Data access method, device, terminal and storage medium

Abstract

The present disclosure is about a data access method, which is applied in a terminal, and includes: determining a target directory and a target application corresponding to the target directory; if an application other than the target application accesses the target directory, denying the application other than the target application access to the target directory. In this way, the data in the target directory can be prevented from being leaked without encrypting the data in the target directory, thereby enhancing the privacy security of the data in the target directory. The present disclosure also provides a data access device, a terminal, and a storage medium.

Description

Technical Field

[0001] The present disclosure relates to the field of terminal technology, and in particular to a data access method, device, mobile terminal and storage medium. Background Art

[0002] In the related art, for pictures or files that need to be kept confidential in the terminal's memory card, these files are usually protected by encrypting them. However, protecting user privacy by encrypting files still has two problems. The first is that when there are many files to be encrypted or the files are large, the encryption time will be very long, which is not conducive to user experience; the second problem is that if only part of the file is encrypted, although the encryption time can be reduced, some files are stored in hidden directories on the memory card. Once the application has the permission to read and write the memory card, it may still be able to access the non-encrypted part of the file, and the content of the file is still at risk of leakage. Therefore, how to balance the privacy security of the file and the user experience of the terminal has become a technical problem that needs to be solved urgently. Summary of the invention

[0003] According to a first aspect of an embodiment of the present disclosure, a data access method is provided, which is applied in a terminal and includes:

[0004] Determine a target directory and a target application corresponding to the target directory;

[0005] If an application other than the target application accesses the target directory, the application other than the target application is denied access to the target directory.

[0006] Optionally, the method further comprises:

[0007] Monitoring preset events of the application, wherein the preset events include: a startup event of the application or an access event of the target directory;

[0008] According to the preset event, determining whether the application executing the preset event is the target application;

[0009] If the application executing the preset event is not the target application, the access permission of the application other than the target application is configured as access-forbidden permission.

[0010] Optionally, the method further comprises:

[0011] If the application executing the preset event is the target application, the access permission of the target application is configured as an access permission.

[0012] Optionally, the method further comprises:

[0013] Detecting an input operation of a privacy control for the target directory;

[0014] The preset events of the monitoring application include:

[0015] If the input operation is an opening operation, the preset event of the application is monitored.

[0016] Optionally, if an application other than the target application accesses the target directory, denying the application other than the target application from accessing the target directory includes:

[0017] If an application other than the target application accesses the target directory, the terminal is notified through the storage daemon process to close the access process to the target directory, or the terminal is notified to close the mounting process of the target directory, thereby denying access to the target directory by applications other than the target application.

[0018] Optionally, the method further comprises:

[0019] If the target application accesses the target directory, the target directory is mounted and the target application is allowed to access the target directory.

[0020] According to a second aspect of an embodiment of the present disclosure, a data access device is provided, which is applied in a terminal and includes:

[0021] A first determination module, used to determine a target directory and a target application corresponding to the target directory;

[0022] The denying module is used to deny the access of the application programs other than the target application programs to the target directory if the application programs other than the target application programs access the target directory.

[0023] Optionally, the device further comprises:

[0024] A monitoring module, used for monitoring preset events of an application, wherein the preset events include: a startup event of an application or an access event of the target directory;

[0025] A second determination module, configured to determine, according to the preset event, whether the application executing the preset event is the target application;

[0026] The first configuration module is used to configure the access permission of the application program other than the target application program as the access prohibition permission if the application program executing the preset event is not the target application program.

[0027] Optionally, the device further comprises:

[0028] The second configuration module is used to allow the target application to access the target directory if the application executing the preset event is the target application.

[0029] Optionally, the device further comprises:

[0030] A detection module, used to detect an input operation of a privacy control for the target directory;

[0031] The monitoring module is further configured to monitor the preset event of the application if the input operation is an opening operation.

[0032] Optionally, the rejection module is further used to:

[0033] If an application other than the target application accesses the target directory, the terminal is notified through the storage daemon process to close the access process to the target directory, or the terminal is notified to close the mounting process of the target directory, thereby denying access to the target directory by applications other than the target application.

[0034] Optionally, the device further comprises:

[0035] The allowing module is used to mount the target directory and allow the target application to access the target directory if the target application accesses the target directory.

[0036] According to a third aspect of an embodiment of the present disclosure, a terminal is provided, including:

[0037] processor;

[0038] a memory for storing processor-executable instructions;

[0039] Wherein, the processor is configured to: implement any of the above-mentioned data access methods when running the executable instructions.

