Method, apparatus and device for permission control and computer readable medium

Abstract

Embodiments of the present application provide a permission control method, device and equipment and a computer readable medium; the method comprises: determining a function module set of a target application program; determining the identification information of the function module according to the service information of the function module in the function module set and the identification information of the target application program; setting the access permission possessed by the function module according to the identification information and the function attribute of the function module; in this way, different permissions are set for different function modules of the target application program, so that the operating system can dynamically manage the permissions possessed by the target application program.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to access control methods, apparatus, devices, and computer-readable media. Background Technology

[0002] In related technologies, once an application is granted permissions in the operating system's permission settings, the scope of those permissions is the entire application itself. Thus, during the operation of an application in the operating system, because the application's permissions apply to the entire application, it is impossible to meet the diverse needs of users for application permissions. Summary of the Invention

[0003] This invention provides a permission control method, apparatus, device, and computer-readable medium that can set different permissions for different functional modules of an application, thereby realizing dynamic management of the permissions that the operating system has for the target application.

[0004] The technical solution of this invention is implemented as follows:

[0005] In a first aspect, embodiments of the present invention provide an access control method, comprising:

[0006] Determine the set of functional modules for the target application;

[0007] The identification information of the functional modules is determined based on the service information of the functional modules in the set of functional modules and the identification information of the target application.

[0008] Based on the identification information and functional attributes of the functional modules, the access permissions of the functional modules are set.

[0009] In a second aspect, embodiments of the present invention provide an access control device, comprising:

[0010] The first determining module is used to determine the set of functional modules of the target application.

[0011] The second determining module is used to determine the identification information of the functional module based on the service information of the functional modules in the functional module set and the identification information of the target application.

[0012] The first setting module is used to set the access permissions of the functional module according to the identification information and functional attributes of the functional module.

[0013] Thirdly, embodiments of the present invention provide an access control device, comprising:

[0014] Memory, used to store executable instructions;

[0015] The processor, when executing executable instructions stored in the memory, implements the above-described access control method.

[0016] Fourthly, embodiments of the present invention provide a computer-readable medium storing executable instructions for implementing the permission control method provided in the embodiments of the present invention when executed by a processor.

[0017] The embodiments of the present invention have the following beneficial effects: by assigning service information to the functional modules of the target application, and based on different service information and the identification information of the target application, setting the identification information of the functional modules, and comprehensively considering the identification information and the function of the functional modules, different access permissions are set for different functional modules; thereby realizing the setting of different permissions for different functional modules of the target application in an operating system, so that the operating system can dynamically manage the permissions possessed by the target application. Attached Figure Description

[0018] Figure 1 This is a schematic diagram of an optional architecture of the access control system provided in an embodiment of the present invention;

[0019] Figure 2 This is a schematic diagram of the access control system provided in an embodiment of the present invention;

[0020] Figure 3A This is a schematic diagram illustrating the implementation process of the access control method provided in this embodiment of the invention;

[0021] Figure 3B This is a schematic diagram of another implementation flow of the access control method provided in this embodiment of the invention;

[0022] Figure 4 This is a schematic diagram illustrating another implementation of the access control method provided in this embodiment of the invention.

[0023] Figure 5A This is a schematic diagram illustrating the implementation process of enabling the same application to have the same permissions according to an embodiment of the present invention;

[0024] Figure 5B This is a schematic diagram illustrating the implementation process of granting different permissions to the same application according to an embodiment of the present invention;

[0025] Figure 6 This is an interface diagram illustrating the implementation of the access control method in an embodiment of the present invention;

[0026] Figure 7 This is a schematic diagram illustrating an application scenario of the access control method implemented in an embodiment of the present invention;

[0027] Figure 8 This is a schematic diagram illustrating another application scenario of the access control method implemented in this embodiment of the invention. Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings. The described embodiments should not be regarded as limitations on the present invention. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0029] In the following description, references are made to “some embodiments,” which describe a subset of all possible embodiments. However, it is understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0030] In the following description, the terms "first, second, third" are used merely to distinguish similar objects and do not represent a specific ordering of objects. It is understood that "first, second, third" may be interchanged in a specific order or sequence where permitted, so that the embodiments of the invention described herein can be implemented in an order other than that illustrated or described herein.

[0031] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used herein is for the purpose of describing embodiments of the invention only and is not intended to limit the invention.

[0032] Before providing a further detailed description of the embodiments of the present invention, the nouns and terms involved in the embodiments of the present invention will be explained, and the nouns and terms involved in the embodiments of the present invention shall be interpreted as follows.

[0033] 1) Hooking: For example, if a user needs to create a proxy object and replace the original object with the user's proxy object, then the proxy object can be modified in terms of parameters or its return value. This process is called hooking. In a specific example, hooking the start activity aims to output a log message before each call to this method.

