A system and method for adjusting application permissions

Abstract

The present invention relates to a method and system for adjusting application permissions. The method at least includes: after a security control file is set at the initial position of the application running, selecting a first policy configuration file, a second policy configuration file, or a third policy configuration file that matches the version information of the application fed back by the security control file and pushing it to the security control file in the application. The present invention aims at software with permission abuse or malicious behavior, truncates its malicious behavior actions according to the policy, closes the permissions with potential risks, and retains and allows the execution of other functions useful to the user, so that the software can meet the needs of the user while ensuring the information security of the user.

Description

[0001] This invention is a divisional application of an invention with the application number 201611095114.4, the application title of "A System and Method for Secure Control of Software Permissions and Behaviors", the application date of December 1, 2016, and the application type of invention. Technical Field

[0002] This invention relates to the field of computer technology, and particularly to a system and method for adjusting application permissions. Background Art

[0003] With the development of software systems and the Internet, a large number of application software with various functions have emerged, meeting the rich software needs of people's work and life. However, at the same time, malicious software and rogue software on computers, especially mobile devices, emerge in an endless stream, making it difficult for users to distinguish. In particular, some APPs provided free of charge by some manufacturers seem to have practical and secure functions on the surface, but the software will collect users' privacy information in the background, such as: geographical location, address book content, text messages, photos, etc., and quietly upload this privacy information to the manufacturer's server, causing potential information leakage risks.

[0004] Regarding similar malicious software or rogue software, on the one hand, ordinary users are unable to identify their permissions and behaviors, and on the other hand, even if they are aware of the privacy leakage risks of the software, many users have to compromise and continue to allow the software to run and collect information considering the functional advantages of the software that are difficult to replace by other software.

[0005] Currently, tools such as antivirus software and security guards on the market monitor software externally. Once they detect violations in terms of permissions or behaviors of the software, they directly close or even uninstall the software, making it difficult to precisely control the permissions and behaviors of the software.

[0006] Chinese Patent CN 105389263 A discloses an application software permission monitoring method, including: downloading a third-party application software installation package; parsing the attributes of the third-party application software, the process name at startup, and the permissions applied for, where the attributes at least include package name, activity, services, broadcast, and permission; generating a job for comparison and verification based on the parsed information; installing the generated job on a tested terminal with security software, and the tested terminal installs the third-party application software according to the description of the job and conducts comparison and verification. Although this patent can monitor the access permissions of software, it requires users to install security software in the operating system and cannot enable the software itself to achieve control of permissions and behaviors.

[0007] Chinese Patent CN104298916A discloses an application management method, an application management system and a user device. The application management method includes the following steps. Receive an original application, and inject usage right management program code into the original application through a re-packaging program to generate a re-packaged application. Publish the re-packaged application for the user device to download and install the re-packaged application, where the user device executes a client program. When the user device executes the re-packaged application, the usage right management program code issues a usage right check request to initiate the client program to send a usage right check response according to the usage right information of the re-packaged application. The usage right check response indicates whether the re-packaged application can continue to execute. When the usage right check response indicates that the re-packaged application cannot continue to execute, the usage right management program code terminates the re-packaged application.

[0008] Chinese Patent CN104484599A discloses a method and device for processing the behavior of an application. The method includes: when detecting a startup operation of an application, obtaining the behavior permission information corresponding to the application; monitoring the behavior information of the application; and processing the behavior information according to the behavior permission information.

[0009] Chinese Patent CN103761471A discloses a method and device for installing an application based on a smart terminal device. The method includes: during the process of installing an application, after detecting that the application needs to read a configuration information file, loading an application authorization permission list interface set for the to-be-installed application, where the application authorization permission list interface is an interface for modifying the application authorization permission list, and includes one or more behavior permissions selectively authorized by the user for the to-be-installed application, and recording the modification of the application authorization permission list; after the application is installed, updating the behavior permissions of the application according to the modification record of the application authorization permission list.

[0010] For software containing permission abuse or malicious behavior, the prior art controls it by means of a one-time prohibition.

