Data access method, device, terminal and storage medium

Abstract

The present disclosure relates to a data access method, which is applied to a terminal and includes: monitoring access to a first application; determining access permission information of the first application based on the first application; and when monitoring access to a designated directory of a second application by a first application in an external storage space, denying or allowing the first application to access the designated directory of the second application in the external storage space based on the access permission information. In this way, refined management of access permissions to directories in the external storage space is achieved, thereby increasing user privacy protection. The present disclosure also provides a data access device, a terminal, and a storage medium.

Description

Technical Field

[0001] The present disclosure relates to the field of terminal technology, and in particular to a data access method, device, mobile terminal, and storage medium. Background Art

[0002] When using a terminal in daily life, such as an Android smartphone, once a user allows an application to obtain access to an external storage card, the application will have operation permissions for all files in the external storage card. This will undoubtedly bring greater security risks to the user and is not conducive to the protection of the user's privacy information. In addition, when the application has some information in the user's external storage card (such as some user behavior information), it may push advertisements to the user, which is not conducive to the user experience. Summary of the Invention

[0003] According to a first aspect of an embodiment of the present disclosure, a data access method is provided, which is applied in a terminal and includes:

[0004] Monitoring access to the first application;

[0005] Determining access permission information for the first application program based on the first application program;

[0006] When it is monitored that the first application accesses the designated directory of the second application in the external storage space, the first application is denied or allowed to access the designated directory of the second application in the external storage space according to the access permission information.

[0007] Optionally, determining access permission information of the first application according to the first application includes:

[0008] According to the first application, when the first application is started, the access permission information of the first application is obtained.

[0009] Optionally, denying the first application program access to the designated directory of the second application program in the external storage space according to the access permission information includes:

[0010] When it is determined, based on the access permission information, that the first application does not have permission to access the designated directory, the data in the designated directory is updated to preset data, and the preset data is returned to the first application.

[0011] Optionally, before updating the data in the designated directory to preset data, the method further includes:

[0012] The data in the designated directory is stored outside the designated directory, and when no access to the designated directory of the second application by the first application is detected, the data in the designated directory is restored to the designated directory.

[0013] Optionally, denying the first application program access to the designated directory of the second application program in the external storage space according to the access permission information includes:

[0014] When it is determined based on the access permission information that the first application does not have permission to access the specified directory, the terminal is notified through the storage daemon to close the first application's access process to the specified directory, or the terminal is notified to close the second application's mounting process to the specified directory, thereby denying the first application access to the specified directory of the second application in the external storage space.

[0015] Optionally, determining, according to the first application, access permission information of the first application includes:

[0016] Determining, based on the first application, permission configuration information corresponding to the first application, wherein the permission configuration information is determined by an input operation on a preset application interface of the first application;

[0017] Based on the permission configuration information of the first application, access permission information of the first application is determined.

[0018] Optionally, determining the access permission information of the first application based on the permission configuration information of the first application includes:

[0019] If the permission configuration information of the first application indicates that the first application has closed access rights to the designated directory, determining that the access permission information of the first application can indicate that the first application does not have permission to access the designated directory;

[0020] or,

[0021] If the permission configuration information of the first application indicates that the first application has access rights to the designated directory enabled, it is determined that the access permission information of the first application can indicate that the first application has permission to access the designated directory.

[0022] According to a second aspect of an embodiment of the present disclosure, a data access device is provided, which is applied to a terminal and includes:

[0023] A monitoring module, configured to monitor access to the first application;

[0024] a determination module, configured to determine access permission information of the first application program based on the first application program;

[0025] The access processing module is used to deny or allow the first application to access the designated directory of the second application in the external storage space according to the access permission information when monitoring the first application accessing the designated directory of the second application in the external storage space.

[0026] Optionally, the determining module is further configured to:

[0027] According to the first application, when the first application is started, the access permission information of the first application is obtained.

[0028] Optionally, the access processing module is further configured to:

[0029] When it is determined, based on the access permission information, that the first application does not have permission to access the designated directory, the data in the designated directory is updated to preset data, and the preset data is returned to the first application.

[0030] Optionally, the access processing module is specifically configured to:

[0031] Before updating the data in the designated directory to the preset data, the data in the designated directory is stored outside the designated directory, and when the first application is not monitored to access the designated directory of the second application, the data in the designated directory is restored to the designated directory.

