CN106127078A - Cryptographic key protection method under a kind of Android environment and system - Google Patents
Cryptographic key protection method under a kind of Android environment and system Download PDFInfo
- Publication number
- CN106127078A CN106127078A CN201610540076.2A CN201610540076A CN106127078A CN 106127078 A CN106127078 A CN 106127078A CN 201610540076 A CN201610540076 A CN 201610540076A CN 106127078 A CN106127078 A CN 106127078A
- Authority
- CN
- China
- Prior art keywords
- key
- file
- user
- screen
- password
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
-
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
- G06F21/6281—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database at program execution time, where the protection is within the operating system
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04M—TELEPHONIC COMMUNICATION
- H04M1/00—Substation equipment, e.g. for use by subscribers
- H04M1/66—Substation equipment, e.g. for use by subscribers with means for preventing unauthorised or fraudulent calling
- H04M1/667—Preventing unauthorised calls from a telephone set
- H04M1/67—Preventing unauthorised calls from a telephone set by electronic means
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Theoretical Computer Science (AREA)
- General Health & Medical Sciences (AREA)
- Health & Medical Sciences (AREA)
- Bioethics (AREA)
- Databases & Information Systems (AREA)
- Computer Hardware Design (AREA)
- Software Systems (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Signal Processing (AREA)
- Storage Device Security (AREA)
Abstract
The invention discloses the cryptographic key protection method under a kind of Android environment and system, realize file by the operation of the key of Android platform transparent encryption and decryption and protect, including generating encryption path catalogue listing and authentication file respectively；Scanning encryption path catalogue listing, carries out initialization encryption for the first time；When user triggers unblock screen event, compare with authentication file after the pass phrase for screen locking is carried out hash algorithm computing；Pass phrase use Shal algorithm be converted into key and store；When user sends write request, call key-pair file and be encrypted；When user sends read request, call key-pair file and be decrypted；When user triggers lock-screen event, remove key screen locking.The present invention uses combination lock interface to reduce the impact on user operation as far as possible, realizes system file being externally obstructed, internally nothing serious cryptographic key protection.
Description
Technical Field
The invention relates to the technical field of information security, in particular to a key protection method and system in an Android environment.
Background
With the rapid development of scientific technology, electronic devices such as computers, internet and smart phones are available everywhere, the wide spread of digital information such as television, film, music and pictures, and the use of a large number of devices such as smart cards, mobile tokens and wireless sensor networks make people have more and more ways to access secret information, so that the use environment of the cryptographic algorithm is not pure and credible. For example, if a user runs a digital media playing software on his own machine, and the software decrypts the encrypted digital information and plays it, the running environment of the software is likely to be insecure, because the decryption process of the software is visible to an attacker (or even the user himself), who can easily obtain the key information; also, wireless sensor network nodes and the like are usually deployed in unsupervised places, and therefore, observation, modification and the like of the internal operation of the nodes are effective attack means. Therefore, an attack against the operation terminal is very direct, and such an attack is called a white-box attack.
White-box attacks, originally proposed by Chow et al in 2002, where the "white-box" communicates with the environment referred to by the "white-box test" in program inspection, have full control over the device terminals (i.e. the environment in which the application runs) and equal rights to the software executors in the white-box attack. An attacker can track the binary system in which the program runs, read the keys in memory, observe intermediate results of program execution, arbitrarily statically analyze, change the results of sub-computations, and so on. An attacker can do any operation at the terminal, and compared with the traditional black box model, the 'white box' has little limit on the capability of the attacker.
White-box attacks are a more advanced security threat that arises in an untrusted terminal environment. The white-box attack can be regarded as a man-at-the-end attack, and currently common direct white-box attacks include OllyDbg, IDA Pro, HexRays, HIEW, VMware and the like, and recently proposed bypass attacks such as time analysis, power consumption analysis, insertion error analysis and the like (side-channel attack). The traditional cryptographic algorithm cannot be safely used in a white-box attack environment and is extremely fragile. Therefore, in order to ensure the normal use of functions such as encryption, decryption, authentication and the like of the encryption algorithm of the untrusted terminal, constructing the encryption algorithm capable of ensuring the security under the white-box attack environment is a major problem in the field of information security.
