Application control method, device and electronic device

Abstract

The present application discloses an application control method, device and electronic device, which belongs to the field of computer technology. The method comprises: receiving a target request sent by a target application, wherein the target request comprises first information for indicating access to target privacy data; in response to the target request, skipping the operation of accessing the target privacy data, and generating target indication information, wherein the target indication information is used to indicate successful access to the target privacy data; and sending the target indication information to the target application. The embodiment of the present invention solves the problem in the prior art that an APP forcibly requires user authorization to obtain user privacy information on the grounds of denial of service, thereby infringing the user's privacy rights and causing privacy information leakage.

Description

Technical Field

[0001] The present application belongs to the field of computer technology, and specifically relates to an application control method, device and electronic equipment. Background Art

[0002] At present, mobile terminal users pay more and more attention to privacy. However, when using certain applications (Application, APP), when the user refuses the APP to obtain certain sensitive privacy information, the APP directly exits and refuses service, and the user cannot use the services provided by the APP. Therefore, if the user must use the APP, the user can only be forced to authorize the APP to obtain sensitive privacy information. However, the user's privacy is violated when the APP obtains sensitive privacy information.

[0003] It can be seen from this that some APPs currently use denial of service as a threat and force users to authorize to obtain sensitive privacy information, which can easily lead to the leakage of privacy information.

[0004] However, the current method of forcing users to authorize permissions on the grounds of refusing service means that if users need to use the APP, they can only be forced to authorize, and there is currently no other general solution. Summary of the invention

[0005] The purpose of the embodiments of the present invention is to provide an application control method, device and electronic device to solve the problem in the prior art that APPs forcibly require users to authorize to obtain user privacy information on the grounds of denying service, thereby infringing user privacy and causing privacy information leakage.

[0006] In order to solve the above technical problems, this application is implemented as follows:

[0007] In a first aspect, an embodiment of the present application provides an application control method, the method comprising:

[0008] Receiving a target request sent by a target application, wherein the target request includes first information for indicating access to target private data;

[0009] In response to the target request, skipping the operation of accessing the target private data, and generating target indication information, wherein the target indication information is used to indicate successful access to the target private data;

[0010] The target indication information is sent to the target application.

[0011] In a second aspect, an embodiment of the present application provides an application control device, the device comprising:

[0012] A receiving module, used for receiving a target request sent by a target application, wherein the target request includes first information for indicating access to target private data;

[0013] a virtual processing module, configured to, in response to the target request, skip the operation of accessing the target private data and generate target indication information, wherein the target indication information is used to indicate successful access to the target private data;

[0014] A sending module is used to send the target indication information to the target application.

[0015] In a third aspect, an embodiment of the present application provides an electronic device, which includes a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the method described in the first aspect.

[0016] In a fourth aspect, an embodiment of the present application provides a readable storage medium, on which a program or instruction is stored, and when the program or instruction is executed by a processor, the steps of the method described in the first aspect are implemented.

[0017] In a fifth aspect, an embodiment of the present application provides a chip, comprising a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run a program or instruction to implement the method described in the first aspect.

[0018] In an embodiment of the present application, when a target request sent by a target application is received, and the target request includes first information for indicating access to target private data, the operation of accessing the target private data can be directly skipped, and target indication information for indicating successful access to the target private data is generated and then sent to the target application, so that the target application believes that it has obtained the permission to access the target private data, and can smoothly provide subsequent services. In this way, the target application can smoothly provide subsequent services without providing real private data to the target application, thereby avoiding infringement of the user's privacy rights to a certain extent and reducing the risk of leaking private information. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 A flowchart showing an application control method provided by an embodiment of the present invention;

[0020] Figure 2 A schematic diagram showing an icon display for entering a global stealth mode in an embodiment of the present invention;

[0021] Figure 3 A schematic diagram showing a display of a permission prompt box in an embodiment of the present invention;

[0022] Figure 4 A schematic diagram showing the relationship between the virtual configuration layer and upper layer applications and system application interfaces in an embodiment of the present invention;

[0023] Figure 5 One of the flowcharts showing a specific implementation of the application control method according to an embodiment of the present invention;

[0024] Figure 6 A second flowchart showing a specific implementation of the program control method according to an embodiment of the present invention;

[0025] Figure 7 A block diagram showing an application control device provided by an embodiment of the present invention;

[0026] Figure 8 One of the block diagrams of the electronic device provided by the embodiment of the present invention is shown;

[0027] Fig. 9 The second block diagram shows the electronic device provided by the embodiment of the present invention. DETAILED DESCRIPTION

[0028] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0029] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here. In addition, the "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally represents that the objects associated with each other are in an "or" relationship.

[0030] The application control method provided in the embodiment of the present application is described in detail below through specific embodiments and their application scenarios in conjunction with the accompanying drawings.

[0031] See also Figure 1 The embodiment of the present invention provides an application control method, wherein the method may include the following steps:

[0032] Step 101: receiving a target request sent by a target application, wherein the target request includes first information for indicating access to target private data.

[0033] The above private data is data that the user does not want others to know, wherein the user can set which data in the target device is private data. For example, the user can select the address book, text messages, photos, and videos as private data.

[0034] The target privacy data is stored on the target device, which is the electronic device where the target application is located. When the target device receives a preset operation, the target device generates a control instruction for controlling the target application to provide a target service in response to the preset operation, and sends it to the target application. After the target application receives the control instruction, it determines that providing the target service requires access to the target privacy data, and the target application generates the above-mentioned target request.

[0035] For example, a game application is installed on the target device. After the user of the target device clicks the "enter" button displayed in the display interface of the application, the application needs to read the address book of the target device, and the application will generate a request for reading the address book of the target device.