[0032] Optionally, the access processing module is further configured to:

[0033] When it is determined based on the access permission information that the first application does not have permission to access the specified directory, the terminal is notified through the storage daemon process to close the first application's access process to the specified directory, or the terminal is notified to close the second application's mounting process to the specified directory, thereby denying the first application access to the specified directory of the second application in the external storage space.

[0034] Optionally, the determining module is further configured to:

[0035] Determining, based on the first application, permission configuration information corresponding to the first application, wherein the permission configuration information is determined by an input operation on a preset application interface of the first application;

[0036] Based on the permission configuration information of the first application, access permission information of the first application is determined.

[0037] Optionally, the determining module is further configured to:

[0038] If the permission configuration information of the first application indicates that the first application has closed access rights to the designated directory, determining that the access permission information of the first application can indicate that the first application does not have permission to access the designated directory;

[0039] or,

[0040] If the permission configuration information of the first application indicates that the first application has enabled access rights to the designated directory, it is determined that the access rights information of the first application can indicate that the first application has permission to access the designated directory.

[0041] According to a third aspect of an embodiment of the present disclosure, a terminal is provided, including:

[0042] processor;

[0043] a memory for storing processor-executable instructions;

[0044] Wherein, the processor is configured to: implement any of the above-mentioned data access methods when running the executable instructions.

[0045] According to a fourth aspect of an embodiment of the present disclosure, a non-transitory computer-readable storage medium is provided, on which a computer program is stored, and the program is executed by a processor to implement any of the method steps described above.

[0046] The technical solutions provided by the embodiments of the present disclosure may have the following beneficial effects:

[0047] In an embodiment of the present disclosure, access to a first application is monitored, and then access permission information of the first application is determined based on the first application; when the first application is monitored accessing a designated directory of a second application in an external storage space, the first application can be denied or allowed to access the designated directory of the second application in the external storage space based on the permission information. Compared with the related art that once an application is granted access to an external storage space, it can access all directories in the external storage space and read or write data in any directory, because the solution of this embodiment can only allow access to the designated directory when the first application has access permission to the designated directory, and deny access to the designated directory when the first application does not have access permission to the designated directory, the access permission of the first application is no longer a permission for the entire external storage space, but can be finely divided into access permissions for the designated directory under the second application. In this way, refined management of access permissions to directories in the external storage space can be achieved, improving the user's control over the access of applications in the terminal to the external storage space, and further enabling the user to protect the data stored in a certain application from being arbitrarily accessed, thereby enhancing user privacy protection.

[0048] Furthermore, precisely because the data under a specified directory in a certain application can be protected from arbitrary access, other applications will not leak user privacy when accessing external storage space due to accessing protected private data, thereby reducing the phenomenon of merchants or criminals using this private information to push malicious advertisements or malicious information, thereby improving the terminal user experience.

[0049] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0051] Figure 1 is a flow chart showing a data access method according to an exemplary embodiment;

[0052] Figure 2 is a software framework diagram illustrating a data access method according to an exemplary embodiment;

[0053] Figure 3 is a scenario diagram showing a data access method according to an exemplary embodiment;

[0054] Figure 4 is a block diagram of a data access device according to an exemplary embodiment;

[0055] Figure 5 It is a block diagram of a terminal according to an exemplary embodiment. DETAILED DESCRIPTION

[0056] Exemplary embodiments will be described in detail herein, examples of which are illustrated in the accompanying drawings. In the following description, when referring to the drawings, like numbers in different figures represent like or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all possible embodiments consistent with the present invention. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present invention, as detailed in the appended claims.

[0057] Figure 1 is a flow chart showing a data access method according to an exemplary embodiment. Figure 1 As shown, the method is applied to a terminal and includes the following steps:

[0058] Step 101: monitoring access to a first application;

[0059] Step 102: Determine access permission information of the first application program according to the first application program;

[0060] Step 103: when it is monitored that the first application accesses the designated directory of the second application in the external storage space, deny or allow the first application to access the designated directory of the second application in the external storage space according to the access permission information.

[0061] Here, the terminal may be a mobile terminal or a fixed terminal; a mobile terminal may be a mobile phone, tablet computer, or laptop computer; a fixed terminal may be a desktop computer or smart home device; a smart home device may be a smart TV or smart refrigerator. This method can be applied to any terminal that has external storage space and can install applications in the external storage space.