[0011] The system provided by the present invention can upgrade and generate a new security control file according to the permission changes of an application for software containing permission abuse or malicious behavior, preventing the situation that the permission range changes due to remote call of permissions and affecting the user's usage safety. The present invention does not simply and crudely directly prohibit its operation and use, but truncates its malicious behavior actions according to the policy and closes the permissions with potential risks, while retaining and allowing the execution of other functions useful to the user in the application. There is no need to rely on the user to install antivirus software or security guards and other monitoring software in the operating system, and the application itself can realize the control of permissions and security behaviors. Summary of the Invention

[0012] In view of the deficiencies of the prior art, the present invention provides a method for securely controlling software permissions and behaviors, characterized in that the method includes:

[0013] Setting a security control file for controlling application permissions based on a policy configuration file in the form of code at the initial position where an application program exists in the form of program code during operation,

[0014] The security control file triggered based on the operation of the application program restricts the permissions of the application program according to the first policy configuration file pushed by the server,

[0015] The server generates and pushes a second policy configuration file to the security control file of the application program based on the permission information and operating conditions of the application program fed back by the security control file.

[0016] According to a preferred embodiment, the server adjusts the first policy configuration file to the second policy configuration file based on the to-be-controlled permission information of the application program marked and fed back by the security control file,

[0017] The security control file restricts the permissions of the application program based on the permission policy list of the second policy configuration file.

[0018] According to a preferred embodiment, the security control file adjusts the permission policy list of the second policy configuration file based on the operation obstacles of the application program to generate a third policy configuration file, and the security control file marks the third policy configuration file and the version information of the corresponding application program and pushes it to the server for storage.

[0019] According to a preferred embodiment, the server selects a first policy configuration file, a second policy configuration file, or a third policy configuration file that matches the version information of the application program fed back by the security control file and pushes it to the security control file in the application program.

[0020] According to a preferred embodiment, the server pushes update information to the security control file based on the permission information of the control failure and the version information of the corresponding application program fed back by the security control file to update the security control file.

[0021] According to a preferred embodiment, the step of setting a security control file for controlling application permissions based on a policy configuration file in the form of code at the initial position where an application program exists in the form of program code during operation includes:

[0022] Decompose, reverse assemble, and / or reverse compile the application to be controlled into program code,

[0023] Set the code of the security control file at the initial position or initialization node position where it runs in the program code,

[0024] Forward compile the program code with the security control file set into an application controlled by the security control file.

[0025] According to a preferred embodiment, the security control file calculates and determines the start times and durations of restricted permissions during the operation of the application based on the policy requirements of the first policy configuration file or the second policy configuration file, and intercepts the restricted information sent by the restricted permissions;

[0026] The security control file recalculates and determines the start times and durations of the restricted permissions during the operation of the application based on the operation obstacles of the application, thereby generating the third policy configuration file and pushing the recalculated and determined start times and durations of the restricted permissions and the restricted information to the server for storage.

[0027] According to a preferred embodiment, the security control file determines restricted permissions by comparing the permission information listed in the permission policy list in the policy configuration file with the permission information applied for by the application,

[0028] The control instruction of the security control file is triggered based on the start of restricted permissions to prevent the start of restricted permissions and / or intercept the restricted information sent by the restricted permissions.

[0029] According to a preferred embodiment, in the case where the security control file loses the signal connection with the server, the security control file adds the to-be-controlled permission information of the application that is not recorded in the permission policy list of the first policy configuration file to the permission policy list and sets it to the prohibited state, thereby generating the second policy configuration file,

[0030] The security control file adjusts the permission policy list of the second policy configuration file based on the operation obstacles of the application to generate the third policy configuration file.

[0031] A system for securely controlling software permissions and behaviors, characterized by including a server, a placement module, a compilation module, and a security control file,

[0032] The server stores the code of the security control file and pushes the policy configuration file based on the feedback information of the security control file,

[0033] The compilation module decomposes, reverse assembles, and / or reverse compiles the application to be controlled into program code,

[0034] The component placement module sets the security control file that controls the application permissions based on the policy configuration file in the form of code at the initial position where the application running in the form of program code exists.