White-box cryptography refers to cryptographic algorithms and their implementations that are resistant to white-box attacks. The white-box cipher includes a white-box implementation of an existing cryptographic algorithm and a white-box cryptographic algorithm. The white-box implementation of the existing cryptographic algorithm means that the known cryptographic algorithm is designed through a white-box cryptographic technology, so that in a white-box attack environment, the function of the original algorithm is not changed, but the security which is hopefully guaranteed by the original algorithm is not damaged. For example, an encryption algorithm wants to ensure that its key is not compromised, a signing algorithm wants its signature not to be forged, etc. The white-box cryptographic algorithm is actually a new cryptographic algorithm, and is different from the traditional cryptographic algorithm in that the white-box cryptographic algorithm can resist hostile attack in a white-box attack environment, and the white-box cryptographic algorithm is a new algorithm instead of the design for implementing white-box security on the existing algorithm.
Most of the current white-box cryptographic technology examples are white-box implementations of known cryptographic algorithms, such as white-box AES implementations and white-box DES implementations, designers try to construct a lookup table in an obfuscated manner and complete execution of a program in a table look-up manner, so that even if a white-box attacker can observe a query of the whole lookup table, the white-box attacker cannot obtain key information faster than an exhaustive search, thereby resisting the white-box attack. The effectiveness of this method has not been found to be satisfactory at present.
The existing Android key protection system directly applies the idea of a personal computer key protection system to mobile equipment, and platform difference is ignored; the mobile equipment mainly emphasizes user experience, not only function realization, but also reduces the convenience degree of the equipment because the key protection systems frequently require a user to input passwords and select encrypted and decrypted files. On the other hand, although the existing transparent encryption and decryption system reduces the influence on the operation habit of the user, the security protection work is not comprehensive, and the defects include:
firstly, a specific directory cannot be protected due to the authority problem, and files on the SD card cannot be protected (the SD card is an important storage position of user data);
(II) only files in a certain specified format can be protected;
thirdly, the system is easy to be attacked due to low combination degree;
and (IV) the compatibility and the expansibility are low, and only part of systems with specific versions can be supported.
Disclosure of Invention
In order to overcome the defects of the prior art, the invention provides a key protection method and a key protection system in an Android environment, which utilize a stack file system implementation technology, adopt a combination frequency locking interface to reduce the influence on user operation as much as possible, and closely combine an operating system to realize encryption and decryption protection which is blocked to the outside and has no influence to the inside.
The technical scheme provided by the invention is as follows:
a key protection method under an Android environment is used for protecting files under the Android environment through transparent encryption and decryption operations of keys of an Android platform, and comprises the following steps:
step one, selecting a path of a folder where a file to be protected is located and setting a password;
step two, respectively generating an encrypted path directory table and an identity verification file according to the path and the password input by the user in the step one;
step three, scanning an encryption path directory table, if the operating system is started for the first time, performing first initialization encryption on the protected file according to the table entry, and then performing the next step;
in the embodiment of the present invention, the above operation is implemented by a stacked file system unit;
step four, when a user triggers a screen unlocking event, receiving a password phrase for locking the screen input by the user, and comparing the password phrase with the identity verification file generated in the step two after carrying out Hash algorithm operation on the password phrase; if not, the unlocking fails; if the password phrases are matched with each other, the password phrases are converted into keys by adopting a Shal algorithm, and the keys are stored;
step five, when the user accesses the file, if the operated file or directory is in the encrypted path directory table, when the user sends a write request, calling the key stored in the step four to encrypt the file; when a user sends a reading request, a secret key is called to decrypt the file;
and step six, when the user triggers a screen locking event, clearing the key stored in the step four and locking the screen.
The file under the Android environment is protected through the steps.
As a further optimization scheme of the key transparent encryption and decryption method for the Android platform, the hash algorithm is an MD5 hash algorithm.
The key protection system realized according to the key protection method in the Android environment comprises a user module and a kernel module, wherein the user module comprises a configuration unit and a screen locking unit, and the kernel module comprises a key manager unit and a stacked file system unit; the key transparent encryption and decryption operation of the Android platform is realized; wherein,
the configuration unit is used for receiving a user-made strategy, wherein the strategy comprises a password, an identity authentication file and an encrypted directory path table, and the password generates a first secret key through a Shal algorithm to be stored; the identity authentication file is input to the key manager unit, and the encrypted directory path table is input to the stacked file system unit;
a screen locking unit for outputting the passphrase input by the user to the key manager unit;
the key manager unit is used for matching the password phrase with the identity verification file after the operation of the Hash algorithm, wherein if the password phrase is not matched with the identity verification file, the unlocking is failed; if the matching is consistent, the screen is unlocked, the passphrase is converted into a second secret key by adopting a Shal algorithm for storage, and when the screen is locked by the screen locking unit, the second secret key is removed;
the stack file system unit calls a first key to initialize and encrypt files in a directory corresponding to the encrypted directory path table when the operating system is started for the first time and the encrypted directory path table is received; covering all file systems supported and mounted by an operating system, calling a second key in the key manager when a user sends a read request, and decrypting the file; when a user sends a write request, a second key in the key manager is called to encrypt the file.