[0036] Optionally, the target request also includes a target service corresponding to the target request, and the target indication information is further used to instruct the target application to provide the target service.

[0037] Among them, the target application needs to access certain private data to provide the service, and these private data are bound to the service. The target service corresponding to the target request is the service bound to the target private data among the services provided by the target application.

[0038] Therefore, when the target application requests to access the target private data for the target service, the target application receives the above target indication information and provides the target service according to the target indication information.

[0039] Optionally, the operation of accessing the target private data may include at least one of reading the target private data and writing the target data into the target private data.

[0040] Step 102: In response to the target request, skip the operation of accessing the target private data, and generate target indication information, where the target indication information is used to indicate successful access to the target private data.

[0041] Among them, "skipping access to the target private data" means not performing the operation of accessing the target private data. Therefore, the application control method provided by the embodiment of the present invention, when receiving a target request sent by a target application, and the target request includes the first information for indicating access to the target private data, does not perform the access operation to the target private data, but generates target indication information for indicating that the target private data has been successfully accessed.

[0042] Step 103: Send the target indication information to the target application.

[0043] The target indication information is used to indicate successful access to the target private data. Therefore, after receiving the target indication information, the target application will believe that it has obtained authorization for the target private data, and can thus smoothly provide subsequent services.

[0044] As can be seen from the above, in the application control method provided by the embodiment of the invention, when receiving a target request sent by a target application, the target request includes first information for indicating access to target private data, then the operation of accessing the target private data can be directly skipped, and target indication information for indicating successful access to the target private data is generated, and then sent to the target application, so that the target application believes that it has obtained the permission to access the target private data, and can smoothly provide subsequent services. In this way, it is not necessary to provide real private data to the target application, and the target application can smoothly provide subsequent services, thereby avoiding infringement of the user's privacy rights to a certain extent and reducing the risk of leaking private information.

[0045] Optionally, before obtaining the target request generated by the target application, the method further includes:

[0046] In the case of receiving the first operation, in response to the first operation, creating a target account on the target device and generating an operating environment for the target account, wherein the operating environment for the target account is isolated from the first operating environment, and the first operating environment is an operating environment that already exists in the target device when the target device receives the first operation;

[0047] When the second operation is received, the target application is installed in the operating environment of the target account in response to the second operation.

[0048] The first operation is used to instruct the creation of a target account and to generate an operating environment for the target account; the second operation is used to instruct the installation of a target application in the operating environment of the target account.

[0049] As can be seen from the above, the embodiment of the present invention can use multi-user technology to create a new account based on the original user's operating environment of the target device (i.e., the first operating environment), and generate an operating environment isolated from the original operating environment of the target device. Then, the operation in the operating environment of the newly created account (i.e., the target account) will not affect the system in the original operating environment of the target device.

[0050] It can be seen from this that when the user of the target device does not trust the target application, that is, he is worried that there is a risk of attacking the original operating environment of the target device during its use, or there is a risk of forcing the user to authorize access to private information before providing certain services, then the user can first perform a first operation on the target device, so that the target device creates a target account and generates an operating environment for the target account, thereby installing the target application in the operating environment of the target account. Among them, after the target application is installed in the operating environment of the target account, if it generates a target request for requesting access to the target private data stored on the target device, the target device will execute the above-mentioned process from step 102 to step 103, that is, it does not perform the access operation to the target private data, but directly informs the target application that it has successfully accessed the target private data, so that the target application can smoothly provide subsequent services.

[0051] Therefore, when an application installed in the target account's operating environment needs to access private data, it will not actually obtain the real private data. That is, for any application, if the user of the target device does not want it to access private data, it can be installed in the target account's operating environment. It can be seen that the target account's operating environment is actually in stealth mode, that is, the application in this operating environment will not access the real private data, thereby avoiding the problem of privacy leakage.

[0052] In the prior art, although there are technical solutions for stealth environments, the existing stealth methods have the following shortcomings:

[0053] First, APP-level privacy protection is not universal, that is, it is heavily dependent on APP developers. If the APP does not provide a stealth mode, then the APP does not have a stealth function. Moreover, most APPs currently do not have a stealth mode.

[0054] Secondly, the stealth effect of the APP level cannot be guaranteed, that is, the degree of privacy protection also depends on the APP developer. The stealth modes developed by different APP developers have completely different privacy protection. Moreover, the developers are of varying quality and users cannot trust them.

[0055] It can be seen from this that the existing APP-level privacy protection solutions are difficult to meet users' privacy needs and gain users' trust.

[0056] In the embodiment of the present invention, a new system user is created and an operating environment is generated that is isolated from the original operating environment of the target device, so that the user of the target device can decide which applications need to be in stealth mode, and then install those applications into the operating environment of the newly created system user, without relying on the APP developer. In addition, the applications installed into the operating environment of the newly created system user will not access the real private data on the target device, so the trust of the user of the target device can be obtained.

[0057] Optionally, a target icon (such as Figure 2 If a “stealth mode” icon is shown in the figure), the first operation may be a click operation on the target icon, that is, the user of the target device clicks the target icon to create the target account; or, a first button is added in the setting interface, the slide-up menu, or the notification bar of the target device, the first operation may be a click operation on the first button, that is, the user of the target device clicks the first button to create the target account.

[0058] That is, the user of the target device chooses the entrance to enter the global stealth mode, which can be placed on the desktop, setting interface, drop-down menu, slide-up menu, notification bar, etc. of the target device.

[0059] Optionally, the target account's operating environment includes a virtual configuration layer, and the virtual configuration layer is used to execute the above steps 101 to 103. The request generated by the application for accessing private data is generally sent to the system application interface, and can be as follows: Figure 4 As shown, a virtual configuration layer is set between the upper-layer application and the system application interface, so that the virtual configuration layer intercepts the request for accessing private data sent by the upper-layer application to the system application interface, and then the virtual configuration layer skips the access to the corresponding private data and informs the upper-layer application that the private data has been successfully accessed, so that the upper-layer application can smoothly provide subsequent services.