[0035] The security control file triggered by the running of the application restricts the permissions of the application according to the first policy configuration file pushed by the server.

[0036] The server generates and pushes a second policy configuration file to the security control file of the application based on the permission information and running status of the application fed back by the security control file.

[0037] The present invention also provides a method for adjusting the permissions of an application. The method at least includes: after the security control file is set at the initial position where the application runs, selecting a first policy configuration file, a second policy configuration file, or a third policy configuration file that matches the version information of the application fed back by the security control file and pushing it to the security control file in the application.

[0038] Preferably, the method further includes:

[0039] Restricting the permissions of the application according to the first policy configuration file pushed by the server;

[0040] Adjusting the first policy configuration file to a second policy configuration file based on the permissions information to be controlled of the application marked and fed back by the security control file.

[0041] Adjusting the permission policy list of the second policy configuration file based on the running obstacles of the application to generate a third policy configuration file.

[0042] Preferably, the method further includes:

[0043] The security control file is set in the form of code at the initial position where the application running in the form of program code exists.

[0044] Preferably, the method further includes:

[0045] The security control file calculates and judges the startup times and time of restricting permissions during the running of the application based on the policy requirements of the first policy configuration file or the second policy configuration file, and intercepts the restriction information sent by the restricted permissions.

[0046] Preferably, the method further includes:

[0047] When the security control file controls the permissions of the application according to the first policy configuration file, the security control file feeds back to the server the permissions not listed in the permission policy list.

[0048] Based on the permission information and running status of the application fed back by the security control file, the server adjusts the permission policy list of the pushed first policy configuration file, adds new permissions, and thus generates a second policy configuration file containing the updated permission policy list.

[0049] Preferably, the method of setting the security control file at the initial position of the application running includes: disassembling, reverse assembling and / or reverse compiling the application to be controlled into program codes.

[0050] Set the code of the security control file at the initial position or initialization node position where the program code runs.

[0051] Forward compile the program code with the security control file set into an application controlled by the security control file.

[0052] The present invention also provides an application permission adjustment system, including a server, a placement module and a security control file. After the placement module sets the security control file at the initial position of the application running, the server selects the first policy configuration file, the second policy configuration file or the third policy configuration file that matches it according to the version information of the application fed back by the security control file and pushes it to the security control file in the application.

[0053] Preferably, the system further includes a compilation module, and the compilation module disassembles, reverse assembles and / or reverse compiles the application to be controlled into program codes.

[0054] The present invention also provides a server based on application permission security control. The server is configured to: in response to the policy configuration file request information sent by the security control file in the application, the server pushes the latest first policy configuration file to the security control file.

[0055] The server adjusts the first policy configuration file to the second policy configuration file based on the to-be-controlled permission information of the application marked and fed back by the security control file.

[0056] Receive and store the third policy configuration file generated by adjusting the permission policy list of the second policy configuration file by the security control file based on the running obstacles of the application.

[0057] Preferably, the server is further configured to: select a first policy configuration file, a second policy configuration file, or a third policy configuration file that matches the version information of the application program fed back by the security control file and push it to the security control file in the application program.

[0058] Advantageous technical effects of the present invention:

[0059] 1. For software containing permission abuse or malicious behavior, the present invention does not simply and crudely directly prohibit its operation and use, but truncates its malicious behavior actions according to the policy and closes the permissions with potential risks. Other functions useful to users in the application program are retained and allowed to execute.

[0060] 2. There is no need to rely on the user to install monitoring software such as antivirus software or security guards in the operating system, and the application program itself can implement the control of permissions and security behaviors.

[0061] 3. The permissions prohibited by traditional manual settings are one-sided and easily cause obstacles to the operation of some application programs or cannot prohibit the permissions that are not set. Based on manual settings, the present invention adjusts the permissions for the operation of the application program, further prohibits other unnecessary permissions that are not set without affecting the progress of the application program. Description of the Drawings

[0062] Figure 1 is a logical schematic diagram of the method of the present invention; and

[0063] Figure 2 is a logical schematic diagram of the system of the present invention.