As a further optimized solution of the key protection system of the present invention, the user-defined policy further includes whether to enable the key protection system, and whether to enable the encryption and decryption operations.
As a further optimized solution of the key protection system of the present invention, the hash algorithm is an MD5 hash algorithm.
Compared with the prior art, the invention has the beneficial effects that:
the invention provides a key protection method and a key protection system in an Android environment, which are realized by using a stack file system mode; the stack file system is an incremental development mode for extending the functions of the original key system. The method does not need to modify the code of the original key system, but covers the code, filters the operations of reading and writing and the like, and adds a set processing method such as encryption and compression (including a white-box encryption algorithm) and the like in the process so as to enhance the function of the original key system. The invention adopts the combined lock interface to reduce the influence on the user operation as much as possible, and is tightly combined with the operating system to realize the key protection of external obstruction and internal obstruction. The invention has the following advantages:
the invention utilizes the stack file system realization technology, reduces the influence on the user operation as much as possible by combining with a frequency locking interface, and realizes the encryption and decryption protection which is blocked externally and has no influence internally by closely combining with an operating system;
protecting the privacy data stored in the equipment by the Android terminal user, and simultaneously not changing the operation habit of the user and not influencing the user experience;
thirdly, a kernel-level encryption mode is selected, so that the system security and the encryption and decryption efficiency are enhanced, the system is tightly combined with the system, the attack resistance is strong, and the security is high; because the system core encryption and decryption module works at the bottommost layer, and the interface interacting with the user is the topmost layer, the system sets up middleware to assist the communication between the kernel module and the upper application; communicating with the middle layer through a JNI (Java local access interface), and then completing the communication with the kernel module by the middle layer in a 1ctl mode;
the invention can support the 3.X kernel used by the current popular android4.X, the system designs a key system, processes the file reading and writing operation, directly orients other file operation to the bottom file system, and is flexible and easy to transplant;
the encryption and decryption are transparent to users, the interference to the user operation is small, and the user experience is good; the deployment and the transplantation are convenient; the performance is higher; the file formats are not distinguished, and a user can encrypt files in any form; the storage position is not distinguished, the information of the application program of the mobile phone and the information in the storage expansion card can be encrypted, and the protection of the file data of the SD card is realized.
Drawings
Fig. 1 is a diagram of the interaction relationship between the modules of the key protection system and the modules thereof provided by the present invention.
Fig. 2 is a functional block diagram of the key protection system provided in the present invention.
FIG. 3 is a diagram illustrating the relationship between an upper stacked encryption/decryption system and a lower actual file system in an implementation of the present invention.
Fig. 4 is a flowchart of the key protection method provided by the present invention.
Detailed Description
The invention will be further described by way of examples, without in any way limiting the scope of the invention, with reference to the accompanying drawings.
The invention provides a key protection method and a key protection system in an Android environment, which are realized by using a stack file system mode; the stack file system is an incremental development mode for extending the functions of the original key system. The method does not need to modify the code of the original key system, but covers the code, filters the operations of reading and writing and the like, and adds a set processing method such as encryption and compression (including a white-box encryption algorithm) and the like in the process so as to enhance the function of the original key system. The invention adopts the combined lock interface to reduce the influence on the user operation as much as possible, and is tightly combined with the operating system to realize the key protection of external obstruction and internal obstruction.
As shown in fig. 1, the key protection system in the Android environment provided by the embodiment of the present invention includes a user module and a kernel module, where the user module includes a configuration unit and a screen locking unit, and the kernel module includes a key manager unit and a stacked file system unit;
fig. 4 is a flowchart of a key protection method in an Android environment provided by the present invention. Procedure for reading the protected key: if the user is an unauthorized user (a user who is not authenticated by the screen locking interface), the operation fails. And for the authorized user, transmitting a reading request to the lower-layer file system to obtain the returned file content, wherein the content is the ciphertext. Requesting a key from a key manager unit, and decrypting the ciphertext by using the key to obtain a plaintext; and copying the obtained plaintext from the kernel space to the user space.