[0062] It is understandable that the external storage space may be the storage space provided by a memory card. For example, the external storage space of a mobile phone may be the storage space provided by an SD card (Secure Digital Memory Card). In related art, in order to expand the storage capacity of a terminal, the storage capacity of the terminal is increased by inserting an SD card so that the user can use the SD card to store more files. In other embodiments, the external storage space may also be the space provided by other digital devices, such as a USB flash drive or a mobile hard drive. Any non-terminal local storage space that can provide accessibility to the terminal belongs to the external storage space described in this embodiment.

[0063] It is understandable that the designated directory can be a preset directory created by the application located in the external storage space during use. In fact, each application can have a directory in the external storage space, and then during the use of the application, since some intermediate files or information will be generated, various directories will be created under the directory of the application. These directories can store files or information generated by the application during use. For example, when a social application located in the external storage space is in use, some chat information may be generated, and these chat information can be stored in one or more directories of the application. It should be noted that the access permission information in step 102 may include: access permissions to different directories in the first application and / or applications other than the first application.

[0064] In actual applications, the designated directory may be a directory preset by the user pointing to a private folder. For example, the user may set a privacy label for the files or information they wish to protect, and the system may automatically place the files or information with the privacy label into the private folder based on the privacy label.

[0065] For example, in an application for storing photos in an external storage space, private photos can be saved in a preset folder by photo classification, and the designated directory of the application for storing photos here can be a directory corresponding to the preset folder.

[0066] In this way, when the first application accesses the designated directory of the second application, if it does not have the permission to access the designated directory, the first application is prohibited from accessing the designated directory, thereby protecting the privacy and security of the data in the designated directory.

[0067] In some embodiments, the first application and the second application may be applications of different categories. In this way, the access permissions of the first application can be set to restrict at least arbitrary access between applications of different categories, thereby protecting the data in the designated directory of the second application from being accessed by another type of application. For example, the first application may be a news application, and the second application may be a social application. The designated directory may be the directory where the chat information of the social application is located. In this way, when the news application does not have access permissions, it cannot access the designated directory of the social application, and thus the news application cannot interpret the chat information in the social application, and thus will not push topics that the user may be interested in, etc., thereby reducing the user's addiction to the news application.

[0068] For another example, the first application may be a shopping application, and the second application may be a social application. The designated directory here may be the directory where the chat information of the social application is located. In this way, when the shopping application does not have access rights, it cannot access the designated directory of the social application, and thus the shopping application cannot interpret the chat information in the social application, and thus will not push unnecessary products or product advertisements to users, causing unnecessary consumption behavior of users.

[0069] In other embodiments, the first application and the second application may be applications with different application identifiers, that is, the first application and the second application are completely different applications. Thus, in this embodiment, by setting access permissions for designated directories of different applications, applications other than the application itself can be denied access if they do not have permission to access the designated directories of the application itself, thereby completely isolating access from other applications and protecting the privacy of data in the designated directories of the application itself from access by applications other than the application itself.

[0070] In other embodiments, the first application may be the same as the second application. It is understandable that when the first application is the same as the second application, the first application can be prevented from accessing its own designated directory based on the access rights of the first application. When the first application does not have access rights, the first application can be prevented from accessing its own designated directory. That is to say, in this embodiment, by setting the access rights of the designated directory of the own application, the own application can be prevented from accessing its own designated directory when it does not have access rights to the designated directory, thereby isolating the access rights of different directories under the own application and protecting the privacy of the data under the designated directory for the own application. Taking social applications as an example, when the first application and the second application are the same application, if the access rights of the first application are not allowed to access the designated directory, for example, when the designated directory is chat information, the chat information in the first application can be protected from being leaked, and the first application will not push unnecessary advertisements to the user because it cannot access the designated directory.

[0071] In this embodiment, when the first application is monitored for accessing the designated directory of the second application, the first application is allowed to access the designated directory based on the access rights of the first application, that is, when the first application has the permission to access the designated directory, and when the first application does not have the permission to access the designated directory, the first application's access to the designated directory will be denied. As a result, the access rights of the first application are no longer permissions for the entire external storage space, but can be finely divided into access rights for the designated directory under the second application. In this way, refined management of access rights to directories of the external storage space can be achieved, and the user's control over the application in the terminal accessing the external storage space is improved, so that the user can protect the data stored in a certain application from being arbitrarily accessed, thereby enhancing the user's privacy protection.

[0072] Furthermore, since this embodiment can protect the data under a specified directory in a certain application and prevent it from being accessed arbitrarily, when an application that is not allowed to access the specified directory accesses the specified directory, it will not leak user privacy due to access to the protected private data, thereby reducing the phenomenon of merchants or criminals using this private information to push malicious advertisements or malicious information, thereby improving the terminal user experience.