[0064] List of Reference Numerals

[0065] 10: Server 20: Component Module 30: Compilation Module

[0066] 40: Security Control File Detailed Embodiments

[0067] The following is a detailed description with reference to the drawings.

[0068] The content of the security control file includes the type of permissions, trust level, permission group name, and functions related to personal privacy information that need to be controlled under the permission group.

[0069] The application program in the present invention is an application program provided by a third-party program developer for installation into a user computer system or intelligent device system. The computer system includes Windows system, XP system, and Linux system. The intelligent device system includes IOS system and Android system.

[0070] The server of the present invention includes a remote server and a cloud server.

[0071] As Figure 1 shown, the present invention provides a method for securely controlling software permissions and behaviors, including:

[0072] S1: Set a security control file that controls the permissions of application programs based on a policy configuration file in the initial position where an application program exists in the form of program coding in the form of code;

[0073] S2: The security control file triggered based on the operation of the application program restricts the permissions of the application program according to the first policy configuration file pushed by the server;

[0074] S3: The server generates and pushes a second policy configuration file to the security control file of the application program based on the permission information and running status of the application program fed back by the security control file.

[0075] In the present invention, the permission behaviors of the application program include: real-time permissions for behaviors such as making a call, sending a text message and / or a multimedia message, privately opening 2G / 3G / 4G, privately opening WLAN, privately opening Bluetooth, reading contacts, reading call records, reading text messages and / or multimedia messages, obtaining the location of the mobile phone, using the microphone to record, turning on the camera, writing / deleting contacts, writing / deleting call records, writing / deleting text messages and / or multimedia messages, etc. The present invention does not limit the types of behaviors, and the behaviors may also include other types of behaviors of the application program.

[0076] The permission restrictions of the present invention include allowing access and prohibiting access. The security control file sets different permissions according to different application programs. For example, for the application program WeChat, the security control file sets the access permission of allowing access for the foreground running state of WeChat, sets the access permission of prohibiting access for the not-yet-running state of WeChat, and sets refined access permissions for the background running state of WeChat. For example: for the background running state of WeChat, the access permission for the system resource GPS resource can be set to allow access, and the access permission for the system resource address book can be set to prohibit access, etc. The present invention does not make special restrictions on this.

[0077] The security control file is a management file formed after being manually written and repeatedly tested by a service team. The security control file can be a complete executable program or a code snippet. The coding languages of the security control file include PASCAL language, C language, FORTRAN language, BASIC language, COBOL language, FOXBASE language, etc.

[0078] Embodiment 1

[0079] This embodiment provides a method for securely controlling software permissions and behaviors, including:

[0080] S1: Set the security control file that manages the application permissions based on the policy configuration file in the form of code at the initial position where the application in the form of program code runs.

[0081] S2: Restrict the permissions of the application according to the first policy configuration file pushed by the server by the security control file triggered by the running of the application.

[0082] S3: The server generates and pushes a second policy configuration file to the security control file of the application based on the permission information and running status of the application fed back by the security control file.

[0083] The following describes a method for securely controlling software permissions and behaviors in this embodiment.

[0084] S1: Set the security control file that manages the application permissions based on the policy configuration file in the form of code at the initial position where the application in the form of program code runs.

[0085] The application to be installed will apply for various permissions during operation, such as obtaining the geographical location, reading the address book, accessing the camera, microphone, etc. These permissions and behaviors are not necessarily required for the functions declared by the application developer to provide. They may be additional code added by the developer to obtain more benefits, or injected and superimposed by the software download channel manufacturer later. Therefore, these permissions and behaviors may be redundant or even harmful to the users of the final application. For example: A developer made a free game program that only provides a picture interactive puzzle game without functions based on geographical location or online gaming functions with communication friends. However, when this game program runs, it will apply for permissions to obtain the system geographical location and access the address book. Its real purpose is to collect user information and upload it to its server, and then sell it to other advertising companies to achieve the purpose of making a profit.