[0034] 2) User Identification (UID): After a user registers as a member, the system automatically assigns a UID value, which is essentially a unique identifier for that user. For example, if user A registers on the forum and receives UID 23, then user B's subsequent registration should receive UID 24, though it could be something else entirely. This is automatically assigned by the entire forum system. Alternatively, if user A registers on the forum and receives UID 20, but later logs out, then user A's UID 20 will be empty. Even if UID 20 is empty, anyone registering after user A will not receive UID 20.

[0035] 3) Process Identification (PID): In operating systems, this refers to the process identifier, also known as the process identification number. Each time a program is opened in the operating system, a process ID (PID) is created; this is a technical term in electrical and electronic engineering. The PID is a unique identifier for each process. It is assigned by the system when the process runs and does not represent a specific process. The PID does not change during runtime, but it is reclaimed by the system after the process terminates and may be reassigned to a newly running program. Whenever a program runs, the system automatically assigns it an identifier. After the process terminates, this number is reclaimed and may be assigned to another new process. As long as no other program runs successfully, this PID will continue to be assigned to the currently running program. If a program runs successfully, and then another program is run, the system will automatically assign a different PID.

[0036] 4) Activity Manager Service (AMS): AMS is started in the System Server process. Its responsibility is to communicate with the four major components of all applications. The Activity startup process is the communication between the application and AMS. The first point to understand is that the application and AMS are in two different processes. Therefore, the application and AMS communicate across processes.

[0037] 5) Binder Mechanism: Binder communication involves four roles: the server process, the client process, the service manager process, and the Binder driver. The client process is the process that uses the service; the server process is the process that provides the service; the service manager's role is to convert the character-based Binder name into a reference to that Binder in the client's memory, allowing the client to obtain a reference to the Binder entity in the server through the Binder name; the Binder driver is responsible for establishing Binder communication between processes, passing Binders between processes, managing Binder reference counting, and providing low-level support for data packet transmission and interaction between processes. Binder is one of the methods of inter-process communication (IPC) in the operating system. The server, client, and service manager run in user space, while the Binder driver runs in kernel space. The Binder driver provides device file interaction with user space, and the client, server, and service manager communicate with the Binder driver through file open operation functions.

[0038] In related technologies, the purpose of permissions in operating systems is to protect user privacy. Operating system applications must request permissions to access sensitive user data (such as contacts and SMS messages), as well as certain system functions (such as camera and internet access). Permissions are not limited to requesting system functions; services provided by applications can enforce custom permissions to restrict who can use the application. In operating system permission schemes, whether the system automatically grants permissions or prompts the user for approval, whether it is a system permission or a custom permission, once an application is granted a permission, the scope of that permission is the entire application itself. Thus, in implementing more complex engineering projects, it is impossible to meet the diverse needs for permissions to different functional modules within an application.

[0039] To address the aforementioned technical problems, embodiments of the present invention provide a permission control method, device, and computer-readable medium. For a target application in an operating system, firstly, the target application is divided according to its functions, resulting in a set of functional modules. Then, service information is assigned to each functional module, and the identification information of the functional module is set by combining this service information with the identification information of the target application. Finally, the identification information is combined with the function of the functional module to set the permissions possessed by the functional module. When multiple service requests are received, the function to be implemented in each service request is determined. Then, candidate permissions required to implement this function are determined. Next, the candidate permissions are compared with the permissions possessed by the functional modules to determine the correlation between the two. If the correlation indicates that the functional module contains the permissions required by the service request, the identification information of the functional module is replaced with preset identification information so that the sender of the service request can identify the replaced functional module. Finally, the replaced functional module is used to implement the function required by the service request. This achieves dynamic management of permissions for different modules within the same application, meeting the diverse needs of large-scale projects.

[0040] The following describes exemplary applications of the access control device provided in the embodiments of the present invention. The device provided in the embodiments of the present invention can be implemented as various types of devices such as laptops or tablets, or as a server. Exemplary applications when the device is implemented as a device or a server will be described below.

[0041] See Figure 1 , Figure 1This is an optional architecture diagram of the access control system provided in this embodiment of the invention. To support an exemplary application, the target application 11 is divided into three functional modules 101, 102, and 103 according to their different functions. Different permissions are set based on the functions and identification information of each functional module. For example, functional module 101 has permission 1; functional module 102 has permission 2; and functional module 103 has permission 3. In this way, different access permissions are set for different functional modules in the target application 11. When server 13 receives service request 12, it can determine whether the functional module has the permission to implement service request 12 based on the identification information of each functional module. If the functional module does not have the permission to implement service request 12, it returns a rejection message. If the functional module has the permission to implement service request 12, it replaces the identification information of the functional module with the identification information of the target application 11, so that the service request 12 can be recognized by the system. Based on the replaced functional module, the function required by the service request can be implemented. In this way, by setting different permissions for different functions of the target application in an operating system, the operating system can dynamically manage the permissions of the target application, which meets the needs of various permissions in the same application in large projects.