[0073] As another optional embodiment, step 101 may be to monitor access to the first application through a security management service.

[0074] Here, the security management service can be a service that performs security management on the access to the external storage space during the operation of the terminal application. Figure 2 , Figure 2 is a software framework diagram of a data access method according to an exemplary embodiment. Figure 2 As shown, the security management service is located in the core service layer in the framework diagram. It can be understood that the security management service can be installed as an application or a plug-in in the terminal system.

[0075] Here, the core service layer refers to the software layer that provides the core functions of the system (such as data storage, etc.).

[0076] In some embodiments, the security management service can be started when the terminal is turned on. Specifically, the security management service can be set as a system service, started when the terminal is started and closed when the terminal is shut down, and is not a visible application in the terminal. Of course, in other real-time methods, the security management service can be an application that is set by default to start when the terminal is turned on during installation.

[0077] In this way, the service of securely managing access to external storage space begins when the terminal is turned on, which can improve the privacy security of the terminal.

[0078] In other embodiments, the security management service may be enabled only upon user input. Here, the user input includes an activation operation in response to a user's request for the security management service. Thus, the security management service is enabled only when the terminal requires it. This can improve the loading speed of the terminal when privacy protection is not required, thereby improving the terminal's usability.

[0079] As another optional embodiment, step 102, i.e., determining access permission information of the first application according to the first application, includes:

[0080] Determining, based on the first application, permission configuration information corresponding to the first application, wherein the permission configuration information is determined by an input operation on a preset application interface of the first application;

[0081] Based on the permission configuration information of the first application, access permission information of the first application is determined.

[0082] See also Figure 3 , Figure 3This is a schematic diagram of a data access scenario according to an exemplary embodiment. As shown in the figure, the configuration information here is determined by the input operation of the preset application interface of the first application. Specifically, the configuration information is determined based on the user's input operation of the permission configuration control for the specified directory of the specified second application. For example, if the first application is "Today's Headlines", the preset interface is the setting interface of the first application, and the input operation includes an on operation or a off operation. Among them, the configuration information corresponding to the on operation is to configure the first application's access rights to the specified directory in the second application as allowed access rights, and the configuration information corresponding to the off operation is to configure the first application's access rights to the specified directory in the second application as prohibited access rights.

[0083] Specifically, determining the access permission information of the first application based on the permission configuration information of the first application includes:

[0084] If the permission configuration information of the first application indicates that the access permission of the first application to the specified directory is closed, it is determined that the access permission information of the first application can indicate that the first application does not have the permission to access the specified directory; or, if the permission configuration information of the first application indicates that the access permission of the first application to the specified directory is turned on, it is determined that the access permission information of the first application can indicate that the first application has the permission to access the specified directory.

[0085] In this embodiment, the access rights of the first application can be configured through the preset application interface, thereby facilitating the user's visual management of the access rights of the first application and facilitating the user to enable protection of privacy data in a timely manner.

[0086] It should be added that, in some embodiments, please refer to Figure 2 and Figure 3 , Figure 2The permission control control for the application in the example can be understood as the permission configuration control described in the above embodiment. If the permission configuration control of the first application detects that the first application's access rights to the designated directory are closed, it notifies the storage management service to record the application identifier of the first application and the corresponding access rights information. In other words, when it is detected that the user has closed the first application's access rights to the designated directory of the second application, the storage policy in the storage management service is adjusted, and then, based on the storage policy, the storage information of the data provision module is updated, that is, the application identifier of the first application and the corresponding access rights information are stored. Here, the application identifier of the first application and the corresponding access rights information can be stored in the data provision module, so that when the first application is monitored accessing the designated directory of the second application, it can be determined that the first application does not have access rights to the designated directory based on the application identifier of the first application and the corresponding access rights information read from the data provision module. Thus, the first application is denied access to the designated directory of the second application in the external storage space, thereby protecting the privacy of the data in the designated directory of the second application.

[0087] Here, the storage policy can be adjusted based on the first application's access rights to the second application's designated directory. When the first application's access rights to the second application's designated directory are enabled, the first application's application identifier does not need to be stored. However, when the first application's access rights to the second application's designated directory are disabled, the first application's application identifier can be stored.

[0088] Here, the storage management service may also be an application or a plug-in installed in the terminal system, and cooperates with the security management service to complete the privacy protection of data in the designated directory.

