WO2016011778A1 - 数据处理的方法和装置 - Google Patents

数据处理的方法和装置 Download PDF

Info

Publication number
WO2016011778A1
WO2016011778A1 PCT/CN2014/095294 CN2014095294W WO2016011778A1 WO 2016011778 A1 WO2016011778 A1 WO 2016011778A1 CN 2014095294 W CN2014095294 W CN 2014095294W WO 2016011778 A1 WO2016011778 A1 WO 2016011778A1
Authority
WO
WIPO (PCT)
Prior art keywords
domain
data packet
network data
certificate
trusted
Prior art date
Application number
PCT/CN2014/095294
Other languages
English (en)
French (fr)
Inventor
华志超
夏虞斌
陈海波
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to KR1020177003845A priority Critical patent/KR101904177B1/ko
Priority to EP14868710.6A priority patent/EP2991268B1/en
Priority to JP2017504082A priority patent/JP6612322B2/ja
Priority to US14/808,332 priority patent/US9762555B2/en
Publication of WO2016011778A1 publication Critical patent/WO2016011778A1/zh
Priority to US15/701,148 priority patent/US10243933B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0435—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/33—User authentication using certificates
    • G06F21/335—User authentication using certificates for accessing specific resources, e.g. using Kerberos tickets
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/42—User authentication using separate channels for security data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0471—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0485—Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0884—Network architectures or network communication protocols for network security for authentication of entities by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2113—Multi-level security, e.g. mandatory access control
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
    • H04L2463/062—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00 applying encryption of the keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/16—Implementing security features at a particular protocol layer
    • H04L63/168—Implementing security features at a particular protocol layer above the transport layer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0838—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these
    • H04L9/0841—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these involving Diffie-Hellman or related key agreement protocols
    • H04L9/0844—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these involving Diffie-Hellman or related key agreement protocols with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H04L9/3265—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements using certificate chains, trees or paths; Hierarchical trust model