[0060] Optionally, after generating the operating environment of the target account, the method further includes:

[0061] When the third operation is received, the operating environment of the target account is deleted in response to the third operation.

[0062] The third operation is used to instruct to delete the operating environment of the target account. When the target device receives the third operation, all applications installed in the operating environment of the target account will be deleted, which prevents information leakage to a certain extent.

[0063] Optionally, the data generated when the target device is in the operating environment of the target account is stored in the operating environment of the target account. When the operating environment of the target account is deleted, the data generated by the target device in the operating environment of the target account will also be deleted, further preventing information leakage.

[0064] Therefore, after deleting the operating environment of the target account, if it is necessary to re-enter an operating environment that is isolated from the original operating environment of the target device, a new target account can be created.

[0065] Optionally, a target list is pre-stored;

[0066] The step of skipping the operation of accessing the target private data and generating target indication information includes:

[0067] In a case where the target list includes a first target record, skipping the operation of accessing the private data corresponding to the first target record, and generating the target indication information;

[0068] Alternatively, the method further comprises:

[0069] If the target list does not include the first target record, prompt information is displayed.

[0070] The target list includes records of applications requesting to access private data, and the first target record is a record of the target application requesting to access the target private data.

[0071] There are various applications installed on the target device, and the types of private data stored are also various. Some applications can obtain some real private data. In this case, it is necessary to distinguish which applications can obtain which type of real private data, and which applications cannot obtain which type of real private data. In the embodiment of the present invention, a target list is used to record applications that cannot obtain certain types of real private data. That is, when there is a record in the target list that a certain application requests to access certain private data, the target device will skip accessing this part of the private data and inform the application that it has successfully accessed the corresponding private data, so that the application can smoothly provide subsequent services.

[0072] The target list may be stored in the original operating environment of the target device, or in the operating environment of the target account created above and isolated from the original operating environment of the target device.

[0073] Specifically, when the above-mentioned target list is stored in the original operating environment of the target device, in the application installed in the original operating environment of the target device, if an application requests to access the privacy data stored in the target device, and there is a record of accessing the privacy data in the target list, the target device will skip accessing this part of the privacy data and inform the application that it has successfully accessed the corresponding privacy data, so that the application can smoothly provide subsequent services.

[0074] When the above-mentioned target list is stored in the operating environment of the target account created above and isolated from the original operating environment of the target device, in the application installed in the operating environment of the above-mentioned target account, if an application requests to access the private data stored in the target device, and there is a record in the target list that the target device requests to access the private data, the target device will skip accessing this part of the private data and inform the application that it has successfully accessed the corresponding private data, so that the application can smoothly provide the corresponding service.

[0075] From this, it can be seen that in the case of the existence of the operating environment of the above-mentioned target account, it is also possible not to intercept requests from all applications installed in the operating environment to access private data. That is, only requests that are recorded in the target list are intercepted, and normally released requests will not be intercepted (that is, some applications can be allowed to access certain private data).

[0076] Optionally, in the presence of the operating environment of the target account, requests for access to private data by certain applications installed in the operating environment may be completely prohibited, that is, indication information indicating that access to private data is not allowed may be directly returned to the application.

[0077] From the above, it can be seen that under the operating environment of the above-mentioned target account, requests from certain applications to access certain private data can be allowed normally; requests from certain applications to access certain private data can also be intercepted and access to this part of private data can be skipped, but these applications are informed that they have obtained access rights to these private data; and certain applications can also be completely prohibited from accessing certain private data.

[0078] In addition, the above prompt information includes second information for prompting the user that the target application requests to access the target private data, so that the user can timely understand which application requests to access which private data.

[0079] Furthermore, the prompt information may also include third information, which is used to prompt the user whether to choose to virtually authorize the target application (that is, whether to choose to skip the operation of accessing the target privacy data, directly generate target indication information that the target privacy data has been successfully accessed, and send it to the target application).

[0080] Specifically, for example, the specific display method of the third information is: displaying a permission prompt pop-up box, and displaying a target option in the permission prompt box. Then, when a fourth operation on the target option is received, the first target record of the target application requesting access to the target privacy data is added to the target list in response to the fourth operation.

[0081] Among them, when the target application requests to access the target private data, virtual authorization is performed (that is, the operation of accessing the target private data is skipped, and the target indication information that the target private data has been successfully accessed is directly generated and sent to the target application). Compared with the existing technology, a new processing method for requests to access private data is provided, so that when it is subsequently detected that the target application requests to access the target private data, it can be directly intercepted and virtually allowed, that is, the access to the target private data is directly skipped, and the target application is informed that the target private data has been successfully accessed, so that the target application can smoothly provide subsequent services.

[0082] In addition, the permission prompt box can be displayed as follows Figure 3 For example, when "XXX application" requests location permission, if there is no record of "XXX application" requesting location information in the target list, a permission prompt pop-up box will be displayed to prompt the user whether to intercept the request. Figure 3 If the "Forbidden" button is clicked, the instruction information of prohibiting "XXX application" from obtaining the location information is directly returned. Furthermore, if the "Do not ask again after prohibition" option is selected again, the prompt box will not pop up subsequently; if the user of the target device clicks the "Always Allow" button, the location information is returned to the "XXX application"; if the user of the target device clicks the "Virtual Allow", the request is intercepted, the reading of the location information is skipped, and the "XXX application" is informed that it has obtained the location information.

[0083] Optionally, the operation of skipping access to target private data includes:

[0084] When the first information indicates to read the target private data, skipping the reading operation of the target private data;

[0085] In a case where the first information indicates to write the target data into the target private data, an operation of writing the target data into the target private data is skipped.