[0089] In fact, the storage management service may also be started when the terminal is turned on, or the storage management service may be started together with the security management service.

[0090] As another optional embodiment, determining the access permission information of the first application according to the first application includes:

[0091] According to the first application, when the first application is started, the access permission information of the first application is obtained.

[0092] In some embodiments, the method further comprises:

[0093] Listen for application startup events;

[0094] Based on the startup event of the application, determining whether the application being started is the first application;

[0095] If the application being started is the first application, it is determined that the first application is started.

[0096] Here, the startup event of the monitoring application may be monitored by the security management service.

[0097] In addition, please refer to Figure 2 The application identifier of the first application here can be recorded in the data providing module. In this way, the application identifier of the application being started can be determined through the startup event of the application. The application identifier of the application being started is compared with the recorded application identifier. If there is a consistency, it is determined that the first application is started.

[0098] In this embodiment, by obtaining the access rights of the first application when the first application is started, the system can accurately locate the access rights of the application being started without having to obtain the access rights of the first application in advance, thereby saving terminal resource energy consumption.

[0099] As another optional embodiment, denying the first application program access to the designated directory of the second application program in the external storage space according to the access permission information includes:

[0100] When it is determined, based on the access permission information, that the first application does not have permission to access the designated directory, the data in the designated directory is updated to preset data, and the preset data is returned to the first application.

[0101] Here, the preset data may be pre-set data, which may be publicly available data, such as a string of characters or a string of numbers. The preset data may be any meaningless data, which is intended to replace the original data in the specified directory so that the original data in the specified directory is not accessible to the first application.

[0102] Here, the data in the designated directory may include file information in the folder pointed to by the designated directory, etc.

[0103] In this embodiment, if the access permission information denies the first application access to the external storage space, the data in the designated directory can be updated with the preset data without terminating the access process. This reduces the first application's access to the original data in the designated directory, thereby protecting the privacy of the data in the designated directory. This ensures terminal performance because the access process does not need to be terminated or changed.

[0104] It should be added that, in some embodiments, please refer to Figure 2 The preset data may also be stored in the data provision module. When the security management service monitors the first application accessing the designated directory of the second application, if it is determined that the first application does not have permission to access the designated directory, the preset data is retrieved from the data provision module based on the storage policy and updated to the folder specified in the designated directory.

[0105] Here, the storage policy can be adjusted based on the first application's access rights to the second application's designated directory. When the first application's access rights to the second application's designated directory are enabled, the instruction data providing module will store the data in the second application's designated directory. However, when the first application's access rights to the second application's designated directory are disabled, the data in the second application's designated directory does not need to be stored.

[0106] Furthermore, before updating the data in the designated directory to the preset data, the method further includes:

[0107] The data in the designated directory is stored outside the designated directory, and when no access to the designated directory of the second application by the first application is detected, the data in the designated directory is restored to the designated directory.

[0108] In this way, by restoring the data in the designated directory to the designated directory when the first application is not monitored accessing the designated directory of the second application, the restoration of the data in the designated directory of the second application is ensured, thereby enhancing the stability of the system.

[0109] As another optional embodiment, denying the first application program access to the designated directory of the second application program in the external storage space according to the access permission information includes:

[0110] When it is determined based on the access permission information that the first application does not have permission to access the specified directory, the storage daemon is used to notify the terminal to close the first application's access process to the specified directory, or to notify the terminal to close the second application's mounting process to the specified directory, thereby denying the first application access to the specified directory of the second application in the external storage space.

[0111] Here, please refer to Figure 2At the kernel layer, that is, in the kernel of the operating system, the storage daemon process can notify the kernel of the terminal's operating system to close the first application's access process to the designated directory, or notify the terminal to close the second application's mounting process to the designated directory, so as to deny the first application access to the designated directory of the second application in the external storage space.

[0112] Here, the operating system kernel refers to the core components of most operating systems. It consists of those parts of the operating system responsible for managing memory, files, peripherals, and system resources. The operating system kernel typically runs processes and provides inter-process communication, such as event scheduling and synchronization, inter-process communication including message passing, memory management, and process management. The kernel layer, at the bottom layer of the operating system, is the system software responsible for managing hardware, performing task scheduling, and maintaining overall security and integrity.