[0040] According to a fourth aspect of an embodiment of the present disclosure, there is provided a non-temporary computer-readable storage medium on which a computer program is stored, and the program is executed by a processor to implement any of the method steps described above.

[0041] The technical solution provided by the embodiments of the present disclosure may have the following beneficial effects:

[0042] In the embodiment of the present disclosure, by determining the target directory and the target application corresponding to the target directory; if an application other than the target application accesses the target directory, the access of the application other than the target application to the target directory is denied. In this way, by directly denying the access of applications other than the target application to the target directory of the target application, the applications other than the target application cannot access the target directory, thereby protecting the privacy security of the data under the target directory. Compared with the related art, in which files are encrypted to protect privacy security, on the one hand, in the embodiment of the present disclosure, by directly denying the access of applications other than the target application to the target directory of the target application, the user does not need to encrypt the folder pointed to by the target directory, thereby reducing the privacy leakage problem caused by the cracking of the password. And because there is no need to encrypt the file, it can simultaneously reduce the problem of poor terminal user experience caused by the long encryption time caused by the full encryption of the file, and reduce the leakage problem of the non-encrypted part caused by the partial encryption of the file.

[0043] In addition, in this embodiment, by directly denying applications other than the target application from accessing the target directory of the target application, applications other than the application corresponding to the target directory cannot access the target directory. Therefore, when applications other than the target application access data in the storage space, the data in the target directory can be isolated, thereby reducing the leakage of data in the target directory by applications other than the target application.

[0044] In summary, this embodiment provides a data storage method with stronger data isolation and greater security, and solves the problems of poor user experience and easy leakage caused by using encryption methods in privacy protection.

[0045] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0047] Figure 1 is a flow chart of a data access method according to an exemplary embodiment;

[0048] Figure 2 is another flow chart of a data access method according to an exemplary embodiment;

[0049] Figure 3is a software framework diagram of a data access method according to an exemplary embodiment;

[0050] Figure 4 is a scenario schematic diagram showing a data access method according to an exemplary embodiment;

[0051] Figure 5 is another scenario schematic diagram of a data access method according to an exemplary embodiment;

[0052] Figure 6 is a block diagram of a data access device according to an exemplary embodiment;

[0053] Figure 7 It is a block diagram of a terminal according to an exemplary embodiment. DETAILED DESCRIPTION

[0054] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Instead, they are merely examples of devices and methods consistent with some aspects of the present invention as detailed in the appended claims.

[0055] Figure 1 is a flow chart of a data access method according to an exemplary embodiment. Figure 1 As shown, the method is applied to a terminal and comprises the following steps:

[0056] Step 101: Determine a target directory and a target application corresponding to the target directory;

[0057] Step 102: If an application other than the target application accesses the target directory, denying the application other than the target application from accessing the target directory.

[0058] Here, the terminal may be a mobile terminal or a fixed terminal; the mobile terminal may be a mobile phone, a tablet computer, or a laptop computer; the fixed terminal may be a desktop computer or a smart home device; the smart home device may be a smart TV or a smart refrigerator. The method may be applied to any terminal that can install and run an application.

[0059] Here, the target directory may be a directory corresponding to a folder for storing preset information pre-set by the user. It is understandable that the target directory is a preset directory created by the target application during use, including information such as intermediate files generated by the target application during use, for example, code files required for system operation generated by the target application during use, or information such as files or pages generated during use and available to users. It is understandable that each application may have a directory, and then during the use of the application, various directories will be created under the directory of the application because some intermediate files or information will be generated, and the folders pointed to by these directories can store files or information generated by the application during use. For example, a social application may generate some chat information during use, and these chat information can be stored in the folder pointed to by one or more directories of the application. For another example, an image application may generate some pictures or videos during use, and these pictures or videos can be stored in the folder pointed to by one or more directories of the application.

[0060] In actual applications, the target directory may be a directory corresponding to a private folder preset by the user. For example, the user may set a privacy label for the files or information to be protected, and then the system may automatically place the files or information with the privacy label into the private folder according to the privacy label.

[0061] For example, in an application for storing photos, photos with privacy tags can be saved in a preset folder according to the photo tags, and the target directory here can be the directory corresponding to the preset folder.

[0062] In this way, when an application other than the target application corresponding to the target directory accesses the target directory, the access to the target directory by the application other than the target application is directly denied, thereby protecting the privacy security of the data in the target directory.