[0086] The application of the present invention includes applications released or not released by the developer. When the user of the application is ready to use the application within a specific range and needs to ensure its security and controllability, the security control file is set into the program code of the application to enable the application to have the function of securely controlling its own permissions, and then the application with the security control function is used within a specific range. The security control file is a universal version applicable to most applications. For special applications discovered later, which may have been code-obfuscated or encrypted, directly injecting the code of the security control file may cause the monitoring function to fail. Therefore, the security control file can be modified, improved, upgraded and updated to achieve better compatibility and universality.

[0087] Preferably, the step of setting the security control file that controls the application permissions based on the policy configuration file in the initial position where the application program running in the form of program coding exists in the form of code includes:

[0088] S11: Disassemble, reverse assemble, and / or reverse compile the application program to be controlled into program coding;

[0089] S12: Set the code of the security control file at the initial position or the initialization node position where it runs in the program coding;

[0090] S13: Forward compile the program coding with the security control file set into an application program controlled by the security control file.

[0091] Disassemble the application program to be controlled into program coding. Or reverse assemble or reverse compile the application program to be controlled into program coding in the form of SMALI or JAVA.

[0092] Find the starting position where the program runs in the program coding of the application program, and set the coding of the security control file at the starting position or the initialization node position where the program runs. The setting of the security control file is equivalent to changing the running mechanism of the application program. When the application program runs to the starting position or the initialization node position, the code of the security control file will be executed. After the code of the security control file is executed, it will return to continue executing the subsequent coding program of the application program.

[0093] After the security control file is set, reassemble or forward compile the modified and set application program to form an application program with security control functions that can be normally installed and run for release within a specific range.

[0094] S2: The security control file triggered based on the running of the application program restricts the permissions of the application program according to the first policy configuration file pushed by the server.

[0095] The security control file is triggered to run based on the operation of the application. When the security control file runs, it sends a policy configuration file request message to the server, and the server responds to the request of the security control file and pushes the latest first policy configuration file to the security control file. The first policy configuration file contains a list of permission policies. The list of permission policies displays some prohibited permissions and permitted permissions to ensure the information security of the application. The security control file correspondingly restricts and controls the permissions of the application item by item according to the list items of the permission policy list in the first policy configuration file. Alternatively, when the application attempts to run the permissions listed in the permission policy list, the security control file monitors and triggers an interception action to intercept the information sent by the permission, so as to ensure that the actual running behavior of the application does not exceed the scope of the permission policy specified by the server, achieving the goal of security control.

[0096] S3: The server generates and pushes a second policy configuration file to the security control file of the application based on the permission information and running status of the application fed back by the security control file.

[0097] In the case where the security control file correspondingly controls the permissions of the application based on the first policy configuration file, the security control file feeds back to the server the permissions not listed in the permission policy list, that is, the permissions not within the control scope. The security control file feeds back to the server the permission information within the control scope and the permission information not within the control scope of the application and the running status of the permissions. The server adjusts the permission policy list of the first policy configuration file pushed based on the permission information and running status of the application fed back by the security control file, adds new permissions, thereby generating a second policy configuration file containing an updated permission policy list. The server pushes the second policy configuration file to the security control file of the corresponding application.

[0098] According to a preferred embodiment, the server adjusts the first policy configuration file to the second policy configuration file based on the to-be-controlled permission information of the application marked and fed back by the security control file. The security control file restricts the permissions of the application based on the permission policy list of the second policy configuration file.

[0099] Preferably, during the process of the security control file feeding back permission information to the server, the permission information to be controlled is marked and then sent to the server. The server adjusts the permission policy list of the first policy configuration file according to the permission information to be controlled marked and fed back by the security control file, adds new permissions, thereby generates a second policy configuration file containing the updated permission policy list and pushes it to the corresponding security control file. For example, the newly added permission of the second policy configuration file is set to prohibited. The security control file accordingly restricts and controls the permissions of the application program item by item based on the list items of the permission policy list of the second policy configuration file. Or, when the application program attempts to run the permissions listed in the permission policy list, the security control file monitors and triggers an interception action to intercept the information sent by the permission, so as to ensure that the actual running behavior of the application program does not exceed the scope of the permission policy specified by the server, achieving the goal of security control.