[0113] In this embodiment, the terminal is notified by the storage daemon process to close the first application's access to the specified directory, or the terminal is notified to close the loading process of the second application to the specified directory, so that the first application cannot access the specified directory, thereby enhancing the privacy security of the data corresponding to the specified directory and protecting user privacy.

[0114] Furthermore, the present disclosure also provides a specific embodiment to further understand the data access method provided by the embodiment of the present disclosure.

[0115] In related technologies, as long as an application has SD card read permission, it can create any directory on the terminal's SD card and access the application's directory data at will. Unauthorized data access can lead to the leakage of user privacy information. For example, accessing chat messages and photo albums from social applications for big data analysis can lead to product recommendations for users, which is detrimental to the user experience.

[0116] It should be noted that, in this embodiment, please refer to Figure 2 and Figure 3 Here, the first application may be "Toutiao," and the second application may be an image album application, with the corresponding designated directory being the directory corresponding to the folder storing the preset album; alternatively, the second application may be a social networking application, with the corresponding designated directory being the directory corresponding to the folder storing chat messages. Here, the SD card may be understood as the external storage space described in the above embodiment.

[0117] Here, we use the Android operating system as an example. The kernel is the core of the operating system. Vold (Volume Daemon) is the management center of the external storage system in the Android operating system. It is a background process that manages and controls external storage devices on the Android platform. Vold is responsible for interacting with the underlying layer.

[0118] When the user turns on the "Access preset photo album" permission and the "Access social information" permission for "Toutiao", the "Toutiao" application will now have access to all directories on the SD card.

[0119] When the user turns off the "access to preset photo albums" permission of "Toutiao" and / or the "access to social information" permission, first, the security management service notifies the adjustment of the storage policy. In some implementations, the application identifier of the first application, that is, "Toutiao", and the application identifier of the second application can be stored in the data provision module; secondly, the application's permission service sets the permission information of the first application to prohibit access rights; then, the security management service monitors the application startup event and the first application's access to the second application. When the first application starts, the access permission information of the first application is obtained from the data provision module. According to the access permission information, Vold notifies the terminal kernel to close the access process of the first application or close the mounting process of the second application, thereby preventing the first application from accessing the specified directory.

[0120] In other embodiments, the storage policy may be such that, when a first application accesses a designated directory, the preset data may be stored in a folder corresponding to the designated directory, while the data in the designated directory may be stored outside the designated directory. Based on the access permission information, the data providing module may return the preset data to the first application according to the storage policy, thereby preventing the first application from accessing the data corresponding to the designated directory.

[0121] Through the above method, the directory of the terminal's SD card is managed in a refined manner, which improves the user's control over the application program on the terminal accessing the SD card and enhances privacy protection.

[0122] Figure 4 FIG. 1 is a block diagram of a data access device according to an exemplary embodiment. Figure 4 , the device includes a monitoring module 41, a determination module 42 and an access processing module 43;

[0123] The monitoring module 41 is used to monitor access to the first application;

[0124] The determining module 42 is configured to determine access permission information of the first application program based on the first application program;

[0125] The access processing module 43 is configured to deny or allow the first application to access the designated directory of the second application in the external storage space according to the access permission information when monitoring the first application accessing the designated directory of the second application in the external storage space.

[0126] In an optional embodiment, the determining module 42 is further configured to:

[0127] According to the first application, when the first application is started, the access permission information of the first application is obtained.

[0128] In an optional embodiment, the access processing module 43 is further configured to:

[0129] When it is determined, based on the access permission information, that the first application does not have permission to access the designated directory, the data in the designated directory is updated to preset data, and the preset data is returned to the first application.

[0130] In an optional embodiment, the access processing module 43 is specifically configured to:

[0131] Before updating the data in the designated directory to the preset data, the data in the designated directory is stored outside the designated directory, and when the first application is not monitored to access the designated directory of the second application, the data in the designated directory is restored to the designated directory.

[0132] In an optional embodiment, the access processing module 43 is further configured to:

[0133] When it is determined based on the access permission information that the first application does not have permission to access the specified directory, the terminal is notified through the storage daemon process to close the first application's access process to the specified directory, or the terminal is notified to close the second application's mounting process to the specified directory, thereby denying the first application access to the specified directory of the second application in the external storage space.

[0134] In an optional embodiment, the determining module 42 is further configured to:

[0135] Determining, based on the first application, permission configuration information corresponding to the first application, wherein the permission configuration information is determined by an input operation on a preset application interface of the first application;

[0136] Based on the permission configuration information of the first application, access permission information of the first application is determined.