Definitions

  • Embodiments of the present invention relate to the field of communications, and, more particularly, to a method and apparatus for data processing.
  • the privacy data is directly stored in the mobile phone in clear text, which easily causes the leakage of the private data.
  • the prior art encrypts user privacy data, for the convenience of version compatibility and user migration, the secret key of the encrypted private data is encoded in the program, which is easily obtained by an attacker, and the user privacy data is greatly risk.
  • the embodiment of the invention provides a data processing method and device, which can effectively prevent data from being stolen by an attacker, thereby improving data security.
  • a method of data processing comprising:
  • the second network data packet is encrypted by using the first session key negotiated in advance with the target server to obtain the encrypted second network data packet.
  • the encrypted second network data packet is sent to the target server.
  • the method further includes:
  • the fourth network data packet is sent to the target application running in the untrusted running domain.
  • the method before acquiring the first network data packet sent by the target application running in the untrusted running domain, the method also includes:
  • a certificate validates the session key generated by the first certificate of the target server, and the first certificate is used to prove the identity of the target server.
  • the method before acquiring the first network data packet sent by the target application running in the untrusted running domain, the method further include:
  • the first network data packet sent by the target application running in the untrusted running domain is obtained in the trusted running domain, including:
  • the trusted domain and the untrusted operation are performed according to the second certificate and the second root certificate Establish an SSL connection between the domains and determine the second session key, including:
  • the encrypted second session key is decrypted using the private key of the second certificate to obtain a second session key.
  • the encrypted second network packet includes:
  • the encrypted second network data packet is sent to the target server.
  • an apparatus for data processing comprising:
  • a first acquiring module configured to acquire a first network data packet sent by a target application running in an untrusted running domain, where the first network data packet includes a first identifier
  • a second acquiring module configured to acquire, in the trusted running domain, first data corresponding to the first identifier in the first network data packet acquired by the first acquiring module, where the first data is the target application target The data required by the server to request the service;
  • a first generating module configured to generate, according to the first data acquired by the second acquiring module and the first network data packet, a second network data packet in the trusted running domain
  • An encryption module configured to encrypt the second network data packet generated by the first generation module by using a first session key negotiated in advance with the target server, to obtain an encrypted second network data packet.
  • a first sending module configured to send, to the target server, the encrypted second network data packet obtained by the encryption module.
  • the apparatus further includes:
  • a receiving module configured to receive a third network data packet that is sent by the target server and encrypted by using the first session key
  • a processing module configured to decrypt the receiving mode by using the first session key in the trusted running domain
  • the encrypted third network data packet received by the block when it is determined that the decrypted third network data packet includes the first data, generates the first according to the first identifier corresponding to the first data and the third network data packet a network packet, the fourth network packet does not include the first data;
  • a second sending module configured to send the fourth network data packet generated by the processing module to the target application running in the untrusted running domain.
  • the apparatus further includes:
  • a first establishing module configured to establish a secure socket SSL connection with the target server in the trusted running domain before the first obtaining module acquires the first network data packet sent by the target application running in the untrusted running domain And determining the first session key, wherein the first session key is a session key generated after the first certificate of the target server is verified by using the first root certificate pre-stored in the trusted running domain The first certificate is used to prove the identity of the target server.
  • the apparatus further includes:
  • a second generating module configured to generate a second certificate according to the second root certificate, in the trusted running domain, before the first acquiring module acquires the first network data packet sent by the target application running in the untrusted running domain
  • the second certificate has the same common name as the first certificate, and the second root certificate is pre-stored in the trusted running domain and the untrusted running domain;
  • a second establishing module configured to establish an SSL connection between the trusted running domain and the untrusted running domain according to the second certificate generated by the second generating module and the second root certificate, and determine the second session secret Key, the second session key is a session key between the trusted running domain and the untrusted running domain;
  • the first obtaining module includes:
  • a first acquiring unit configured to acquire the first network data packet encrypted by using the second session key
  • a decryption unit configured to decrypt the encrypted first network data packet acquired by the first acquiring unit by using the second session key in the trusted running domain.
  • the second establishing module includes:
  • a second acquiring unit configured to acquire the second certificate generated in the trusted operating domain
  • a processing unit configured to verify, according to the second root certificate, the second certificate obtained by the second obtaining unit in the untrusted running domain, and after the verification is passed, generate the second session key, and use the second certificate
  • the public key encrypts the second session key
  • a decryption unit configured to decrypt the second session key encrypted by the processing unit by using a private key of the second certificate in the trusted running domain to obtain the second session key.
  • the first sending module includes :
  • a transfer unit configured to transfer the encrypted second network data packet to the untrusted running domain through the shared memory
  • a sending unit configured to send the encrypted second network data packet to the target server in the untrusted running domain.
  • the data processing method and device in the embodiment of the present invention can effectively prevent the plaintext form of the data from appearing in the untrusted running domain by storing the data in the trusted running domain, and in the process of using the data. Effectively prevent data from being stolen by attackers, thus improving data security.
  • FIG. 1 is a schematic diagram of an application scenario of a method for data processing according to an embodiment of the present invention.
  • FIG. 2 is a schematic flowchart of a method of data processing according to an embodiment of the present invention.
  • FIG. 3 is another schematic flowchart of a method for data processing according to an embodiment of the present invention.
  • FIG. 4 is still another schematic flowchart of a method for data processing according to an embodiment of the present invention.
  • FIG. 5 is a schematic block diagram of an apparatus for data processing according to an embodiment of the present invention.
  • FIG. 6 is a schematic block diagram of an apparatus for data processing according to another embodiment of the present invention.
  • GSM Global System of Mobile communication
  • CDMA Code Division Multiple Access
  • WCDMA Wideband Code Division Multiple Access
  • GPRS General Packet Radio Service
  • LTE Long Term Evolution
  • FDD Frequency Division Duplex
  • TDD Time Division Duplex
  • Universal Mobile Telecommunication System Universal Mobile Telecommunication System
  • the terminal may also be referred to as a user equipment (User Equipment, referred to as "UE"), a mobile station (Mobile Station, abbreviated as "MS”), or a mobile terminal (Mobile Terminal).
  • the terminal may communicate with one or more core networks via a Radio Access Network ("RAN"), for example, the terminal may be a mobile phone (or "cellular" phone, a mobile phone) or have The computer or the like of the mobile terminal, for example, the terminal may also be a portable, pocket, handheld, computer built-in or in-vehicle mobile device that exchanges voice and/or data with the wireless access network.
  • RAN Radio Access Network
  • the embodiment of the present invention will be described by taking a terminal as a mobile phone as an example, but the embodiment of the present invention is not limited thereto.
  • An untrusted running domain and a trusted running domain can be understood as two operating environments that can run on the same processor.
  • the untrusted running domain may also be referred to as a “normal world”, such as an environment in which an application is running.
  • the trusted running domain may be referred to as a “safe world”.
  • the information or data in the untrusted running domain may be stolen or destroyed by the attacker, that is, the information and data in the untrusted running domain are not high; compared to the untrusted running domain, the trusted running domain can effectively guarantee the information. And the security of the data, the information or data in the trusted running domain will not be obtained or tampered by the attacker, because the application/system program in any untrusted running domain cannot access/modify the data in the trusted running domain at will.
  • the terminal's hardware and software together ensure the trusted operating domain Safety.
  • the TrustZone security extension technology provided by ARM can be used to design an untrusted running domain and a trusted running domain.
  • SSL is a general-purpose communication encryption protocol that can securely and effectively secure communication between the client and the server.
  • SSL-based communication is divided into two steps: The first step is to encrypt the communication by using asymmetric encryption to establish an SSL connection between the client and the server.
  • the specific steps are as follows: first, the client initiates a connection request to the server; the server sends a certificate to the client to prove its identity, the certificate contains some information of the server and an asymmetrically encrypted public key; when the client verifies the server through the server After the identity, a symmetrically encrypted session key is generated, and the session key is encrypted using the public key in the server certificate and sent to the server.
  • the session key is encrypted asymmetrically, only the server's private key (the private key is held by the server) can decrypt the session key encrypted with the public key.
  • the client completes the verification of the service identity and securely negotiates a session key with the server.
  • the communication phase all subsequent communication between the client and the server will be encrypted using the session key.
  • the server in the process of establishing an SSL connection, the server often provides a certificate for authenticating the identity of the client for verification, that is, the certificate is a file used to prove the identity of the server.
  • the certificate includes at least the following three types of information:
  • the public key in the certificate can ensure that the owner of the certificate must be connected to the client (the non-certificate owner does not have the private key corresponding to the public key, and the information encrypted by the client using the certificate public key cannot be decrypted. Communicate with the client).
  • the common name of the certificate can inform the client of the identity of the certificate owner, and the client can compare the certificate. Whether the common name is the same as the server domain name you want to connect to.
  • the certificate also has a signature information of the certificate authority, and the client verifies the authenticity of the certificate by the signature information, because the signature information is information encrypted by the certificate authority using the private key of the corresponding root certificate, and the corresponding information
  • the root certificate is pre-installed in the client, and the client only trusts a certificate signed by a trusted root certificate.
  • the root certificate is a certificate that is trusted by the client in advance (for example, Microsoft Root Authority), and the root certificate is pre-installed in the client (there is also a public key in the root certificate).
  • a trusted certificate authority signs a certificate for a website, it encrypts the signature information with the private key of its own root certificate, which allows only the public key in the root certificate of the organization to decrypt the signature information, and the certificate The public key in it must be able to decrypt the signature information. Therefore, when the client verifies the authenticity of a certificate, the signature information in the certificate can be decrypted in turn using the public key in the plurality of root certificates saved in advance. Once the public key of a root certificate exists, the certificate can be decrypted. Signing information, then the certificate is considered to be issued by a trusted certificate authority, which means that the certificate is trusted.
  • the certificate and the root certificate are two important elements, which are the basis and key to ensure communication security.
  • the user privacy data is usually saved in the application (equivalent to being stored in the untrusted running domain), and then the user privacy data is sent together with other information to the application server (for example, an Alipay server) for operation.
  • the communication protocol is encrypted between the mobile phone and the server. For example, according to the SSL protocol, the server sends a certificate to the mobile phone, and at the same time in the untrusted running domain of the mobile phone.
  • Some root certificates are stored in advance, and the mobile phone will use these root certificates to verify the certificate provided by the server; after the verification is passed, the application in the mobile phone will negotiate an encryption key with the server, and use the key for encryption in subsequent communication.
  • a terminal specifically, for example, a mobile phone
  • a trusted running domain and an untrusted running domain, wherein, unlike the current technology, running in an untrusted running domain
  • Application modules such as Alipay applications
  • user privacy data such as Alipay payment passwords
  • store an identifier corresponding to the user's private data instead of user privacy data
  • the correspondence and user privacy data storage within the trusted operating domain (for example, the security data stored in the trusted operating domain as shown in the figure).
  • the application module running in the untrusted running domain sends a network packet containing the identifier
  • the security module in the trusted running domain intercepts the network packet, and determines corresponding user privacy data according to the identifier in the network packet, and the network packet is
  • the identity is replaced with user privacy data, and then the network packet containing the user's private data is sent to the application server.
  • the root certificate for verifying the identity of the application server is no longer stored in the untrusted running domain, but is stored in the trusted running domain (for example, the root certificate 1 in the SSL module 3 shown in FIG. 1). So that even if the attacker installs a malicious root certificate in the untrusted running domain, the SSL module 3 in the trusted running domain can identify the forged application server because the data in the trusted running domain cannot be obtained by the attacker or tamper.
  • the terminal includes an untrusted running domain and a trusted running domain, and the user privacy data is stored in a trusted operation.
  • the application module, the SSL module 1, the proxy module 1, and the network driver are included in the untrusted operation domain
  • the security module, the SSL module 2, the SSL module 3, and the proxy module 2 are included in the trusted operation domain, and the modules are briefly introduced below. Its connection relationship.
  • an application running in an untrusted running domain when requesting related services from an application server, these applications need to use some data related to user privacy (for example, user payment password, identity) Certificate number, etc.).
  • user privacy for example, user payment password, identity
  • an application running in an untrusted running domain no longer stores user privacy data to be used, but saves an identifier corresponding to user privacy data (as shown in FIG. 1), and The correspondence is stored in the trusted running domain in advance.
  • the identifier has no association with the user privacy data. Therefore, when the attacker attacks the untrusted running domain, even if the identity is stolen, Unable to get user privacy data.
  • SSL module 1 in the untrusted running domain provides SSL services for the application module. It will use the root certificate stored in the untrusted running domain (root certificate 2 as shown in Figure 1) to verify the identity of the application server while guaranteeing SSL. The security of the session, specifically, the SSL module 1 verifies whether it is an application (for example, Alipay) designated network server (for example, an Alipay server) with which the SSL session is performed.
  • an application for example, Alipay
  • network server for example, an Alipay server
  • Agent module 1
  • the proxy module 1 in the untrusted running domain is responsible for forwarding network packets. For the network data packet sent from the application module to the application server, the proxy module 1 forwards it to the trusted running domain for processing; for the network data packet sent from the application server to the untrusted running domain, the proxy module 1 is also the same. It will be forwarded to the trusted running domain for processing; for the network data packet sent from the trusted running domain to the application server, the proxy module 1 forwards it to the network driver, so that the network driver sends the network data packet to the application. server.
  • the security module the user privacy data will be saved in the module, and any malicious program/system in the untrusted running domain cannot steal the user's private data stored in the security module. More specifically, in this module, all user privacy data is stored in a pattern of "user privacy data + identification" similar to such a relationship.
  • the SSL module 3 in the trusted running domain is used to establish an SSL connection with the network server (such as the SSL connection 1 shown in FIG. 1), and is verified by using the root certificate 1 stored in the trusted running domain.
  • the network server identity and the security of the communication (session key 1 determined by negotiation in Figure 1).
  • the SSL module 2 is responsible for helping the security module in the trusted running domain to perform SSL connection with the application module in the untrusted running domain instead of the application server (such as the SSL connection 2 shown in FIG. 1).
  • the application module in the untrusted running domain will use the SSL module 1 also located in the untrusted running domain to verify whether it is an application (such as Alipay) designated network server (such as Alipay server) for the SSL session.
  • an SSL connection is established with the application server in the trusted operating domain, in other words, an SSL connection between the security module and the application server is established. Therefore, the security module needs to be replaced by the application server specified by the application module.
  • the application module establishes an SSL connection. Therefore, in the trusted operation domain, a certificate needs to be created for different servers. Specifically, a certificate is created for the security module, so that it can replace the application server with the application module for SSL connection. A detailed description will be given below.
  • the proxy module 2 in the trusted operating domain is also responsible for forwarding network packets. It sends the data packet forwarded by the proxy module 1 in the untrusted running domain to the security module (via SSL module 2 or SSL module 3 encryption and decryption), and sends the network packet sent by the security module to the application server to the untrusted Agent module 1 processing in the running domain.
  • the network driver shown in FIG. 1 is in the untrusted running domain, that is, the terminal directly communicates with the application server in the untrusted running domain.
  • the proxy is sent to the application server, so the proxy module 2 needs to send the network packet sent by the security module to the application server to the proxy module 1 in the untrusted running domain for processing.
  • the network driver can be set in the trusted operating domain.
  • the terminal can directly communicate with the application server in the untrusted running domain, correspondingly, for the security module.
  • the network packet sent to the application server, the proxy module 2 does not need to be forwarded to the proxy module 1 in the untrusted running domain for processing, but can be sent to the network driver in the trusted running domain for transmission to the application server.
  • the application module in the untrusted running domain will only store the identifier of the user's private data, so the attacker can only steal the identity of the user's private data and cannot steal the private data itself.
  • the identifier does not have an association with the privacy data itself, the attacker cannot reversely push the user's private data by stealing the identifier.
  • the trusted running domain only the identifiers in the network packets sent to the trusted application server are replaced with the user privacy data. If the target server of a network packet is found to be not a trusted server, no operation will be performed on the network packet, which prevents the attacker from stealing user privacy data through a malicious untrusted server.
  • the architecture or the scenario shown in FIG. 1 is intended to help those skilled in the art to better understand the embodiments of the present invention and not to limit the scope of the embodiments of the present invention.
  • the identifier corresponding to the user privacy data is not necessarily stored in the application module, as long as it is stored in the untrusted running domain; similarly, the user privacy data is not necessarily stored in the security module shown in FIG. It can be stored in the trusted running domain.
  • those skilled in the art can make various modifications and changes in the form of the embodiment of FIG. 1 and such modifications or variations are also within the scope of the embodiments of the present invention.
  • FIG. 2 is a schematic flowchart of a method 100 for data processing according to an embodiment of the present invention.
  • the method 100 may be performed by, for example, a terminal, and the terminal includes an untrusted running domain and a trusted running domain, such as shown in FIG.
  • the terminal shown is as shown in FIG. 2, and the method includes:
  • S110 Acquire a first network data packet sent by a target application running in an untrusted running domain, where the first network data packet includes a first identifier;
  • S140 in the trusted running domain, encrypting the second network data packet by using a first session key negotiated in advance with the target server, and acquiring the encrypted second network data packet;
  • the target application running in the untrusted running domain generates a first network data packet including the first identifier, where the first network data packet can be understood as a request data packet requesting a service from the target server; and in the trusted running domain, acquiring the first a network data packet, and acquiring first data corresponding to the first identifier in the first network data packet, where the first data is required for the target application to request the service from the target server
  • the required data for example, the user privacy data shown in FIG.
  • the first identifier has a corresponding relationship with the first data required to request the service, and the corresponding relationship is stored in the trusted running domain in advance
  • the first data may be obtained according to the correspondence between the obtained first identifier and the implemented storage in the trusted running domain; and the first data and the first network data packet obtained in the trusted running domain are determined to include the first a second network data packet of data, optionally, the second network data packet may be determined by replacing the first identifier in the first network data packet with the first data data; in the trusted operating domain, according to the target
  • the server negotiates the determined first session key (such as the session key 1 shown in FIG. 1) to encrypt the second network data packet. It should be understood that the first session key is stored in the trusted running domain and is not trusted.
  • the first session key cannot be obtained in the running domain. Therefore, the system or program running in the untrusted running domain cannot obtain the first session key, that is, the plaintext of the first data cannot be obtained.
  • Formula; to the target server sends the encrypted data packet comprises a second network a first data, so that the target server according to the second packet data network, in response to the request of the target application.
  • the data processing method of the embodiment of the present invention can effectively prevent the data from being attacked by storing the data in the trusted running domain and effectively preventing the plaintext form of the data from appearing in the untrusted running domain during the use of the data. Stealing, which can improve the security of data.
  • the first data in the embodiment of the present invention is data necessary for the target application to request the service from the target server.
  • the user when the Alipay application requests the related service from the Alipay server, the user must provide the user name and the login password or the payment password to the service.
  • the first data may specifically be the username and the login password or the payment password. If the attacker steals the data, it is likely to endanger the user's personal property or private resources. It should be understood that in the present invention, the first A piece of data is called user privacy data.
  • the first network data packet may include other information, such as the domain name of the target server, in addition to the first identifier, which is not limited in this embodiment of the present invention.
  • the first network data packet sent by the target application running in the untrusted running domain is obtained, where the first network data packet includes the first identifier, and specifically, the first network data packet may be obtained by sharing the memory. .
  • acquiring the first network data packet sent by the target application running in the untrusted running domain includes:
  • the first network packet is obtained through shared memory.
  • the first network data packet sent by the target application is stored in the shared memory; then, the untrusted running domain is switched to the trusted running domain; in the trusted running domain, The first network data packet is obtained from the shared memory, and then the first network data packet is subsequently processed in the trusted operating domain. More specifically, as shown in FIG. 1 , in the untrusted operation domain, the first network data packet including the first identifier generated by the application module is stored in the shared memory by the proxy module 1; in the trusted operation domain, through the proxy module 2 Extract the first network data packet from the shared memory, and then send it to other modules in the trusted running domain for subsequent processing.
  • the first data corresponding to the first identifier is obtained.
  • the first identifier has a corresponding relationship with the first data required to request the service, and the corresponding relationship is pre-stored in the trusted running domain, and in the trusted running domain, the corresponding identifier and the first identifier may be Determining the first data determined by the first identifier.
  • the first identifier has a corresponding relationship with the first data, but the first identifier may have no association relationship with the first data, that is, when the attacker attacks the untrusted running domain, even if the first identifier is stolen, The corresponding first data cannot be derived or obtained, which can improve the security of the first data.
  • the first identifier may be pre-stored in the untrusted running domain, and specifically may be stored in the target application, for example, stored in the application module as shown in FIG. 1.
  • the correspondence between the first identifier and the first data may be stored in the trusted running domain in any storage mode, for example, may be stored in a mode of “first identifier+first data”, or may be based on the first identifier.
  • the mode storage of the index established with the first data is not limited in this embodiment of the present invention, as long as the corresponding first data can be obtained in the trusted running domain according to the first identifier.
  • the second network data packet is generated according to the first data and the first network data packet, and it should be understood that the first data data is included in the second network data packet.
  • S130 in the trusted operating domain, generating the second network data packet according to the first data and the first network data packet, including:
  • the second network data packet is determined by replacing the first identifier in the first network data packet with the first data.
  • the second network data packet may be regenerated according to the first data and the first network data packet, which is not limited in this embodiment of the present invention, as long as the second network data packet includes the first A data, and can request a service from the target server specified by the target application.
  • the second network data packet is encrypted by using the first session key negotiateed in advance with the target server, and it should be understood that the first session key is in the trusted running domain and the target service.
  • the key for communicating with the device, for the encryption/decryption module and the target server in the trusted running domain, has already agreed the first session key before communication, which will be described in detail below with reference to FIG. 3.
  • the first session key may be pre-stored in the trusted running domain, or may be obtained from the server at any time in the trusted running domain, which is not limited in this embodiment of the present invention, as long as the system in the untrusted running domain is guaranteed. Or the program cannot obtain the first session key.
  • the encrypted second network data packet is sent to the target server.
  • the encrypted second network data packet may be directly sent to the target server in the trusted running domain; or may be switched to untrusted. Within the running domain, the encrypted second network packet is sent to the target server.
  • the network driver for transmitting data to the target server is trusted and secure, that is, the network driver runs in the trusted running domain
  • the encrypted second network data may be sent to the target server within the trusted operating domain. Packet; when the network driver is untrusted, that is, running in an untrusted running domain, that is, sending the encrypted second network packet to the target server in the untrusted running domain.
  • the S150 sends the encrypted second network data packet to the target server, including:
  • the encrypted second network data packet is sent to the target server.
  • the security of the data can be improved, and when the network data packet including the first data is transmitted to the target server, The first data is encrypted by using the first session key and then transmitted, thereby further improving the security of the first data.
  • the second network data packet is encrypted by using a first session key negotiateed in advance with the target server, and it should be understood that the first session key is a key that communicates with the target server in the trusted operating domain. Specifically, the first session key may be determined by establishing an SSL connection with the target server.
  • the method before the acquiring, by the S110, the first network data packet sent by the target application running in the untrusted running domain, the method further includes:
  • a certificate validates the session key generated by the first certificate of the target server, and the first certificate is used to prove the identity of the target server.
  • the application in S201, by the target running in the untrusted running domain The application generates a request data packet for requesting to establish an SSL connection with the target server; in S202, the request data packet is sent to the target server; in S303, the target server sends the certificate capable of proving the identity to the terminal according to the request data packet.