[0063] Here, the target application refers to the application corresponding to the target directory. It should be noted that the target application corresponding to the target directory is unique, that is, if the target directory is not accessed by the unique target application corresponding to the target directory, applications other than the target application are denied access to the target directory, thus achieving privacy protection of the data in the target directory.

[0064] In some embodiments, the target directory is a storage directory of user information, including but not limited to user identity information, user behavior data, and / or user data on the use of the target application.

[0065] In other embodiments, the target application corresponding to the target directory may include: an application associated with the application where the target directory is located; specifically, the target application may be an application provided by the same manufacturer as the application where the target directory is located, for example, if the target directory is a directory where WeChat chat information is located, then the target application corresponding to the target directory may be WeChat and / or QQ, etc. In this way, data access between associated applications can be facilitated, data sharing between associated applications is provided, and it is convenient for associated applications to perform related operations based on shared data.

[0066] It should be supplemented that the target application and the target directory are located in the external storage space of the terminal.

[0067] In some scenarios, for example, in order to shorten the encryption time of private files, only the header of the file can be encrypted. However, since the stored files are stored in the external storage space of the terminal, and when the application has access rights to the external storage space, it can access all the data in the external storage space. Therefore, even if the data header of the target directory is encrypted, the unencrypted part of the data in the target directory can still be accessed, which is obviously not conducive to the security of private data.

[0068] Based on this, this embodiment balances the problems of long encryption time for all encrypted files in the external storage space and poor data privacy caused by encrypting the headers of files in the external storage space by only allowing the target application corresponding to the target directory to access the target directory.

[0069] Here, the external storage space may be the storage space provided by the memory card. For example, the external storage space of the mobile phone may be the storage space provided by the SD card (Secure Digital Memory Card). In the related art, in order to expand the storage capacity of the terminal, the storage capacity of the terminal is increased by inserting an SD card so that the user can use the SD card to store more files. In other embodiments, the external storage space may also be the space provided by other digital devices, such as a USB flash drive or a mobile hard disk. Any non-terminal local storage space that can provide the terminal with accessible storage space belongs to the external storage space described in this embodiment.

[0070] In some embodiments, the step 102: that is, if an application other than the target application accesses the target directory, denying the application other than the target application access to the target directory includes:

[0071] If an application other than the target application accesses the target directory, the data in the target directory is updated to preset data, and the preset data is returned to the target application.

[0072] Here, the preset data may be pre-set data, and the preset data may be publicly available data, for example, a string of characters or a string of numbers. The preset data may be any meaningless data, and is intended to replace the original data of the designated directory, so that the original data of the target directory will not be accessed by applications other than the target application.

[0073] Here, the data of the target directory may include file information in the folder pointed to by the target directory, etc.

[0074] In some other embodiments, the step 102, i.e., if an application other than the target application accesses the target directory, denying the application other than the target application access to the target directory, may further include:

[0075] If an application other than the target application accesses the target directory, the access process of the application other than the target application to the target directory is processed to deny the application other than the target application from accessing the target directory.

[0076] Among them, the access process of the application other than the current target application to the target directory is processed, including: the access process of the application other than the current target application to the target directory is removed from the process list, so that the access process of the application other than the current target application cannot be executed, so as to ensure that the application other than the target application cannot access the target directory.

[0077] Of course, in other embodiments, the processing of the access process of applications other than the current target application to the target directory may also include: directly closing the access process of applications other than the current target application to the target directory, thereby completely clearing the access process of applications other than the current target application to the target directory, so that the target directory cannot be accessed by applications other than the current target application, thereby ensuring the privacy security of the data in the target directory.

[0078] In this embodiment, by processing the access processes of applications other than the current target application, access to the target directory by applications other than the target application is denied. Compared with updating the data in the target directory, the operation is simpler and does not require moving data in and out, thereby improving the processing performance of the terminal.

[0079] In the above embodiment, by directly denying access to the target directory by applications other than the target application corresponding to the target directory, the user does not need to encrypt the folder pointed to by the target directory, thereby reducing the privacy leakage caused by the cracking of the password. And because there is no need to encrypt the file, it can also reduce the problem of poor terminal user experience caused by the long encryption time due to the full encryption of the file, and reduce the leakage of the non-encrypted part caused by the partial encryption of the file.

[0080] Furthermore, by directly denying applications other than the target application from accessing the target directory of the target application, applications other than the application corresponding to the target directory cannot access the target directory. As a result, when applications other than the target application access data in the storage space, the data in the target directory can be isolated, thereby reducing the leakage of data in the target directory by applications other than the target application.