[0086] That is, the target application may request to read the target private data, or may request to write data in the target private data. Regardless of whether it requests to read the target private data or to write data in the target private data, the corresponding operation can be skipped and the target application can be informed that the corresponding operation has been successfully performed, so that the target application can smoothly provide subsequent services.

[0087] Optionally, when the first information indicates reading the target private data, the generating target indication information includes:

[0088] generating a random number, and determining the random number as the target indication information;

[0089] or,

[0090] Determine the empty data as the target indication information;

[0091] or,

[0092] Determining predetermined data as the target indication information;

[0093] or,

[0094] A request is made to the server for data that needs to be returned to the target application, and the received data sent by the server is determined as the target indication information.

[0095] That is, when the target application requests to read the target private data, the target device can return false private data to the target application, such as returning a random number or empty data or predetermined data or data requested from the server. The specific type of false private data returned can be the system default type of data.

[0096] Optionally, a target list is pre-stored, the target list including records of application requests to access private data, and a virtual processing method corresponding to each record, the virtual processing method including returning a random number, returning empty data, returning predetermined data, and requesting the server for data to be returned to the application;

[0097] In a case where the first information indicates reading the target private data, the generating target indication information includes:

[0098] In the target list, searching for a first target record that matches the target request;

[0099] The target indication information is generated according to the virtual processing mode corresponding to the first target record.

[0100] That is, the target list can store records of each application's request to access different private data and the corresponding virtual processing methods, so that different false private data can be returned in response to various situations in which different applications request to access different private data, thereby better adapting to scenarios in which different applications request to access different private data.

[0101] For example, when an application requests to read an address book, a fake address book may be randomly generated and returned to the application, so that the application believes that it has obtained a real address book.

[0102] Optionally, the method further includes:

[0103] When the fifth operation is received, in response to the fifth operation, the virtual processing mode corresponding to the second target record in the target list is modified, the second target record being the record corresponding to the fifth operation in the target list.

[0104] Among them, the fifth operation is used to indicate the modification of the virtual processing method in the target list. Therefore, in the embodiment of the present invention, the user of the target device can set the specific virtual processing methods used by different applications to access different private data. For example, in the setting interface of the target device corresponding to the permission setting of the address book, the options of the above different virtual processing methods can be added. Whichever one the user of the target device selects, when certain applications request to read the address book, the target device will use which virtual processing method to return the corresponding information to these applications.

[0105] Optionally, when the first information indicates that target data is written into the target private data, before generating the target indication information, the method further includes:

[0106] The target data is written into a target storage space, where the target storage space is a storage space other than a storage space for the target private data.

[0107] That is, when the target application requests to write the target data in the target private data, the target data may be written into other storage spaces other than the storage space of the target private data.

[0108] In summary, the application control method of the embodiment of the present invention can be implemented in one of the following ways: way 1 and way 2.

[0109] Method 1: If Figure 5 As shown, follow the steps below:

[0110] Step 501: Global stealth mode is turned on.

[0111] For example, a user of the target device clicks a target icon displayed on the desktop, or a first button set in one of the setting interface, drop-down menu, slide-up menu, and notification bar, and the target device begins to enter the global stealth mode.

[0112] Among them, if the user of the target device downloads an application from an unknown source on the Internet, and believes that this application has security and privacy leakage risks and does not want to take the risk of running it in the original operating environment of the target device, he can choose to enable a global stealth mode.

[0113] Step 502: Create a target account and generate an operating environment that is isolated from the original operating environment of the target device (ie, the existing operating environment of the target device before the global stealth mode is turned on), wherein the operating environment of the target account includes a virtual configuration layer.

[0114] Step 503: Install the application in the operating environment of the target account.

[0115] Step 504: setting the virtual processing mode of the virtual configuration layer according to the configuration information, that is, setting the virtual processing mode corresponding to different applications accessing different privacy data according to the operation of the user of the target device.

[0116] Among them, for requests to read private data, you can set it to return random data, empty data, predetermined data, request data from the server, etc.; for requests to write data in private data, you can set it to write the data to be written elsewhere and return an indication of successful writing.

[0117] Step 505: Perform operations in the operating environment of the target account. For example, if the target application generates a target request to access the target private data, the virtual configuration layer will intercept the target request and skip the operation of accessing the target private data, generate target indication information (the target indication information is used to indicate that the target private data has been successfully accessed, and is used to instruct the target application to provide corresponding services), and send it to the target application so that the target application can provide subsequent services.

[0118] Among them, in the operating environment of the above-mentioned target account, when an application requests access to certain private data for the first time, a permission prompt box may pop up, and when the user clicks the "virtual allow" button displayed in the permission prompt box, a record of the application requesting access to the private data is added to the target list, so that when the application subsequently requests access to the private data, the operation of accessing the corresponding private data is directly skipped, and indication information indicating that the corresponding private data has been successfully accessed is generated and sent to the application.

[0119] Step 506: After exiting the target account, clear the entire operating environment of the target account and the data generated by the target device in the operating environment.

[0120] For example, the user of the target device installs an application from an unknown source in the operating environment of the target account. At this time, the operating environment of the target account is completely isolated from the original operating environment of the target device. Therefore, running this application in the operating environment of the target account will not affect the original operating environment of the target device. And the information obtained by the application is all from the virtual configuration layer, not real information, so there is no need to worry about privacy leakage. In addition, after exiting the operating environment of the target account, all data in the environment will be deleted, further avoiding the leakage of private information.