[0100] According to a preferred embodiment, the security control file adjusts the permission policy list of the second policy configuration file based on the running obstacles of the application program to generate a third policy configuration file. The security control file marks the third policy configuration file and the version information of the corresponding application program and pushes them to the server for storage.

[0101] After the security control file performs permission control according to the second policy configuration file, it may cause running obstacles to the application program. Because some permissions are necessary startup permissions during the running of the application program. The security control file adjusts each of the newly added controlled permissions in the permission policy list of the second policy configuration file one by one, changes the permission limitations until the application program can run normally. The security control file monitors the newly started permissions and the information sent by them and sends them to the server. The second policy configuration file with the adjusted permission policy list is generated into a third policy configuration file. The security control file adds a mark to the third policy configuration file and pushes it together with the version information of the corresponding application program to the server. The server stores the marked third policy configuration file and the version information of the corresponding application program. When the security control file is reinstalled into the application program with the same version information, the server directly pushes the marked third policy configuration file to the security control file according to the version information of the application program fed back by the security control file. By adjusting the policy configuration file, the present invention can enhance the control scope of the application program. It will neither miss the management of permissions due to the pre-set control scope, nor affect the running of the application program due to the one-sidedness of the controlled permissions and generate running obstacles.

[0102] According to a preferred embodiment, the server selects a matching first policy configuration file, second policy configuration file, or third policy configuration file based on the version information of the application program fed back by the security control file and pushes it to the security control file in the application program.

[0103] Different application programs apply different permission control scopes. Some application programs apply the first policy configuration file without adjustment. Some application programs apply the second policy configuration file after adjustment. Some application programs apply the third policy configuration file after adjustment. After the security control file is set in the application program, it is triggered and started based on the operation of the application program. After the security control file is started, it sends the version information of the application program to the server. If the server stores the records of the version information of the application program and its corresponding policy configuration file, it sends the corresponding first policy configuration file, second policy configuration file, or third policy configuration file to the security control file. If the server has no record of the version information of the application program fed back by the security control file, it sends the first policy configuration file with a universal scope to it.

[0104] According to a preferred embodiment, the server pushes update information to the security control file based on the permission information of the control failure and the version information of the corresponding application program fed back by the security control file, so as to update the security control file.

[0105] The security control file can be applicable to the universal versions of multiple application programs. However, due to the diversity of application programs, some application programs may be obfuscated or encrypted. The code directly set in the security control file may result in control failure. That is, the permissions in the application program do not accept the control and restrictions of the security control file. Therefore, the security control file feeds back the version information of the application program and the permission control situation to the server. The R & D service team of the security control file modifies and improves the security control file according to the version information of the application program and the permission control situation recorded by the server to achieve better compatibility and universality. The modified application program can achieve full compatibility and applicability within a certain period of time.

[0106] According to a preferred embodiment, the security control file calculates and judges the start times and duration of the restricted permissions during the operation of the application program based on the policy requirements of the first policy configuration file or the second policy configuration file, and intercepts the restricted information sent by the restricted permissions. The security control file recalculates and judges the start times and duration of the restricted permissions during the operation of the application program based on the operation obstacles of the application program, thereby generating the third policy configuration file and pushing the recalculated and judged start times and duration of the restricted permissions and the restricted information to the server for storage.

[0107] Preferably, the security control file can determine the specific behaviors of malicious behaviors in the application program. For example, the first policy configuration file or the second policy configuration file pushed by the server stipulates that the mobile office application program shall not use the permission to obtain microphone recording, and the geographical location acquisition shall not exceed 1 time per day to prevent information leakage. When the application program is running, once it attempts to start the microphone, the security control file monitors this behavior and immediately blocks it. Each time the application program obtains the geographical location, it will trigger the security control file to judge and record. If it is triggered more than 1 time during the time period from 00:00 to 24:00, it will be recorded, reported, and the running will be blocked. If the permission regulations in the first policy configuration file hinder the running of the application program and cause running obstacles, the security control file adjusts the permission policy list in the policy configuration file to generate a third policy configuration file, and recalculates and judges the start times and times of the restricted permissions during the running of the application program again. Or, the security control file recalculates and judges the start times and times of the restricted permissions that do not affect the running of the application program based on the running obstacles of the application program, so as to adjust the permission policy list in the policy configuration file to generate a third policy configuration file. The security control file pushes the start times, times, and restriction information of the restricted permissions obtained by recalculation and judgment to the server for storage.

