入模块，以使得电子设备将加密处理后的密钥信息和目标虚拟地址进行传输。
可选地，本申请实施例中，电子设备根据标记信息和设备驱动层的预设写入函数，调用第三写入函数。
可选地，本申请实施例中，电子设备可以根据标记信息和设备驱动层的预设写入函数，生成第三写入函数，即在设备驱动层的预设函数中增加一个输入参数：flag_I，以生成第三写入函数，该第三写入函数可以与其他需要存储的数据进行区分。
示例性地，设备驱动层的预设写入函数可以为：
write_to_block([encrypted]key/random/IV,…)。
示例性地，第一写入函数可以为：
write_to_block([encrypted]key/random/IV,…,flag_I)。
可选地，本申请实施例中，电子设备的系统相关功能(例如：密钥或密钥素材生成功能，key/key_material generation process)会调用第二写入函数/模块，即基于标记信息与设备驱动层的预设写入函数生成的写入函数/模块(即write_to_block([encrypted]key/random/IV,...,flag_I))，将加密处理后的密钥信息和目标虚拟地址从文件系统层发送至设备驱动层，以从设备驱动层发送至闪存转换层。
步骤302g2、电子设备通过第三写入模块，将加密处理后的密钥信息和目标虚拟地址从文件系统层发送至设备驱动层。
本申请实例中，电子设备在根据标记信息和设备驱动层的预设写入模块，调用第三写入模块之后，可以通过第三写入模块，将加密处理后的密钥信息和目标虚拟地址从文件系统层发送至设备驱动层。
步骤302g3、电子设备根据标记信息和闪存转换层的预设写入模块，调用第二写入模块。
本申请实施例中，电子设备在通过第三写入模块，将加密处理后的密钥信息和目标虚拟地址从文件系统层发送至设备驱动层之后，可以根据标记信息和闪存转换层的预设写入模块，调用第二写入模块。
可选地，本申请实施例中，电子设备根据标记信息和闪存转换层的预设写入函数，调用第二写入函数。
可选地，本申请实施例中，电子设备可以根据标记信息和闪存转换层的预设写入函数，生成第二写入函数，即在闪存转换层的预设函数中增加一个输入参数：flag_I，以生成第二写入函数。
步骤302g4、电子设备通过第二写入模块，将加密处理后的密钥信息和目标虚拟地址从设备驱动层发送至闪存转换层。
本申请实施例中，电子设备在根据标记信息和闪存转换层的预设写入模块，调用 第二写入模块之后，可以通过第二写入模块，将加密处理后的密钥信息和目标虚拟地址从设备驱动层发送至闪存转换层。
可选地，本申请实施例中，电子设备的系统相关功能(例如：密钥或密钥素材生成功能，key/key_material generation process)会调用第二写入函数/模块，即基于标记信息与闪存转换层的预设写入函数生成的第二写入函数/模块write_to_ftl([encrypted]key/random/IV,...,flag_I))，并加密处理后的密钥信息和目标虚拟地址从设备驱动层发送至闪存转换层，以对加密处理后的密钥信息和目标虚拟地址进行存储。
步骤302h、电子设备在闪存转换层中建立目标映射表，通过第二写入模块，将加密处理后的密钥信息存储在目标映射表中的目标数据块中。
其中，第二写入模块为闪存转换层对应的写入模块，第二写入模块中包括标记信息；标记信息用于确定目标数据块。
本申请实施例中，电子设备可以在闪存转换层中建立目标映射表，并通过第二写入模块，将接收到的加密处理后的密钥信息存储在目标映射表中的目标数据块中，以对加密处理后的密钥信息存储进行存储。
可选地，本申请实施例中，电子设备闪存转换层中建立目标映射表，并通过第二写入函数，将加密处理后的密钥信息存储在目标映射表中的目标数据块中。
可选地，本申请实施例中，电子设备可以根据第二写入函数/模块中的flag_I，在闪存转换层中建立一个目标映射表，用于管理闪存中所有存储敏感数据(例如第一数据和第一信息)的物理块(例如第一数据块)，该目标信息映射表中包括以下至少一项：逻辑页号(Logical Page Number，LPN)、逻辑块号(Logical Block Number，LBN)、物理块号(Physical Block Number，PBN)、目标数据的标记信息(flag_I)等。
可选地，本申请实施例中，该目标映射表可以存储在闪存中，其可以称之为物理块或重要信息物理块(其是一种map block，其它已有几种物理块有data/log/free/dirty blocks)。
需要说明的是，在电子设备的系统启动时，上述目标映射表会缓存在内存中。
可选地，本申请实施例中，FTL根据写入第二写入函数/模块(例如write_to_ftl([encrypted]key/random/IV,...,flag_I))中的flag_I，在目标映射表中，寻找合适的物理块block，然后按照已有的方式写入新数据或更新现有的数据；若发生物理块的地址变更，需要将新的物理块号同步到该目标映射表中，同时该新的物理块的元数据状态值更改为flag_I。
可选地，本申请实施例中，在物理块(block)元数据的状态值增加一个，即属性标签flag_I(其它已有状态值是：regular,sequentially written,randomly written,，还有其它系统自定义的system specific purposes)。
需要说明的是，若FTL的地址映射采用混合模式(hybrid FTL)，则在FTL是page-level或block-level的情况下，该目标映射表的中包括的信息会有所不同。
本申请实施例提供的数据删除方法，执行主体可以为数据删除装置。本申请实施例中以数据删除装置执行数据删除方法为例，说明本申请实施例提供的数据删除装置。
图7示出了本申请实施例中涉及的数据删除装置的一种可能的结构示意图。如图7所示，该数据删除装置40可以包括：接收模块41和删除模块42。