FIG. 3 is a diagram of an upper-layer stacked encryption/decryption file system and a lower-layer actual file system, taking the file structure as an example (the second group in FIG. 3): here upper _ file is an object of the upper file system, and lower _ file is an object of the corresponding lower file system. The two are linked by the private _ data pointer of the upper _ file. When the file is operated, the function in the file _ ops file operation table in the upper _ file is called. Because the operation request sent to the upper layer of the stack file system is processed and then transmitted to the lower layer, specifically, the function in the upper layer file _ ops operation table calls the corresponding function in the lower layer file _ ops table. Similarly, the entry, inode, and address _ space structures of the upper file system are associated with the corresponding data structures of the lower file system to transmit respective operation requests. In fig. 3, the dotted line separates the upper layer and the lower layer, and the dotted line is divided into four different types from top to bottom, and each type represents a different transmission mode.
Fig. 4 is a workflow of screen unlocking and locking in the embodiment of the present invention. The screen locking unit is specifically realized as follows: the screen locking application receives a password phrase input by a user and reads whether a switch of the encryption and decryption service is opened or not. This information is copied to the kernel space where the passphrase is computed by a hashing algorithm and compared to the MD5 value stored in the authentication file to confirm identity. If the unlocking result does not accord with the preset unlocking result, the unlocking failure is prompted, and the user can perform limited attempts; if the two match, go to the next step. If the identity authentication is successful, judging whether to start a switch of the encryption and decryption service; if the service is not started, the next step is carried out, if the service is started, the secret key is converted and stored in the secret key manager, and the next step is executed to unlock the screen. The screen locking unit provides two control groups for interaction with a user, namely a password input control group and a binary switch. The former is used for recording a key input by a user, and the latter decides whether only the mobile phone operating system is unlocked or both the operating system and the encrypted file are unlocked. The screen locking unit only receives and caches the user password and is not responsible for identity authentication. Authentication is done by the kernel key management unit, in security considerations. The screen locking unit communicates with the middle layer dynamic library through a JNI (Java native Access interface), and the middle layer communicates with the kernel in a 1ctl mode to transfer the key from the user space to the kernel space. Considering that users who try out the system are divided into two types, namely mobile phone operating system customizers and personal users, JNI deployment can provide an upper layer calling interface on an application framework layer, is used as a system API to be called by an application program or is expanded by a third party application program, is tightly combined with the system, and can be directly compiled to be used as an independent dynamic library file to be loaded by the application program, so that the deployment process of the personal users is simple and convenient, and screen locking and screen unlocking in the Android system are messages transmitted in a Broadcast form. The system screen locking application module monitors the message and carries out corresponding processing. Unlocking is to complete identity authentication and key transmission, and to clear the key when locking the screen.
How the present invention realizes the protection of files is further described by the concrete implementation of the embodiment as follows:
A. selecting a path of a folder where a file to be protected is located and setting a password;
B. respectively generating an encrypted path directory table and an identity verification file according to a path and a password input by a user;
C. scanning an encryption path directory table, if the operating system is started for the first time, performing initialization encryption on the protected file for the first time according to the table entry, and then performing the next operation;
in a stack file system unit, when an operating system is started for the first time and an encrypted directory path table is received, a first key is called to carry out initialization encryption on files in a directory corresponding to the encrypted directory path table; covering all file systems supported and mounted by an operating system, calling a second key in the key manager when a user sends a read request, and decrypting the file; when a user sends a write request, a second key in the key manager is called to encrypt the file.
D. When the user triggers the screen unlocking event, the user receives the password phrase input by the user, and the password phrase is compared with the identity verification file generated in the step B after the hash algorithm operation is carried out on the password phrase: if not, the unlocking fails; if the matching is consistent, converting the passphrase into a key by adopting a sha1 algorithm, and storing the key; the method comprises the following specific steps: defining a TRANSPARENT _ IOCCAUTHEN command as receiving a password input by a user, comparing the password with a locally stored authentication file after Md5 operation, returning to pass the authentication if the password is consistent with the locally stored authentication file, converting the password into a 128bit key by Shal operation, and storing the 128bit key in a global buffer area. And defining the transfer _ iocklearkey command as the task of clearing the key in the key manager to be completed when the screen is locked.
E. When a user accesses a file, if the operated file or directory is in the encryption path directory table, when the user sends a write request, calling the key stored in the D to encrypt the file; when a user sends a reading request, a secret key is called to decrypt the file;
the process of reading the protected file is: if the user is an unauthorized user (a user who is not authenticated by the screen locking interface), the operation fails. And for the authorized user, transmitting a reading request to the lower-layer file system to obtain the returned file content, wherein the content is the ciphertext. A key is requested from the key manager unit, with which the ciphertext is decrypted. The obtained plaintext is copied from the kernel space to the user space. And modifying the attribute of the corresponding file to finish the reading operation.