  • the certificate 1 includes a public key
  • the domain name of the server is used as the common name of the certificate 1
  • the signature information of the certificate 1 uses the private certificate of the root certificate 1 (corresponding to the first root certificate)
  • the key is encrypted, and the root certificate 1 is pre-stored in the trusted running domain of the terminal (specifically, the root certificate 1 in the SSL module 3 as shown in FIG.
  • the pre-stored root certificate 1 verifies the certificate 1 sent by the server. Specifically, when it is determined that the public key of the root certificate 1 can decrypt the signature information in the certificate 1, the certificate 1 is a trusted certificate, that is, the target server is trusted. Secondly, when it is determined that the common name of the certificate 1 is consistent with the domain name of the server that the target application wants to request the service, it can be determined that the target server is the target application running in the untrusted running domain.
  • SSL connection 1 (also corresponds to SSL connection 1 shown in Figure 1).
  • an SSL connection with the target server is established in the trusted running domain, and a session key 1 for communication encryption is generated, that is, the terminal only knows and targets when running in the trusted running domain.
  • the session key 1 negotiated by the server in other words, the program and system in the untrusted running domain cannot acquire the session key 1.
  • the encrypted second network data packet is only in the trusted running domain and the target Only the server can be decrypted, so that the attacker can not steal the user's private data, because, first of all, the attacker can not steal any data in the trusted running domain, that is, it is impossible to steal the stored in the trusted operation.
  • User privacy data in the domain secondly, the attacker cannot steal the user's private data by forging the server.
  • the root certificate 1 used to verify the identity of the server is stored in the trusted running domain in advance, the attacker cannot tamper with the root certificate. 1, therefore, only the trusted server can pass the security authentication in the trusted running domain.
  • the security authentication can be fixed, that is, the SSL connection with the fake server fails, so it will not
  • the session key 1 is negotiated with the forged server, so the attacker cannot forge the root certificate or forge the server. To steal the plaintext of user privacy data.
  • the plaintext form of the user privacy data (the first data) does not appear in the infeasible running domain, and the attacker can effectively prevent the attacker from stealing the plaintext of the user's private data, thereby improving the security of the data.
  • the request data packet is sent to the target server, specifically, the request data packet generated in the untrusted running domain may be first transferred to the trusted running domain through the shared memory; secondly, in the trusted running domain, according to The request packet acquires the domain name of the server that the target application wants to request the service, so that the common name of the certificate 1 is verified according to the server domain name in S204; finally, the request packet is sent to the target server, optionally, The request packet may be sent to the target server in the trusted running domain or the trusted running domain, which is not limited by the embodiment of the present invention.
  • Security that is, when the network driver runs in the trusted running domain, in S202, the request packet is sent to the target server in the trusted running domain; when the network driver is untrusted, that is, running in the untrusted operation In the case of the domain, in S202, the request packet is sent to the target server in the untrusted running domain.
  • the operations related to transmitting data with the server in FIG. 3, such as S202, S203, and S206, are all executed in the trusted running domain, or are all executed in the untrusted running domain, and the specific implementation is performed according to the operation of the network driver. Depending on the domain.
  • the network driver is running in an untrusted running domain, as shown in FIG. Therefore, in the embodiment of the present invention, if the network driver also runs in the untrusted running domain, that is, communicates with the target server in the untrusted running domain, specifically, sends the request data to the target server in the untrusted running domain.
  • the invention provides a certificate, a certificate sent by the target server, an encrypted session key 1 sent to the target server, or an encrypted second network data packet, and the technical solution provided by the embodiment of the present invention improves data security. On the basis of this, compared with the existing architecture, there are no excessive modifications, which can reduce the cost of code modification.
  • the data processing method of the embodiment of the present invention can prevent the data from being attacked by preventing the data from being attacked by storing the data in the trusted running domain and preventing the plaintext form of the data from appearing in the untrusted running domain during the use of the data. Stealing, which can improve the security of data.
  • the target application running in the untrusted runtime domain will also verify whether it is the server specified by the target application.
  • the first network data packet including the first identifier generated by the target application is not directly sent to the server, but is obtained after being processed in the trusted running domain (for example, the first identifier is Replaced with the first data) and then sent to the target server, that is, in the present invention, with the target application in the untrusted running domain
  • Direct communication is a trusted operating domain (such as the security module shown in Figure 1). Therefore, a certificate needs to be created in the trusted running domain to establish an SSL connection with the untrusted running domain.
  • the security module in the trusted running domain replaces the target server specified by the application module with the application module to establish an SSL connection.
  • the method before the acquiring, by the S110, the first network data packet sent by the target application running in the untrusted running domain, the method further includes:
  • the first network packet sent by the target application running in the untrusted running domain is obtained in the trusted running domain, including:
  • the encrypted first network data packet is decrypted by the second session key in the trusted operating domain.
  • an SSL connection is established between the trusted running domain and the untrusted running domain according to the second certificate and the second root certificate, and the second session key is determined, including :
  • the encrypted second session key is decrypted using the private key of the second certificate to obtain a second session key.
  • the root certificate 2 pre-stored in the untrusted operation domain is used (for example, the untrusted one shown in FIG. 1 is used.
  • the common name of 2 is the same as the common name of the certificate 1 of the target server (see S203).
  • the certificate 2 also includes a public key, and the private key corresponding to the public key is stored in the trusted running domain; in S209, the shared memory is shared.
  • the root certificate 2 is used to verify the certificate 2, specifically, the public key of the root certificate 2 is used to decrypt the signature information of the certificate 2, and it is verified whether the common name of the certificate 2 is the domain name of the server specified by the target application; in S211 After the verification is passed, the session key 2 (corresponding to the session key 1 in the SSL module 1 shown in FIG.
  • the session key 2 is generated in the untrusted operation domain (corresponding to the second session key in the embodiment of the present invention) And encrypting the session key 2 by using the public key of the certificate 2; in S212, transferring the encrypted session key 2 to the trusted running domain by means of shared memory; in S213, running in a trusted operation Within the domain, the session key 2 is decrypted using the private key corresponding to the public key included in the certificate 2. So far, an SSL connection 2 between the untrusted running domain and the trusted running domain has been established (corresponding to the SSL connection 2 shown in FIG. 1). In this case, the session key 2 for communication encryption is known in both the untrusted running domain and the feasible operation. As shown in FIG. 1, the session key 2 is stored in both the SSL module 1 and the SSL module 2.
  • the root certificate 2 is used to verify the certificate 2 in the untrusted running domain, and for the target application in the untrusted running domain, the certificate 2 belongs to its target server (the certificate 2 common name and the certificate provided by the target server 1)
  • the common name is consistent
  • certificate 2 is a certificate issued by a trusted certificate authority (certificate 2 is signed by root certificate 2, and root certificate 2 is installed in the untrusted running domain beforehand, so
  • the root certificate 2 is the root certificate belonging to the trusted certificate authority. Therefore, in S210, the root certificate 2 is verified to pass the certificate 2.
  • the example shown in FIG. 1 can also be understood as the application module verification. Passed the identity of the security module.
  • communication between the trusted running domain and the untrusted running domain may be implemented by means of shared memory. Specifically, S209 and S212 as shown in FIG. 3 may also be used. The communication between the trusted running domain and the untrusted running domain is implemented in other manners, which is not limited by the embodiment of the present invention.
  • the certificate 1, the root certificate 1, the certificate 2, and the root certificate 2 shown in FIG. 3 correspond to the first certificate, the first root certificate, the second certificate, and the second root certificate, respectively, in the example of the present invention.
  • an SSL connection with the target server is established in the trusted running domain, and a communication key (first session key) with the target server is generated, and the After the first key is encrypted, the communication key is sent to the target server to prevent the plaintext of the first data from appearing in the untrusted running domain, which can effectively prevent the attacker from stealing the first data, thereby effectively ensuring that the first data is in the first data.
  • Security during transmission which further enhances data security.
  • the target server When receiving network packets sent by the target server, it can also receive in the trusted running domain. After the network packet is processed, it is sent to the target application running in the untrusted running domain.
  • the method 100 shown in FIG. 2 further includes:
  • the fourth network data packet is sent to the target application running in the untrusted running domain.
  • the third network data packet is a response data packet used by the target server to respond to the second network data packet.
  • a data packet 1 including an identifier 1 (corresponding to the first identifier) (corresponding to the first network data packet) is generated by the target application; in S302, the data is shared by the shared memory.
  • the packet 1 is transferred to the trusted running domain; in S303, in the trusted running domain, the corresponding user privacy data is determined according to the correspondence relationship and the identifier 1 in the data packet 1; in S304, the data packet including the user privacy data is generated.
  • the data packet 2 encrypted with the session key 1 (corresponding to the first session key) is transmitted to the target server; in S306, the target server utilizes the session key 2 Decrypting the data packet 2; in S307, the target server determines the response packet according to the data packet 2, that is, the data packet 3 (corresponding to the third network data packet); in S308, the target server transmits the encrypted data using the session key to the terminal.
  • the application uses the data in packet 4 to implement the corresponding application operation.
  • the wechat application can implement the login operation of the user after receiving the response from the wechat application server; for example, after receiving the response of the Alipay application server, the payment application can implement the user's payment operation or login operation.
  • the data packet 4 not including the user privacy data is determined according to the data packet 3. Specifically, when it is determined that the user privacy data is not included in the data packet 3, the data packet 3 may be directly determined as Packet 4, in other words, can directly transfer packet 3 to no Within the trusted operating domain; when it is determined that the user privacy data is included in the data packet 3, the data packet 4 can be determined by replacing the user privacy data in the data packet 3 with the first identifier.
  • the third network data packet is determined as the fourth network data packet.
  • the data is stored in the trusted running domain of the terminal, and the plaintext form of the data is also exposed to the untrusted running domain of the terminal during the use of the data. Therefore, the data can be effectively prevented from being stolen by an attacker, thereby effectively protecting the security of the data in the terminal.
  • the user privacy data is stored in the trusted running domain of the terminal, compared with the prior art, when the user privacy data is stored in the application (ie, within the untrusted running domain).
  • the identifier of the user privacy data is stored in the untrusted running domain, and the security of the user's private data is improved, and the terminal has a large performance overhead.
  • the root certificate used for the authentication server is stored in the trusted running domain, the identity of the server is effectively verified, and the attack of the terminal by the malicious server is effectively prevented.
  • the terminal shown in FIG. 1 is a mobile phone
  • the application module in the untrusted running domain is specifically a mobile banking
  • the application server is a mobile banking server.
  • the mobile banking bank reads the first identifier of the stored user privacy data (including the account number and the password), and generates and uses other information to request the login service from the mobile banking server.
  • the first network data packet, and the first network data packet is encrypted by the SSL module 1 by using the session key 1;
  • the security module receives the first network data packet that is forwarded through the proxy module 1, the shared memory, the proxy module 2, and decrypted by the SSL module 2, and replaces the first identifier with the user privacy data (including the account number and Password), generating a second network data packet, encrypting the second network data packet by using the session key 2 via the SSL module 3, and then sending the encryption to the mobile banking server through the proxy module 2, the shared memory, the proxy module 1 and the network driver After the second network packet.
  • the mobile banking server processes the request for the second network data packet to determine the response request a third network data packet, and sending the third network data packet encrypted by using the session key 1 to the mobile phone;
  • the fourth network data packet not including the user privacy data is sent to the mobile banking through the security module, the SSL module 2, the proxy module 1, the shared memory, and the proxy module 2.
  • the plaintext of user privacy data (including account number and password) has never been exposed to the untrusted running domain, and the user's mobile banking password and account security can be effectively guaranteed.
  • the security root certificate stored in the trusted running domain is used to verify the authenticity of the mobile banking server, so that the malicious forged mobile banking server can be identified, thereby further improving the security of the user's private data.
  • the terminal shown in FIG. 1 can be a mobile phone, and the application module in the untrusted running domain is specifically a credit card application module, and the application server is a credit card application server.
  • the credit card application module sends the first identifier of the user privacy data (credit card number) to the credit card application server for payment, etc., in the trusted running domain, the first identifier is replaced with the user privacy data (credit card number), and then the user is The privacy data is sent to the credit card application server, which protects the user's credit card number from being stolen by malicious programs.
  • the detailed description is similar to the example of mobile banking, and for brevity, it will not be described here.
  • the data processing method of the embodiment of the present invention saves the user privacy data in the trusted running domain, and effectively prevents the plain text form of the user privacy data from appearing in the untrusted running domain during the use of the user privacy data. It can effectively prevent user privacy data from being stolen by attackers, thereby improving the security of user privacy data.
  • a malicious untrusted encryption/decryption module for example, an encryption module in an untrusted running domain, such as SSL module 1 in FIG. 1.
  • the attacker installs a malicious root certificate in the mobile phone, so that the root certificate can be used to disguise the malicious server as the target server of the target application, thereby obtaining all the plaintext of the data sent by the user.
  • the root certificate stored in the trusted running domain is used to verify the identity of the server, and the attacker cannot install any malicious root certificate in the trusted running domain, so the malicious root certificate cannot be used to attack the terminal.
  • User privacy data is used to verify the identity of the server, and the attacker cannot install any malicious root certificate in the trusted running domain, so the malicious root certificate cannot be used to attack the terminal.
  • the attacker will be able to steal all the information sent by the application, but since all the data sent by the application is only the identifier, and the identifier has no relevance to the user privacy data corresponding to it, An attacker could not obtain user privacy data from any user.
  • the user privacy data is stored in the trusted running domain of the terminal, and the plaintext form of the user privacy data is also exposed to the terminal during the use of the user privacy data.
  • the untrusted running domain can effectively prevent the user's private data from being stolen by the attacker, thereby effectively protecting the security of the user's private data in the terminal.
  • the method of data processing of the present invention is also applicable to a protection scenario similar to an order amount such that data that needs to be modified and is very important at any time.
  • the security module in the running domain can effectively prevent the order information from being tampered with.
  • the size of the sequence numbers of the above processes does not mean the order of execution, and the order of execution of each process should be determined by its function and internal logic, and should not be taken to the embodiments of the present invention.
  • the implementation process constitutes any limitation.
  • the data processing method of the embodiment of the present invention effectively avoids the user privacy data by storing the user privacy data in the trusted running domain and during the use of the user privacy data.
  • the plain text form appears in the untrusted running domain, which can effectively prevent the user's private data from being stolen by the attacker, thereby improving the security of the user's private data.
  • FIG. 5 shows a schematic block diagram of an apparatus 400 for data processing in accordance with an embodiment of the present invention. As shown in Figure 5, the device includes:
  • the first acquiring module 410 is configured to acquire a first network data packet sent by the target application running in the untrusted running domain, where the first network data packet includes a first identifier;
  • the second obtaining module 420 is configured to acquire, in the trusted running domain, first data corresponding to the first identifier in the first network data packet acquired by the first acquiring module, where the first data is the target application The data required by the target server to request the service;
  • the first generating module 430 is configured to generate, according to the first data acquired by the second acquiring module and the first network data packet, a second network data packet in the trusted operating domain;
  • the encryption module 440 is configured to encrypt the second network data packet generated by the first generation module by using a first session key negotiated in advance with the target server in the trusted operation domain to obtain the encrypted second network data. package;
  • the first sending module 450 is configured to send the encrypted second network data packet acquired by the encryption module to the target server.
  • the apparatus for data processing can improve the security of data by storing data in a trusted operation domain and storing the encryption key of the data in the trusted operation domain.
  • the device further includes:
  • a receiving module configured to receive a third network data packet that is sent by the target server and encrypted by using the first session key
  • a processing module configured to decrypt, by using the first session key, the encrypted third network data packet received by the receiving module in the trusted running domain, when determining that the decrypted third network data packet includes the first data Generating, according to the first identifier corresponding to the first data and the third network data packet, a fourth network data packet, where the fourth network data packet does not include the first data;
  • a second sending module configured to send the fourth network data packet generated by the processing module to the target application running in the untrusted running domain.
  • the device further includes:
  • a first establishing module configured to establish a secure socket SSL connection with the target server in the trusted running domain before the first obtaining module acquires the first network data packet sent by the target application running in the untrusted running domain And determining the first session key, wherein the first session key is a session key generated after the first certificate of the target server is verified by using the first root certificate pre-stored in the trusted running domain The first certificate is used to prove the identity of the target server.
  • the device includes:
  • a second generating module configured to generate a second certificate according to the second root certificate, in the trusted running domain, before the first acquiring module acquires the first network data packet sent by the target application running in the untrusted running domain
  • the second certificate has the same common name as the first certificate, and the second root certificate is pre-stored in the trusted running domain and the untrusted running domain;
  • a second establishing module configured to establish an SSL connection between the trusted running domain and the untrusted running domain according to the second certificate generated by the second generating module and the second root certificate, and determine the second session secret Key, the second session key is a session key between the trusted running domain and the untrusted running domain;
  • the first obtaining module includes:
  • a first acquiring unit configured to acquire the first network data packet encrypted by using the second session key
  • a decryption unit configured to decrypt the encrypted first network data packet acquired by the first acquiring unit by using the second session key in the trusted running domain.
  • the second establishing module includes:
  • a second acquiring unit configured to acquire the second certificate generated in the trusted operating domain
  • a processing unit configured to verify, according to the second root certificate, the second certificate obtained by the second obtaining unit in the untrusted running domain, and after the verification is passed, generate the second session key, and use the second certificate
  • the public key encrypts the second session key
  • a decryption unit configured to decrypt the second session key encrypted by the processing unit by using a private key of the second certificate in the trusted running domain to obtain the second session key.
  • the first sending module includes:
  • a transfer unit configured to transfer the encrypted second network data packet to the untrusted running domain through the shared memory
  • a sending unit configured to send the encrypted first to the target server in the untrusted running domain Two network packets.
  • the apparatus 400 for data processing may correspond to a terminal of the method of data processing of the embodiment of the present invention, such as the terminal shown in FIG. 1, and the above and other of each module in the apparatus 400.
  • the operations and/or functions are respectively implemented in order to implement the corresponding processes of the respective methods in FIG. 1 to FIG. 4, and are not described herein again for brevity.
  • the apparatus for data processing can improve the security of data by storing data in a trusted operation domain and storing the encryption key of the data in the trusted operation domain.
  • the embodiment of the present invention further provides a network device 500, which includes a processor 510, a memory 520, a bus system 530, a receiver 540, and a transmitter 550.
  • the processor 510, the memory 520, the receiver 540 and the transmitter 550 are connected by a bus system 530 for storing instructions for executing instructions stored in the memory 520 to control the receiver 540 to receive.
  • Signal and control transmitter 550 to send a signal.
  • the processor 510 is configured to acquire a first network data packet that is sent by the target application that is to be run in the untrusted running domain, where the first network data packet includes a first identifier, and in the trusted operating domain, obtain the first identifier corresponding to the first identifier.
  • the first data is data necessary for the target application to request a service from the target server; and the first data acquired by the second obtaining module and the first network data packet are generated in the trusted running domain.
  • a second network data packet in the trusted operating domain, encrypting the second network data packet generated by the first generation module by using a first session key negotiated in advance with the target server, and acquiring the encrypted second network data.
  • a packet 550 configured to send the encrypted second network data packet obtained by the encryption module to the target server.
  • the apparatus for data processing can improve the security of data by storing data in a trusted operation domain and storing the encryption key of the data in the trusted operation domain.
  • the receiver 540 is configured to receive a third network data packet that is sent by the target server and that is encrypted by using the first session key, and the processor 510 is configured to use the trusted operating domain.
  • the first session key decrypts the encrypted third network data packet received by the receiver 540.
  • the decrypted third network data packet includes the first data
  • the first identifier corresponding to the first data and
  • the third network data packet generates a fourth network data packet
  • the fourth network data packet does not include the first data
  • the transmitter 550 is configured to send the fourth network data packet to the operation in the untrusted running domain.
  • the target application is configured to send the fourth network data packet to the operation in the untrusted running domain.
  • the processor 510 is configured to establish a condom with the target server in the trusted running domain before acquiring the first network data packet sent by the target application running in the untrusted running domain. Connected to the SSL connection, and determines the first session key, wherein the first session key is generated after verifying the first certificate of the target server by using the first root certificate pre-stored in the trusted running domain The session key used to prove the identity of the target server.
  • the processor 510 is configured to generate a second according to the second root certificate in the trusted running domain before acquiring the first network data packet sent by the target application running in the untrusted running domain.
  • a certificate the second certificate having the same common name as the first certificate, the second root certificate being pre-stored in the trusted running domain and the untrusted running domain; and the second certificate generated by the second generating module and the a second root certificate, establishing an SSL connection between the trusted running domain and the untrusted running domain, and determining a second session key, where the second session key is the trusted running domain and the untrusted running domain a session key; obtaining the first network data packet encrypted by using the second session key; and decrypting the encrypted first network data packet by using the second session key in the trusted operation domain.
  • the processor 510 is configured to obtain the second certificate generated in the trusted operating domain; and in the untrusted running domain, verify the second certificate according to the second root certificate, when After the verification is passed, the second session key is generated, and the second session key is encrypted by using the public key of the second certificate; in the trusted operation domain, the processing unit is decrypted by using the private key of the second certificate.
  • the second session key obtains the second session key.
  • the processor 510 is configured to transfer the encrypted second network data packet to the untrusted running domain by using a shared memory.
  • the sender 550 is configured to send the encrypted second network data packet to the target server in the untrusted running domain.
  • the processor 510 may be a central processing unit (“CPU"), and the processor 510 may also be other general-purpose processors, digital signal processors (DSPs). , an application specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, and the like.
  • the general purpose processor may be a microprocessor or the processor or any conventional processor or the like.
  • the memory 520 can include read only memory and random access memory and provides instructions and data to the processor 510. A portion of the memory 520 may also include a non-volatile random access memory. For example, the memory 520 can also store information of the device type.
  • the bus system 530 may include a power bus, a control bus, a status signal bus, and the like in addition to the data bus. However, for clarity of description, various buses are labeled as bus system 530 in the figure.
  • each step of the above method may be completed by an integrated logic circuit of hardware in the processor 510 or an instruction in a form of software.
  • the steps of the method disclosed in the embodiments of the present invention may be directly implemented as a hardware processor, or may be performed by a combination of hardware and software modules in the processor.
  • the software module can be located in a conventional storage medium such as random access memory, flash memory, read only memory, programmable read only memory or electrically erasable programmable memory, registers, and the like.
  • the storage medium is located in the memory 520, and the processor 510 reads the information in the memory 520 and completes the steps of the above method in combination with its hardware. To avoid repetition, it will not be described in detail here.
  • apparatus 500 for data processing according to an embodiment of the present invention may correspond to the apparatus 400 for data processing of the embodiment of the present invention, or may correspond to the terminal of data processing according to an embodiment of the present invention, and
  • the above and other operations and/or functions of the respective modules are respectively implemented in order to implement the respective processes of the respective methods in FIG. 1 to FIG. 4, and are not described herein again for brevity.
  • the apparatus for data processing can improve the security of data by storing data in a trusted operation domain and storing the encryption key of the data in the trusted operation domain.
  • the size of the sequence numbers of the above processes does not mean the order of execution, and the order of execution of each process should be determined by its function and internal logic, and should not be taken to the embodiments of the present invention.
  • the implementation process constitutes any limitation.
  • the disclosed systems, devices, and methods may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the functions may be stored in a computer readable storage medium if implemented in the form of a software functional unit and sold or used as a standalone product.
  • the technical solution of the present invention which is essential or contributes to the prior art, or a part of the technical solution, may be embodied in the form of a software product, which is stored in a storage medium, including
  • the instructions are used to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. .