[0042] See Figure 2 , Figure 2 This is a schematic diagram of the access control system provided in an embodiment of the present invention. Figure 2 The illustrated device 400 includes at least one processor 410, a memory 450, at least one network interface 420, and a user interface 430. The various components in device 400 are coupled together via a bus system 440. It is understood that the bus system 440 is used to implement communication between these components. In addition to a data bus, the bus system 440 also includes a power bus, a control bus, and a status signal bus. However, for clarity, ... Figure 2 The general labeled all buses as Bus System 440.

[0043] Processor 410 can be an integrated circuit chip with signal processing capabilities, such as a general-purpose processor, digital signal processor, or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, etc., wherein the general-purpose processor can be a microprocessor or any conventional processor, etc.

[0044] User interface 430 includes one or more output devices 431 that enable the presentation of media content, including one or more speakers and / or one or more visual displays. User interface 430 also includes one or more input devices 432, including user interface components that facilitate user input, such as a keyboard, mouse, microphone, touch screen display, camera, other input buttons and controls in some examples.

[0045] The memory 450 may be removable, non-removable, or a combination thereof. Exemplary hardware devices include solid-state storage, hard disk drives, optical disk drives, etc. The memory 450 may optionally include one or more storage devices physically located away from the processor 410.

[0046] The memory 450 may include volatile memory or non-volatile memory, or both. The non-volatile memory may be read-only memory (ROM), and the volatile memory may be random access memory (RAM). The memory 450 described in this embodiment is intended to include any suitable type of memory.

[0047] In some embodiments, memory 450 is capable of storing data to support various operations, examples of which include programs, modules, and data structures or subsets or supersets thereof, as illustrated below.

[0048] Operating system 451 includes system programs for handling various basic system services and performing hardware-related tasks, such as the framework layer, core library layer, driver layer, etc., for implementing various basic business functions and handling hardware-based tasks;

[0049] The network communication module 452 is used to reach other computing devices via one or more (wired or wireless) network interfaces 420, exemplary network interfaces 420 including: Bluetooth, wireless compatibility authentication, and Universal Serial Bus (USB), etc.

[0050] Presentation module 453 is configured to enable the presentation of information (e.g., a user interface for operating peripheral devices and displaying content and information) via one or more output devices 431 associated with user interface 430 (e.g., a display screen, a speaker, etc.).

[0051] The input processing module 454 is used to detect and translate one or more user inputs or interactions from one or more input devices 432.

[0052] In some embodiments, the apparatus provided in this invention can be implemented in software. Figure 2 A server 455 for access control, stored in memory 450, is shown. This server can be software in the form of programs and plug-ins, and includes the following software modules: a first determination module 4551, a second determination module 4552, and a first setting module 4553. These modules are logically sequential and can therefore be arbitrarily combined or further divided according to their implemented functions. The functions of each module will be described below.

[0053] In other embodiments, the apparatus provided in the embodiments of the present invention can be implemented in hardware. As an example, the apparatus provided in the embodiments of the present invention can be a processor in the form of a hardware decoding processor, which is programmed to execute the access control method provided in the embodiments of the present invention. For example, the processor in the form of a hardware decoding processor can be one or more application specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), or other electronic components.

[0054] The permission control method provided by the embodiments of the present invention will be described in conjunction with exemplary applications and implementations of the devices provided in the embodiments of the present invention.

[0055] See Figure 3A , Figure 3A This is a schematic diagram illustrating the implementation flow of the access control method provided in this embodiment of the invention, combined with... Figure 3A The steps shown are explained below:

[0056] Step S301: Determine the set of functional modules for the target application.

[0057] In some embodiments, the target application may be a program included in any application installed in the operating system. The set of functional modules includes at least two functional modules, each of which implements a portion of the functionality of the target application, and the at least two functional modules may be in the same process or in different processes.

[0058] Step S302: Determine the identification information of the functional module based on the service information of the functional modules in the functional module set and the identification information of the target application.

[0059] In some embodiments, the service information of the functional module is set for each functional module in the set of functional modules according to the input setting instructions. For example, an operating system service is defined for each functional module to set the identification information of the functional module. In a specific example, step S302 can be understood as follows: the identification information of the target application is A123456, the service information is b, and the identification information of the functional module can be set to Ab, 123b, or A123456b, etc.

[0060] Step S303: Based on the identification information and functional attributes of the functional module, set the access permissions of the functional module.

[0061] In some embodiments, the functional attributes of the functional module are used to characterize the functions that the functional module can perform. Step S303 can be implemented in the following three ways:

[0062] Method 1: Determine the access permissions of the functional module based on its functions.

[0063] For example, the function of this module is to make a phone call. Determining the access permissions required during the phone call process is the access permission that this module possesses.