[0108] According to a preferred embodiment, the security control file determines the restricted permissions by comparing the permission information listed in the permission policy list in the policy configuration file with the permission information applied for by the application program. The control instruction of the security control file is triggered based on the start of the restricted permissions to prevent the start of the restricted permissions and / or intercept the restriction information sent by the restricted permissions.

[0109] For example, the permission policy list in the policy configuration file stipulates that the permission to read text messages is prohibited. The application program runs or applies to run the permission to read text messages during the running process. The security control file determines that the permission to read text messages is a restricted permission that should be prohibited by comparing the prohibited information of the permission to read text messages listed in the permission policy list in the policy configuration file with the applied permission to read text messages. The control instruction of the security control file is triggered when the permission to read text messages of the application program is running. The control instruction of the security control file is triggered based on the start of the permission to read text messages to prevent the start of the permission to read text messages and / or intercept the information sent by the application program after reading text messages.

[0110] According to a preferred embodiment, in the case where the security control file loses the signal connection with the server, the security control file adds the to-be-controlled permission information of the application that is not recorded in the permission policy list of the first policy configuration file to the permission policy list and sets it to the prohibited state, thereby generating the second policy configuration file. The security control file adjusts the permission policy list of the second policy configuration file based on the running obstacle of the application, thereby generating the third policy configuration file.

[0111] After the security control file is set into the application, the application with the control function can be independently released and used without being associated with the server. In the case where the security control file loses the signal connection with the server, the security control file can control the application without the information pushed by the server. The security control file is set with a default policy configuration file. The security control file can still control the permission behavior and malicious behavior of the application according to the default policy configuration file.

[0112] If the security control file finds that there is to-be-controlled permission information of the application that is not recorded in the permission policy list of the first policy configuration file, it adds the to-be-controlled permission information to the permission control list and sets it to the prohibited state, thereby generating the second policy configuration file. Since some necessary permissions are prohibited, the application has a running obstacle. The security control file adjusts the permission policy list of the second policy configuration file based on the running obstacle of the application, and adjusts the newly added restricted permissions that affect the running of the application to the allowed state, so that the application can run normally. The adjusted second policy configuration file generates the third policy configuration file.

[0113] Embodiment 2

[0114] This embodiment is a further improvement and explanation of Embodiment 1, and the repeated content will not be elaborated.

[0115] As Figure 2 shown, this embodiment provides a system for securely controlling software permissions and behaviors, including a server 10, a plug-in module 20, a compilation module 30, and a security control file 40.

[0116] Preferably, the first policy configuration file is formed by manual writing and repeated testing, rather than being automatically generated by software or a system. The first policy file is stored in the server or configured in the security control file.

[0117] According to a preferred embodiment, the security control file is integrated in the plug-in module 20 before being set into the application.

[0118] The server stores the code of the security control file and pushes the policy configuration file based on the feedback information of the security control file.

[0119] Preferably, the component placing module 20 and the compiling module 30 are arranged on a remote server wirelessly connected to the application or on an intelligent terminal. Therefore, the code of the security control file is stored in the server 10 or in the component placing module 20. The component placing module 20 designates the object for component placement and the time therebetween by the user.

[0120] Intelligent terminals include desktop computers, laptop computers, smart phones, smart bracelets, smart glasses, etc.

[0121] Normally, the user cannot access the code of the security control file. The user starts the compiling module 30 and the component placing module 20 by wirelessly connecting to the server 10 through the intelligent terminal. The compiling module 30 decodes the specified application program, and the component placing module 20 sets the security control file for the specified application program. Finally, the compiling module 30 positively compiles the application program with the security control file set therein into an application program with the function of controlling its own permissions.