[0121] Method 2: A virtual configuration layer is set in the original operating environment of the target device. Figure 6 As shown, follow the steps below:

[0122] Step 601: The user of the target device selects virtual authorization, that is, when the target application generates a target request for accessing the target private data, a permission prompt box is displayed. The user of the target device can click the "virtual allow" button displayed in the permission prompt box to select virtual authorization for the target private data.

[0123] For example, if the target application requests to obtain the address book permission, a permission prompt box will pop up when the target application's request to obtain the address book is detected. If the user of the target device does not want the address book to be leaked, he or she can select "virtual allow" in the permission prompt box. In this way, the virtual configuration layer will intercept this request and return the information that the permission has been obtained successfully to the target application. At this time, the target application believes that it has obtained the permission and will continue to execute the subsequent process.

[0124] Step 602: The virtual configuration layer records the target application's request to access the target private data and processes it in a virtual authorization manner.

[0125] Taking the target application obtaining the address book permission as an example, the virtual configuration layer knows that the user of the target device has set the "virtual authorization" for the "target application" to use the "address book" permission. The virtual configuration layer will record this setting, and subsequent requests will be intercepted in a targeted manner. It should be noted here that the virtual configuration layer only intercepts requests that select "virtual authorization", and normal requests will not be intercepted, and prohibited requests are also completely prohibited.

[0126] Step 603: The virtual configuration layer is turned on, and requests to access private data are intercepted according to the records.

[0127] Specifically, if the intercepted request is to read private data, you can choose to return nothing, return predetermined false information, random information, etc. to the application that generated the request; if the intercepted request is to write data in private data, you can return success to the application that generated the request, but it is not actually written to the private data and can be temporarily written to other places.

[0128] Still taking the target application reading the address book as an example, the target application attempts to actually read the address book, but the virtual configuration layer finds that the user of the target device has set virtual authorization for this request, so it intercepts the process. Among them, the user of the target device can configure the return content of the address book, or automatically return random data, or return nothing, or customize data. It should be noted here that the user of the target device can set which of the above content is returned to the target application.

[0129] Step 604: The virtual configuration layer returns to normal to the upper layer application, deceiving the upper layer application so that the upper layer application continues to execute.

[0130] Among them, the upper-layer application cannot perceive the underlying virtual authorization, and the virtual configuration layer returns normal to the upper-layer application, then the upper-layer application will continue to execute downward according to the process, so there is no need to worry about the application denial of service due to unauthorized.

[0131] Still taking the target application reading the address book as an example, since the information returned to the upper layer is the successful acquisition of permission, the target application believes that it has obtained the permission and will not interfere with the normal execution of the program.

[0132] From the above methods 1 and 2, we can know that a virtual configuration layer can be added to intercept the system application interface (Application Programming Interface, API). Among them, the reading and writing of privacy data of some upper-layer applications can be processed in the virtual configuration layer, and the real data will not be read or written, so that the real privacy data at the bottom layer can be fully protected.

[0133] It should be noted that the application control method provided in the embodiment of the present application can be executed by an application control device or a control module in the application control device for executing the loading application control method. In the embodiment of the present application, the application control method provided in the embodiment of the present application is described by taking the application control device executing the loading application control method as an example.

[0134] The above describes the application control method provided by the embodiment of the present invention. The following describes the application control device provided by the embodiment of the present invention in conjunction with the accompanying drawings.

[0135] See also Figure 7The embodiment of the present invention further provides an application control device 700, including:

[0136] A receiving module 701 is used to receive a target request sent by a target application, wherein the target request includes first information for indicating access to target private data;

[0137] A virtual processing module 702, configured to skip the operation of accessing the target private data in response to the target request, and generate target indication information, wherein the target indication information is used to indicate successful access to the target private data;

[0138] The sending module 703 is used to send the target indication information to the target application.

[0139] Optionally, in the embodiment of the present invention, the device further includes:

[0140] a system user establishment module, configured to, upon receiving a first operation, create a target account on a target device in response to the first operation, and generate an operating environment for the target account, wherein the operating environment for the target account is isolated from the first operating environment, and the first operating environment is an operating environment that already exists in the target device when the target device receives the first operation;

[0141] The application installation module is used to install the target application in the operating environment of the target account in response to the second operation when the second operation is received.

[0142] Optionally, in the embodiment of the present invention, the device further includes:

[0143] The deleting module is used to delete the operating environment of the target account in response to the third operation when the third operation is received.

[0144] Optionally, the virtual processing module 702 pre-stores a target list and includes:

[0145] A first generating submodule, configured to skip accessing the privacy data corresponding to the first target record and generate the target indication information when the target list includes the first target record;

[0146] or,

[0147] The device also includes:

[0148] The prompt module is used to display prompt information when the target list does not include the first target record.

[0149] The target list includes records of applications requesting to access private data, and the first target record is a record of the target application requesting to access the target private data.

[0150] In addition, the above prompt information includes second information for prompting the user that the target application requests to access the target private data, so that the user can timely understand which application requests to access which private data.

[0151] Furthermore, the prompt information may also include third information, which is used to prompt the user whether to choose to virtually authorize the target application (that is, whether to choose to skip the operation of accessing the target privacy data, directly generate target indication information that the target privacy data has been successfully accessed, and send it to the target application).

[0152] Specifically, when prompting the above-mentioned third information, the prompt module is specifically used to: display a permission prompt pop-up box, and a virtual permission option is displayed in the permission prompt box. The above-mentioned device also includes: an adding module, which is used to, when receiving a fourth operation on the virtual permission option, respond to the fourth operation and add a first target record in the target list in which the target application requests to access the target privacy data.

[0153] Optionally, in the embodiment of the present invention, the virtual processing module 702 includes:

[0154] A first skipping submodule, configured to skip a reading operation on the target private data when the first information indicates to read the target private data;

[0155] The second skipping submodule is configured to skip writing the target data into the target private data when the first information indicates to write the target data into the target private data.