[0137] In an optional embodiment, the determining module 43 is further configured to:

[0138] If the permission configuration information of the first application indicates that the first application has closed access rights to the designated directory, determining that the access permission information of the first application can indicate that the first application does not have permission to access the designated directory;

[0139] or,

[0140] If the permission configuration information of the first application indicates that the first application has enabled access rights to the designated directory, it is determined that the access rights information of the first application can indicate that the first application has permission to access the designated directory.

[0141] Regarding the apparatus in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0142] Figure 5 FIG5 is a block diagram of a terminal 500 according to an exemplary embodiment. For example, the terminal 500 may be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc.

[0143] Reference Figure 5 , terminal 500 may include one or more of the following components: a processing component 502 , a memory 504 , a power component 506 , a multimedia component 508 , an audio component 510 , an input / output (I / O) interface 512 , a sensor component 514 , and a communication component 516 .

[0144] The processing component 502 generally controls the overall operation of the terminal 500, such as operations associated with display, phone calls, data communications, camera operation, and recording operations. The processing component 502 may include one or more processors 520 to execute instructions to perform all or part of the steps of the above-described method. In addition, the processing component 502 may include one or more modules to facilitate interaction between the processing component 502 and other components. For example, the processing component 502 may include a multimedia module to facilitate interaction between the multimedia component 508 and the processing component 502.

[0145] The memory 504 is configured to store various types of data to support operations on the terminal 500. Examples of such data include instructions for any application or method operating on the terminal 500, contact data, phone book data, messages, pictures, videos, etc. The memory 504 can be implemented by any type of volatile or non-volatile storage device, or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk, or optical disk.

[0146] Power component 506 provides power to various components of terminal 500. Power component 506 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to terminal 500.

[0147] The multimedia component 508 includes a screen that provides an output interface between the terminal 500 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen can be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor can not only sense the boundaries of the touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 508 includes a front camera and / or a rear camera. When the terminal 500 is in an operating mode, such as a shooting mode or a video mode, the front camera and / or the rear camera can receive external multimedia data. Each front camera and rear camera can be a fixed optical lens system or have a focal length and optical zoom capability.

[0148] The audio component 510 is configured to output and / or input audio signals. For example, the audio component 510 includes a microphone (MIC), which is configured to receive external audio signals when the terminal 500 is in an operating mode, such as a call mode, a recording mode, and a voice recognition mode. The received audio signal can be further stored in the memory 504 or transmitted via the communication component 516. In some embodiments, the audio component 510 also includes a speaker for outputting audio signals.

[0149] I / O interface 512 provides an interface between processing component 502 and peripheral interface modules, such as a keyboard, click wheel, buttons, etc. These buttons may include but are not limited to: a home button, volume buttons, a start button, and a lock button.

[0150] The sensor assembly 514 includes one or more sensors for providing various aspects of status assessment for the terminal 500. For example, the sensor assembly 514 can detect the open / closed state of the terminal 500, the relative positioning of components, such as the display and keypad of the terminal 500. The sensor assembly 514 can also detect changes in the position of the terminal 500 or a component of the terminal 500, the presence or absence of user contact with the terminal 500, the orientation or acceleration / deceleration of the terminal 500, and temperature changes of the terminal 500. The sensor assembly 514 can include a proximity sensor configured to detect the presence of nearby objects without any physical contact. The sensor assembly 514 can also include an optical sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 514 can also include an accelerometer, a gyroscope, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0151] The communication component 516 is configured to facilitate wired or wireless communication between the terminal 500 and other devices. The terminal 500 can access a wireless network based on a communication standard, such as WiFi, 2G or 3G, or a combination thereof. In an exemplary embodiment, the communication component 516 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 516 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0152] In an exemplary embodiment, the terminal 500 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the above methods.

[0153] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 504 including instructions, and the instructions can be executed by the processor 520 of the terminal 500 to perform the above method. For example, the non-transitory computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0154] A non-transitory computer-readable storage medium, when instructions in the storage medium are executed by a processor of a terminal, enables the terminal to execute the data access method described in the above embodiments.

[0155] Other embodiments of the present invention will readily occur to those skilled in the art after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein. The description and examples are to be considered as exemplary only, with the true scope and spirit of the invention being indicated by the following claims.