[0081] As another alternative embodiment, see Figure 2 , Figure 2 is another flow chart of a data access method according to an exemplary embodiment. Figure 2 As shown, the method also includes:

[0082] Step 201: monitoring preset events of an application, wherein the preset events include: a startup event of an application or an access event of the target directory;

[0083] Step 202: Determine, according to the preset event, whether the application executing the preset event is the target application;

[0084] Step 203: If the application executing the preset event is not the target application, the access permission of the application other than the target application is configured as access-forbidden permission.

[0085] Specifically, configuring the access permission of the application program other than the target application program as the access-forbidden permission includes: configuring the access permission of the application program other than the target application program to the target directory as the access-forbidden permission.

[0086] Here, the target directory access event includes: events of reading and / or writing the target directory.

[0087] When the preset event is an access event of the target directory, here, whether the application accessing the target directory is the target application is determined based on the access event of the target directory. If it is not the target application, in order to prevent applications other than the target application corresponding to the target directory from accessing the target directory, the access permissions of applications other than the target directory can be configured as access-prohibited permissions, thereby ensuring the privacy and security of the data in the target directory in a timely manner.

[0088] When the preset event is the startup event of an application, here, whether the application being started is the target application is determined based on the startup event of the application. If it is not the target application, in order to prevent the target directory from being accessed by the non-target application being started in advance, the access permissions of applications other than the target directory can also be configured as access-prohibited permissions, thereby preventing applications other than the target application from accessing the target directory in advance, thereby further ensuring the privacy security of the data in the target directory.

[0089] It should be added that, in some embodiments, if the application executing the preset event is not the target application, the access rights of applications other than the target application are configured as access-forbidden rights, including: if the application executing the preset event is not the target application, the access rights of the application in the target directory executing the preset event are configured as access-forbidden rights. In this way, by dynamically configuring the access rights of non-target applications that are executing the preset event, the system does not need to set the access rights of all non-target applications at one time, thereby improving the processing speed of the terminal.

[0090] In some embodiments, step 201 may include: monitoring preset events of the application through a security management service.

[0091] Here, the security management service may be a service that performs security management on access to storage space during the operation of an application program of a terminal. Figure 3 , the security management service is located in the core service layer in the framework diagram. It can be understood that the security management service can be installed as an application or a plug-in in the terminal system.

[0092] Here, the core service layer refers to the software layer that provides the core functions of the system (such as data storage, etc.).

[0093] In some embodiments, the security management service can be started when the terminal is turned on. Specifically, the security management service can be set in the system service, started when the terminal is started, and closed when the terminal is closed, and is not a visible application in the terminal. Of course, in other real-time methods, the security management service can be an application that is set by default to start when it is turned on during installation.

[0094] In this way, the service of securely managing access to the external storage space begins when the terminal is turned on, which can improve the privacy security of the terminal.

[0095] In other embodiments, the security management service may also be enabled based on a user input operation, where the user input operation includes: a user's enabling operation for the security management service. In this way, the security management service is enabled only when the terminal needs to enable the security management service, which can improve the loading speed of the terminal when privacy protection is not required, thereby improving the terminal's performance.

[0096] In the above embodiment, by introducing the configuration timing of access rights for applications other than the target application, that is, when it is detected that the application being accessed to the target directory or being started is not the target application itself, the access prohibition rights of applications other than the target application are configured, so that the terminal can ensure the privacy security of the data in the target directory in real time by dynamically configuring the access rights.

[0097] In some other embodiments, the method further comprises:

[0098] If the application executing the preset event is the target application, the access permission of the target application is configured as an access permission.

[0099] Here, the access rights of the target application program include: the access rights of the target application program to the target directory.

[0100] In the above embodiment, when the application that executes the preset event is the target application, the access permission of the target application is configured as the access permission, thereby reducing the phenomenon that the target application cannot run due to data loss caused by the inability to access the intermediate files generated by itself during the operation, or reducing the phenomenon of low operating efficiency caused by the need to reload data because the target application cannot access the intermediate files generated by itself during the operation.

[0101] In some other embodiments, the method further comprises:

[0102] Detecting an input operation of a privacy control for the target directory;

[0103] The preset events of the monitoring application include:

[0104] If the input operation is an opening operation, the preset event of the application is monitored.

[0105] Specifically, the detecting an input operation of the privacy control for the target directory may include:

[0106] Detect an input operation of a privacy control of a target directory in a preset page provided by a terminal.

[0107] Here, the preset page is a page used by the terminal to interact with the user, specifically: a setting page provided by the terminal to the user for whether to perform privacy protection on the target directory.