[0156] Optionally, in the embodiment of the present invention, when the first information indicates to read the target private data, the virtual processing module 702 includes:

[0157] A second generating submodule, used for generating a random number, and determining the random number as the target indication information;

[0158] or,

[0159] A third generating submodule is used to determine the empty data as the target indication information;

[0160] or,

[0161] A fourth generating submodule, used for determining predetermined data as the target indication information;

[0162] or,

[0163] The fifth generating submodule is used to request the server for data to be returned to the target application, and determine the received data sent by the server as the target indication information.

[0164] Optionally, in an embodiment of the present invention, a target list is pre-stored, the target list including records of application requests to access private data, and a virtual processing method corresponding to each record, the virtual processing method including returning a random number, returning empty data, returning predetermined data, and requesting the server for data to be returned to the application;

[0165] In the case where the first information indicates to read the target private data, the virtual processing module 702 includes:

[0166] A search submodule, configured to search the target list for a first target record that matches the target request;

[0167] The sixth generating submodule is used to generate the target indication information according to the virtual processing mode corresponding to the first target record.

[0168] Optionally, in the embodiment of the present invention, the device further includes:

[0169] The modification module is used to modify the virtual processing mode corresponding to the second target record in the target list in response to the fifth operation when the fifth operation is received, and the second target record is the record corresponding to the fifth operation in the target list.

[0170] Optionally, in the embodiment of the present invention, when the first information indicates that target data is written into the target private data, the device further includes:

[0171] The writing module is used to write the target data into a target storage space, where the target storage space is a storage space other than the storage space of the target private data.

[0172] The application control device in the embodiment of the present application can be a device, or a component, integrated circuit, or chip in a terminal. The device can be a mobile electronic device or a non-mobile electronic device. Exemplarily, the mobile electronic device can be a mobile phone, a tablet computer, a laptop computer, a PDA, an in-vehicle electronic device, a wearable device, an ultra-mobile personal computer (UMPC), a netbook, or a personal digital assistant (PDA), etc. The non-mobile electronic device can be a server, a network attached storage (NAS), a personal computer (PC), a television (TV), a teller machine or a self-service machine, etc., which is not specifically limited in the embodiment of the present application.

[0173] The application control device in the embodiment of the present application may be a device having an operating system. The operating system may be an Android operating system, an iOS operating system, or other possible operating systems, which are not specifically limited in the embodiment of the present application.

[0174] The application control device provided in the embodiment of the present application can achieve Figure 1 In order to avoid repetition, the various processes implemented by the control method in the method embodiment are not described here.

[0175] As can be seen from the above, in the application control device provided in the embodiment of the invention, the target request sent by the target application is received by the receiving module, and the target request includes the first information for indicating access to the target private data. Then, the virtual processing module directly skips the operation of accessing the target private data, and generates target indication information for indicating successful access to the target private data, which is then sent to the target application by the sending module, so that the target application believes that it has obtained the right to access the target private data, so that subsequent services can be provided smoothly. In this way, the target application can provide subsequent services without providing real private data to the target application, thereby avoiding infringement of the user's privacy rights to a certain extent and reducing the risk of leaking private information.

[0176] Optional, such as Figure 8 As shown, an embodiment of the present application also provides an electronic device 800, including a processor 801, a memory 802, and a program or instruction stored in the memory 802 and executable on the processor 801. When the program or instruction is executed by the processor, each process of the above-mentioned application control method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0177] It should be noted that the electronic devices in the embodiments of the present application include the mobile electronic devices and non-mobile electronic devices mentioned above.

[0178] Fig. 9 A schematic diagram of the hardware structure of an electronic device to implement an embodiment of the present application.

[0179] The electronic device 900 includes but is not limited to: a radio frequency unit 901, a network module 902, an audio output unit 903, an input unit 904, a sensor 905, a display unit 906, a user input unit 907, an interface unit 908, a memory 909, and a processor 910 and other components.

[0180] Those skilled in the art will appreciate that the electronic device 900 may also include a power source (such as a battery) for supplying power to various components, and the power source may be logically connected to the processor 910 through a power management system, thereby implementing functions such as managing charging, discharging, and power consumption management through the power management system. Fig. 9 The electronic device structure shown in the figure does not constitute a limitation on the electronic device. The electronic device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently, which will not be described in detail here.

[0181] The processor 910 is configured to receive a target request sent by a target application, wherein the target request includes first information for indicating access to target private data;

[0182] In response to the target request, skipping the operation of accessing the target private data, and generating target indication information, wherein the target indication information is used to indicate successful access to the target private data;

[0183] The target indication information is sent to the target application.

[0184] In the embodiment of the present invention, when the processor 910 receives a target request sent by a target application, and the target request includes first information for indicating access to target private data, the operation of accessing the target private data can be directly skipped, and target indication information for indicating successful access to the target private data is generated, and then sent to the target application, so that the target application believes that it has obtained the permission to access the target private data, and can smoothly provide subsequent services. In this way, the target application can smoothly provide subsequent services without providing real private data to the target application, thereby avoiding infringement of the user's privacy rights to a certain extent and reducing the risk of leaking private information.

[0185] Optionally, the processor 910 is further configured to, when the user input unit 907 receives a first operation, create a target account on the electronic device in response to the first operation, and generate an operating environment for the target account, wherein the operating environment for the target account is isolated from the first operating environment, and the first operating environment is an operating environment that already exists in the target device when the target device receives the first operation;

[0186] When the user input unit 907 receives the second operation, the target application is installed in the running environment of the target account in response to the second operation.

[0187] As can be seen from the above, the embodiment of the present invention can use multi-user technology to create a new system account based on the original user's operating environment (i.e., the first operating environment) of the target device, and generate an operating environment isolated from the original operating environment of the target device. Then, operations in the operating environment of the newly created account (i.e., the target account) will not affect the system in the original operating environment of the target device.