Abstract

本发明实施例提供一种数据处理的方法和装置，该方法包括：获取运行于不可信运行域内的目标应用发送的第一网络数据包，该第一网络数据包包括第一标识；在可信运行域内，获取与该第一标识对应的第一数据，该第一数据为该目标应用向目标服务器请求服务所必需的数据；在该可信运行域内，根据该第一数据和该第一网络数据包生成第二网络数据包；在该可信运行域内，利用预先与该目标服务器协商的第一会话密钥对该第二网络数据包进行加密，获取加密的第二网络数据包；向该目标服务器发送该加密的第二网络数据包。本发明实施例的数据处理的方法和装置，能够有效避免数据被攻击者窃取，从而能够提高数据的安全性。

Description

数据处理的方法和装置
本申请要求于2014年7月25日提交中国专利局、申请号为201410361410.9、发明名称为“数据处理的方法和装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明实施例涉及通信领域，并且更具体地，涉及一种数据处理的方法和装置。
背景技术
随着信息化技术的发展，个人信息安全已经成为人们关心的重要问题。用户可以通过各种智能终端(例如笔记本电脑、智能手机和平板电脑等)进行个人数据操作，例如对电子邮件、手机银行、社交网络等应用程序进行操作，为了使用方便，用户通常会将登陆密码等隐私数据保存在智能终端中。
然而，当前智能终端对这些隐私数据的保护也存在一些隐患，例如直接将隐私数据以明文形式保存在手机中，这就很容易造成该隐私数据的泄露。现有技术虽然对用户隐私数据进行加密，但为了版本兼容性和用户迁移的便捷性，将加密隐私数据的秘钥编码在程序中，很容易被攻击者获得，使得用户隐私数据存在很大的风险。
因此在当前智能终端中，数据的安全性亟待增强。
发明内容
本发明实施例提供一种数据处理的方法和装置，能够有效避免数据被攻击者窃取，从而能够提高数据的安全性。
第一方面，提供了一种数据处理的方法，该方法包括：
获取运行于不可信运行域内的目标应用发送的第一网络数据包，该第一网络数据包包括第一标识；
在可信运行域内，获取与该第一标识对应的第一数据，该第一数据为该目标应用向目标服务器请求服务所必需的数据；
在该可信运行域内，根据该第一数据和该第一网络数据包生成第二网络 数据包；
在该可信运行域内，利用预先与该目标服务器协商的第一会话密钥对该第二网络数据包进行加密，获取加密的第二网络数据包；
向该目标服务器发送该加密的第二网络数据包。
结合第一方面，在第一方面的第一种可能的实现方式中，该方法还包括：
接收该目标服务器发送的利用该第一会话密钥加密的第三网络数据包；
在该可信运行域内，利用该第一会话密钥解密该加密的第三网络数据包，当确定被解密的第三网络数据包包括该第一数据时，根据该第一数据对应的该第一标识以及该第三网络数据包，生成第四网络数据包，该第四网络数据包不包括该第一数据；
将该第四网络数据包发送给运行于该不可信运行域内的该目标应用。
结合第一方面或第一方面的第一种可能的实现方式，在第一方面的第二种可能的实现方式中，获取运行于不可信运行域内的目标应用发送的第一网络数据包之前，该方法还包括：
在该可信运行域内，建立与该目标服务器之间安全套接层SSL连接，并确定该第一会话密钥，其中，该第一会话密钥为在利用预先存储于该可信运行域内的第一根证书对该目标服务器的第一证书验证通过后生成的会话密钥，该第一证书用来证明该目标服务器的身份。
结合第一方面的第二种可能的实现方式，在第一方面的第三种可能的实现方式中，在获取运行于不可信运行域内的目标应用发送的第一网络数据包之前，该方法还包括：
在该可信运行域内，根据第二根证书生成第二证书，该第二证书与该第一证书具有相同通用名，该第二根证书预先存储于该可信运行域和该不可信运行域内；
根据该第二证书与该第二根证书，在该可信运行域和该不可信运行域之间建立SSL连接，并确定第二会话密钥，该第二会话密钥为该可信运行域和该不可信运行域之间的会话密钥；
该在可信运行域内，获取运行于不可信运行域内的目标应用发送的第一网络数据包，包括：
获取利用该第二会话密钥加密的该第一网络数据包；
在该可信运行域内，利用该第二会话密钥，解密该加密的第一网络数据 包。
结合第一方面的第三种可能的实现方式，在第一方面的第四种可能的实现方式中，根据该第二证书与该第二根证书，在该可信运行域和该不可信运行域之间建立SSL连接，并确定第二会话密钥，包括：
获取在该可信运运行域内生成的该第二证书；
在该不可信运行域内，根据该第二根证书验证该第二证书，当验证通过后，生成该第二会话密钥，并利用该第二证书的公钥对该第二会话密钥加密；
在该可信运行域内，利用该第二证书的私钥解密该加密的第二会话密钥，获得第二会话密钥。
结合第一方面和第一方面的第一种至第四种可能的实现方式中的任一种可能的实现方式，在第一方面的第五种可能的实现方式中，向该目标服务器发送该加密的第二网络数据包，包括：
通过共享内存，将该加密的第二网络数据包转移到该不可信运行域内；
在该不可信运行域内，向该目标服务器发送该加密的第二网络数据包。
第二方面，提供了一种数据处理的装置，该装置包括：
第一获取模块，用于获取运行于不可信运行域内的目标应用发送的第一网络数据包，该第一网络数据包包括第一标识；
第二获取模块，用于在可信运行域内，获取与该第一获取模块获取的该第一网络数据包中的该第一标识对应的第一数据，该第一数据为该目标应用向目标服务器请求服务所必需的数据；
第一生成模块，用于在该可信运行域内，根据该第二获取模块获取的该第一数据和该第一网络数据包生成第二网络数据包；
加密模块，用于在该可信运行域内，利用预先与该目标服务器协商的第一会话密钥对该第一生成模块生成的该第二网络数据包进行加密，获取加密的第二网络数据包；
第一发送模块，用于向该目标服务器发送该加密模块获取的该加密的第二网络数据包。
结合第二方面，在第二方面的第一种可能的实现方式中，该装置还包括：
接收模块，用于接收该目标服务器发送的利用该第一会话密钥加密的第三网络数据包；
处理模块，用于在该可信运行域内，利用该第一会话密钥解密该接收模 块接收的该加密的第三网络数据包，当确定被解密的第三网络数据包包括该第一数据时，根据该第一数据对应的该第一标识以及该第三网络数据包，生成第四网络数据包，该第四网络数据包不包括该第一数据；
第二发送模块，用于将该处理模块生成的该第四网络数据包发送给运行于该不可信运行域内的该目标应用。
结合第二方面或第二方面的第一种可能的实现方式，在第二方面的第二种可能的实现方式中，该装置还包括：
第一建立模块，用于在第一获取模块获取运行于不可信运行域内的目标应用发送的第一网络数据包之前，在该可信运行域内，建立与该目标服务器之间安全套接层SSL连接，并确定该第一会话密钥，其中，该第一会话密钥为在利用预先存储于该可信运行域内的第一根证书对该目标服务器的第一证书验证通过后生成的会话密钥，该第一证书用来证明该目标服务器的身份。
结合第二方面的第二种可能的实现方式，在第二方面的第三种可能的实现方式中，该装置还包括：
第二生成模块，用于在第一获取模块获取运行于不可信运行域内的目标应用发送的第一网络数据包之前，在该可信运行域内，根据第二根证书生成第二证书，该第二证书与该第一证书具有相同通用名，该第二根证书预先存储于该可信运行域和该不可信运行域内；
第二建立模块，用于根据该第二生成模块生成的该第二证书与该第二根证书，在该可信运行域和该不可信运行域之间建立SSL连接，并确定第二会话密钥，该第二会话密钥为该可信运行域和该不可信运行域之间的会话密钥；
该第一获取模块包括：
第一获取单元，用于获取利用该第二会话密钥加密的该第一网络数据包；
解密单元，用于在该可信运行域内，利用该第二会话密钥，解密该第一获取单元获取的该加密的该第一网络数据包。
结合第二方面的第三种可能的实现方式，在第二方面的第四种可能的实现方式中，该第二建立模块包括：
第二获取单元，用于获取在该可信运运行域内生成的该第二证书；
处理单元，用于在该不可信运行域内，根据该第二根证书验证该第二获取单元获取的该第二证书，当验证通过后，生成该第二会话密钥，并利用该第二证书的公钥对该第二会话密钥加密；
解密单元，用于在该可信运行域内，利用该第二证书的私钥解密该处理单元加密的第二会话密钥，获得该第二会话密钥。
结合第二方面和第二方面的第一种至第四种可能的实现方式中的任一种可能的实现方式，在第二方面的第五种可能的实现方式中，该第一发送模块包括：
转移单元，用于通过共享内存，将该加密的第二网络数据包转移到该不可信运行域内；
发送单元，用于在该不可信运行域内，向该目标服务器发送该加密的第二网络数据包。
基于以上技术方案，本发明实施例的数据处理的方法和装置，通过将数据存储在可信运行域内，并在数据的使用过程中也有效避免了数据的明文形式出现在不可信运行域内，能够有效避免数据被攻击者窃取，从而能够提高数据的安全性。
附图说明
为了更清楚地说明本发明实施例的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1示出了本发明实施例的数据处理的方法的应用场景的示意图。
图2示出了本发明实施例的数据处理的方法的示意性流程图。
图3示出了本发明实施例的数据处理的方法的另一示意性流程图。
图4示出了本发明实施例的数据处理的方法的再一示意性流程图。
图5示出了本发明实施例的数据处理的装置的示意性框图。
图6示出了本发明另一实施例提供的数据处理的装置的示意性框图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行 清楚地描述，显然，所描述的实施例是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
应理解，本发明的技术方案可以应用于各种通信系统，例如：全球移动通讯(Global System of Mobile communication，简称为“GSM”)系统、码分多址(Code Division Multiple Access，简称为“CDMA”)系统、宽带码分多址(Wideband Code Division Multiple Access，简称为“WCDMA”)系统、通用分组无线业务(General Packet Radio Service，简称为“GPRS”)系统、长期演进(Long Term Evolution，简称为“LTE”)系统、频分双工(Frequency Division Duplex，简称为“FDD”)系统、时分双工(Time Division Duplex，简称为“TDD”)系统、通用移动通信系统(Universal Mobile Telecommunication System，简称为“UMTS”)等。
还应理解，在本发明实施例中，终端也可称之为用户设备(User Equipment，简称为“UE”)、移动台(Mobile Station，简称为“MS”)或移动终端(Mobile Terminal)等，该终端可以经无线接入网(Radio Access Network，简称为“RAN”)与一个或多个核心网进行通信，例如，终端可以是移动电话(或称为“蜂窝”电话、手机)或具有移动终端的计算机等，例如，终端还可以是便携式、袖珍式、手持式、计算机内置的或者车载的移动装置，它们与无线接入网交换语音和/或数据。为了便于表述，本发明实施例会以终端为手机为例进行说明，但是本发明实施例并不限于此。
为了方便理解本发明实施例，首先在此介绍本发明实施例描述中会引入的几个要素；
1)不可信运行域和可信运行域：
不可信运行域和可信运行域可以理解为可以在同一个处理器上运行的两个运行环境。其中，不可信运行域还可称之为“正常世界”，例如运行应用的环境等，对应地，可信运行域可称之为“安全世界”。不可信运行域内的信息或数据可能会受到攻击者的窃取或破坏，即不可信运行域内的信息和数据的安全性不高；相较于不可信运行域，可信运行域可以有效地保证信息和数据的安全性，可信运行域中的信息或数据将无法被攻击者获取或者篡改，因为任何不可信运行域中的应用/系统程序均无法随意访问/修改可信运行域中的数据和信息，此外，终端的硬件以及软件一同保证了可信运行域的 安全。具体地，对于基于ARM(Advanced RISC Machine，高级精简指令集机器)处理器的终端，可以采用ARM提供的TrustZone安全扩展技术进行设计不可信运行域和可信运行域。
2)安全套接层(Secure Sockets Layer，简称为“SSL”)通信：
SSL为一种通用的通信加密协议，可以安全有效的保证客户端与服务器之间的通信安全。基于SSL的通信分为两步：第一步通过使用非对称加密方式来加密通信，建立客户端与服务器之间的SSL连接。具体步骤为：首先客户端向服务器发起连接请求；服务器会向客户端发送一张证明自己身份的证书，该证书中包含服务器的一些信息和一个非对称加密的公钥；当客户端验证通过服务器身份后，会生成一个对称加密的会话秘钥，然后使用服务器证书中的公钥对该会话密钥加密后发送给服务器。由于使用非对称加密该会话密钥，因此只有服务器的私钥(私钥仅被服务器持有)才能解密利用公钥加密的会话秘钥。至此，客户端完成对服务身份的验证，并且安全地与服务器协商出了一个会话秘钥。第二步，通信阶段，后续客户端与服务器之间的所有通信都将使用该会话秘钥进行加密。
3)证书和根证书：
上述可知，在建立SSL连接过程中，服务器往往会提供证明自己身份的证书供客户端验证，即证书是用来证明服务器身份的文件，一般来说，证书中至少包括下列三种信息：
(1)公钥
证书中会有一个公钥，只有证书的拥有者才会拥有这个公钥对应的私钥。在非对称加密中，只有对应的私钥才能解密被公钥加密的内容，反之亦然(只有对应的公钥才能解密被私钥加密的内容)。即使用证书中公钥加密后的信息将只有证书的拥有者才能解密。因此，证书中的公钥可以确保与客户端进行连接的一定是证书的拥有者(非证书拥有者没有公钥对应的私钥，也就无法解密客户端使用证书公钥加密后的信息，无法与客户端通信)。
(2)通用名
证书中会有一个通用名，例如域名为www.google.com的服务器，其证书通用名为www.google.com，证书的通用名可以告知客户端证书拥有者的身份，客户端可以比较证书的通用名是否与想要连接的服务器域名一致。
(3)签名信息
证书中还会有一个证书颁发机构的签名信息，客户端通过该签名信息验证证书的真伪，因为该签名信息是经过证书颁发机构利用对应的根证书的私钥加密后的信息，而该对应的根证书事先会安装在客户端内，客户端只会相信一个被可信根证书签名的证书。为了便于理解，下面介绍一下根证书：
根证书是一个事先被客户端所信任的证书(例如Microsoft Root Authority)，根证书被事先安装在客户端中(根证书中同样会有一个公钥)。当可信的证书颁发机构为一个网站的证书签名时，它会使用自己根证书的私钥对签名信息加密，这使得只有这个机构的根证书中的公钥才能解密签名信息，并且这根证书中的公钥一定可以解密签名信息。所以当客户端验证一张证书的真伪时，可以使用事先保存的多张根证书中的公钥依次对证书中的签名信息进行解密，一旦存在一张根证书的公钥可以解密证书中的签名信息，那么就认为该证书是通过一个可信的证书颁发机构颁发的，即说明该证书可信。
上述可知，在基于SSL协议的通信过程中，证书和根证书是两个重要的要素，它们是保证通信安全的基础和关键。
当前，手机端的一些应用(例如支付宝)在运行时，需要将与用户隐私密切相关的数据(例如用户账号、密码或身份证号码等，下面简称为用户隐私数据)发送给应用服务器进行登录或者支付等操作，现有技术中，通常将用户隐私数据保存在应用中(相当于保存在不可信运行域内)，然后将用户隐私数据与其他信息一同发送给应用服务器(例如支付宝服务器)进行操作。当前，为了保证手机与服务器之间的通信安全，手机与服务器之间会使用SSL协议对通信进行加密，例如，根据SSL协议，服务器会向手机发送一张证书，同时在手机的不可信运行域预先存储有一些根证书，手机将使用这些根证书验证服务器提供的证书；验证通过后，手机中的应用会与服务器协商出一个加密密钥，在后续通信中使用该密钥进行加密。
但是这样的架构存在一些问题，首先，由于用户隐私数据被保存在手机的不可信运行域中，这就给攻击者提供了窃取用户隐私数据的机会；其次，手机使用存在不可信运行域中的根证书来验证服务器提供的证书，这样使得攻击者可以通过在手机的不可信运行域安装恶意的根证书来攻击用户的手机，因为安装了恶意根证书的手机将无法分辨出伪造的应用服务器，相应地会向伪造的应用服务器发送用户隐私数据，这样极大地降低了用户隐私数据 的安全性。
为了解决上述问题，本发明提出如图1所示的架构，首先终端(具体地，例如手机)包括可信运行域和不可信运行域，其中，与当前技术不同，运行在不可信运行域中的应用模块(例如支付宝等应用)将不再保存用户隐私数据(例如支付宝支付密码)，而是保存一个与用户隐私数据具有对应关系的标识来代替用户隐私数据；该对应关系和用户隐私数据存储在可信运行域内(例如图所示的，隐私数据存储在可信运行域内的安全模块)。运行于不可信运行域内的应用模块发出包含标识的网络数据包，可信运行域内的安全模块将截获该网络数据包，并根据网络数据包中的标识确定对应的用户隐私数据，将网络数据包的标识替换为用户隐私数据，然后将包含用户隐私数据的网络数据包发送给应用服务器。这样能够有效提高用户隐私数据的安全性，因为当攻击者攻击了不可信运行域，即使窃取了标识，也无法获取到用户隐私数据。同时，与现有技术不同，用于验证应用服务器身份的根证书不再存储在不可信运行域，而是存储在可信运行域(例如图1所示的SSL模块3中的根证书1)，这样即使攻击者在不可信运行域安装了恶意的根证书，可信运行域中的SSL模块3也可以识别出伪造的应用服务器，因为可信运行域中的数据将无法被攻击者获取或者篡改。
为了便于理解，下面结合图1简单介绍本发明实施例的一个应用场景中的各个模块，如图1所示，终端包括不可信运行域和可信运行域，且用户隐私数据存储在可信运行域内。具体地，在不可信运行域内包括应用模块、SSL模块1、代理模块1和网络驱动，在可信运行域内包括安全模块、SSL模块2、SSL模块3和代理模块2，下面简单介绍各个模块及其连接关系。
首先介绍在不可信运行域内的各个模块：
应用模块：
具体地，例如运行在不可信运行域中的应用，例如支付宝、126邮箱、QQ等，这些应用在向应用服务器请求相关服务时，需要使用一些与用户隐私相关的数据(例如用户支付密码、身份证号码等)。与现有技术不同，在本发明中，运行于不可信运行域内的应用不再保存需要使用的用户隐私数据，而是保存与用户隐私数据具有对应关系的标识(如图1所示)，且该对应关系是事先保存在可信运行域内的，此外，该标识与用户隐私数据在内容上没有关联关系，因此当攻击者攻击了不可信运行域，即使窃取了标识，也 无法获取到用户隐私数据。
SSL模块1：
不可信运行域中的SSL模块1为应用模块提供SSL服务，它将使用储存在不可信运行域中的根证书(如图1所示的根证书2)来验证应用服务器的身份，同时保证SSL会话的安全性，具体地，SSL模块1验证与其进行SSL会话的是否是应用(例如支付宝)指定的网络服务器(例如支付宝服务器)。下文会进行详细地描述。
代理模块1：
不可信运行域中的代理模块1负责转发网络数据包。对于从应用模块发给应用服务器的网络数据包，该代理模块1会将其转发给可信运行域进行处理；对于从应用服务器发给不可信运行域中的网络数据包，该代理模块1同样会将其转发给可信运行域进行处理；对于从可信运行域发给应用服务器的网络数据包，该代理模块1将其转发给网络驱动，以便于网络驱动将该网络数据包发送给应用服务器。
网络驱动：