[0108] In some cases, see Figure 4 , Figure 4 is a schematic diagram of a scenario of a data access method according to an exemplary embodiment. Figure 4 As shown, here, the preset page can be a privacy safe page 41, and the privacy control 411 is set on the privacy safe page 41. Among them, one privacy control corresponds to a target directory, for example, "WeChat private photo album" and "WeChat private folder" are different target directories. It should be noted that the privacy safe page 41 here can be a subpage of the system setting page, or it can be an operation page provided by the security management service.

[0109] In other scenarios, for example, when multiple applications installed on the terminal have the same or similar file contents that need to be protected, for example, when the terminal has multiple social applications installed, and each social application may generate a directory of private photo albums, as another optional embodiment, please refer to Figure 5 , Figure 5 is a schematic diagram of a scenario of a data access method according to an exemplary embodiment. Figure 5 As shown, the detecting the input operation of the privacy control for the target directory may also include:

[0110] Detecting an input operation of a first control 511 of a target directory of a first setting page 51 provided by the terminal, wherein the first control corresponds to a set of the target directories;

[0111] When it is detected that the input operation of the first control 511 for the target directory of the first setting page 51 provided by the terminal is a preset operation, a selection page 52 of an application program related to the target directory indicated by the first control 511 is provided to the user;

[0112] An input operation on a second control 521 on the selection page 52 for a target application is detected, wherein the second control 521 corresponds to the target application.

[0113] Here, the method of enabling privacy protection of the target directory by first selecting a set of target directories and then selecting the application corresponding to the target directory to be enabled is compared to displaying all target directories on a preset page, which requires users to manually turn pages when there are many selectable target directories. In this embodiment, the target directory to be protected is selected by first selecting a set of target directories and then selecting the target application from the set of target directories. This method is more operational and improves the user's operating experience.

[0114] It should be further added that, when an input operation of the privacy control for the target directory is detected, the system will record the directory identifier of the selected target directory and the application identifier of the target application corresponding to the target directory, so that the system can determine whether the application that executes the preset event is the target application when the above-mentioned preset event occurs based on the recorded directory identifier of the target directory and the application identifier of the target application corresponding to the target directory.

[0115] Specifically, in some embodiments, please refer to Figure 3 When an input operation of the privacy control for the target directory is detected, the security management service notifies the storage management service to adjust the storage policy, and stores the directory identifier of the target directory and the application identifier of the corresponding target application based on the storage policy, so as to compare the application identifier of the application executing the preset event to determine whether the application executing the preset event is the target application.

[0116] Here, the storage policy can be adjusted based on the input operation of the privacy control for the target directory. When the input operation is an open operation, the directory identifier of the target directory and the application identifier of the target application are stored; when the input operation is a closed operation, the stored directory identifier of the target directory and the application identifier of the target application are deleted.

[0117] Here, the storage management service may also be an application or a plug-in installed in the terminal system, and cooperates with the security management service to complete the privacy protection of the data in the designated directory.

[0118] In fact, the storage management service may also be started when the terminal is turned on, or the storage management service may also be started together with the security management service.

[0119] In some other embodiments, the method further includes: if the input operation is a close operation, stopping monitoring the preset event of the application.

[0120] Here, when the input operation is a closing operation, that is, when the user opens the target directory, it is not necessary to protect the data in the target directory. By stopping monitoring the preset event of the application, the power consumption of the terminal can be saved.

[0121] In some embodiments, when the input operation is detected to be a close operation, the security management service notifies the storage management service to adjust the storage policy, that is, notifies the storage management service of the directory identifier of the target directory to be stored and the application identifier of the target application, thereby saving storage space.

[0122] As another optional embodiment, if an application other than the target application accesses the target directory, denying the application other than the target application access to the target directory includes:

[0123] If an application other than the target application accesses the target directory, the terminal is notified through the storage daemon process to close the access process of the target directory, or the terminal is notified to close the mounting process of the target directory, thereby denying access to the target directory by applications other than the target application.

[0124] Here, please refer to Figure 3 At the kernel layer, that is, in the kernel of the operating system, the storage daemon process can notify the kernel of the terminal's operating system to close the access process of the target directory, or notify the terminal to close the mounting process of the target directory to deny access to the target directory by applications other than the target application.