[0188] Moreover, by creating a new system user and generating an operating environment isolated from the original operating environment of the target device, the user of the target device can decide which applications need to be in stealth mode, and then install them into the operating environment of the newly created system user, without relying on APP developers. Moreover, the applications installed into the operating environment of the newly created system user will not access the real private data on the target device, thus gaining the trust of the user of the target device.

[0189] Optionally, the processor 910 is further configured to:

[0190] When the user input unit 907 receives the third operation, the operating environment of the target account is deleted in response to the third operation.

[0191] The third operation is used to instruct to delete the operating environment of the target account. When the target device receives the third operation, all applications installed in the operating environment of the target account will be deleted, which prevents information leakage to a certain extent.

[0192] Optionally, the data generated when the target device is in the operating environment of the target account is stored in the operating environment of the target account. When the operating environment of the target account is deleted, the data generated by the target device in the operating environment of the target account will also be deleted, further preventing information leakage.

[0193] Optionally, a target list is pre-stored in the target device; when skipping the operation of accessing the privacy data corresponding to the first target record and generating the target indication information, the processor 910 is specifically configured to:

[0194] In a case where the target list includes a first target record, skipping the operation of accessing the private data corresponding to the first target record, and generating the target indication information;

[0195] or,

[0196] The display unit 906 is used to display prompt information when the target list does not include the first target record.

[0197] The target list includes records of applications requesting to access private data, and the first target record is a record of the target application requesting to access the target private data.

[0198] There are various applications installed on the target device, and the types of private data stored are also various. Some applications can obtain some real private data. In this case, it is necessary to distinguish which applications can obtain which type of real private data, and which applications cannot obtain which type of real private data. In the embodiment of the present invention, a target list is used to record applications that cannot obtain certain types of real private data. That is, when there is a record in the target list that a certain application requests to access certain private data, the target device will skip accessing this part of the private data and inform the application that it has successfully accessed the corresponding private data, so that the application can smoothly provide the corresponding service.

[0199] In addition, the above prompt information includes second information for prompting the user that the target application requests to access the target private data, so that the user can timely understand which application requests to access which private data.

[0200] Furthermore, the prompt information may also include third information, which is used to prompt the user whether to choose to virtually authorize the target application (that is, whether to choose to skip the operation of accessing the target privacy data, directly generate target indication information that the target privacy data has been successfully accessed, and send it to the target application).

[0201] Specifically, for example, when the display unit 906 displays the above-mentioned third information, it is specifically used to: display a permission prompt pop-up box, in which a virtual permission option is displayed, and the processor 910 is also used to, when the user input unit 907 receives a fourth operation on the virtual permission option, respond to the fourth operation and add a first target record in the target list in which the target application requests access to the target privacy data.

[0202] Among them, when the target application requests to access the target private data, virtual authorization is performed (that is, the operation of accessing the target private data is skipped, and the target indication information that the target private data has been successfully accessed is directly generated and sent to the target application). Compared with the existing technology, a new processing method for requests to access private data is provided, so that when it is subsequently detected that the target application requests to access the target private data, it can be directly intercepted and virtually allowed, that is, the access to the target private data is directly skipped, and the target application is informed that the target private data has been successfully accessed, so that the target application can smoothly provide the corresponding service.

[0203] Optionally, when skipping the operation of accessing the target private data, the processor 910 is specifically configured to:

[0204] When the first information indicates to read the target private data, skipping the reading operation of the target private data;

[0205] In a case where the first information indicates to write the target data into the target private data, an operation of writing the target data into the target private data is skipped.

[0206] That is, the target application may request to read the target private data, or may request to write data in the target private data. Regardless of whether it requests to read the target private data or to write data in the target private data, the corresponding operation can be skipped and the target application can be informed that the corresponding operation has been successfully performed, so that the target application can smoothly provide subsequent services.

[0207] Optionally, when the first information indicates to read the target private data, the processor 910, when generating the target indication information, is specifically configured to:

[0208] generating a random number, and determining the random number as the target indication information;

[0209] or,

[0210] Determine the empty data as the target indication information;

[0211] or,

[0212] Determining predetermined data as the target indication information;

[0213] or,

[0214] A request is made to the server for data that needs to be returned to the target application, and the received data sent by the server is determined as the target indication information.

[0215] That is, when the target application requests to read the target private data, the target device can return false private data to the target application, such as returning a random number or empty data or predetermined data or data requested from the server. The specific type of false private data returned can be the system default type of data.

[0216] Optionally, a target list is pre-stored, the target list including records of application requests to access private data, and a virtual processing method corresponding to each record, the virtual processing method including returning a random number, returning empty data, returning predetermined data, and requesting the server for data to be returned to the application;

[0217] In the case where the first information indicates reading the target private data, the processor 910 is specifically configured to:

[0218] In the target list, searching for a first target record that matches the target request;

[0219] The target indication information is generated according to the virtual processing mode corresponding to the first target record.

[0220] That is, the target list can store records of each application's request to access different private data and the corresponding virtual processing methods, so that different false private data can be returned in response to various situations in which different applications request to access different private data, thereby better adapting to scenarios in which different applications request to access different private data.

[0221] Optionally, the processor 910 is further configured to:

[0222] When the fifth operation is received, in response to the fifth operation, the virtual processing mode corresponding to the second target record in the target list is modified, the second target record being the record corresponding to the fifth operation in the target list.