其中，接收模块41，用于接收第一指令，第一指令用于指示电子设备删除目标数据；第一指令中包括目标数据的标记信息。删除模块42，用于响应于接收模块41接收的第一指令，根据第一指令中的标记信息，从目标存储区域中删除目标数据；其中，目标存储区域包括：重放保护内存块RPMB，或者，用户数据分区UDA和重放保护内存块RPMB。
本申请实施例提供一种数据删除装置，由于电子设备可以接收用于指示电子设备删除目标数据的第一指令，并根据第一指令中包括的目标数据的标记信息，从RPMB中删除目标数据，或者从UDA和RPMB中删除目标数据。因此，即使在用户的电子设备丢失的情况下，也可以对电子设备的隐私数据进行删除处理，如此，提升了电子设备处理隐私数据的效率，提升了电子设备处理隐私数据的灵活性。
在一种可能实现的方式中，目标数据包括加密处理后的密钥信息；数据删除装置40还包括：加密模块和存储模块。加密模块，用于对敏感数据的加密密钥、生成加密密钥的密钥素材中的任何一项进行加密，以形成加密处理后的密钥信息。存储模块，用于将加密处理后的密钥信息存储在目标存储区域。其中，生成加密密钥的密钥素材包括以下至少一项：一个随机数，初始化向量、时间戳以及文件标识。
在一种可能实现的方式中，删除模块42，具体用于在目标数据存储于RPMB的情况下，根据第一指令中的标记信息，通过可信执行环境中的可信应用程序向RPMB发送物理删除请求消息；通过RPMB内核驱动程序和文件操作接口将物理删除消息请求发送给RPMB监听器；通过RPMB监听器经由文件系统UFS的控制模块，从RPMB中删除目标数据。
在一种可能实现的方式中，删除模块42，具体用于在目标数据存储于RPMB和UDA的情况下，根据第一指令中的标记信息，从RPMB中删除第一目标数据，并从UDA中删除第二目标数据。
在一种可能实现的方式中，删除模块42，具体用于根据第一指令中的标记信息，通过可信执行环境中的可信应用程序向RPMB发送物理删除请求消息；通过RPMB内核驱动程序和文件操作接口将物理删除消息请求发送给RPMB监听器；通过RPMB监听器经由文件系统UFS的控制模块，从RPMB中删除第一目标数据。
在一种可能实现的方式中，删除模块42，具体用于根据第一指令中的标记信息，通过文件系统层的第一删除模块42和设备驱动层的第二删除模块42，从文件系统层中的固定逻辑页号LPN中对第二目标数据进行寻址，得到目标虚拟地址；通过闪存转换层的预设删除模块42，根据目标虚拟地址和标记信息，从闪存转换层的目标映射表中确定存储有第二目标数据的目标数据块，并删除目标数据块中的第二目标数据。
在一种可能实现的方式中，删除模块42，具体用于通过控制器启动垃圾回收，并对目标数据块进行回收；或者，通过控制器调用硬件物理删除命令，从目标数据块中删除第二目标数据。
在一种可能实现的方式中，加密模块，具体用于在应用层启动可信执行环境中的应用层的对应的可信应用程序；基于应用层的对应可信应用程序调用RPMB对应的可信应用程序，将敏感数据的加密密钥、生成加密密钥的密钥素材中任何一项从应用层发送至RPMB的可信应用程序；通过RPMB对应的可信应用程序对敏感数据的加密密钥、生成加密密钥的密钥素材中的任何一项进行加密，以形成加密处理后的密钥信息；
在一种可能实现的方式中，目标数据至少部分存储于RPMB，存储模块，具体用于通过RPMB对应的可信应用程序，将加密处理后的密钥信息和文件操作系统命令通过RPMB内核驱动程序发送给RPMB监听器；通过RPMB监听器，将加密处理后的密钥信息和文件操作系统命令发送给UFS；通过UFS基于文件操作系统命令，将加密处理后的密钥信息存储至RPMB。
在一种可能实现的方式中，目标数据至少部分存储于UDA，存储模块，具体用于根据标记信息和文件系统层的预设写入模块，调用第一写入模块，第一写入模块包括标记信息；通过第一写入模块，将加密处理后的密钥信息，从应用层发送至文件系统层；根据标记信息，从文件系统层中的逻辑页号LPN中为加密处理后的密钥信息分配 目标虚拟地址；将加密处理后的密钥信息和目标虚拟地址从文件系统层经由设备驱动层发送至闪存转换层；在闪存转换层中建立目标映射表，并通过第二写入模块，将加密处理后的密钥信息存储在目标映射表中的目标数据块中，第二写入模块为闪存转换层对应的写入模块，第二写入模块中包括标记信息；标记信息用于确定目标数据块。
在一种可能实现的方式中，存储模块，具体用于根据标记信息和设备驱动层的预设写入模块，调用第三写入模块，第三写入模块包括标记信息；通过第三写入模块，将加密处理后的密钥信息和目标虚拟地址从文件系统层发送至设备驱动层；根据标记信息和闪存转换层的预设写入模块，调用第二写入模块；通过第二写入模块，将加密处理后的密钥信息和目标虚拟地址从设备驱动层发送至闪存转换层。
在一种可能实现的方式中，目标数据还包括：数据属性信息，数据属性信息用于标识敏感数据的属性，数据属性信息包括以下至少一项：文件大小、文件权限、文件时间戳、扩展属性、配置信息；数据属性信息与密钥信息同时存储于目标存储区域。
本申请实施例中的数据删除装置可以是电子设备，也可以是电子设备中的部件，例如集成电路或芯片。该电子设备可以是终端，也可以为除终端之外的其他设备。示例性的，电子设备可以为手机、平板电脑、笔记本电脑、掌上电脑、车载电子设备、移动上网装置(Mobile Internet Device，MID)、增强现实(augmented reality，AR)/虚拟现实(virtual reality，VR)设备、机器人、可穿戴设备、超级移动个人计算机(ultra-mobile personal computer，UMPC)、上网本或者个人数字助理(personal digital assistant，PDA)等，还可以为服务器、网络附属存储器(Network Attached Storage，NAS)、个人计算机(personal computer，PC)、电视机(television，TV)、柜员机或者自助机等，本申请实施例不作具体限定。