[0125] Here, the kernel of the operating system refers to the core part of most operating systems. It consists of those parts of the operating system that are used to manage memory, files, peripherals, and system resources. The kernel of the operating system usually runs processes and provides inter-process communication, such as scheduling and synchronization of events, inter-process communication including message passing, memory management, process management, etc. The kernel layer, as the lowest layer of the operating system, is the system software responsible for managing hardware, performing task scheduling, and maintaining overall security and integrity.

[0126] In this embodiment, the storage daemon process is used to notify the terminal to close the access process to the target directory, or the terminal is notified to close the mounting process of the target directory, so that applications other than the target application cannot access the target directory, thereby enhancing the privacy security of the data corresponding to the target directory and protecting user privacy.

[0127] As another optional embodiment, the method further includes: if the target application accesses the target directory, mounting the target directory and allowing the target application to access the target directory.

[0128] Mounting is the process by which the operating system makes computer files and directories on a storage device accessible to users through the computer's file system. In Windows operating systems, mounting usually refers to assigning a drive letter to a disk partition. In Linux operating systems, mounting refers to mounting a device (usually a storage device) to an existing directory. It is important to understand that the Linux operating system treats all devices as files. It integrates the resources of the entire computer into a large file directory. When you want to access files in a storage device, you must mount the partition where the file is located to an existing directory, and then access the storage device by accessing this directory.

[0129] In fact, mounting is to add the access path of a device to a directory of the operating system, and the files in the device can be accessed by accessing the path. Mounting the target directory here means adding the access path of the target data to the target directory. The target data here is the data that the user pre-sets to require privacy protection, and the target directory is accessed by accessing the access path of the target data.

[0130] For example, if the operating system wants to access data stored on a USB flash drive, the operating system needs to mount the USB flash drive to a certain path (such as / media / usb / ). Assuming the USB flash drive is / dev / usb, then when the USB flash drive is inserted into the terminal, the corresponding mount command executed is:

[0131] mount / dev / usb / media / usb.

[0132] After the above command, all the files on the USB flash drive are mounted under / media / usb / . At this point, the files on the USB flash drive are visible to the operating system.

[0133] In order to be able to write-protect the data in the target directory, the system may mount the directory in a read-only manner, so that the mounted directory can be write-protected. In some embodiments, if the target application accesses the target directory, the target directory is mounted and the target application is allowed to access the target directory, including: if the target application accesses the target directory, the target directory is mounted in a read-only manner, and the target application is allowed to read the target directory. In this way, by mounting the target directory read-only, the data in the target directory can be write-protected, reducing the target application's own arbitrary writing or modification of the target directory's data.

[0134] In order to modify the data in the target directory, so as to facilitate the user to adjust the privacy data that he wants to protect, in other embodiments, if the target application accesses the target directory, the target directory is mounted and the target application is allowed to access the target directory, including: if the target application accesses the target directory, the target directory is mounted in write mode, and the target application is allowed to write to the target directory. In this way, it is convenient for the user to modify or adjust the data in the target directory based on the target application.

[0135] In short, whether the target directory is write-mounted and / or read-only mounted, only the target application corresponding to the target directory is allowed to access it, so as to protect the data of the target directory from being accessed by applications other than the target application, thereby improving the privacy security of the data in the target directory.

[0136] Furthermore, the present disclosure also provides a specific embodiment to further understand the data access method provided by the embodiment of the present disclosure.

[0137] In the related art, in order to protect the privacy and security of the files on the terminal, the files that need to be kept confidential are encrypted. There are two problems with the current encryption method. One is that the entire file is encrypted. When the file is large, the encryption time will be very long, which will have a great impact on the user experience; the other is that part of the file is encrypted, for example, only the 64 bytes of the file header are encrypted. Since some files are stored in the terminal's SD card (Secure Digital Memory Card), when the application has the permission to read and write the SD card, it can still read or write to the partially encrypted files and view the non-encrypted parts, causing the risk of leakage of encrypted files.

[0138] Based on this, the data access method provided in this embodiment is intended to solve the problem of poor terminal experience caused by full encryption of files that require privacy protection and the risk of leakage caused by partial encryption.

[0139] Please refer to Figure 3 and Figure 4 ,or, Figure 3 and Figure 5, when it is detected that the input operation of the privacy control for the target directory is an open operation, the security management service will notify the storage management service to adjust the storage policy, save the directory identifier of the target directory and the application identifier of the target application corresponding to the target directory, and the security management service will initiate monitoring of the pre-events. The preset events specifically include: the access event of the target directory and the startup time of the application. If the application executing the preset event is not the target application, that is, when an application other than the target application corresponding to the target directory accesses the target directory, or when an application other than the target application corresponding to the target directory is started, the storage management service is used to notify the storage daemon to configure the access rights of the application executing the preset event as prohibited access rights, so that the target directory corresponding to the application cannot be read or written. Thereby protecting the privacy security of the data in the target directory.