负责向应用服务器发送网络数据包或接收应用服务器发送的网络数据包，该网络驱动具体地，例如手机中网卡的驱动。
上面介绍了不可信运行域内的各个模块，下面介绍可信运行域内的各个模块：
安全模块，用户隐私数据将被保存在该模块中，任何处于不可信运行域中的恶意程序/系统都不能窃取存储在安全模块中的用户隐私数据。更具体地，在该模块中，所有用户隐私数据都以“用户隐私数据+标识”类似这样的对应关系的模式储存。
SSL模块3：
如图1所示，可信运行域中的SSL模块3用于与网络服务器建立SSL连接(如图1所示的SSL连接1)，同时使用储存在可信运行域中的根证书1来验证网络服务器身份，并保证通信的安全性(图1所示的协商确定的会话密钥1)。
SSL模块2：
该SSL模块2负责帮助可信运行域内的安全模块代替应用服务器与不可信运行域中的应用模块进行SSL连接(如图1所示的SSL连接2)。
不可信运行域中的应用模块会使用同样位于不可信运行域中的SSL模块1验证与其进行SSL会话的是否是应用(例如支付宝)指定的网络服务器(例如支付宝服务器)。由于在本发明中，是在可信运行域内与应用服务器建立SSL连接，换句话说是建立安全模块与应用服务器之间的SSL连接，因此，需要让安全模块来代替应用模块指定的应用服务器与应用模块建立SSL连接，因此在可信运行域中，需要针对不同的服务器，制作证书，具体地，是为安全模块制作证书，使得其可以代替应用服务器与应用模块进行SSL连接。下文会进行详细描述。
代理模块2：
可信运行域中的代理模块2也是负责网络数据包的转发。它会将不可信运行域中的代理模块1转发来的数据包发送给安全模块(经过SSL模块2或SSL模块3加解密)，同时将安全模块发送给应用服务器的网络数据包发给不可信运行域中的代理模块1处理。
应理解，图1所示的网络驱动在不可信运行域内，即终端是在不可信运行域内与应用服务器进行直接通信，例如，网络数据包经过在可信运行域处理后，还需转移到不可信运行域内，再发送给应用服务器，所以代理模块2需要将安全模块发送给应用服务器的网络数据包发给不可信运行域中的代理模块1处理。可选地，如果网络驱动是可信地，安全地，可以将网络驱动设置在可信运行域内，换句话说，终端可以在不可信运行域内与应用服务器进行直接通信，对应地，对于安全模块发送给应用服务器的网络数据包，代理模块2无需转发给不可信运行域中的代理模块1处理，而是可以之间发送给可信运行域内的网络驱动以发送给应用服务器。
共享内存：
如图1所示，为了支持可信运行域与不可信运行域之间的通信，在这两个运行域之间有一个共享内存。在不可信运行域将想要发送给可信运行域的数据包存放在共享内存，在可信运行域内从该共享内存获取该数据包(反之亦然)，即，通过该共享内存实现了可信运行域与不可信运行域之间的通信。
应理解，上述提到的代理模块1和代理模块2网络数据包的转发，即通过共享内存实现了可信运行域与不可信运行域之间的通信。
还应理解，在实际操作中，还可以采用其他手段来实现可信运行域和不可信运行域之间的通信，本发明实施例对比不作限定。
综上所述，与传统架构不同，在本发明中，不可信运行域中的应用模块将仅仅储存用户隐私数据的标识，因此攻击者仅能窃取用户隐私数据的标识而无法窃取隐私数据本身。同时，由于标识与隐私数据本身并不存在内容上的关联，所以攻击者并不能通过窃取的标识反向推出用户的隐私数据。并且在可信运行域内，只会将发往可信应用服务器的网络数据包中的标识替换为用户隐私数据。如果发现一个网络数据包的目标服务器不是可信服务器，将不会对该网络数据包做任何操作，这也就防止了攻击者通过恶意的不可信的服务器窃取用户隐私数据。
应理解，图1所示的架构或者场景是为了帮助本领域技术人员更好地理解本发明实施例，而非要限制本发明实施例的范围。例如，与用户隐私数据具有对应关系的标识并非一定要存储在应用模块中，只要存储在不可信运行域内均可；同理，用户隐私数据非必要一定存储在图1所示的安全模块，只要存储在可信运行域内均可。此外，本领域技术人员根据所给出的图1的例子，显然可以进行各种等价的修改或变化，这样的修改或变化也落入本发明实施例的范围内。
图2示出了本发明实施例的数据处理的方法100的示意性流程图，该方法100例如可以由终端来执行，且该终端包括不可信运行域和可信运行域，例如图1中所示的终端，该如图2所示，该方法包括：
S110，获取运行于不可信运行域内的目标应用发送的第一网络数据包，该第一网络数据包包括第一标识；
S120，在可信运行域内，获取与该第一标识对应的第一数据，该第一数据为该目标应用向目标服务器请求服务所必需的数据；
S130，在该可信运行域内，根据该第一数据和该第一网络数据包生成第二网络数据包；
S140，在该可信运行域内，利用预先与该目标服务器协商的第一会话密钥对该第二网络数据包进行加密，获取加密的第二网络数据包；
S150，向该目标服务器发送该加密的第二网络数据包。
运行于不可信运行域内的目标应用生成包括第一标识的第一网络数据包，该第一网络数据包可以理解是向目标服务器请求服务的请求数据包；在可信运行域内，获取该第一网络数据包，并获取第一网络数据包中的第一标识所对应的第一数据，该第一数据为目标应用向目标服务器请求服务时所必 需的数据，例如，图1中所示的用户隐私数据，具体地，该第一标识与请求服务所需的第一数据具有对应关系，且该对应关系事先存储于可信运行域内，则在可信运行域内，可以根据获取的第一标识与实现存储的对应关系，获取到该第一数据；在可信运行域内，根据获取的该第一数据和第一网络数据包，确定包括该第一数据的第二网络数据包，可选地，可以通过将第一网络数据包中的第一标识替换为该第一数据来确定该第二网络数据包；在可信运行域内，根据与目标服务器协商确定的第一会话密钥(例如图1中所示的会话密钥1)对第二网络数据包进行加密，应理解，该第一会话密钥存储于可信运行域内，在不可信运行域内无法获取该第一会话密钥，因此，运行于不可信运行域内的系统或者程序无法获取该第一会话密钥，即也无法获取到第一数据的明文形式；向该目标服务器发送加密的包括第一数据的第二网络数据包，以便于该目标服务器根据该第二网络数据包，响应目标应用的请求。
因此，本发明实施例的数据处理的方法，通过将数据存储在可信运行域内，并在数据的使用过程中有效避免了数据的明文形式出现在不可信运行域内，能够有效避免数据被攻击者窃取，从而能够提高数据的安全性。
应理解，本发明实施例中的第一数据为目标应用向目标服务器请求服务所必须的数据，例如支付宝应用向支付宝服务器请求相关服务时，必须向服务求提供用户名和登陆密码或者支付密码等，第一数据具体地可以为该用户名和登陆密码或支付密码，如果被攻击者窃取了这些数据，极有可能会危及用户的个人财产或私有资源，应理解，在本发明中，也会将第一数据称之为用户隐私数据。
还应理解，该第一网络数据包除了包括第一标识，还可以包括其他请求信息，例如目标服务器的域名等信息，本发明实施例对此不作限定。
在S110中，获取运行于不可信运行域内的目标应用发送的第一网络数据包，该第一网络数据包包括第一标识，具体地，可以通过共享内存的方式，获取该第一网络数据包。
可选地，在本发明实施例中，获取运行于不可信运行域内的目标应用发送的第一网络数据包，包括：
通过共享内存，获取该第一网络数据包。
具体地，在不可信运行域内，将目标应用发送的该第一网络数据包存储到共享内存；然后从不可信运行域切换到可信运行域内；在可信运行域内， 从该共享内存获取该第一网络数据包，然后在该可信运行域内对该第一网络数据包进行后续的处理。更具体地，如图1所示，在不可信运行域内，通过代理模块1将应用模块生成的包括第一标识的第一网络数据包存储到共享内存内；在可信运行域内，通过代理模块2从共享内存提取到该第一网络数据包，然后将其发送给可信运行域内的其他模块作后续的处理。
在S120中，在可信运行域内，获取与该第一标识对应的第一数据。具体地，该第一标识与请求服务所必需的第一数据具有对应关系，且该对应关系预先存储于可信运行域内，则，在可信运行域内，可以根据该对应关系与该第一标识，确定该第一标识所确定的第一数据。
应理解，该第一标识与第一数据具有对应关系，但是第一标识可以与第一数据在内容上没有关联关系，即当攻击者攻击了不可信运行域，即使窃取了第一标识，也无法推导或者获取到对应的第一数据，这样能够提高第一数据的安全性。该第一标识可以预先存储于不可信运行域内，具体地，可以存储于目标应用内，例如图1所示的存储在应用模块内。
还应理解，第一标识与第一数据之间的对应关系可以任意存储模式存储在可信运行域内，例如可以采用“第一标识+第一数据”的模式存储，也可以采用基于第一标识与第一数据建立的索引的模式存储，本发明实施例对此不作限定，只要能够根据第一标识，在可信运行域内获取到对应的第一数据即可。
在S130中，根据第一数据和第一网络数据包生成第二网络数据包，应理解，该第二网络数据包中包括该第一数据。
可选地，在本发明实施例中，S130，在该可信运行域内，根据该第一数据和该第一网络数据包生成第二网络数据包，包括：
通过将第一网络数据包中的第一标识替换为该第一数据，以确定该第二网络数据包。
应理解，在本发明实施例中，也可以根据第一数据和第一网络数据包，重新生成第二网络数据包，本发明实施例对此不作限定，只要该第二网络数据包包括该第一数据，且能够向目标应用所指定的目标服务器请求服务即可。
在S140中，利用预先与该目标服务器协商的第一会话密钥对该第二网络数据包进行加密，应理解，该第一会话密钥为在可信运行域内与目标服务 器进行通信的密钥，对于可信运行域内的加解密模块与目标服务器，在通信之前，已经约定好该第一会话密钥了，下文将结合图3进行详细描述。
还应理解，该第一会话密钥可以预先存储于可信运行域内，也可以在可信运行域内，随时从服务器那里获得，本发明实施例对此不作限定，只要保证不可信运行域内的系统或程序无法获取该第一会话密钥即可。
在S150中，向该目标服务器发送该加密的第二网络数据包，具体地，可以直接在可信运行域，向该目标服务器发送该加密后的第二网络数据包；也可以切换到不可信运行域内，向该目标服务器发送该加密的第二网络数据包。应理解，当用于向目标服务器发送数据的网络驱动是可信的，安全的，即该网络驱动运行于可信运行域内时，可以在可信运行域内向目标服务器发送加密的第二网络数据包；当该网络驱动是不可信的，即是运行于不可信运行域时，即在不可信运行域内向目标服务器发送加密后的第二网络数据包。
可选地，在本发明实施例中，S150向该目标服务器发送该加密的第二网络数据包，包括：
通过共享内存，将该加密的第二网络数据包转移到该不可信运行域内；
在该不可信运行域内，向该目标服务器发送该加密的第二网络数据包。
因此，在本发明实施例的数据处理的方法中，通过将第一数据存储在可信运行域，能够提高数据的安全性，并且，在向目标服务器发送包含有第一数据的网络数据包时，是将第一数据利用第一会话密钥加密后再发送，进一步提高了第一数据的安全性。
在S140中，利用预先与该目标服务器协商的第一会话密钥对该第二网络数据包进行加密，应理解，该第一会话密钥为在可信运行域内与目标服务器进行通信的密钥，具体地，可以通过与目标服务器建立SSL连接来确定该第一会话密钥。
可选地，作为一个实施例，在S110获取运行于不可信运行域内的目标应用发送的第一网络数据包之前，该方法还包括：
在该可信运行域内，建立与该目标服务器之间安全套接层SSL连接，并确定该第一会话密钥，其中，该第一会话密钥为在利用预先存储于该可信运行域内的第一根证书对该目标服务器的第一证书验证通过后生成的会话密钥，该第一证书用来证明该目标服务器的身份。
具体地，如图3所示，在S201中，通过运行于不可信运行域内的目标 应用生成用于请求与目标服务器建立SSL连接的请求数据包；在S202中，向目标服务器发送该请求数据包；在S303中，目标服务器根据请求数据包，向终端发送能够证明自己身份的证书1(对应于第一证书)，具体地，该证书1包括公钥，该服务器的域名作为该证书1的通用名，该证书1的签名信息利用根证书1(对应于第一根证书)的私钥进行加密，且该根证书1事先存放在终端的可信运行域内(具体地，如图1中所示的SSL模块3中的根证书1)；在S204中，在可信运行域内，利用预先存储的根证书1验证服务器发送的证书1，具体地，当确定根证书1的公钥可以解密证书1中的签名信息时，说明该证书1是可信的证书，即该目标服务器可信的，其次当确定证书1的通用名与目标应用想要请求服务的服务器的域名一致时，可以确定该目标服务器就是运行于不可信运行域内的目标应用指定的服务器；在S205中，当验证目标服务器身份通过后，生成会话密钥1(对应于第一会话密钥)，并利用证书1中包括的公钥对会话密钥1进行加密；在S206中，向服务器发送加密后的会话密钥1；在S207中，目标服务器利用证书1中包括的公钥所对应的私钥加密该会话密钥1；至此，就实现了终端与目标服务器之间的SSL连接1(也对应于图1中所示的SSL连接1)。
应理解，在本发明实施例中，是在可信运行域内建立与目标服务器的SSL连接，同时生成用于通信加密的会话密钥1，即终端只有运行在可信运行域内时才获知与目标服务器协商的该会话密钥1，换句话说，不可信运行域内的程序和系统无法获取该会话密钥1。因此，在S140中，当在可信运行域内，利用第一会话密钥对包括第一数据的第二网络数据包进行加密后，该加密的第二网络数据包只有在可信运行域内以及目标服务器内才可以被解密，这样的话，攻击者是无法窃取到用户隐私数据的，因为，首先，攻击者不可能窃取到可信运行域内的任何数据的，即不可能窃取到存储于可信运行域内的用户隐私数据；其次，攻击者也无法通过伪造服务器来窃取用户隐私数据，因为，用于验证服务器身份的根证书1是事先存储于可信运行域内的，则攻击者无法篡改此根证书1，因此，只有可信的服务器才可以通过可信运行域内的安全认证，如果是攻击者伪造的服务器，安全认证可定通不过，即与该伪造的服务器的SSL连接失败，也就不会与该伪造的服务器协商会话密钥1，因此，攻击者也无法通过伪造根证书或者伪造服务器来窃取用户隐私数据的明文。
因此，在本发明实施例中，用户隐私数据(第一数据)的明文形式不会出现在不可行运行域内，也能够有效防攻击者窃取用户隐私数据的明文，从而能够提高数据的安全性。
应理解，在S202中，向目标服务器发送请求数据包，具体地，可以首先通过共享内存将在不可信运行域内生成的请求数据包转移到可信运行域内；其次，在可信运行域内，根据该请求数据包获取目标应用想要请求服务的服务器的域名，以便于后续在S204中，根据服务器域名来验证证书1的通用名；最后，将该请求数据包发送给目标服务器，可选地，可以在可信运行域或者可信运行域内向目标服务器发送该请求数据包，本发明实施例对此不作限，例如当用于向服务器发送数据或者接收服务器的数据的网络驱动是可信的，安全的，即该网络驱动运行于可信运行域内时，在S202中，是在可信运行域内向目标服务器发送请求数据包的；当该网络驱动是不可信的，即是运行于不可信运行域时，在S202中，是在不可信运行域内向目标服务器发送请求数据包。应理解，图3中涉及到与服务器传输数据的操作，如S202、S203、S206要不都在可信运行域内执行，要不都在不可信运行域内执行，具体实施依网络驱动所处的运行域而定。
特别地，在现有技术中，网络驱动是运行于不可信运行域内的，如图1中所示的。因此，在本发明实施例中，如果该网络驱动也运行于在不可信运行域内，即是在不可信运行域内与目标服务器进行通信传输，具体地，在不可信运行域内向目标服务器发送请求数据包、接收目标服务器发送的证书1、向目标服务器发送加密的会话密钥1或向目标服务器发送加密后的第二网络数据包等操作，本发明实施例提供的技术方案在提高数据的安全性的基础上，相对于现有的架构并没有增加过多的修改，可以降低代码修改成本。
因此，本发明实施例的数据处理的方法，通过将数据存储在可信运行域内，并在数据的使用过程中也防止了数据的明文形式出现在不可信运行域内，能够有效避免数据被攻击者窃取，从而能够提高数据的安全性。
上文结合图1提到过，运行于不可信运行域中的目标应用同样也会验证与其进行通信的是否是目标应用指定的服务器。在本发明实施例中，目标应用生成的包括第一标识的第一网络数据包不是直接发送给服务器，而是在可信运行域内被获取后再作作一定的处理后(例如将第一标识替换为第一数据)再发送给目标服务器，也即在本发明中，与不可信运行域内的目标应用 直接通信的是可信运行域(例如图1所示的安全模块)，因此，需要在可信运行域内制作一张证书，以实现建立与不可信运行域之间的SSL连接。以图1所示的架构为例，可以理解为可信运行域内的安全模块代替应用模块指定的目标服务器与应用模块建立SSL连接。
可选地，作为一个实施例，在S110获取运行于不可信运行域内的目标应用发送的第一网络数据包之前，该方法还包括：
在该可信运行域内，根据第二根证书生成第二证书，该第二证书与该第一证书具有相同通用名，该第二根证书预先存储于该可信运行域和该不可信运行域内；
根据该第二证书与该第二根证书，在该可信运行域和该不可信运行域之间建立SSL连接，并确定第二会话密钥，该第二会话密钥为该可信运行域和该不可信运行域之间的会话密钥；
在可信运行域内，获取运行于不可信运行域内的目标应用发送的第一网络数据包，包括：
获取利用该第二会话密钥加密的该第一网络数据包；
在该可信运行域内，利用该第二会话密钥，解密该加密的第一网络数据包。
可选地，在本发明实施例中，根据该第二证书与该第二根证书，在该可信运行域和该不可信运行域之间建立SSL连接，并确定第二会话密钥，包括：
获取在该可信运运行域内生成的该第二证书；
在该不可信运行域内，根据该第二根证书验证该第二证书，当验证通过后，生成该第二会话密钥，并利用该第二证书的公钥对该第二会话密钥加密；
在该可信运行域内，利用该第二证书的私钥解密该加密的第二会话密钥，获得第二会话密钥。
具体地，如图3所示，在S208中，在可信运运行域内，当验证目标服务器的身份通过后，利用预先存储于不可信运行域内的根证书2(例如图1所示的不可信运行域内的SSL模块1中的根证书2)(对应于第二根证书)制作证书2(对应于第二证书)，即用根证书2的私钥加密证书2的签名信息，此外，该证书2的通用名与目标服务器的证书1(见S203)的通用名相同，该证书2也包括一个公钥，可信运行域内会存储该公钥对应的私钥；在S209中，通过共享内存的方式，将证书2转移到不可信运行域内；在S210中， 在不可信运行域内，利用根证书2验证证书2，具体地，利用根证书2的公钥解密证书2的签名信息，验证证书2的通用名是否为目标应用指定的服务器的域名；在S211中，在验证通过后，在不可信运行域内生成会话密钥2(对应于图1中所示的SSL模块1中的会话密钥1)(对应于本发明实施例中的第二会话密钥)，并利用证书2的公钥对该会话密钥2进行加密；在S212中，通过共享内存的方式，将加密后的会话密钥2转移到可信运行域内；在S213中，在可信运行域内，利用证书2中包括的公钥所对应的私钥解密该会话密钥2。至此建立了不可信运行域和可信运行域之间的SSL连接2(对应于图1中所示的SSL连接2)。这样的话，不可信运行域和可行运行内都公知了用于通信加密的会话密钥2，如图1中所示，在SSL模块1和SSL模块2中都存储有会话密钥2。
应理解，在S210中，在不可信运行域内利用根证书2验证证书2，对于不可信运行域内的目标应用来说，证书2是属于其目标服务器(证书2通用名与目标服务器提供的证书1通用名一致)的，并且对于目标应用来说，证书2是由可信证书颁发机构颁发的证书(证书2由根证书2签名，而根证书2事先被安装在不可信运行域中，因此对于目标应用而言，根证书2是属于可信证书颁发机构的根证书)，因此在S210中，根证书2验证通过了证书2，以图1所示为例，也可以理解为，应用模块验证通过了安全模块的身份。