本申请实施例中的数据删除装置可以为具有操作系统的装置。该操作系统可以为安卓(Android)操作系统，可以为ios操作系统，还可以为其他可能的操作系统，本申请实施例不作具体限定。
本申请实施例提供的数据删除装置能够实现图1至图6的方法实施例实现的各个过程，为避免重复，这里不再赘述。
可选地，如图8所示，本申请实施例还提供一种电子设备500，包括处理器501和存储器502，存储器502上存储有可在所述处理器501上运行的程序或指令，该程序或指令被处理器501执行时实现上述数据删除方法实施例的各个步骤，且能达到相同的技术效果，为避免重复，这里不再赘述。
需要说明的是，本申请实施例中的电子设备包括上述所述的移动电子设备和非移动电子设备。
图9为实现本申请实施例的一种电子设备的硬件结构示意图。
该电子设备100包括但不限于：射频单元101、网络模块102、音频输出单元103、输入单元104、传感器105、显示单元106、用户输入单元107、接口单元108、存储器109、以及处理器110等部件。
本领域技术人员可以理解，电子设备100还可以包括给各个部件供电的电源(比如电池)，电源可以通过电源管理系统与处理器110逻辑相连，从而通过电源管理系统实现管理充电、放电、以及功耗管理等功能。图9中示出的电子设备结构并不构成对电子设备的限定，电子设备可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置，在此不再赘述。
其中，处理器110，用于接收第一指令，第一指令用于指示电子设备删除目标数据；第一指令中包括目标数据的标记信息，并响应于第一指令，根据第一指令中的标记信息，从目标存储区域中删除目标数据；其中，目标存储区域包括：重放保护内存 块RPMB，或者，用户数据分区UDA和重放保护内存块RPMB。
本申请实施例提供一种电子设备，由于电子设备可以接收用于指示电子设备删除目标数据的第一指令，并根据第一指令中包括的目标数据的标记信息，从RPMB中删除目标数据，或者从UDA和RPMB中删除目标数据。因此，即使在用户的电子设备丢失的情况下，也可以对电子设备的隐私数据进行删除处理，如此，提升了电子设备处理隐私数据的效率，提升了电子设备处理隐私数据的灵活性。
可选地，本申请实施例中，目标数据包括加密处理后的密钥信息；处理器110，用于对敏感数据的加密密钥、生成加密密钥的密钥素材中的任何一项进行加密，以形成加密处理后的密钥信息。存储器109，用于将加密处理后的密钥信息存储在目标存储区域。其中，生成加密密钥的密钥素材包括以下至少一项：一个随机数，初始化向量、时间戳以及文件标识。
可选地，本申请实施例中，处理器110，具体用于在目标数据存储于RPMB的情况下，根据第一指令中的标记信息，通过可信执行环境中的可信应用程序向RPMB发送物理删除请求消息；通过RPMB内核驱动程序和文件操作接口将物理删除消息请求发送给RPMB监听器；通过RPMB监听器经由文件系统UFS的控制模块，从RPMB中删除目标数据。
可选地，本申请实施例中，处理器110，具体用于在目标数据存储于RPMB和UDA的情况下，根据第一指令中的标记信息，从RPMB中删除第一目标数据，并从UDA中删除第二目标数据。
可选地，本申请实施例中，处理器110，具体用于根据第一指令中的标记信息，通过可信执行环境中的可信应用程序向RPMB发送物理删除请求消息；通过RPMB内核驱动程序和文件操作接口将物理删除消息请求发送给RPMB监听器；通过RPMB监听器经由文件系统UFS的控制模块，从RPMB中删除第一目标数据。
可选地，本申请实施例中，处理器110，具体用于根据第一指令中的标记信息，通过文件系统层的第一处理器110和设备驱动层的第二处理器110，从文件系统层中的固定逻辑页号LPN中对第二目标数据进行寻址，得到目标虚拟地址；通过闪存转换层的预设处理器110，根据目标虚拟地址和标记信息，从闪存转换层的目标映射表中确定存储有第二目标数据的目标数据块，并删除目标数据块中的第二目标数据。
可选地，本申请实施例中，处理器110，具体用于通过控制器启动垃圾回收，并对目标数据块进行回收；或者，通过控制器调用硬件物理删除命令，从目标数据块中删除第二目标数据。
可选地，本申请实施例中，处理器110，具体用于在应用层启动可信执行环境中的应用层的对应的可信应用程序；基于应用层的对应可信应用程序调用RPMB对应的可信应用程序，将敏感数据的加密密钥、生成加密密钥的密钥素材中任何一项从应用层发送至RPMB的可信应用程序；通过RPMB对应的可信应用程序对敏感数据的加密密钥、生成加密密钥的密钥素材中的任何一项进行加密，以形成加密处理后的密钥信息；
可选地，本申请实施例中，目标数据至少部分存储于RPMB，存储器109，具体用于通过RPMB对应的可信应用程序，将加密处理后的密钥信息和文件操作系统命令通过RPMB内核驱动程序发送给RPMB监听器；通过RPMB监听器，将加密处理后的密钥信息和文件操作系统命令发送给UFS；通过UFS基于文件操作系统命令，将加密处理后的密钥信息存储至RPMB。
可选地，本申请实施例中，目标数据至少部分存储于UDA，存储器109，具体用于根据标记信息和文件系统层的预设写入模块，调用第一写入模块，第一写入模块包 括标记信息；通过第一写入模块，将加密处理后的密钥信息，从应用层发送至文件系统层；根据标记信息，从文件系统层中的逻辑页号LPN中为加密处理后的密钥信息分配目标虚拟地址；将加密处理后的密钥信息和目标虚拟地址从文件系统层经由设备驱动层发送至闪存转换层；在闪存转换层中建立目标映射表，并通过第二写入模块，将加密处理后的密钥信息存储在目标映射表中的目标数据块中，第二写入模块为闪存转换层对应的写入模块，第二写入模块中包括标记信息；标记信息用于确定目标数据块。