The process of writing to the protected file is: if the user is an unauthorized user (a user who is not authenticated by the screen locking interface), the operation fails. For authorized users, a key is requested, and the buffer where the data transferred by the user space is located is encrypted by the key. The buffer contents are passed to the underlying file system, where they are written to disk. And modifying the attribute of the corresponding file to finish the write operation. The specific content of the file read-write operation is as follows, after the bottom layer file system is called to read in data, the buffer area is decrypted before the content is returned to the user space. Also, at the time of a write operation, the buffer is encrypted before the underlying file system write operation is invoked. The encryption and decryption process can be realized by using a kernel encryption and decryption framework, so that the space-time overhead is saved, and the development cost is reduced.
F. And when the user triggers the screen locking event, clearing the stored key and locking the screen.
The key protection system under the Android environment is realized by using the method, and as shown in fig. 1, the interaction among all modules of the system is shown. The key storage protection system of the Android platform comprises a user module and a kernel module, wherein the user module comprises a configuration unit and a screen locking unit, and the kernel module comprises a key manager unit and a stacked file system unit; wherein:
the system comprises a configuration unit, a storage unit and a processing unit, wherein the configuration unit is used for receiving a user-formulated strategy, the strategy comprises a password, an identity authentication file and an encrypted directory path table, and the password generates a first secret key through a Shal algorithm to be stored; the identity authentication file is input to the key manager unit, and the encrypted directory path table is input to the stacked file system unit;
the policy configuration of the configuration unit is the core of the control of the system. On the implementation of the configuration unit, the policy configuration of the configuration unit maintains two files, namely a password Md5 file and an encrypted directory table file which are compared for authentication. The file system is used as a common Android application program, but needs to hold administrator authority, is automatically started when the computer is started, and then scans an encrypted directory table to mount the file systems for the directories in the table one by one.
(II) a screen locking unit which outputs the password phrase input by the user to a key manager unit;
thirdly, the key manager unit is used for matching the password phrase with the identity verification file after the operation of the Hash algorithm, wherein if the password phrase is not matched with the identity verification file, the unlocking is failed; if the matching is consistent, the screen is unlocked, the passphrase is converted into a second secret key by adopting a Shal algorithm for storage, and when the screen is locked by the screen locking unit, the second secret key is removed;
the kernel key manager unit is specifically implemented as follows: the kernel key manager unit functions like a kernel key ring. The kernel key ring is not used directly because it is too complex to minimize the limited time and space resources of the embedded device occupied by the kernel. The kernel key manager mainly includes a global buffer that can be accessed by other modules for storing keys. The module directly communicates with an application layer screen locking interface in an ioctl mode. Defining a TRANSPARENT _ IOCAUTHEN command as receiving a password input by a user, comparing the password with a locally stored authentication file after Md5 operation, returning to pass the authentication if the password is consistent with the locally stored authentication file, converting the password into a 128bit key by Shal operation, and storing the 128bit key in a global buffer area. And defining the transfer _ iocklearkey command as the task of clearing the key in the key manager to be completed when the screen is locked.
The stack file system unit calls a first key to initialize and encrypt files in a directory corresponding to the encrypted directory path table when the operating system is started for the first time and the encrypted directory path table is received; covering all file systems supported and mounted by an operating system, calling a second key in the key manager when a user sends a read request, and decrypting the file; and calling a second key of the key manager when the user sends a writing request to encrypt the file.
The user-defined policy is received in a configuration unit of the user module, the user-defined policy also including whether to enable the key protection system (encryption/decryption system). In the user module and the kernel module, the related hash algorithm is the MD5 hash algorithm.
Fig. 2 is a schematic diagram of the operation of the system of the present invention. The process of reading the protected file is: if the user is an unauthorized user (a user who is not authenticated by the screen locking interface), the operation fails. And for the authorized user, transmitting a reading request to the lower-layer file system to obtain the returned file content, wherein the content is the ciphertext. A key is requested from the key manager unit, with which the ciphertext is decrypted. The obtained plaintext is copied from the kernel space to the user space. The working process of the method comprises the following steps: modifying the attribute of the corresponding file to finish the reading operation; procedure for writing protected files: if the user is an unauthorized user (the user is not authenticated by the screen locking interface), the operation is failed; for an authorized user, requesting a key, and encrypting a buffer area where data transmitted by a user space is located by using the key; transferring the buffer content to a lower file system, and writing the buffer content to a disk; and modifying the attribute of the corresponding file to finish the write operation.