[0140] Of course, when it is detected that the input operation of the privacy control for the target directory is a closing operation, the security management service will notify the storage management service to adjust the storage policy, delete the directory identifier of the saved target directory and the application identifier of the target application corresponding to the target directory, and stop listening to the preset events of the application.

[0141] Through the above method, the privacy security of files can be guaranteed without encrypting the files that need to be kept confidential, that is, the performance and experience problems caused by large file encryption can be solved while improving privacy security.

[0142] Figure 6 is a block diagram of a data access device according to an exemplary embodiment. Figure 6 , the device includes a first determination module 61 and a rejection module 62;

[0143] A first determination module 61, used to determine a target directory and a target application corresponding to the target directory;

[0144] The denying module 62 is configured to deny the access of the application programs other than the target application programs to the target directory if the application programs other than the target application programs access the target directory.

[0145] In an optional embodiment, the device further includes:

[0146] A monitoring module, used for monitoring preset events of an application, wherein the preset events include: a startup event of an application or an access event of the target directory;

[0147] A second determination module, configured to determine, according to the preset event, whether the application executing the preset event is the target application;

[0148] The first configuration module is used to configure the access permission of the application program other than the target application program as the access prohibition permission if the application program executing the preset event is not the target application program.

[0149] In an optional embodiment, the device further comprises:

[0150] The second configuration module is used to configure the access permission of the target application program as the access permission if the application program executing the preset event is the target application program.

[0151] In an optional embodiment, the device further comprises:

[0152] A detection module, used to detect an input operation of a privacy control for the target directory;

[0153] The monitoring module is further configured to monitor the preset event of the application if the input operation is an opening operation.

[0154] In an optional embodiment, the rejection module is further used to:

[0155] If an application other than the target application accesses the target directory, the terminal is notified through the storage daemon process to close the access process to the target directory, or the terminal is notified to close the mounting process of the target directory, thereby denying access to the target directory by applications other than the target application.

[0156] In an optional embodiment, the device further comprises:

[0157] The allowing module is used for mounting the target directory and allowing the target application to access the target directory if the target application accesses the target directory.

[0158] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0159] Figure 7 is a block diagram of a terminal 700 according to an exemplary embodiment. For example, the terminal 700 may be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc.

[0160] Reference Figure 7The terminal 700 may include one or more of the following components: a processing component 702 , a memory 704 , a power component 706 , a multimedia component 708 , an audio component 710 , an input / output (I / O) interface 712 , a sensor component 714 , and a communication component 716 .

[0161] The processing component 702 generally controls the overall operation of the terminal 700, such as operations associated with display, phone calls, data communications, camera operations, and recording operations. The processing component 702 may include one or more processors 720 to execute instructions to complete all or part of the steps of the above-mentioned method. In addition, the processing component 702 may include one or more modules to facilitate the interaction between the processing component 702 and other components. For example, the processing component 702 may include a multimedia module to facilitate the interaction between the multimedia component 708 and the processing component 702.

[0162] The memory 704 is configured to store various types of data to support operations at the terminal 700. Examples of such data include instructions for any application or method operating on the terminal 700, contact data, phone book data, messages, pictures, videos, etc. The memory 704 may be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as a static random access memory (SRAM), an electrically erasable programmable read-only memory (EEPROM), an erasable programmable read-only memory (EPROM), a programmable read-only memory (PROM), a read-only memory (ROM), a magnetic memory, a flash memory, a magnetic disk, or an optical disk.

[0163] Power component 706 provides power to various components of terminal 700. Power component 706 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to terminal 700.

[0164] The multimedia component 708 includes a screen that provides an output interface between the terminal 700 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundaries of the touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 708 includes a front camera and / or a rear camera. When the terminal 700 is in an operating mode, such as a shooting mode or a video mode, the front camera and / or the rear camera may receive external multimedia data. Each front camera and the rear camera may be a fixed optical lens system or have a focal length and optical zoom capability.

[0165] The audio component 710 is configured to output and / or input audio signals. For example, the audio component 710 includes a microphone (MIC), and when the terminal 700 is in an operation mode, such as a call mode, a recording mode, and a speech recognition mode, the microphone is configured to receive an external audio signal. The received audio signal can be further stored in the memory 704 or sent via the communication component 716. In some embodiments, the audio component 710 also includes a speaker for outputting audio signals.