可选地，本申请实施例中，存储器109，具体用于根据标记信息和设备驱动层的预设写入模块，调用第三写入模块，第三写入模块中包括标记信息；通过第三写入模块，将加密处理后的密钥信息和目标虚拟地址从文件系统层发送至设备驱动层；根据标记信息和闪存转换层的预设写入模块，调用第二写入模块；通过第二写入模块，将加密处理后的密钥信息和目标虚拟地址从设备驱动层发送至闪存转换层。
可选地，本申请实施例中，目标数据还包括：数据属性信息，数据属性信息用于标识敏感数据的属性，数据属性信息包括以下至少一项：文件大小、文件权限、文件时间戳、扩展属性、配置信息；数据属性信息与密钥信息同时存储于目标存储区域。
应理解的是，本申请实施例中，输入单元104可以包括图形处理器(Graphics Processing Unit，GPU)1041和麦克风1042，图形处理器1041对在视频捕获模式或图像捕获模式中由图像捕获装置(如摄像头)获得的静态图片或视频的图像数据进行处理。显示单元106可包括显示面板1061，可以采用液晶显示器、有机发光二极管等形式来配置显示面板1061。用户输入单元107包括触控面板1071以及其他输入设备1072中的至少一种。触控面板1071，也称为触摸屏。触控面板1071可包括触摸检测装置和触摸控制器两个部分。其他输入设备1072可以包括但不限于物理键盘、功能键(比如音量控制按键、开关按键等)、轨迹球、鼠标、操作杆，在此不再赘述。
存储器109可用于存储软件程序以及各种数据。存储器109可主要包括存储程序或指令的第一存储区和存储数据的第二存储区，其中，第一存储区可存储操作系统、至少一个功能所需的应用程序或指令(比如声音播放功能、图像播放功能等)等。此外，存储器109可以包括易失性存储器或非易失性存储器，或者，存储器109可以包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(Read-Only Memory，ROM)、可编程只读存储器(Programmable ROM，PROM)、可擦除可编程只读存储器(Erasable PROM，EPROM)、电可擦除可编程只读存储器(Electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(Random Access Memory，RAM)，静态随机存取存储器(Static RAM，SRAM)、动态随机存取存储器(Dynamic RAM，DRAM)、同步动态随机存取存储器(Synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(Double Data Rate SDRAM，DDRSDRAM)、增强型同步动态随机存取存储器(Enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(Synch link DRAM，SLDRAM)和直接内存总线随机存取存储器(Direct Rambus RAM，DRRAM)。本申请实施例中的存储器109包括但不限于这些和任意其它适合类型的存储器。
处理器110可包括一个或多个处理单元；可选的，处理器110集成应用处理器和调制解调处理器，其中，应用处理器主要处理涉及操作系统、用户界面和应用程序等的操作，调制解调处理器主要处理无线通信信号，如基带处理器。可以理解的是，上述调制解调处理器也可以不集成到处理器110中。
本申请实施例还提供一种可读存储介质，所述可读存储介质上存储有程序或指令，该程序或指令被处理器执行时实现上述数据删除方法实施例的各个过程，且能达到相同的技术效果，为避免重复，这里不再赘述。
其中，所述处理器为上述实施例中所述的电子设备中的处理器。所述可读存储介 质，包括计算机可读存储介质，如计算机只读存储器ROM、随机存取存储器RAM、磁碟或者光盘等。
本申请实施例另提供了一种芯片，所述芯片包括处理器和通信接口，所述通信接口和所述处理器耦合，所述处理器用于运行程序或指令，实现上述数据删除方法实施例的各个过程，且能达到相同的技术效果，为避免重复，这里不再赘述。
应理解，本申请实施例提到的芯片还可以称为系统级芯片、系统芯片、芯片系统或片上系统芯片等。
本申请实施例提供一种计算机程序产品，该程序产品被存储在存储介质中，该程序产品被至少一个处理器执行以实现如上述数据删除方法实施例的各个过程，且能达到相同的技术效果，为避免重复，这里不再赘述。
需要说明的是，在本文中，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者装置不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者装置所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括该要素的过程、方法、物品或者装置中还存在另外的相同要素。此外，需要指出的是，本申请实施方式中的方法和装置的范围不限按示出或讨论的顺序来执行功能，还可包括根据所涉及的功能按基本同时的方式或按相反的顺序来执行功能，例如，可以按不同于所描述的次序来执行所描述的方法，并且还可以添加、省去、或组合各种步骤。另外，参照某些示例所描述的特征可在其他示例中被组合。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到上述实施例方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分可以以计算机软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端(可以是手机，计算机，服务器，或者网络设备等)执行本申请各个实施例所述的方法。
上面结合附图对本申请的实施例进行了描述，但是本申请并不局限于上述的具体实施方式，上述的具体实施方式仅仅是示意性的，而不是限制性的，本领域的普通技术人员在本申请的启示下，在不脱离本申请宗旨和权利要求所保护的范围情况下，还可做出很多形式，均属于本申请的保护之内。