[0064] Method 2: Based on the identification information of the functional module, determine whether there are other functional modules in the process where the functional module is located. Then, take the part of the permissions that the other functional modules have that are different from the permissions required to implement the function of the functional module as the permissions that the functional module has. In this way, multiple identical permissions will not be repeated in a process, and dynamic management of permissions for different functional modules is realized.

[0065] Method 3: Based on the identification information of the functional module, determine the permissions required by the process in which the functional module resides, as well as the permissions currently held by other functional modules in the process, and set access permissions for the functional module.

[0066] For example, if a process requires 5 permissions, while other functional modules currently have 4 permissions, then the remaining permission is set to the access permissions that the functional module has.

[0067] In a specific example, for application A in a virtual operating system in the relevant technology, if all functions of the entire application A have the same set of access permissions, then when application A issues a service request, all functional modules will participate, which will inevitably affect the access time. However, by setting different access permissions for different functional modules in the same target application through any of the methods one to three mentioned above, different functional modules in application A can have different access permissions. In this way, more access permissions can be set for application A, and the access time for permissions can be reduced when application A issues a service request, thus avoiding access congestion.

[0068] In this embodiment of the invention, by assigning service information to the functional modules of the target application, and setting the identification information of the functional modules based on different service information and the identification information of the target application, and comprehensively considering the identification information and the function of the functional modules, different permissions are set for different functional modules; thereby realizing the setting of different permissions for different functions of the target application in an operating system, enabling the operating system to dynamically manage the permissions it has for the target application.

[0069] In some embodiments, in order to uniquely identify different functional modules, the target application is divided to obtain a set of functional modules containing at least two functional modules, which can be achieved through the following steps:

[0070] The first step is to set service information for each functional module in the set of functional modules according to the input setting instructions.

[0071] In some embodiments, the service information of each functional module can be arbitrarily set by the operator; and the identification information is used to form the corresponding functional module.

[0072] The second step is to determine the identification information of the interface used to implement the corresponding function of the functional module based on the service information of the functional module.

[0073] In some embodiments, by starting the service of the functional module, the business that the functional module can implement is started, thereby determining the identification information of the interface that implements the business.

[0074] The third step is to generate the identification information of the functional module based on the identification information of the interface and the identification information of the target application.

[0075] In some possible implementations, the identification information of the interface is combined with the identification information of the target application to obtain the identification information of the functional module; for example, if the identification information of the interface is J and the identification information of the target application is M, the identification information of the functional module can be set to MJ.

[0076] In some embodiments, in order to achieve dynamic control over the permissions of different functional modules in a target application, step S303 can be implemented through the following steps. Figure 3B This is a schematic diagram of another implementation flow of the access control method provided in this embodiment of the invention, combined with... Figure 3A The following explanation is provided:

[0077] Step S321: Determine the target access permissions required to implement the functions included in the functional attributes.

[0078] For example, the functional attributes include the function of food delivery, which determines the target access permissions required to make a call, such as obtaining the user's location, phone number, courier's phone number, and merchant's location.

[0079] Step S322: Determine the current process of the functional module based on the identification information.

[0080] In some embodiments, after determining the identification information of a functional module, the process in which the functional module is currently located is searched based on the identification information to determine whether the process contains other functional modules.

[0081] Step S323: Determine the access permissions of other functional modules contained in the current process.

[0082] For example, identify the other functional modules running concurrently in the process and determine the access permissions of these other functional modules.

[0083] Step S324: Set the permissions in the target access permissions that are different from the access permissions of the other functional modules to the access permissions that the functional module has.

[0084] For example, if the access permissions of other functional modules include ABCDE, while the target access permissions include ABEFR, then the access permission FR is set to the access permission that the functional module has. In this way, within a process, the same permission between different functional modules is retained only once, avoiding multiple functional modules accessing the same permission at the same time, which could cause access congestion. At the same time, dynamic management of access permissions for different functional modules is achieved.

[0085] In some embodiments, in order to enable different functional modules of the target application to access system services, after step S303, the method further includes the following steps, such as... Figure 4 As shown, Figure 4 This is a schematic diagram illustrating another implementation of the access control method provided in this invention, combined with... Figure 3A The following explanation is provided:

[0086] Step S401: When a service request is received, detect the association between the functional module and the permissions required by the service request.

[0087] In some embodiments, the service request is used to request access to a system service. For example, requesting access to an image. The association between the functional module and the permissions required by the service request includes: the access permissions possessed by the functional module do not include the permissions required by the service request, and the access permissions possessed by the functional module include the permissions required by the service request. Step S401 can be implemented through the following process: First, when a service request is received, the function to be implemented in the service request is determined; for example, if the service request is to access an image, then the function to be implemented in the service request is the function required to access an image. Then, candidate permissions required to implement the function to be implemented are determined; for example, the permissions required to access an image are determined. Finally, the association is determined based on the candidate permissions and the permissions possessed by the functional module; for example, the candidate permissions and the permissions possessed by the functional module are compared to determine whether the access permissions possessed by the functional module include the candidate permissions.