还应理解，在本发明实施例中，可以通过共享内存的方式，实现在可信运行域与不可信运行域之间的通信，具体地，如图3中所示的S209和S212，也可以采用其他方式，实现在可信运行域与不可信运行域之间的通信，本发明实施例对此不作限定。
还应理解，图3中所示的证书1、根证书1、证书2和根证书2分别对应于本发明实例中的第一证书、第一根证书、第二证书和第二根证书。
因此，在本发明实施例的数据处理的方法中，在可信运行域内建立与目标服务器之间的SSL连接，并生成与目标服务器之间的通信密钥(第一会话密钥)，利用该通信密钥对第一数据加密后，在发送给目标服务器，能够防止该第一数据的明文出现在不可信运行域内，可以有效防止攻击者窃取该第一数据，从而能够有效保证第一数据在传输时的安全性，从而可以进一步提高数据的安全性。
在接收目标服务器发送的网络数据包时，也可以在可信运行域内对接收 到的网络数据包作相关处理后，在发送给运行于不可信运行域内的目标应用。
可选地，作为一个实施例，在图2所示的方法100还包括：
接收该目标服务器发送的利用该第一会话密钥加密的第三网络数据包；
在该可信运行域内，利用该第一会话密钥解密该加密的第三网络数据包，当确定被解密的第三网络数据包包括该第一数据时，根据该第一数据对应的该第一标识以及该第三网络数据包，生成第四网络数据包，该第四网络数据包不包括该第一数据；
将该第四网络数据包发送给运行于该不可信运行域内的该目标应用。
可选地，在本发明实施例中，该第三网络数据包为该目标服务器用于响应该第二网络数据包的响应数据包。
具体地，如图4所示，在S301中，通过目标应用生成包括标识1(对应于第一标识)的数据包1(对应于第一网络数据包)；在S302中，通过共享内存将数据包1转移到可信运行域内；在S303中，在可信运行域内，根据对应关系和数据包1中的标识1确定对应的用户隐私数据；在S304中，生成包括用户隐私数据的数据包2(对应于第二网络数据包)；在S305中，向目标服务器发送利用会话密钥1(对应于第一会话密钥)加密后的数据包2；在S306中，目标服务器利用会话密钥2解密该数据包2；在S307中，目标服务器根据数据包2确定响应包，即数据包3(对应于第三网络数据包)；在S308中，目标服务器向终端发送利用会话密钥加密后的数据包3；在S309中，在可信运行域内，利用会话密钥1解密数据包3，并根据数据包3确定不包括用户隐私数据的数据包4(对应于第四网络数据包)；在S310中，通过共享内存的方式将利用会话密钥2(对应于第二会话密钥)加密后的数据包4；在S311中，在不可信运行域内，利用会话密钥2解密该数据包4，以便于目标应用使用数据包4中的数据，来实现相应的应用操作。例如wechat应用接收到wechat应用服务器的响应后，可以实现用户的登录操作；再例如，支付宝应用接收到支付宝应用服务器的响应后，可以实现用户的支付操作或者登录操作等。
应理解，S309中，在可信运行域内，根据数据包3确定不包括用户隐私数据的数据包4，具体地，当确定数据包3内不包括用户隐私数据，可以直接将数据包3确定为数据包4，换句话说，可以直接将数据包3转移到不 可信运行域内；当确定数据包3中包括用户隐私数据时，可以通过将数据包3中的用户隐私数据替换为第一标识来确定数据包4。
可选地，在本发明实施例中，当确定该第三网络数据包中不包括该第一数据时，将该第三网络数据包确定为该第四网络数据包。
因此，在本发明是实施例的数据处理的方法中，通过将数据存储在终端的可信运行域内，并且在数据的使用过程中也杜绝了数据的明文形式暴露于终端的不可信运行域内，从而能够有效避免数据被攻击者窃取，从而能够有效保护数据在终端中的安全性。
此外，在本发明是实施例的数据处理的方法中，与现有技术将用户隐私数据存储于应用中(即不可信运行域内)相比，将用户隐私数据存储于终端的可信运行域，而将用户隐私数据的标识存储于不可信运行域内，在提高用户隐私数据的安全性的同时，并没有增加终端很大的性能开销。此外，由于用于验证服务器的根证书存储于可信运行域，从而防止了有效验证服务器的身份，有效防止了恶意服务器对终端的攻击。
为了更容易理解本发明实施例的数据处理的方法，下面结合图1所示的架构，以手机银行和信用卡支付为例，简单阐述本发明实施例的具体实施。
一、以手机银行为例，即图1中所示的终端为手机，不可信运行域内的应用模块具体为手机银行，应用服务器为手机银行服务器。
1)建立手机银行与安全模块，安全模块与手机银行服务器之间的SSL连接，其中，可信SSL模块3来验证手机银行服务器的身份；
2)例如在用户执行手机银行服务器的登录操作时，手机银行会读取储存的用户隐私数据的(包括账号以及密码)第一标识，将其与其他信息生成用于向手机银行服务器请求登录服务的第一网络数据包，并经过SSL模块1利用会话密钥1对第一网络数据包加密；
3)安全模块收到经由代理模块1、共享内存、代理模块2转发而来、以及经过SSL模块2解密获取到的第一网络数据包，替换其中的第一标识为用户隐私数据(包括账号以及密码)，生成第二网络数据包，经过SSL模块3利用会话密钥2对该第二网络数据包进行加密，然后通过代理模块2、共享内存、代理模块1和网络驱动向手机银行服务器发送加密后的第二网络数据包。
4)手机银行服务器处理第二网络数据包的请求，确定用于响应请求的 第三网络数据包，并将利用会话密钥1加密后的第三网络数据包发送给手机；
5)在可信运行域内，经过SSL模块3解密第三网络数据包；
6)在可信运行域内，经过安全模块、SSL模块2、代理模块1、共享内存、代理模块2将不包括用户隐私数据的第四网络数据包发送给手机银行。
在手机银行的使用过程中，用户隐私数据明文(包括账号以及密码)从未暴露给不可信运行域，也就能有效的保证用户手机银行密码以及账号的安全。并且使用保存在可信运行域中的安全根证书验证手机银行服务器的真伪，因此可以识别出恶意伪造的手机银行服务器，从而进一步提高了用户隐私数据的安全性。
二、以信用卡支付为例，即图1中所示的终端可以为手机，不可信运行域内的应用模块具体为信用卡应用模块，应用服务器为信用卡应用服务器。
当信用卡应用模块发送用户隐私数据(信用卡号)的第一标识给信用卡应用服务器进行支付等操作时，在可信运行域内，会将第一标识替换为用户隐私数据(信用卡号)，再将用户隐私数据发送给信用卡应用服务器，这样便可以保护用户的信用卡号的安全以防止其被恶意程序窃取。具体描述与手机银行的例子类似，为了简洁，这里不再赘述。
因此，本发明实施例的数据处理的方法，通过将用户隐私数据存储在可信运行域内，并在用户隐私数据的使用过程中也有效避免了用户隐私数据的明文形式出现在不可信运行域内，能够有效避免用户隐私数据被攻击者窃取，从而能够提高用户隐私数据的安全性。
本发明实施例的数据处理的方法可以抵御的用户隐私数据的攻击方式包括但不限于：
1)利用应用漏洞，获取储存在应用中的用户隐私数据。
2)利用系统漏洞，获取应用加密的用户隐私数据。出于性能考虑，应用往往只会对用户隐私数据做一些简单加密后存储，很容易被破解。
3)利用恶意的不可信的加密/解密模块(例如不可信运行域内的加密模块，例如图1中的SSL模块1)，从而获得应用发送/接收的所有数据明文，获得用户隐私数据。
在本发明实施例中，由于用户隐私数据的明文不会出现在不可信运行域中，因此上面提到的直接针对用户隐私数据的攻击均不能获取用户隐私数据。用户隐私数据仅仅会经过可信的加密模块(例如可信运行域内的加密模 块，例如图1中的SSL模块3)加密后出现在不可信区域内，而基于当前技术，通过暴力破解经过可信加密协议(例如SSL协议)加密后的信息代价非常大，无需考虑这种攻击方式。
本发明实施例的数据处理的方法还可以抵御攻击者在终端安装恶意根证书来实现对终端的攻击：
1)攻击者在手机中安装恶意的根证书，这样便可以使用该根证书将恶意服务器伪装成目标应用的目标服务器，从而获得用户发出的所有数据明文。
在本发明实施例中，使用存储在可信运行域中的根证书验证服务器身份，而攻击者无法在可信运行域中安装任何恶意根证书，因此无法使用安装恶意根证书来攻击终端中的用户隐私数据。
2)攻击者可以在安装恶意根证书的同时，攻击不可信代理使其不使用可信运行域的任何功能。
如果绕开可信运行域，攻击者将可以窃取应用发出的所有信息，但是由于应用发出的所有数据都仅仅是标识，而且该标识与与其对应的用户隐私数据在内容上毫无关联性，因此攻击者无法获得任何用户的用户隐私数据。
因此，在本发明是实施例的数据处理的方法中，通过将用户隐私数据存储在终端的可信运行域内，并且在用户隐私数据的使用过程中也杜绝了用户隐私数据的明文形式暴露于终端的不可信运行域内，从而能够有效避免用户隐私数据被攻击者窃取，从而能够有效保护用户隐私数据在终端中的安全性。
应理解，本发明是实施例的数据处理的方法还可应用于类似于订单金额这样随时需要修改且非常重要的数据的保护场景中。例如，可以通过在可信运行域中添加输入与显示模块，然后对订单金额相关的信息采取与用户隐私数据同样的或者类似的处理方式存入可信运行域中，更具体，存入可信运行域内的安全模块中，便可以有效防止订单信息被篡改。
应理解，在本发明的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本发明实施例的实施过程构成任何限定。
因此，本发明实施例的数据处理的方法，通过将用户隐私数据存储在可信运行域内，并在用户隐私数据的使用过程中也有效避免了用户隐私数据的 明文形式出现在不可信运行域内，能够有效避免用户隐私数据被攻击者窃取，从而能够提高用户隐私数据的安全性。
上文中结合图1至图4，详细描述了根据本发明实施例的数据处理的方法，下面将结合图5，详细描述根据本发明实施例的数据处理的装置。
图5示出了根据本发明实施例的数据处理的装置400的示意性框图。如图5所示，该装置包括：
第一获取模块410，用于获取运行于不可信运行域内的目标应用发送的第一网络数据包，该第一网络数据包包括第一标识；
第二获取模块420，用于在可信运行域内，获取与该第一获取模块获取的该第一网络数据包中的该第一标识对应的第一数据，该第一数据为该目标应用向目标服务器请求服务所必需的数据；
第一生成模块430，用于在该可信运行域内，根据该第二获取模块获取的该第一数据和该第一网络数据包生成第二网络数据包；
加密模块440，用于在该可信运行域内，利用预先与该目标服务器协商的第一会话密钥对该第一生成模块生成的该第二网络数据包进行加密，获取加密的第二网络数据包；
第一发送模块450，用于向该目标服务器发送该加密模块获取的该加密的第二网络数据包。
因此，根据本发明实施例的数据处理的装置，通过将数据存储在可信运行域内，并将数据的加密密钥也存储在可信运行域内，能够提高数据的安全性。
可选地，作为一个实施例，该装置还包括：
接收模块，用于接收该目标服务器发送的利用该第一会话密钥加密的第三网络数据包；
处理模块，用于在该可信运行域内，利用该第一会话密钥解密该接收模块接收的该加密的第三网络数据包，当确定被解密的第三网络数据包包括该第一数据时，根据该第一数据对应的该第一标识以及该第三网络数据包，生成第四网络数据包，该第四网络数据包不包括该第一数据；
第二发送模块，用于将该处理模块生成的该第四网络数据包发送给运行于该不可信运行域内的该目标应用。
可选地，作为一个实施例，该装置还包括：
第一建立模块，用于在第一获取模块获取运行于不可信运行域内的目标应用发送的第一网络数据包之前，在该可信运行域内，建立与该目标服务器之间安全套接层SSL连接，并确定该第一会话密钥，其中，该第一会话密钥为在利用预先存储于该可信运行域内的第一根证书对该目标服务器的第一证书验证通过后生成的会话密钥，该第一证书用来证明该目标服务器的身份。
可选地，作为一个实施例，该装置包括：
第二生成模块，用于在第一获取模块获取运行于不可信运行域内的目标应用发送的第一网络数据包之前，在该可信运行域内，根据第二根证书生成第二证书，该第二证书与该第一证书具有相同通用名，该第二根证书预先存储于该可信运行域和该不可信运行域内；
第二建立模块，用于根据该第二生成模块生成的该第二证书与该第二根证书，在该可信运行域和该不可信运行域之间建立SSL连接，并确定第二会话密钥，该第二会话密钥为该可信运行域和该不可信运行域之间的会话密钥；
该第一获取模块包括：
第一获取单元，用于获取利用该第二会话密钥加密的该第一网络数据包；
解密单元，用于在该可信运行域内，利用该第二会话密钥，解密该第一获取单元获取的该加密的该第一网络数据包。
可选地，作为一个实施例，该第二建立模块包括：
第二获取单元，用于获取在该可信运运行域内生成的该第二证书；
处理单元，用于在该不可信运行域内，根据该第二根证书验证该第二获取单元获取的该第二证书，当验证通过后，生成该第二会话密钥，并利用该第二证书的公钥对该第二会话密钥加密；
解密单元，用于在该可信运行域内，利用该第二证书的私钥解密该处理单元加密的第二会话密钥，获得该第二会话密钥。
可选地，作为一个实施例，该第一发送模块包括：
转移单元，用于通过共享内存，将该加密的第二网络数据包转移到该不可信运行域内；
发送单元，用于在该不可信运行域内，向该目标服务器发送该加密的第 二网络数据包。
应理解，根据本发明实施例的数据处理的装置400，可对应于本发明实施例的数据处理的方法的终端，例如图1中所示的终端，并且装置400中的各个模块的上述和其它操作和/或功能分别为了实现图1至图4中的各个方法的相应流程，为了简洁，在此不再赘述。
因此，根据本发明实施例的数据处理的装置，通过将数据存储在可信运行域内，并将数据的加密密钥也存储在可信运行域内，能够提高数据的安全性。
如图6所示，本发明实施例还提供了一种网络设备500，该网络设备500包括处理器510、存储器520、总线系统530、接收器540和发送器550。其中，处理器510、存储器520、接收器540和发送器550通过总线系统530相连，该存储器520用于存储指令，该处理器510用于执行该存储器520存储的指令，以控制接收器540接收信号，并控制发送器550发送信号。其中，处理器510，用于获取运行于不可信运行域内的目标应用发送的第一网络数据包，该第一网络数据包包括第一标识；在可信运行域内，获取与该第一标识对应的第一数据，该第一数据为该目标应用向目标服务器请求服务所必需的数据；在该可信运行域内，根据该第二获取模块获取的该第一数据和该第一网络数据包生成第二网络数据包；在该可信运行域内，利用预先与该目标服务器协商的第一会话密钥对该第一生成模块生成的该第二网络数据包进行加密，获取加密的第二网络数据包；发送器550，用于向该目标服务器发送该加密模块获取的该加密的第二网络数据包。
因此，根据本发明实施例的数据处理的装置，通过将数据存储在可信运行域内，并将数据的加密密钥也存储在可信运行域内，能够提高数据的安全性。
可选地，作为一个实施例，接收器540，用于接收该目标服务器发送的利用该第一会话密钥加密的第三网络数据包；处理器510，用于在该可信运行域内，利用该第一会话密钥解密接收器540接收的该加密的第三网络数据包，当确定被解密的第三网络数据包包括该第一数据时，根据该第一数据对应的该第一标识以及该第三网络数据包，生成第四网络数据包，该第四网络数据包不包括该第一数据；发送器550，用于将该第四网络数据包发送给运行于该不可信运行域内的该目标应用。
可选地，作为一个实施例，处理器510，用于在获取运行于不可信运行域内的目标应用发送的第一网络数据包之前，在该可信运行域内，建立与该目标服务器之间安全套接层SSL连接，并确定该第一会话密钥，其中，该第一会话密钥为在利用预先存储于该可信运行域内的第一根证书对该目标服务器的第一证书验证通过后生成的会话密钥，该第一证书用来证明该目标服务器的身份。
可选地，作为一个实施例，处理器510，用于在获取运行于不可信运行域内的目标应用发送的第一网络数据包之前，在该可信运行域内，根据第二根证书生成第二证书，该第二证书与该第一证书具有相同通用名，该第二根证书预先存储于该可信运行域和该不可信运行域内；根据该第二生成模块生成的该第二证书与该第二根证书，在该可信运行域和该不可信运行域之间建立SSL连接，并确定第二会话密钥，该第二会话密钥为该可信运行域和该不可信运行域之间的会话密钥；获取利用该第二会话密钥加密的该第一网络数据包；在该可信运行域内，利用该第二会话密钥，解密该加密的该第一网络数据包。
可选地，作为一个实施例，处理器510，用于获取在该可信运运行域内生成的该第二证书；在该不可信运行域内，根据该第二根证书验证该第二证书，当验证通过后，生成该第二会话密钥，并利用该第二证书的公钥对该第二会话密钥加密；在该可信运行域内，利用该第二证书的私钥解密该处理单元加密的第二会话密钥，获得该第二会话密钥。
可选地，作为一个实施例，处理器510，用于通过共享内存，将该加密的第二网络数据包转移到该不可信运行域内；
发送器550，用于在该不可信运行域内，向该目标服务器发送该加密的第二网络数据包。
应理解，在本发明实施例中，该处理器510可以是中央处理单元(Central Processing Unit，简称为“CPU”)，该处理器510还可以是其他通用处理器、数字信号处理器(DSP)、专用集成电路(ASIC)、现成可编程门阵列(FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
该存储器520可以包括只读存储器和随机存取存储器，并向处理器510提供指令和数据。存储器520的一部分还可以包括非易失性随机存取存储器。 例如，存储器520还可以存储设备类型的信息。
该总线系统530除包括数据总线之外，还可以包括电源总线、控制总线和状态信号总线等。但是为了清楚说明起见，在图中将各种总线都标为总线系统530。
在实现过程中，上述方法的各步骤可以通过处理器510中的硬件的集成逻辑电路或者软件形式的指令完成。结合本发明实施例所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器520，处理器510读取存储器520中的信息，结合其硬件完成上述方法的步骤。为避免重复，这里不再详细描述。
还应理解，根据本发明实施例的数据处理的装置500，可对应于本发明实施例的数据处理的装置400，也可以对应于根据本发明实施例的数据处理的终端，并且装置500中的各个模块的上述和其它操作和/或功能分别为了实现图1至图4中的各个方法的相应流程，为了简洁，在此不再赘述。
因此，根据本发明实施例的数据处理的装置，通过将数据存储在可信运行域内，并将数据的加密密钥也存储在可信运行域内，能够提高数据的安全性。
应理解，本文中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系。
应理解，在本发明的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本发明实施例的实施过程构成任何限定。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本发明的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描 述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本发明各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本发明的具体实施方式，但本发明的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应以所述权利要求的保护范围为准。