Claims (28)

  1. 一种数据删除方法，应用于电子设备，包括：
    接收第一指令，所述第一指令用于指示所述电子设备删除目标数据；所述第一指令中包括所述目标数据的标记信息；
    响应于所述第一指令，根据所述第一指令中的标记信息，从目标存储区域中删除所述目标数据；其中，所述目标存储区域包括：重放保护内存块RPMB，或者，用户数据分区UDA和重放保护内存块RPMB。
  2. 根据权利要求1所述的方法，其中，所述目标数据包括加密处理后的密钥信息；所述方法还包括：
    对敏感数据的加密密钥、生成所述加密密钥的密钥素材中的任何一项进行加密，以形成加密处理后的密钥信息；
    将所述加密处理后的密钥信息存储在所述目标存储区域；
    其中，所述生成所述加密密钥的密钥素材包括以下至少一项：一个随机数，初始化向量、时间戳以及文件标识。
  3. 根据权利要求1所述的方法，其中，所述根据所述第一指令中的标记信息，从目标存储区域中删除所述目标数据，包括：
    在所述目标数据存储于所述RPMB的情况下，根据所述第一指令中的标记信息，通过所述可信执行环境中的可信应用程序向所述RPMB发送物理删除请求消息；
    通过所述RPMB内核驱动程序和文件操作接口将所述物理删除消息请求发送给所述RPMB监听器；
    通过所述RPMB监听器经由文件系统UFS的控制模块，从所述RPMB中删除所述目标数据。
  4. 根据权利要求1所述的方法，其中，所述目标数据包括第一目标数据和第二目标数据；所述根据所述第一指令中的标记信息，从目标存储区域中删除所述目标数据，包括：
    在所述目标数据存储于所述RPMB和所述UDA的情况下，根据所述第一指令中的标记信息，从所述RPMB中删除所述第一目标数据，并从所述UDA中删除所述第二目标数据。
  5. 根据权利要求4所述的方法，其中，所述根据所述第一指令中的标记信息，从所述RPMB中删除所述第一目标数据，包括：
    根据所述第一指令中的标记信息，通过所述可信执行环境中的可信应用程序向所述RPMB发送物理删除请求消息；
    通过所述RPMB内核驱动程序和文件操作接口将所述物理删除消息请求发送给所述RPMB监听器；
    通过所述RPMB监听器经由文件系统UFS的控制模块，从所述RPMB中删除所述第一目标数据。
  6. 根据权利要求4所述的方法，其中，所述从所述UDA中删除所述第二目标数据，包括：
    根据所述第一指令中的标记信息，通过文件系统层的第一删除模块和设备驱动层的第二删除模块，从所述文件系统层中的固定逻辑页号LPN中对所述第二目标数据进行寻址，得到目标虚拟地址；
    通过闪存转换层的预设删除模块，根据所述目标虚拟地址和所述标记信息，从所述闪存转换层的目标映射表中确定存储有所述第二目标数据的目标数据块，并删除所述目标数据块中的所述第二目标数据。
  7. 根据权利要求6所述的方法，其中，所述删除所述目标数据块中的所述第二目标数据，包括：
    通过控制器启动垃圾回收，并对所述目标数据块进行回收；
    或者，
    通过控制器调用硬件物理删除命令，从所述目标数据块中删除所述第二目标数据。
  8. 根据权利要求2所述的方法，其中，所述对敏感数据的加密密钥、生成所述加密密钥的密钥素材中的任何一项进行加密，以形成加密处理后的密钥信息，包括：
    在应用层启动可信执行环境中的应用层的对应的可信应用程序；
    基于所述应用层的对应可信应用程序调用所述RPMB对应的可信应用程序，将所述敏感数据的加密密钥、生成所述加密密钥的密钥素材中任何一项从所述应用层发送至所述RPMB的可信应用程序；
    通过所述RPMB对应的可信应用程序对所述敏感数据的加密密钥、生成所述加密密钥的密钥素材中的任何一项进行加密，以形成加密处理后的密钥信息。
  9. 根据权利要求2所述的方法，其中，所述目标数据至少部分存储于所述RPMB，
    所述将所述加密处理后的密钥信息存储在所述目标存储区域，包括：
    通过所述RPMB对应的可信应用程序，将所述加密处理后的密钥信息和文件操作系统命令通过RPMB内核驱动程序发送给RPMB监听器；
    通过所述RPMB监听器，将所述加密处理后的密钥信息和所述文件操作系统命令发送给UFS；
    通过所述UFS基于所述文件操作系统命令，将所述加密处理后的密钥信息存储至所述RPMB。