[0088] Step S402: Respond to the service request based on the association relationship.

[0089] In some embodiments, the system responds to the service request based on whether the access permissions possessed by the functional module include the permissions required for the service request. If the association indicates that the functional module does not contain the permissions required for the service request, a rejection message is returned; for example, if the functional module does not contain the permissions required to access an image, a rejection message is returned. If the association indicates that the functional module contains the permissions required for the service request, the identification information of the functional module is replaced with preset identification information so that the system can recognize the functional module. In a specific example, the identification information of the functional module is replaced with the identification information of the target application to ensure that the system can recognize the functional module. Finally, based on the replaced functional module, the function required by the service request is implemented. Thus, since the replaced functional module possesses the permissions required for the service request, the function required by the service request can be implemented based on the replaced functional module; for example, based on the functional module with the permission to access an image, access to the image is completed.

[0090] In other embodiments, when multiple functional modules within the same process access system services simultaneously, to ensure the synchronization of calls between the multiple functional modules, the method can be implemented through the following steps:

[0091] The first step is to determine the thread corresponding to each of the multiple service requests when multiple service requests are received.

[0092] In some embodiments, the multiple service requests belong to multiple threads within the same process or to a single thread.

[0093] The second step is to respond to the multiple service requests synchronously based on the identification information of each service request if the threads corresponding to the multiple service requests are different.

[0094] In some embodiments, if the multiple service requests correspond to different threads, a synchronization module is added for each service request. This synchronization module records the identification information of each service request and is responsible for acknowledging the return of the IPC call. Creating a synchronization module for each service request ensures both the timeliness of responses to multiple service requests and the synchronous response to multiple service requests. This solves the synchronization problem of functional modules within multiple threads and also guarantees the timeliness of IPC calls.

[0095] The following will illustrate an exemplary application of the present invention in a real-world application scenario, using the example of dynamically setting applications within the Unified Endpoint Management (UEM) security space to have or deny certain specific permissions in order to ensure data privacy within the security space and isolation from external implementations.

[0096] In related technologies, whether the permission is granted automatically by the system or by prompting the user for approval, whether it is a system permission or a custom permission, once an application is granted a permission, the scope of that permission is the entire application itself. Figure 5A As shown, Figure 5A This is a schematic diagram illustrating the implementation process of enabling the same application to have the same permissions according to an embodiment of the present invention, combined with... Figure 5A The following explanation is provided: The entire target application 501 has access permissions of system permissions 1, 2, and 3. This means that different functions belonging to the same application have permissions to access system services 1 and 2. Furthermore, the target application 501 has a custom permission 3 to access another application 502. However, in implementing more complex projects, the permission requirements for different modules of the application are diverse. Therefore, it is necessary to dynamically set the permissions of each functional block to meet these varied needs.

[0097] Based on this, embodiments of the present invention provide an access control method. Figure 5B This is a schematic diagram illustrating the implementation process of granting different permissions to the same application according to an embodiment of the present invention, combined with... Figure 5B The following explanation is provided:

[0098] For functional modules A501, B502, and C503 belonging to the same application, module A501 has system permission 1; module B502 has system permission 2; and module C503 has custom permission 3 and permission to access functional module D504 in another application. Modules A501 and B502 have permissions to access system services 1 and 2, respectively. In this way, each functional module can have different access permissions according to its own needs, realizing a method of dynamic management within the same application based on functional modules.

[0099] Figure 6 This is an interface diagram illustrating the implementation of the access control method in an embodiment of the present invention. Figure 6 Within the secure space, applications are dynamically granted or denied certain permissions to ensure data privacy within the secure space and external isolation. System services corresponding to prohibited permissions will be denied access. For example, in the application permission settings interface 60 within the secure space, settings include whether clipboard 601 is allowed at the secure space level, whether data sharing is prohibited 602, whether watermarking is allowed 603, whether the watermark uses the username 604, whether a custom watermark is allowed 605, whether network restrictions are allowed 606, whether screenshots are prohibited 607, whether location access is prohibited 608, whether phone calls are prohibited 609, whether sending SMS messages is prohibited 610, whether reading SMS messages is prohibited 611, whether reading contacts is prohibited 612, whether reading call logs is prohibited 613, whether reading phone numbers is prohibited 614, whether printing is prohibited 615, and whether accessing the media library is prohibited 616, etc.

[0100] In this embodiment of the invention, the operating system's permission check requires several parameters. The first two permission parameters, permission and PID, represent the permission corresponding to the access service and the process ID of the current application, respectively. For functional modules, permission and PID can be obtained directly from the current application. However, for the parameter UID, since all functional modules and the application they reside in share the same UID, and since different permissions cannot be controlled for different functional blocks within the same process, UID is crucial for functional module division.

[0101] Set different permissions for different functional blocks, including the following two scenarios:

[0102] Scenario 1: If all functional modules are in the same process, the target application can manage the permissions of the functional modules through the process identifier of the functional modules.