Claims (12)

  1. 一种数据处理的方法，其特征在于，包括：
    获取运行于不可信运行域内的目标应用发送的第一网络数据包，所述第一网络数据包包括第一标识；
    在可信运行域内，获取与所述第一标识对应的第一数据，所述第一数据为所述目标应用向目标服务器请求服务所必需的数据；
    在所述可信运行域内，根据所述第一数据和所述第一网络数据包生成第二网络数据包；
    在所述可信运行域内，利用预先与所述目标服务器协商的第一会话密钥对所述第二网络数据包进行加密，获取加密的第二网络数据包；
    向所述目标服务器发送所述加密的第二网络数据包。
  2. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    接收所述目标服务器发送的利用所述第一会话密钥加密的第三网络数据包；
    在所述可信运行域内，利用所述第一会话密钥解密所述加密的第三网络数据包，当确定被解密的第三网络数据包包括所述第一数据时，根据所述第一数据对应的所述第一标识以及所述第三网络数据包，生成第四网络数据包，所述第四网络数据包不包括所述第一数据；
    将所述第四网络数据包发送给运行于所述不可信运行域内的所述目标应用。
  3. 根据权利要求1或2所述的方法，其特征在于，所述获取运行于不可信运行域内的目标应用发送的第一网络数据包之前，所述方法还包括：
    在所述可信运行域内，建立与所述目标服务器之间安全套接层SSL连接，并确定所述第一会话密钥，其中，所述第一会话密钥为在利用预先存储于所述可信运行域内的第一根证书对所述目标服务器的第一证书验证通过后生成的会话密钥，所述第一证书用来证明所述目标服务器的身份。
  4. 根据权利要求3所述的方法，其特征在于，在获取运行于不可信运行域内的目标应用发送的第一网络数据包之前，所述方法还包括：
    在所述可信运行域内，根据第二根证书生成第二证书，所述第二证书与所述第一证书具有相同通用名，所述第二根证书预先存储于所述可信运行域和所述不可信运行域内；
    根据所述第二证书与所述第二根证书，在所述可信运行域和所述不可信运行域之间建立SSL连接，并确定第二会话密钥，所述第二会话密钥为所述可信运行域和所述不可信运行域之间的会话密钥；
    所述在可信运行域内，获取运行于不可信运行域内的目标应用发送的第一网络数据包，包括：
    获取利用所述第二会话密钥加密的所述第一网络数据包；
    在所述可信运行域内，利用所述第二会话密钥，解密所述加密的第一网络数据包。
  5. 根据权利要求4所述的方法，其特征在于，所述根据所述第二证书与所述第二根证书，在所述可信运行域和所述不可信运行域之间建立SSL连接，并确定第二会话密钥，包括：
    获取在所述可信运运行域内生成的所述第二证书；
    在所述不可信运行域内，根据所述第二根证书验证所述第二证书，当验证通过后，生成所述第二会话密钥，并利用所述第二证书的公钥对所述第二会话密钥加密；
    在所述可信运行域内，利用所述第二证书的私钥解密所述加密的第二会话密钥，获得第二会话密钥。
  6. 根据权利要求1至5中任一项所述的方法，其特征在于，所述向所述目标服务器发送所述加密的第二网络数据包，包括：
    通过共享内存，将所述加密的第二网络数据包转移到所述不可信运行域内；
    在所述不可信运行域内，向所述目标服务器发送所述加密的第二网络数据包。
  7. 一种数据处理的装置，其特征在于，包括：
    第一获取模块，用于获取运行于不可信运行域内的目标应用发送的第一网络数据包，所述第一网络数据包包括第一标识；
    第二获取模块，用于在可信运行域内，获取与所述第一获取模块获取的所述第一网络数据包中的所述第一标识对应的第一数据，所述第一数据为所述目标应用向目标服务器请求服务所必需的数据；
    第一生成模块，用于在所述可信运行域内，根据所述第二获取模块获取的所述第一数据和所述第一网络数据包生成第二网络数据包；
    加密模块，用于在所述可信运行域内，利用预先与所述目标服务器协商的第一会话密钥对所述第一生成模块生成的所述第二网络数据包进行加密，获取加密的第二网络数据包；
    第一发送模块，用于向所述目标服务器发送所述加密模块获取的所述加密的第二网络数据包。
  8. 根据权利要求7所述的装置，其特征在于，所述装置还包括：
    接收模块，用于接收所述目标服务器发送的利用所述第一会话密钥加密的第三网络数据包；
    处理模块，用于在所述可信运行域内，利用所述第一会话密钥解密所述接收模块接收的所述加密的第三网络数据包，当确定被解密的第三网络数据包包括所述第一数据时，根据所述第一数据对应的所述第一标识以及所述第三网络数据包，生成第四网络数据包，所述第四网络数据包不包括所述第一数据；
    第二发送模块，用于将所述处理模块生成的所述第四网络数据包发送给运行于所述不可信运行域内的所述目标应用。
  9. 根据权利要求7或8所述的装置，其特征在于，所述装置还包括：
    第一建立模块，用于在第一获取模块获取运行于不可信运行域内的目标应用发送的第一网络数据包之前，在所述可信运行域内，建立与所述目标服务器之间安全套接层SSL连接，并确定所述第一会话密钥，其中，所述第一会话密钥为在利用预先存储于所述可信运行域内的第一根证书对所述目标服务器的第一证书验证通过后生成的会话密钥，所述第一证书用来证明所述目标服务器的身份。
  10. 根据权利要求9所述的装置，其特征在于，所述装置还包括：
    第二生成模块，用于在第一获取模块获取运行于不可信运行域内的目标应用发送的第一网络数据包之前，在所述可信运行域内，根据第二根证书生成第二证书，所述第二证书与所述第一证书具有相同通用名，所述第二根证书预先存储于所述可信运行域和所述不可信运行域内；
    第二建立模块，用于根据所述第二生成模块生成的所述第二证书与所述第二根证书，在所述可信运行域和所述不可信运行域之间建立SSL连接，并确定第二会话密钥，所述第二会话密钥为所述可信运行域和所述不可信运行域之间的会话密钥；
    所述第一获取模块包括：
    第一获取单元，用于获取利用所述第二会话密钥加密的所述第一网络数据包；
    解密单元，用于在所述可信运行域内，利用所述第二会话密钥，解密所述第一获取单元获取的所述加密的所述第一网络数据包。
  11. 根据权利要求10所述的装置，其特征在于，所述第二建立模块包括：
    第二获取单元，用于获取在所述可信运运行域内生成的所述第二证书；
    处理单元，用于在所述不可信运行域内，根据所述第二根证书验证所述第二获取单元获取的所述第二证书，当验证通过后，生成所述第二会话密钥，并利用所述第二证书的公钥对所述第二会话密钥加密；
    解密单元，用于在所述可信运行域内，利用所述第二证书的私钥解密所述处理单元加密的第二会话密钥，获得所述第二会话密钥。
  12. 根据权利要求7至11中任一项所述的装置，其特征在于，所述第一发送模块包括：
    转移单元，用于通过共享内存，将所述加密的第二网络数据包转移到所述不可信运行域内；
    发送单元，用于在所述不可信运行域内，向所述目标服务器发送所述加密的第二网络数据包。
PCT/CN2014/095294 2014-07-25 2014-12-29 数据处理的方法和装置 WO2016011778A1 (zh)