[0166] I / O interface 712 provides an interface between processing component 702 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include but are not limited to: home button, volume button, start button, and lock button.

[0167] The sensor assembly 714 includes one or more sensors for providing various aspects of status assessment for the terminal 700. For example, the sensor assembly 714 can detect the open / closed state of the terminal 700, the relative positioning of the components, such as the display and keypad of the terminal 700, and the sensor assembly 714 can also detect the position change of the terminal 700 or a component of the terminal 700, the presence or absence of contact between the user and the terminal 700, the orientation or acceleration / deceleration of the terminal 700, and the temperature change of the terminal 700. The sensor assembly 714 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. The sensor assembly 714 may also include an optical sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 714 may also include an acceleration sensor, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0168] The communication component 716 is configured to facilitate wired or wireless communication between the terminal 700 and other devices. The terminal 700 can access a wireless network based on a communication standard, such as WiFi, 2G or 3G, or a combination thereof. In an exemplary embodiment, the communication component 716 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 716 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0169] In an exemplary embodiment, terminal 700 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the above methods.

[0170] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 704 including instructions, and the instructions can be executed by a processor 720 of a terminal 700 to perform the above method. For example, the non-transitory computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0171] A non-transitory computer-readable storage medium, when instructions in the storage medium are executed by a processor of a terminal, enables the terminal to execute the data access method described in the above embodiments.

[0172] Those skilled in the art will readily appreciate other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses or adaptations of the present invention that follow the general principles of the present invention and include common knowledge or customary techniques in the art that are not disclosed in this disclosure. The specification and examples are to be considered exemplary only, and the true scope and spirit of the present invention are indicated by the following claims.

[0173] It should be understood that the present invention is not limited to the exact construction that has been described above and shown in the drawings and that various modifications and changes may be made without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A data access method, characterized in that: Applied in terminals, including: Determine a target directory and a target application corresponding to the target directory; If the target application accesses the target directory, mounting the target directory and allowing the target application to access the target directory; If an application other than the target application accesses the target directory, the terminal is notified through the storage daemon process to close the access process to the target directory, or the terminal is notified to close the mounting process of the target directory, thereby refusing the application other than the target application to access the target directory; The target application and the target directory are located in the external storage space of the terminal.

2. The method according to claim 1, characterized in that The method further comprises: Monitoring preset events of the application, wherein the preset events include: a startup event of the application or an access event of the target directory; According to the preset event, determining whether the application executing the preset event is the target application; If the application executing the preset event is not the target application, the access permission of the application other than the target application is configured as access-forbidden permission.

3. The method according to claim 2, characterized in that The method further comprises: If the application executing the preset event is the target application, the access permission of the target application is configured as an access permission.

4. The method according to claim 2, characterized in that: The method further comprises: Detecting an input operation of a privacy control for the target directory; The preset events of the monitoring application include: If the input operation is an opening operation, the preset event of the application is monitored.

5. A data access device, characterized in that: Applied in terminals, including: A first determination module, used to determine a target directory and a target application corresponding to the target directory; An allowing module, used for mounting the target directory and allowing the target application to access the target directory if the target application accesses the target directory; A rejection module, used for notifying the terminal to close the access process to the target directory through the storage daemon process if an application other than the target application accesses the target directory, or notifying the terminal to close the mounting process of the target directory, thereby rejecting the access of the application other than the target application to the target directory; The target application and the target directory are located in the external storage space of the terminal.

6. The device according to claim 5, characterized in that The device further comprises: A monitoring module, used for monitoring preset events of an application, wherein the preset events include: a startup event of an application or an access event of the target directory; A second determination module, configured to determine, according to the preset event, whether the application executing the preset event is the target application; The first configuration module is used to configure the access permission of the application program other than the target application program as the access prohibition permission if the application program executing the preset event is not the target application program.

7. The device according to claim 6, characterized in that The device also includes: The second configuration module is used to configure the access permission of the target application program as the access permission if the application program executing the preset event is the target application program.

8. The device according to claim 6, characterized in that The device also includes: A detection module, used to detect an input operation of a privacy control for the target directory; The monitoring module is further configured to monitor the preset event of the application if the input operation is an opening operation.

9. A terminal, characterized in that: include: processor; a memory for storing processor-executable instructions; Wherein, the processor is configured to: implement the data access method described in any one of claims 1 to 4 when running the executable instructions.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: The program is executed by a processor to implement the method steps of any one of claims 1 to 4.

Images