[0103] Scenario 2: If all or some functional modules reside in the same process, the process ID cannot distinguish between them. In this case, the following two methods can be used to address the issue:

[0104] Method 1: All functional modules run in different processes, which can be achieved using the method described in Scenario 1. However, starting a new process for each functional module is acceptable for a small number of modules. But for applications with a large number of functional modules, starting too many processes will lead to significant resource consumption for the entire system. Furthermore, the inter-module dependencies become inefficient and resource-intensive due to process isolation, which can also disrupt the overall application architecture.

[0105] Method 2: Set separate identification information for each functional module (e.g., set a sub-UID), which can be achieved through the following steps:

[0106] The first step is to define a service information (service) for each functional module, and combine it with the identification information of the target application to determine the identification information of each functional module.

[0107] The second step is to input the functional modules with the identified identification information into the activity management service platform.

[0108] For example, by binding hooks, the parameters of the interfaces of functional modules in the AMS system service that have already been identified can be determined.

[0109] The third step is to start the business of each functional module by activating the service information of each functional module.

[0110] The fourth step is to modify the parameters in AMS during the service information startup process to start the service information interface.

[0111] In a specific example, the parameters in AMS include: the name of the class in AMS or the return value of the function, etc. The interface for starting service information is the interface for starting or binding the service (start Service or bind Service).

[0112] The fifth step involves generating a sub-UID for the current functional block based on the target application within the hooked start Service or bind Service method, and caching it in a map of the target application according to the structure of the current service component.

[0113] Step six: In order for the target application to dynamically identify functional modules, two scenarios need to be considered:

[0114] Scenario 1: When multiple functional modules access system services in the same thread, the identification information of the functional modules is fed back to the target application before calling the system service. Then, the user identification information of the caller can be obtained from the system service interface to enable the target application to identify the functional modules.

[0115] Scenario 2: For situations where different threads access system services simultaneously, in the operating system, when a target application calls a system interface, to ensure the timeliness of inter-process communication (IPC) calls, the service will allocate a bound thread from the thread pool for each request to handle the request. For example... Figure 7 As shown, when two threads (service request 71 and service request 72) in the threaded process A701 simultaneously access the system service, service requests 71 and 72 are passed to the client 702. Then, the client 702 passes service requests 71 and 72 to the binding driver 703. Next, the binding driver 703 passes service requests 71 and 72 to the service process 704 of the binding thread. Finally, the service process 704 of the binding thread provides two binding threads 73 and 74 for service requests 71 and 72. Through these two binding threads 73 and 74, service requests 71 and 72 are responded to and processed respectively, resulting in processing results 75 and 76. The processing results 75 and 76 are then passed to the threaded process A701 through the binding driver 703 and the client 702 in sequence.

[0116] When multiple threads within the same process access system services simultaneously, it's impossible to achieve synchronization of function module calls (within the same process, due to resource sharing, only by ensuring the synchronization of system service calls can the target application layer recognize the current function module), and the timeliness of IPC cannot be sacrificed for synchronization. Therefore, this invention provides an access control method that can solve the problem of synchronizing function modules within multiple threads while also ensuring the timeliness of IPC calls.

[0117] like Figure 8 As shown, a sync recognizer (801) is added to the target application to control the synchronization of multi-threaded functional modules calling system services. Whenever a functional module requests a system service, the syncrecognizer module creates a sync model for each request, responsible for recording the identification information of each service request and for acknowledging the return of the IPC call.

[0118] The seventh step involves checking permissions in the operating system during the process of calling system service interfaces using AMS's checkPermission function.

[0119] In some embodiments, such as Figure 8 As shown, when two threads (i.e., service request 81 and service request 82) in process A802 with threads access the system service simultaneously, service requests 81 and 82 are passed to the synchronization identifier 801. Then, the synchronization identifier 801 creates synchronization models 803 and 804 for service requests 81 and 82 respectively. For example, the synchronization module 803 is responsible for recording the UID 810 of service request 81 and for confirming the return of the IPC call; the synchronization module 804 is responsible for recording the UID 820 of service request 82 and for confirming the return of the IPC call. Then, service requests 81 and 82 are passed to client 805, which then passes them to binding driver 806. Next, binding driver 806 passes service requests 81 and 82 to service process 807 of the binding thread. Finally, service process 807 of the binding thread provides two binding threads 83 and 84 for service requests 81 and 82, respectively responding to and processing service requests 81 and 82, obtaining processing results 85 and 86. Processing results 85 and 86 are then passed to process A802 with threads through synchronization models 803 and 804. For example, binding thread 83 passes processing result 85 to process A802 with threads through synchronization module 803, and binding thread 84 passes processing result 86 to process A802 with threads through synchronization module 804. The processing result can also be passed directly to the threaded process A802 through the binding program. For example, the processing result 85 can be passed directly from the binding thread 83 to the threaded process A802.