The system forms a stack structure, and the upper file system is the developed stack type encryption and decryption file system. The underlying file system is the actual file system (but it could also be another stacked file system, which could also be considered the actual file system if it is sufficiently "transparent").
Since the upper file system depends on the operation method and data structure of the lower file system, the first step should be to construct the relationship between the data structures of the upper and lower file systems.
As shown in FIG. 3, a schematic diagram between an upper-layer stacked encryption/decryption File system and a lower-layer actual File system is shown, taking a File structure as an example, where an upper File is an object of the File system of the present layer, and a lower _ File is an object of the lower-layer File system corresponding to the upper File. The two are linked by the Private _ date pointer of the Upper _ file. When the File is operated, a function in a File _ ops File operation table in the Upper _ File is called. Because the operation request sent to the upper layer of the stack file system is processed and then transmitted to the lower layer. Specifically, the function in the operation table of the upper File _ opS calls the corresponding function in the table of the lower File _ opS. Similarly, the Dentry, Inode and Address _ space structure of the file system of the layer are linked with the corresponding data structure of the file system of the lower layer to transmit respective operation requests.
And the construction of the relationship between the upper and lower key data structures is completed, and a foundation is laid for the following operation.
Except for the file read-write operation, the other file system operations only call the corresponding functions of the lower file system or use general processing functions. If necessary, the relevant fields of the underlying file system data structure, such as the file access time, the current reading position of the file, etc., are also updated. Taking reading directory File as an example, at this time, the relationship between the upper and Lower File systems is already established, because the operation of the Lower File system needs to be invoked, the data structure Lower _ File of the Lower File system corresponding to the File of the current layer is found through the relationship. And reading the directory information of the Lower _ file through the VFS layer general function. The directory information here is directory information of the underlying file system, but since this operation is not processed, it can be returned as directory information of the present layer as it is. After the VFS _ readdir reads the information, the access time of Lower _ File is automatically updated, but the access time of upper File needs to be manually updated. Here, the synchronization is achieved by copying the underlying file access information.
The specific contents of the file reading and writing operations are as follows: after invoking the underlying file system to read in the data, the buffer is decrypted before returning the content to the user space. Also, at the time of a write operation, the buffer is encrypted before the underlying file system write operation is invoked.
The encryption and decryption process can be realized by using a kernel encryption and decryption framework, so that the space-time overhead is saved, and the development cost is reduced.
The following is the implementation process of each module in specific implementation:
the implementation of the configuration unit: the strategy configuration interface is the control core of the system, and maintains two files, namely a password Md5 file and an encryption directory table file which are used for comparison during identity authentication. The file system is used as a common Android application program, but needs to hold administrator authority, is automatically started when the computer is started, and then scans an encrypted directory table to mount the file systems for the directories in the table one by one.
Implementation of the kernel key manager unit: the kernel key manager unit, functions like a kernel key ring. The kernel key ring is not used directly because it is too complex to minimize the limited time and space resources of the embedded device occupied by the kernel. The kernel key manager mainly comprises a global buffer which can be accessed by other modules and is used for storing keys. The module directly communicates with the application layer screen locking interface in an ioct1 mode. Defining a TRANSPARENT _ IOCAUTHEN command as receiving a password input by a user, comparing the password with a locally stored authentication file after Md5 operation, returning to pass the authentication if the password is consistent with the locally stored authentication file, converting the password into a 128bit key by Shal operation, and storing the 128bit key in a global buffer area. And defining the transfer _ iocklearkey command as the task of clearing the key in the key manager to be completed when the screen is locked.
The screen locking application receives a password phrase input by a user and reads whether a switch of the encryption and decryption service is opened or not.
This information is copied to the kernel space where the passphrase is computed by a hashing algorithm and compared to the MD5 value stored in the authentication file to confirm the user's identity. If the unlocking result does not accord with the preset unlocking result, the unlocking failure is prompted, and the user can perform limited attempts; if the two match, go to the next step.
If the identity authentication is successful, judging whether to start the switching value of the encryption and decryption service; if the service is not started, the next step is carried out; if the service is opened, the key is transformed and stored in the key manager, and the next step is executed.