[0223] Among them, the fifth operation is used to indicate the modification of the virtual processing method in the target list. Therefore, in the embodiment of the present invention, the user of the target device can set the specific virtual processing methods used by different applications to access different private data. For example, in the setting interface of the target device corresponding to the permission setting of the address book, the options of the above different virtual processing methods can be added. Whichever one the user of the target device selects, when certain applications request to read the address book, the target device will use which virtual processing method to return the corresponding information to these applications.

[0224] Optionally, when the first information indicates that target data is written into the target private data, the processor 910 is further configured to:

[0225] The target data is written into a target storage space, where the target storage space is a storage space other than a storage space for the target private data.

[0226] That is, when the target application requests to write the target data in the target private data, the target data may be written into other storage spaces other than the storage space of the target private data.

[0227] It should be understood that in the embodiment of the present application, the input unit 904 may include a graphics processor (Graphics Processing Unit, GPU) 9041 and a microphone 9042, and the graphics processor 91041 processes the image data of the static picture or video obtained by the image capture device (such as a camera) in the video capture mode or the image capture mode. The display unit 906 may include a display panel 9061, and the display panel 9061 may be configured in the form of a liquid crystal display, an organic light emitting diode, etc. The user input unit 907 includes a touch panel 9071 and other input devices 9072. The touch panel 9071 is also called a touch screen. The touch panel 9071 may include two parts: a touch detection device and a touch controller. Other input devices 9072 may include but are not limited to physical keyboards, function keys (such as volume control keys, switch keys, etc.), trackballs, mice, and joysticks, which will not be repeated here. The memory 909 can be used to store software programs and various data, including but not limited to application programs and operating systems. The processor 910 may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the modem processor may not be integrated into the processor 910.

[0228] An embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the various processes of the above-mentioned application control method embodiment are implemented and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0229] The processor is the processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0230] An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned application control method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0231] It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0232] It should be noted that, in this article, the terms "comprise", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0233] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0234] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims

1. An application control method, characterized in that: include: Receiving a target request sent by a target application, wherein the target request includes first information for indicating access to target private data; In response to the target request, skipping the operation of accessing the target private data, and generating target indication information, wherein the target indication information is used to indicate successful access to the target private data; sending the target indication information to the target application; Before receiving the target request sent by the target application, the method further includes: In the case of receiving a first operation, in response to the first operation, a target account is created on the target device, and an operating environment of the target account is generated, the operating environment of the target account is isolated from the first operating environment, and the first operating environment is the operating environment that already exists in the target device when the target device receives the first operation; wherein the operating environment of the target account includes a virtual configuration layer, the virtual configuration layer is arranged between the upper layer application and the system application interface, the virtual configuration layer is used to execute the operation of receiving the target request sent by the target application, skipping the operation of accessing the target private data, and generating target indication information, and sending the target indication information to the operation of the target application; When receiving the second operation, in response to the second operation, installing the target application in the operating environment of the target account; After generating the operating environment of the target account, the method further includes: When the third operation is received, the operating environment of the target account is deleted in response to the third operation.

2. The application control method according to claim 1, characterized in that: A target list is stored in advance; The step of skipping the operation of accessing the target private data and generating target indication information includes: In a case where the target list includes a first target record, skipping the operation of accessing the private data corresponding to the first target record, and generating the target indication information; Alternatively, the method further comprises: If the target list does not include the first target record, prompt information is displayed.

3. The application control method according to claim 1, characterized in that: In a case where the first information indicates reading the target private data, the generating target indication information includes: generating a random number, and determining the random number as the target indication information; or, Determine the empty data as the target indication information; or, Determining predetermined data as the target indication information; or, A request is made to the server for data that needs to be returned to the target application, and the received data sent by the server is determined as the target indication information.

4. An application control device, characterized in that: The device comprises: A receiving module, used for receiving a target request sent by a target application, wherein the target request includes first information for indicating access to target private data; a virtual processing module, configured to, in response to the target request, skip the operation of accessing the target private data and generate target indication information, wherein the target indication information is used to indicate successful access to the target private data; A sending module, used for sending the target indication information to the target application; Wherein, the device further comprises: A system user establishment module, used for, upon receiving a first operation, creating a target account on a target device in response to the first operation, and generating an operating environment for the target account, wherein the operating environment for the target account is isolated from the first operating environment, and the first operating environment is an operating environment that already exists in the target device when the target device receives the first operation; wherein the operating environment for the target account includes a virtual configuration layer, the virtual configuration layer is provided between an upper layer application and a system application interface, the virtual configuration layer is used for executing the operation of receiving a target request sent by a target application, skipping the operation of accessing the target privacy data, and generating target indication information, and sending the target indication information to the operation of the target application; an application installation module, configured to install the target application in the operating environment of the target account in response to the second operation when the second operation is received; The deleting module is used to delete the operating environment of the target account in response to the third operation when the third operation is received.

5. The application control device according to claim 4, characterized in that: A target list is stored in advance; The virtual processing module comprises: A first generating submodule, configured to skip accessing the privacy data corresponding to the first target record and generate the target indication information when the target list includes the first target record; or, The device also includes: The prompt module is used to display prompt information when the target list does not include the first target record.

6. The application control device according to claim 4, characterized in that: In the case where the first information indicates to read the target private data, the virtual processing module includes: A second generating submodule, used for generating a random number, and determining the random number as the target indication information; or, A third generating submodule is used to determine the empty data as the target indication information; or, A fourth generating submodule, used for determining predetermined data as the target indication information; or, The fifth generating submodule is used to request the server for data to be returned to the target application, and determine the received data sent by the server as the target indication information.

7. An electronic device, characterized in that: The invention comprises a processor, a memory and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the application control method as claimed in any one of claims 1 to 3.

8. A readable storage medium, characterized in that: The readable storage medium stores a program or instruction, and when the program or instruction is executed by the processor, the steps of the application control method according to any one of claims 1 to 3 are implemented.

Images