[0120] Step 8: When check Permission is invoked, determine the functional modules by viewing the service information.

[0121] In some embodiments, since each functional module is assigned a service information and each service information has an identifier, the corresponding functional module can be identified by viewing the service information.

[0122] In the ninth step, when performing permission checks on the current functional module, if the permission is denied, the return value is denied; if the permission is not denied, the identification information of the functional module is replaced with the identification information of the target application, so that the identification information passed to the system service is the identification information of the target application.

[0123] In this embodiment of the invention, the system's API call can also be hooked, and permission checks can be performed on the functional modules at this time. If the permission is denied, the function returns directly without making a request to the system service. This also achieves the function of dynamic permission control. For example, Figure 8 As shown, by hooking the system's call interface, the processing results 85 and 86, which respond to and process service requests 81 and 82, are directly passed from the service process 805 bound to the thread to the process A802 with the thread.

[0124] The following description continues to illustrate the exemplary structure of the access control server 455 provided in the embodiments of the present invention as a software module. In some embodiments, such as... Figure 2 As shown, the software modules stored in the access control server 455 in the memory 450 may include:

[0125] The first determining module 4551 is used to determine the set of functional modules of the target application;

[0126] The second determining module 4552 is used to determine the identification information of the functional module based on the service information of the functional modules in the functional module set and the identification information of the target application.

[0127] The first setting module 4553 is used to set the access permissions of the functional module according to the identification information and functional attributes of the functional module.

[0128] In some embodiments, the first determining module 4551 is further configured to:

[0129] Determine the functionality implemented by each program segment in the target application;

[0130] Based on the function implemented by each program segment, the target application is divided into multiple functional modules to obtain the set of functional modules; wherein, the multiple functional modules are in the same process or in different processes.

[0131] In some embodiments, the first determining module 4551 is further configured to:

[0132] Based on the input setting instructions, service information is set for each functional module in the set of functional modules;

[0133] Correspondingly, the second determining module 4552 is further configured to:

[0134] Based on the service information of the functional module, determine the identification information of the interface used to implement the corresponding function of the functional module;

[0135] The identification information of the functional module is generated based on the identification information of the interface and the identification information of the target application.

[0136] In some embodiments, the first setting module 4553 is further configured to:

[0137] Determine the target access permissions required to implement the functions included in the aforementioned functional attributes;

[0138] The current process of the functional module is determined based on the identification information;

[0139] Determine the access permissions of other functional modules included in the current process;

[0140] The permissions in the target access permissions that are different from the access permissions of the other functional modules are set to the access permissions that the functional module has.

[0141] In some embodiments, the first setting module 4553 is further configured to:

[0142] When a service request is received, the association between the functional module and the permissions required by the service request is detected; wherein, the service request is used to request access to system services;

[0143] Respond to the service request based on the aforementioned relationship.

[0144] In some embodiments, the first setting module 4553 is further configured to:

[0145] When a service request is received, the function to be implemented in the service request is determined;

[0146] Determine the candidate permissions required to implement the desired function;

[0147] The association relationship is determined based on the candidate permissions and the permissions possessed by the functional module.

[0148] In some embodiments, the first setting module 4553 is further configured to:

[0149] If the association indicates that the functional module does not contain the permissions required for the service request, a rejection message is returned.

[0150] If the association indicates that the functional module contains the permissions required for the service request, the identification information of the functional module is replaced with preset identification information so that the system can identify the functional module;

[0151] Based on the replaced functional modules, the functions required for the service request are implemented.

[0152] This invention provides a computer-readable medium storing executable instructions, wherein the executable instructions, when executed by a processor, will cause the processor to perform the method provided in this invention.

[0153] In some embodiments, the computer-readable medium may be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, flash memory, magnetic surface memory, optical disk, or CD-ROM; or it may be a variety of devices including one or any combination of the above-mentioned memories.

[0154] In some embodiments, executable instructions may take the form of a program, software, software module, script, or code, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and may be deployed in any form, including as a standalone program or as a module, component, subroutine, or other unit suitable for use in a computing environment.

[0155] As an example, executable instructions may, but do not necessarily, correspond to files in a file system. They may be stored as part of a file that holds other programs or data, for example, in one or more scripts in a Hyper Text Markup Language (HTML) document, in a single file dedicated to the program in question, or in multiple collaborative files (e.g., a file that stores one or more modules, subroutines, or code sections).

[0156] As an example, executable instructions can be deployed to execute on a single computing device, or on multiple computing devices located in one location, or on multiple computing devices distributed across multiple locations and interconnected via a communication network.