Unlocking the screen: the screen locking unit provides two control groups for interaction with a user, namely a password input control group and a binary switch. The former is used for recording a key input by a user, and the latter decides whether only the mobile phone operating system is unlocked or both the operating system and the encrypted file are unlocked. The screen locking unit only receives and caches the user password and is not responsible for identity authentication. Authentication is done by the kernel key management unit, in security considerations. The screen locking unit communicates with the middle layer dynamic library through JNI (Java native Access interface), and the middle layer communicates with the kernel through icot1 to transfer the key from the user space to the kernel space. Considering that users who try out the system are divided into two types, namely mobile phone operating system customizers and personal users, JNI deployment can provide an upper layer calling interface on an application framework layer, is used as a system API to be called by an application program or is expanded by a third party application program, is tightly combined with the system, and can be directly compiled to be used as an independent dynamic library file to be loaded by the application program, so that the deployment process of the personal users is simple and convenient, and screen locking and screen unlocking in the Android system are messages transmitted in a Broadcast form. The system screen locking application module monitors the message and carries out corresponding processing. Unlocking is to complete identity authentication and key transmission, and to clear the key when locking the screen.
It is noted that the disclosed embodiments are intended to aid in further understanding of the invention, but those skilled in the art will appreciate that: various substitutions and modifications are possible without departing from the spirit and scope of the invention and appended claims. Therefore, the invention should not be limited to the embodiments disclosed, but the scope of the invention is defined by the appended claims.
Claims (8)
1. A method for protecting a key under an Android environment, which realizes the protection of a file under the Android environment through the transparent encryption and decryption operation of the key of an Android platform, comprises the following steps:
step one, selecting a path of a folder where a file to be protected is located and setting a password;
step two, respectively generating an encrypted path directory table and an identity verification file according to a path and a password input by a user;
step three, scanning the encryption path directory table, if the operation system is started for the first time, initializing and encrypting the protected file for the first time according to the table entry, and then performing the next step;
step four, when the user triggers the screen unlocking event, receiving a password phrase input by the user and used for unlocking the screen, and comparing the password phrase with the identity verification file generated in the step two after carrying out Hash algorithm operation on the password phrase; when the comparison result is not matched, the unlocking is failed; when the comparison result is matching, unlocking the screen, converting the passphrase into a secret key by adopting a Shal algorithm, and storing the secret key;
step five, when the user accesses the file, if the operated file or directory is in the encrypted path directory table, when the user sends a write request, the key stored in the step four is called to encrypt the file; when the user sends out a reading request, the key stored in the step four is called to decrypt the file;
and step six, when the user triggers a screen locking event, clearing the stored key and locking the screen.
2. The key protection method in the Android environment of claim 1, wherein the hash algorithm is an MD5 hash algorithm.
3. The key protection method in the Android environment of claim 1, wherein the password in the second step generates the first key through a Shal algorithm for storage.
4. The key protection method in the Android environment of claim 1, wherein in step four, the pass phrase is converted into the second key by using a Shal algorithm and stored while the screen is unlocked.
5. The key protection method in the Android environment of claim 4, wherein the second key is cleared while the screen is locked in step six.
6. A key protection system under an Android environment comprises a user module and a kernel module, and is characterized in that the user module comprises a configuration unit and a screen locking unit, and the kernel module comprises a key manager unit and a stacked file system unit; wherein,
the configuration unit is used for receiving a user-made strategy, wherein the user-made strategy comprises a password, an identity authentication file and an encryption directory path table, and the password is generated into a first secret key through a Shal algorithm and stored; the identity authentication file is input to a key manager unit, and an encrypted directory path table is input to a stack file system unit;
the screen locking unit is used for outputting the passphrase input by the user to the key manager unit;
the key manager unit is used for matching the password phrase with the authentication file after the operation of the Hash algorithm so as to realize unlocking; when the matching is consistent, the passphrase is converted into a second secret key for storage by adopting a Shal algorithm while the screen is unlocked, and the second secret key is removed when the screen is locked by the screen locking unit;
the stack file system unit is used for calling a first key to carry out initialization encryption on files in a directory corresponding to the encrypted directory path table when the encrypted directory path table is received when the operating system is started for the first time, and covering all file systems supported and mounted by the operating system; when a user calls a second key in the key manager when sending a reading request, decrypting the file; when a user sends a write request, a second key in the key manager is called to encrypt the file.
7. The key protection system in the Android environment of claim 6, wherein the user-defined policy further includes whether to enable the key protection system.