[0156] It should be understood that the present invention is not limited to the exact construction described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A data access method, characterized in that: Applied in terminals, including: Monitoring access to the first application; Determining access permission information for the first application program based on the first application program; When monitoring the first application program accessing a designated directory of a second application program in an external storage space, denying or allowing the first application program access to the designated directory of the second application program in the external storage space according to the access permission information; wherein the first application program and the second application program are of different categories, or the first application program and the second application program are the same application program; Denying the first application program access to the designated directory of the second application program in the external storage space according to the access permission information includes: When it is determined, based on the access permission information, that the first application does not have permission to access the designated directory, updating the data in the designated directory to preset data and returning the preset data to the first application; wherein the preset data is pre-stored in the data providing module; Before updating the data in the designated directory to the preset data, the method further includes: The data in the designated directory is stored outside the designated directory, and when no access to the designated directory of the second application by the first application is detected, the data in the designated directory is restored to the designated directory.

2. The method according to claim 1, characterized in that The determining, based on the first application, access permission information of the first application includes: According to the first application, when the first application is started, the access permission information of the first application is obtained.

3. The method according to claim 1, characterized in that Denying the first application program access to the designated directory of the second application program in the external storage space according to the access permission information includes: When it is determined based on the access permission information that the first application does not have permission to access the specified directory, the storage daemon is used to notify the terminal to close the first application's access process to the specified directory, or to notify the terminal to close the second application's mounting process to the specified directory, thereby denying the first application access to the specified directory of the second application in the external storage space.

4. The method according to claim 1, wherein The determining, based on the first application, access permission information of the first application includes: Determining, based on the first application, permission configuration information corresponding to the first application, wherein the permission configuration information is determined by an input operation on a preset application interface of the first application; Based on the permission configuration information of the first application, access permission information of the first application is determined.

5. The method according to claim 4, characterized in that The determining, based on the permission configuration information of the first application, the access permission information of the first application includes: If the permission configuration information of the first application indicates that the first application has closed access rights to the designated directory, determining that the access permission information of the first application can indicate that the first application does not have permission to access the designated directory; or, If the permission configuration information of the first application indicates that the first application has access rights to the designated directory enabled, it is determined that the access permission information of the first application can indicate that the first application has permission to access the designated directory.

6. A data access device, characterized in that: Applied in terminals, including: A monitoring module, configured to monitor access to the first application; a determination module, configured to determine access permission information of the first application program based on the first application program; an access processing module, configured to, upon monitoring access by the first application to a designated directory of a second application in the external storage space, deny or allow, based on the access permission information, the first application to access the designated directory of the second application in the external storage space; wherein the first application and the second application are of different categories, or the first application and the second application are the same application; Denying the first application program access to the designated directory of the second application program in the external storage space according to the access permission information includes: When it is determined, based on the access permission information, that the first application does not have permission to access the designated directory, updating the data in the designated directory to preset data and returning the preset data to the first application; wherein the preset data is pre-stored in the data providing module; Before updating the data in the designated directory to the preset data, the method further includes: The data in the designated directory is stored outside the designated directory, and when no access to the designated directory of the second application by the first application is detected, the data in the designated directory is restored to the designated directory.

7. The device according to claim 6, characterized in that The determining module is further configured to: According to the first application, when the first application is started, the access permission information of the first application is obtained.

8. The device according to claim 6, characterized in that The access processing module is further configured to: When it is determined based on the access permission information that the first application does not have permission to access the specified directory, the terminal is notified through the storage daemon process to close the first application's access process to the specified directory, or the terminal is notified to close the second application's mounting process to the specified directory, thereby denying the first application access to the specified directory of the second application in the external storage space.

9. The device according to claim 6, characterized in that The determining module is further configured to: Determining, based on the first application, permission configuration information corresponding to the first application, wherein the permission configuration information is determined by an input operation on a preset application interface of the first application; Based on the permission configuration information of the first application, access permission information of the first application is determined.

10. The device according to claim 9, characterized in that The determining module is further configured to: If the permission configuration information of the first application indicates that the first application has closed access rights to the designated directory, determining that the access permission information of the first application can indicate that the first application does not have permission to access the designated directory; or, If the permission configuration information of the first application indicates that the first application has enabled access rights to the designated directory, it is determined that the access rights information of the first application can indicate that the first application has permission to access the designated directory.

11. A terminal, characterized in that: include: processor; a memory for storing processor-executable instructions; Wherein, the processor is configured to: implement the data access method according to any one of claims 1 to 5 when running the executable instructions.

12. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: The program is executed by a processor to implement the method steps according to any one of claims 1 to 5.

Images