  10. 根据权利要求2所述的方法，其中，所述目标数据至少部分存储于所述UDA，
    所述将所述加密处理后的密钥信息存储在所述目标存储区域，包括：
    根据所述标记信息和文件系统层的预设写入模块，调用第一写入模块，所述第一写入模块包括所述标记信息；
    通过所述第一写入模块，将所述加密处理后的密钥信息，从应用层发送至文件系统层；
    根据所述标记信息，从所述文件系统层中的逻辑页号LPN中为所述加密处理后的密钥信息分配目标虚拟地址；
    将所述加密处理后的密钥信息和所述目标虚拟地址从文件系统层经由设备驱动层发送至闪存转换层；
    在所述闪存转换层中建立目标映射表，通过第二写入模块，将所述加密处理后的密钥信息存储在所述目标映射表中的目标数据块中；所述第二写入模块为所述闪存转换层对应的写入模块；所述第二写入模块中包括所述标记信息；所述标记信息用于确定所述目标数据块。
  11. 根据权利要求10所述的方法，其中，所述将所述加密处理后的密钥信息和所述目标虚拟地址从文件系统层经由设备驱动层发送至闪存转换层，包括：
    根据所述标记信息和设备驱动层的预设写入模块，调用第三写入模块，所述第三写入模块包括所述标记信息；
    通过所述第三写入模块，将所述加密处理后的密钥信息和所述目标虚拟地址从所述文件系统层发送至所述设备驱动层；
    根据所述标记信息和所述闪存转换层的预设写入模块，调用所述第二写入模块；
    通过所述第二写入模块，将所述加密处理后的密钥信息和所述目标虚拟地址从所述设备驱动层发送至所述闪存转换层。
  12. 根据权利要求2所述的方法，其中，所述目标数据还包括：数据属性信息，所述数据属性信息用于标识所述敏感数据的属性，所述数据属性信息包括以下至少一项：文件大小、文件权限、文件时间戳、扩展属性、配置信息；所述数据属性信息与所述密钥信息同时存储于所述目标存储区域。
  13. 一种数据删除装置，包括：接收模块和删除模块；
    所述接收模块，用于接收第一指令，所述第一指令用于指示所述电子设备删除目标数据；所述第一指令中包括所述目标数据的标记信息；
    所述删除模块，用于响应于所述接收模块接收的所述第一指令，根据所述第一指令中的标记信息，从目标存储区域中删除所述目标数据；其中，所述目标存储区域包括：重放保护内存块RPMB，或者，用户数据分区UDA和重放保护内存块RPMB。
  14. 根据权利要求13所述的装置，其中，所述目标数据包括加密处理后的密钥信息；所述装置还包括：加密模块和存储模块；
    所述加密模块，用于对敏感数据的加密密钥、生成所述加密密钥的密钥素材中的任何一项进行加密，以形成加密处理后的密钥信息；
    所述存储模块，用于将所述加密处理后的密钥信息存储在所述目标存储区域；
    其中，所述生成所述加密密钥的密钥素材包括以下至少一项：一个随机数，初始化向量、时间戳以及文件标识。
  15. 根据权利要求13所述的装置，其中，所述删除模块，具体用于在所述目标数据存储于所述RPMB的情况下，根据所述第一指令中的标记信息，通过所述可信执行环境中的可信应用程序向所述RPMB发送物理删除请求消息；通过所述RPMB内核驱动程序和文件操作接口将所述物理删除消息请求发送给所述RPMB监听器；通过所述RPMB监听器经由文件系统UFS的控制模块，从所述RPMB中删除所述目标数据。
  16. 根据权利要求13所述的装置，其中，所述删除模块，具体用于在所述目标数据存储于所述RPMB和所述UDA的情况下，根据所述第一指令中的标记信息，从所述RPMB中删除所述第一目标数据，并从所述UDA中删除所述第二目标数据。
  17. 根据权利要求16所述的装置，其中，所述删除模块，具体用于根据所述第一指令中的标记信息，通过所述可信执行环境中的可信应用程序向所述RPMB发送物理删除请求消息；通过所述RPMB内核驱动程序和文件操作接口将所述物理删除消息请求发送给所述RPMB监听器；通过所述RPMB监听器经由文件系统UFS的控制模块，从所述RPMB中删除所述第一目标数据。
  18. 根据权利要求16所述的装置，其中，所述删除模块，具体用于根据所述第一指令中的标记信息，通过文件系统层的第一删除模块和设备驱动层的第二删除模块，从所述文件系统层中的固定逻辑页号LPN中对所述第二目标数据进行寻址，得到目标虚拟地址；通过闪存转换层的预设删除模块，根据所述目标虚拟地址和所述标记信息，从所述闪存转换层的目标映射表中确定存储有所述第二目标数据的目标数据块，并删除所述目标数据块中的所述第二目标数据。