Priority Applications (5)

Application Number Priority Date Filing Date Title
KR1020177003845A KR101904177B1 (ko) 2014-07-25 2014-12-29 데이터 처리 방법 및 장치
EP14868710.6A EP2991268B1 (en) 2014-07-25 2014-12-29 Data processing method and apparatus
JP2017504082A JP6612322B2 (ja) 2014-07-25 2014-12-29 データ処理方法およびデータ処理装置
US14/808,332 US9762555B2 (en) 2014-07-25 2015-07-24 Data processing method and apparatus
US15/701,148 US10243933B2 (en) 2014-07-25 2017-09-11 Data processing method and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410361410.9A CN105450406B (zh) 2014-07-25 2014-07-25 数据处理的方法和装置
CN201410361410.9 2014-07-25

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US14/808,332 Continuation US9762555B2 (en) 2014-07-25 2015-07-24 Data processing method and apparatus

Publications (1)

Publication Number Publication Date
WO2016011778A1 true WO2016011778A1 (zh) 2016-01-28

Family

ID=54288622

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/095294 WO2016011778A1 (zh) 2014-07-25 2014-12-29 数据处理的方法和装置

Country Status (6)

Country Link
US (2) US9762555B2 (zh)
EP (1) EP2991268B1 (zh)
JP (1) JP6612322B2 (zh)
KR (1) KR101904177B1 (zh)
CN (1) CN105450406B (zh)
WO (1) WO2016011778A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
USD870922S1 (en) 2016-07-27 2019-12-24 Marshalls Mono Limited Drainage component
CN111625815A (zh) * 2020-05-26 2020-09-04 牛津(海南)区块链研究院有限公司 一种基于可信执行环境的数据交易方法及装置
CN111753312A (zh) * 2019-03-26 2020-10-09 钉钉控股（开曼）有限公司 数据处理方法、装置、设备和系统

Families Citing this family (22)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3033707A4 (en) * 2013-08-12 2017-03-29 Graphite Software Corporation Secure authentication and switching to encrypted domains
WO2015074150A1 (en) 2013-11-21 2015-05-28 Graphite Software Corporation Managed domains for remote content and configuration control on mobile information devices
US10205598B2 (en) 2015-05-03 2019-02-12 Ronald Francis Sulpizio, JR. Temporal key generation and PKI gateway
US10417456B2 (en) * 2015-12-23 2019-09-17 Tracfone Wireless, Inc. Secure system having a multi-locking mechanism for devices having embedded systems
CN106101068B (zh) * 2016-05-27 2019-06-11 宇龙计算机通信科技(深圳)有限公司 终端通信方法及系统
EP3447992B1 (en) 2016-11-14 2020-09-23 Huawei Technologies Co., Ltd. Message pushing method and terminal
US11165565B2 (en) 2016-12-09 2021-11-02 Microsoft Technology Licensing, Llc Secure distribution private keys for use by untrusted code
US10749690B2 (en) * 2017-03-10 2020-08-18 Samsung Electronics Co., Ltd. System and method for certificate authority for certifying accessors
CN107423610B (zh) * 2017-08-11 2019-11-15 北京安云世纪科技有限公司 一种基于无线通信连接的私密信息处理方法及装置
CN109495269B (zh) * 2017-09-13 2023-11-03 厦门雅迅网络股份有限公司 车载端对接入设备的可信验证方法及其系统、车载端
CN107800716B (zh) * 2017-11-14 2020-05-01 中国银行股份有限公司 一种数据处理方法及装置
US11146407B2 (en) * 2018-04-17 2021-10-12 Digicert, Inc. Digital certificate validation using untrusted data
CN112292682A (zh) * 2018-04-20 2021-01-29 维沙尔.古普塔 分散式文档和实体验证引擎
CN110489971A (zh) * 2018-05-15 2019-11-22 微软技术许可有限责任公司 安全的数据集管理
CN108959906B (zh) * 2018-07-13 2020-08-21 Oppo广东移动通信有限公司 数据获取方法、移动终端、电子设备、产线标定系统、可读存储介质及计算机设备
CN111105777B (zh) * 2018-10-25 2023-10-31 阿里巴巴集团控股有限公司 语音数据的采集和播放方法和装置、密钥包的更新方法和装置以及存储介质
CN112422487A (zh) * 2019-08-23 2021-02-26 北京小米移动软件有限公司 数据传输方法、装置、系统及计算机可读存储介质
KR20210028422A (ko) * 2019-09-04 2021-03-12 삼성전자주식회사 전자장치 및 그 제어방법
CN110691265B (zh) * 2019-10-10 2021-04-20 四川虹微技术有限公司 基于声纹识别的电视支付方法及系统
CN111131200B (zh) * 2019-12-11 2022-06-28 新华三大数据技术有限公司 网络安全性检测方法及装置
CN113691394B (zh) * 2021-07-29 2023-07-21 广州鲁邦通物联网科技股份有限公司 一种vpn通信的建立和切换的方法和系统
CN114553428B (zh) * 2022-01-11 2023-09-22 北京三快在线科技有限公司 一种可信验证系统、装置、存储介质及电子设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130086380A1 (en) * 2011-09-30 2013-04-04 Avaya Inc. System and method for facilitating communications based on trusted relationships
CN103139221A (zh) * 2013-03-07 2013-06-05 中国科学院软件研究所 一种可信虚拟平台及其构建方法、平台之间数据迁移方法
CN103843303A (zh) * 2012-11-22 2014-06-04 华为技术有限公司 虚拟机的管理控制方法及装置、系统
CN103856477A (zh) * 2012-12-06 2014-06-11 阿里巴巴集团控股有限公司 一种可信计算系统及相应的认证方法和设备

Family Cites Families (24)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7418504B2 (en) * 1998-10-30 2008-08-26 Virnetx, Inc. Agile network protocol for secure communications using secure domain names
JP2001251297A (ja) * 2000-03-07 2001-09-14 Cti Co Ltd 情報処理装置、該情報処理装置を具備する暗号通信システム及び暗号通信方法
US7571314B2 (en) * 2001-12-13 2009-08-04 Intel Corporation Method of assembling authorization certificate chains
US7277972B2 (en) * 2002-03-08 2007-10-02 Freescale Semiconductor, Inc. Data processing system with peripheral access protection and method therefor
US7028149B2 (en) * 2002-03-29 2006-04-11 Intel Corporation System and method for resetting a platform configuration register
FR2906960B1 (fr) * 2006-10-05 2009-04-17 Radiotelephone Sfr Procede de mise a disposition cloisonnee d'un service electronique.
DE102007012749A1 (de) * 2007-03-16 2008-09-18 Siemens Ag Verfahren und System zur Bereitstellung von Diensten für Endgeräte
US8001592B2 (en) * 2007-05-09 2011-08-16 Sony Computer Entertainment Inc. Methods and apparatus for accessing resources using a multiprocessor in a trusted mode
DE102008051578A1 (de) * 2008-10-14 2010-04-15 Giesecke & Devrient Gmbh Datenkommunikation mit portablem Endgerät
WO2011068738A2 (en) * 2009-11-25 2011-06-09 Orsini Rick L Systems and methods for securing data in motion
EP3001326B1 (en) 2009-12-14 2017-07-26 Citrix Systems Inc. Methods and systems for communicating between trusted and non-trusted virtual machines
US8655966B1 (en) 2010-03-31 2014-02-18 Emc Corporation Mobile device data protection
US8543805B2 (en) * 2010-04-21 2013-09-24 Citrix Systems, Inc. Systems and methods for split proxying of SSL via WAN appliances
CN103262024B (zh) 2010-05-09 2015-05-13 思杰系统有限公司 用于强制应用将数据存储在安全的存储位置中的方法和系统
CN201699728U (zh) * 2010-06-17 2011-01-05 宁波电业局 用于电力实时系统的可信网络管理系统
EP2498529A1 (en) * 2011-03-08 2012-09-12 Trusted Logic Mobility SAS User authentication method for accessing an online service
WO2012167352A1 (en) * 2011-06-10 2012-12-13 Securekey Technologies Inc. Credential authentication methods and systems
CN103020538B (zh) 2011-09-23 2016-01-13 国民技术股份有限公司 一种终端数据保护方法及终端
US8769302B2 (en) * 2011-10-14 2014-07-01 International Business Machines Corporation Encrypting data and characterization data that describes valid contents of a column
CN103139366B (zh) 2011-12-05 2014-09-24 希姆通信息技术（上海）有限公司 移动终端及其数据保护方法
US9032496B2 (en) * 2012-02-28 2015-05-12 Citrix Systems, Inc. Secure single sign-on
US8839004B1 (en) * 2012-04-16 2014-09-16 Ionu Security, Inc. Secure cloud computing infrastructure
US9344275B2 (en) 2012-05-08 2016-05-17 Arm Technologies Israel Ltd. System, device, and method of secure entry and handling of passwords
CN103532927A (zh) 2013-07-30 2014-01-22 北京中科金财科技股份有限公司 一种基于移动终端的金融云安全服务平台和数据保护方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130086380A1 (en) * 2011-09-30 2013-04-04 Avaya Inc. System and method for facilitating communications based on trusted relationships
CN103843303A (zh) * 2012-11-22 2014-06-04 华为技术有限公司 虚拟机的管理控制方法及装置、系统
CN103856477A (zh) * 2012-12-06 2014-06-11 阿里巴巴集团控股有限公司 一种可信计算系统及相应的认证方法和设备
CN103139221A (zh) * 2013-03-07 2013-06-05 中国科学院软件研究所 一种可信虚拟平台及其构建方法、平台之间数据迁移方法

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
USD870922S1 (en) 2016-07-27 2019-12-24 Marshalls Mono Limited Drainage component
CN111753312A (zh) * 2019-03-26 2020-10-09 钉钉控股（开曼）有限公司 数据处理方法、装置、设备和系统
CN111753312B (zh) * 2019-03-26 2023-09-08 钉钉控股（开曼）有限公司 数据处理方法、装置、设备和系统
CN111625815A (zh) * 2020-05-26 2020-09-04 牛津(海南)区块链研究院有限公司 一种基于可信执行环境的数据交易方法及装置
CN111625815B (zh) * 2020-05-26 2023-09-26 牛津(海南)区块链研究院有限公司 一种基于可信执行环境的数据交易方法及装置

Also Published As

Publication number Publication date
US20160028701A1 (en) 2016-01-28
KR20170032374A (ko) 2017-03-22
US20170374040A1 (en) 2017-12-28
EP2991268A1 (en) 2016-03-02
KR101904177B1 (ko) 2018-10-04
EP2991268A4 (en) 2016-03-02
CN105450406B (zh) 2018-10-02
JP2017529729A (ja) 2017-10-05
US10243933B2 (en) 2019-03-26
CN105450406A (zh) 2016-03-30
EP2991268B1 (en) 2018-05-23
US9762555B2 (en) 2017-09-12
JP6612322B2 (ja) 2019-11-27

Similar Documents

Publication Publication Date Title
WO2016011778A1 (zh) 数据处理的方法和装置
US11432150B2 (en) Method and apparatus for authenticating network access of terminal
WO2018050081A1 (zh) 设备身份认证的方法、装置、电子设备及存储介质
EP3175597B1 (en) Apparatus and method for sharing a hardware security module interface in a collaborative network
WO2015180691A1 (zh) 验证信息的密钥协商方法及装置
USH2270H1 (en) Open protocol for authentication and key establishment with privacy
US8881257B2 (en) Method and apparatus for trusted federated identity management and data access authorization
JP6896940B2 (ja) 第１のアプリケーションと第２のアプリケーションとの間の対称型相互認証方法
CN108566381A (zh) 一种安全升级方法、装置、服务器、设备和介质
GB2439240A (en) A method for realizing network access authentication
WO2015180689A1 (zh) 验证信息的获取方法及装置
WO2015117523A1 (zh) 访问控制方法及装置
CN115333779A (zh) 一种验证数据的方法、装置及电子设备
Kim et al. Secure user authentication based on the trusted platform for mobile devices
CN114065170A (zh) 平台身份证书的获取方法、装置和服务器
CN114692120A (zh) 国密认证方法、虚拟机、终端设备、系统及存储介质
US20240007456A1 (en) Method, system and apparatus for protecting access tokens created by multifactor authentication
Hsieh et al. An Improved Mutual Authentication Mechanism for Securing Smart Phones
KR20170066957A (ko) 장치 및 이의 제어 방법

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 2014868710

Country of ref document: EP

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14868710

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2017504082

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 20177003845

Country of ref document: KR

Kind code of ref document: A