8. The key protection system in the Android environment of claim 6, wherein the hash algorithm is an MD5 hash algorithm.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610540076.2A CN106127078A (en) | 2016-07-11 | 2016-07-11 | Cryptographic key protection method under a kind of Android environment and system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610540076.2A CN106127078A (en) | 2016-07-11 | 2016-07-11 | Cryptographic key protection method under a kind of Android environment and system |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN106127078A true CN106127078A (en) | 2016-11-16 |
Family
ID=57284107
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201610540076.2A Pending CN106127078A (en) | 2016-07-11 | 2016-07-11 | Cryptographic key protection method under a kind of Android environment and system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN106127078A (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110569651A (en) * | 2019-08-27 | 2019-12-13 | 北京明朝万达科技股份有限公司 | file transparent encryption and decryption method and system based on domestic operating system |
| CN111143879A (en) * | 2019-12-26 | 2020-05-12 | 厦门市美亚柏科信息股份有限公司 | Android platform SD card file protection method, terminal device and storage medium |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103106372A (en) * | 2013-01-17 | 2013-05-15 | 上海交通大学 | Lightweight class privacy data encryption method and system for Android system |
| CN104252605A (en) * | 2014-09-17 | 2014-12-31 | 南京信息工程大学 | Method and system for file transparent encryption and decryption of Android platform |
| CN104331644A (en) * | 2014-11-24 | 2015-02-04 | 北京邮电大学 | Transparent encryption and decryption method for intelligent terminal file |
-
2016
- 2016-07-11 CN CN201610540076.2A patent/CN106127078A/en active Pending
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103106372A (en) * | 2013-01-17 | 2013-05-15 | 上海交通大学 | Lightweight class privacy data encryption method and system for Android system |
| CN104252605A (en) * | 2014-09-17 | 2014-12-31 | 南京信息工程大学 | Method and system for file transparent encryption and decryption of Android platform |
| CN104331644A (en) * | 2014-11-24 | 2015-02-04 | 北京邮电大学 | Transparent encryption and decryption method for intelligent terminal file |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110569651A (en) * | 2019-08-27 | 2019-12-13 | 北京明朝万达科技股份有限公司 | file transparent encryption and decryption method and system based on domestic operating system |
| CN111143879A (en) * | 2019-12-26 | 2020-05-12 | 厦门市美亚柏科信息股份有限公司 | Android platform SD card file protection method, terminal device and storage medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN104252605B (en) | A kind of file transparent encrypting and deciphering system of Android platform and method | |
| CN103686716B (en) | Android access control system for enhancing confidentiality and integrality | |
| WO2004034184A3 (en) | Encrypting operating system | |
| CN101309138A (en) | Encryption-based security protection method and device for processor | |
| CN100543759C (en) | Data Storage and Data Retrieval Based on Public Key Encryption | |
| CN106997439A (en) | TrustZone-based data encryption and decryption method and device and terminal equipment | |
| CN111949999B (en) | Apparatus and method for managing data | |
| US20130125196A1 (en) | Method and apparatus for combining encryption and steganography in a file control system | |
| CN107066885A (en) | Cross-platform credible middleware realizes system and implementation method | |
| US7970142B2 (en) | System, method and apparatus for decrypting data stored on removable media | |
| US20250148073A1 (en) | Systems and methods for managing state | |
| Yenugula et al. | Dynamic data breach prevention in mobile storage media using DQN-enhanced context-aware access control and lattice structures | |
| CN104717643A (en) | Mobile device safety communication platform | |
| US20080010686A1 (en) | Confidential Information Processing Device | |
| da Rocha et al. | Secure cloud storage with client-side encryption using a trusted execution environment | |
| CN115758396B (en) | Database security access control technology based on trusted execution environment | |
| CN106127078A (en) | Cryptographic key protection method under a kind of Android environment and system | |
| CN114942729A (en) | Data safety storage and reading method for computer system | |
| CN101604296A (en) | Disk-data sector-level encryption method | |
| CN111523129A (en) | A TPM-Based Data Leak Prevention Method | |
| CN115766003B (en) | Secret information recovery method, device, equipment and storage medium | |
| CN117150521A (en) | Transparent encryption and decryption method and device for universal encryption card | |
| CN116781400A (en) | Method, system and device for processing block chain uplink data and electronic equipment | |
| Sharma et al. | Transcrypt: A secure and transparent encrypting file system for enterprises | |
| KR100952300B1 (en) | Terminal device, memory, and method thereof for secure data management of storage media |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20161116 |
|
| RJ01 | Rejection of invention patent application after publication |