  19. 根据权利要求18所述的装置，其中，所述删除模块，具体用于通过控制器启动垃圾回收，并对所述目标数据块进行回收；或者，通过控制器调用硬件物理删除命令，从所述目标数据块中删除所述第二目标数据。
  20. 根据权利要求14所述的装置，其中，所述加密模块，具体用于在应用层启动可信执行环境中的应用层的对应的可信应用程序；基于所述应用层的对应可信应用程序调用所述RPMB对应的可信应用程序，将所述敏感数据的加密密钥、生成所述加密密钥的密钥素材中任何一项从所述应用层发送至所述RPMB的可信应用程序；通过所述RPMB对应的可信应用程序对所述敏感数据的加密密钥、生成所述加密密钥的密钥 素材中的任何一项进行加密，以形成加密处理后的密钥信息。
  21. 根据权利要求14所述的装置，其中，所述目标数据至少部分存储于所述RPMB，所述存储模块，具体用于通过所述RPMB对应的可信应用程序，将所述加密处理后的密钥信息和文件操作系统命令通过RPMB内核驱动程序发送给RPMB监听器；通过所述RPMB监听器，将所述加密处理后的密钥信息和所述文件操作系统命令发送给UFS；通过所述UFS基于所述文件操作系统命令，将所述加密处理后的密钥信息存储至所述RPMB。
  22. 根据权利要求14所述的装置，其中，所述目标数据至少部分存储于所述UDA，
    所述存储模块，具体用于根据所述标记信息和文件系统层的预设写入模块，调用第一写入模块，所述第一写入模块包括所述标记信息；通过所述第一写入模块，将所述加密处理后的密钥信息，从应用层发送至文件系统层；根据所述标记信息，从所述文件系统层中的逻辑页号LPN中为所述加密处理后的密钥信息分配目标虚拟地址；将所述加密处理后的密钥信息和所述目标虚拟地址从文件系统层经由设备驱动层发送至闪存转换层；在所述闪存转换层中建立目标映射表，并通过第二写入模块，将所述加密处理后的密钥信息存储在所述目标映射表中的目标数据块中，所述第二写入模块为所述闪存转换层对应的写入模块；所述第二写入模块中包括所述标记信息；所述标记信息用于确定所述目标数据块。
  23. 根据权利要求22所述的装置，其中，所述存储模块，具体用于根据所述标记信息和设备驱动层的预设写入模块，调用第三写入模块，所述第三写入模块包括所述标记信息；通过所述第三写入模块，将所述加密处理后的密钥信息和所述目标虚拟地址从所述文件系统层发送至所述设备驱动层；根据所述标记信息和所述闪存转换层的预设写入模块，调用所述第二写入模块；通过所述第二写入模块，将所述加密处理后的密钥信息和所述目标虚拟地址从所述设备驱动层发送至所述闪存转换层。
  24. 根据权利要求14所述的装置，其中，所述目标数据还包括：数据属性信息，所述数据属性信息用于标识所述敏感数据的属性，所述数据属性信息包括以下至少一项：文件大小、文件权限、文件时间戳、扩展属性、配置信息；所述数据属性信息与所述密钥信息同时存储于所述目标存储区域。
  25. 一种电子设备，包括处理器和存储器，所述存储器存储可在所述处理器上运行的程序或指令，所述程序或指令被所述处理器执行时实现如权利要求1至12任一项所述的数据删除方法的步骤。
  26. 一种可读存储介质，所述可读存储介质上存储程序或指令，所述程序或指令被处理器执行时实现如权利要求1至12任一项所述的数据删除方法的步骤。
  27. 一种芯片，所述芯片包括处理器和通信接口，所述通信接口和所述处理器耦合，所述处理器用于运行程序或指令，实现如权利要求1至12任一项所述的数据删除方法的步骤。
  28. 一种计算机程序产品，所述程序产品被至少一个处理器执行以实现如权利要求1至12任一项所述的数据删除方法的步骤。
PCT/CN2023/112560 2022-08-12 2023-08-11 数据删除方法和电子设备 WO2024032770A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210969912.4 2022-08-12
CN202210969912.4A CN115357930A (zh) 2022-08-12 2022-08-12 数据删除方法和电子设备