[0157] In summary, through the embodiments of the present invention, for different functional modules of a target application, firstly, a set of functional modules of the target application is determined; then, based on the service information of the functional modules in the set and the identification information of the target application, the identification information of the functional modules is determined; finally, based on the identification information and functional attributes of the functional modules, the access permissions of the functional modules are set. Thus, by assigning service information to the functional modules of the target application, setting the identification information of the functional modules based on different service information and the identification information of the target application, and comprehensively considering the identification information and the functions of the functional modules, different permissions are set for different functional modules; thereby realizing the setting of different permissions for different functions of a target application within an operating system, enabling the operating system to dynamically manage the permissions possessed by the target application.

[0158] The above description is merely an embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and scope of the present invention are included within the scope of protection of the present invention.

Claims

1. An access control method, characterized in that, The method includes: Determine the functionality implemented by each program segment in the target application; Based on the function implemented by each program segment, the target application is divided to obtain a set of functional modules including multiple functional modules; wherein, the multiple functional modules are in different processes; Based on the input setting instructions, service information is set for each functional module in the set of functional modules; Based on the service information of the functional module, determine the identification information of the interface used to implement the corresponding function of the functional module; The identification information of the functional module is generated based on the identification information of the interface and the identification information of the target application. Determine the functions included in the functional attributes of the functional module and the required target access permissions; the functional attributes are used to characterize the functions that the functional module can perform. The current process of the functional module is determined based on the identification information of the functional module; Determine the access permissions of other functional modules included in the current process; The permissions in the target access permissions that are different from the access permissions of the other functional modules are set to the access permissions that the functional module has; When a service request is received, the association between the functional module and the permissions required by the service request is detected; wherein, the service request is used to request access to system services; the detection of the association between the functional module and the permissions required by the service request includes: determining the function to be implemented in the service request; determining the candidate permissions required to implement the function to be implemented; and determining the association between the functional module and the candidate permissions required by the service request based on the candidate permissions and the access permissions possessed by the functional module. If the association indicates that the functional module does not contain the candidate permissions required for the service request, a rejection message is returned. If the association indicates that the functional module contains the candidate permissions required by the service request, the identification information of the functional module is replaced with preset identification information so that the sender of the service request can identify the replaced functional module. Based on the replaced functional modules, the functions required for the service request are implemented.

2. The method according to claim 1, characterized in that, The association between the functional module and the candidate permissions required for the service request includes: the access permissions possessed by the functional module do not include the candidate permissions required for the service request, and the access permissions possessed by the functional module include the candidate permissions required for the service request.

3. The method according to claim 1, characterized in that, The method further includes: Based on the functions of the functional modules, determine the access permissions that the functional modules possess.

4. The method according to any one of claims 1-3, characterized in that, The method further includes: When multiple service requests are received, the thread corresponding to the multiple service requests is determined; If the multiple service requests correspond to different threads, the multiple service requests are responded to synchronously based on the identification information of each service request.

5. The method according to claim 4, characterized in that, If the multiple service requests correspond to different threads, the system synchronously responds to the multiple service requests based on the identifier information of each service request, including: If the multiple service requests correspond to different threads, a synchronization module is added for each service request; The synchronization module is used to record the identification information of each service request and to confirm the return of the inter-process communication call.

6. An access control device, characterized in that, The device includes: The first determining module is used to determine the function implemented by each program segment in the target application; based on the function implemented by each program segment, the target application is divided to obtain a set of functional modules including multiple functional modules; wherein, the multiple functional modules are in different processes; The second determining module is used to set service information for each functional module in the set of functional modules according to the input setting instructions; determine the identification information of the interface used to implement the corresponding function of the functional module according to the service information of the functional module; and generate the identification information of the functional module according to the identification information of the interface and the identification information of the target application. A first setting module is used to determine the functions included in the functional attributes of the functional module and the target access permissions required to implement them; the functional attributes are used to characterize the functions that the functional module can perform; determine the current process in which the functional module is located based on the identification information of the functional module; determine the access permissions of other functional modules included in the current process; set the permissions in the target access permissions that are different from the access permissions of the other functional modules as the access permissions possessed by the functional module; when a service request is received, detect the association between the functional module and the permissions required by the service request; wherein, the service request is used to request access to system services; the detection of the association between the functional module and the permissions required by the service request... The association process includes: determining the function to be implemented in the service request; determining the candidate permissions required to implement the function; determining the association between the functional module and the candidate permissions required for the service request based on the candidate permissions and the access permissions possessed by the functional module; if the association indicates that the functional module does not contain the candidate permissions required for the service request, returning a rejection message; if the association indicates that the functional module contains the candidate permissions required for the service request, replacing the identification information of the functional module with preset identification information so that the sender of the service request can identify the replaced functional module; and implementing the function required for the service request based on the replaced functional module.

7. An access control device, characterized in that, include: Memory, used to store executable instructions; A processor, when executing executable instructions stored in the memory, implements the method according to any one of claims 1 to 5.

8. A computer-readable medium, characterized in that, It stores executable instructions for causing a processor to execute, thereby implementing the method of any one of claims 1 to 5.

Images