Publications (1)

Publication Number Publication Date
WO2024032770A1 true WO2024032770A1 (zh) 2024-02-15

Family

ID=84032895

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/112560 WO2024032770A1 (zh) 2022-08-12 2023-08-11 数据删除方法和电子设备

Country Status (2)

Country Link
CN (1) CN115357930A (zh)
WO (1) WO2024032770A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115357930A (zh) * 2022-08-12 2022-11-18 维沃移动通信有限公司 数据删除方法和电子设备

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105760788A (zh) * 2016-02-05 2016-07-13 青岛海信移动通信技术股份有限公司 一种数据保护方法和装置
CN110008062A (zh) * 2019-03-28 2019-07-12 维沃移动通信有限公司 一种数据管理方法及移动终端
US20200250144A1 (en) * 2019-02-04 2020-08-06 EMC IP Holding Company LLC Storage system utilizing content-based and address-based mappings for deduplicatable and non-deduplicatable types of data
CN111723383A (zh) * 2019-03-22 2020-09-29 阿里巴巴集团控股有限公司 数据存储、验证方法及装置
CN115357930A (zh) * 2022-08-12 2022-11-18 维沃移动通信有限公司 数据删除方法和电子设备

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105760788A (zh) * 2016-02-05 2016-07-13 青岛海信移动通信技术股份有限公司 一种数据保护方法和装置
US20200250144A1 (en) * 2019-02-04 2020-08-06 EMC IP Holding Company LLC Storage system utilizing content-based and address-based mappings for deduplicatable and non-deduplicatable types of data
CN111723383A (zh) * 2019-03-22 2020-09-29 阿里巴巴集团控股有限公司 数据存储、验证方法及装置
CN110008062A (zh) * 2019-03-28 2019-07-12 维沃移动通信有限公司 一种数据管理方法及移动终端
CN115357930A (zh) * 2022-08-12 2022-11-18 维沃移动通信有限公司 数据删除方法和电子设备

Also Published As

Publication number Publication date
CN115357930A (zh) 2022-11-18

Similar Documents

Publication Publication Date Title
US11513707B2 (en) Memory system and method of controlling nonvolatile memory
US20230229791A1 (en) Memory system and method of controlling nonvolatile memory
US20190102262A1 (en) Automated continuous checkpointing
EP2631916B1 (en) Data deletion method and apparatus
US8301909B2 (en) System and method for managing external storage devices
US10552073B2 (en) Storage system including non-volatile memory device
US8423592B2 (en) Method and system for accessing a storage system with multiple file systems
US20160259583A1 (en) Storage device, storage device system and information terminal
CN104424016B (zh) 用于自加密驱动器的虚拟带集中
JP2016170583A (ja) メモリシステムおよび情報処理システム
US20180260151A1 (en) Data Storage Device and Operating Method Therefor
WO2024032770A1 (zh) 数据删除方法和电子设备
US8898807B2 (en) Data protecting method, mobile communication device, and memory storage device
US20130073870A1 (en) Secure relocation of encrypted files
JP2015172959A (ja) フラッシュメモリのアクセス方法
WO2015096454A1 (zh) 一种数据处理方法及装置
US11036652B2 (en) Secured access control in a storage system
Zhang et al. Ensuring data confidentiality via plausibly deniable encryption and secure deletion–a survey
TW202215222A (zh) 快閃記憶體局部清除
Yang et al. SADUS: Secure data deletion in user space for mobile devices
US11644983B2 (en) Storage device having encryption
US9645946B2 (en) Encryption for solid state drives (SSDs)
TWI775284B (zh) 記憶系統、其控制方法及資訊處理系統
Chen Towards Designing A Secure Plausibly Deniable System for Mobile Devices against Multi-snapshot Adversaries--A Preliminary Design
TW201830284A (zh) 資料儲存系統、資料儲存方法及資料讀取方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23851990

Country of ref document: EP

Kind code of ref document: A1