[0122] The user connects to the server through the application program of the intelligent terminal and instructs to install the security control file for the specified application program. The server responds to the instruction of the intelligent terminal and starts the compiling module 30. The compiling module 30 disassembles, reverse assembles, and / or reverse compiles the application program to obtain the program code. After the compiling module 30 finishes decoding the application program, it sends a completion message to the component placing module 20. The component placing module 20 responds to the message of the compiling module 20 and starts to set the code of the security control file 40 for the program code of the application program. After the component placing module 20 sets the security control file 40, it sends an instruction or message for positive compilation to the compiling module 20. The compiling module 20 positively compiles the application program with the program code having the security control file set therein.

[0123] Specifically, the operation of the system for securely controlling software permissions and behaviors of the present invention is described as follows.

[0124] S1: The component placing module 20 sets, in the form of code, a security control file for controlling the permissions of the application program at the initial position where the application program exists in the form of program code.

[0125] Preferably, the step in which the component placing module 20 sets, in the form of code, a security control file for controlling the permissions of the application program at the initial position where the application program exists in the form of program code includes:

[0126] S11: The compiling module 30 disassembles, reverse assembles, and / or reverse compiles the application program to be controlled into program code;

[0127] S12: The component placement module 20 sets the code of the security control file at the initial position or the initialization node position where it runs in the program code.

[0128] S13: The compilation module 30 compiles the program code with the security control file set therein in the forward direction into an application program controlled by the security control file.

[0129] The compilation module 30 disassembles the application program to be controlled into program code. Or the compilation module 30 disassembles or decompiles the application program to be controlled in the reverse direction into program code in the form of SMALI or JAVA.

[0130] The component placement module 20 finds the starting position of the program running in the program code of the application program, and sets the code of the security control file at the starting position of the program running or the initialization node position.

[0131] After the security control file is set, the compilation module 30 reassembles or recompiles the application program that has been changed and set in the forward direction to form an application program with security control functions that can be normally installed and run, for release within a specific range.

[0132] S2: The security control file triggered based on the running of the application program restricts the permissions of the application program according to the first policy configuration file pushed by the server.

[0133] The security control file 40 is triggered to run based on the running of the application program. When the security control file 40 runs, it sends policy configuration file request information to the server 10, and the server 10 responds to the request of the security control file 40 and pushes the latest first policy configuration file to the security control file 40. The first policy configuration file contains a list of permission policies. The list of permission policies lists some prohibited permissions and permitted permissions to ensure the information security of the application program. The security control file 40 accordingly restricts and controls the permissions of the application program item by item according to the list items of the permission policy list in the first policy configuration file. Or, when the application program attempts to run the permissions listed in the permission policy list, the security control file monitors and triggers an interception action to intercept the information sent by the permission, so as to ensure that the actual running behavior of the application program does not exceed the scope of the permission policy specified by the server, achieving the goal of security control.

[0134] S3: The server generates and pushes a second policy configuration file to the security control file of the application program based on the permission information and running status of the application program fed back by the security control file.

[0135] When the security control file controls the permissions of the application according to the first policy configuration file, the security control file feeds back to the server the permissions not listed in the permission policy list, that is, the permissions not within the control scope. The security control file feeds back to the server the permission information within the control scope of the application, the permission information not within the control scope, and the running status of the permissions. Based on the permission information and running status of the application fed back by the security control file, the server adjusts the permission policy list of the first policy configuration file pushed, adds new permissions, and thus generates a second policy configuration file containing the updated permission policy list. The server pushes the second policy configuration file to the security control file of the corresponding application.

[0136] According to a preferred embodiment, the server adjusts the first policy configuration file to the second policy configuration file based on the information of the permissions to be controlled of the application marked and fed back by the security control file. The security control file restricts the permissions of the application based on the permission policy list of the second policy configuration file.

[0137] According to a preferred embodiment, the security control file adjusts the permission policy list of the second policy configuration file based on the running obstacles of the application to generate a third policy configuration file. The security control file marks the third policy configuration file and the version information of its corresponding application and pushes them to the server for storage.

[0138] After the security control file performs permission control according to the second policy configuration file, it may cause running obstacles to the application. The security control file adjusts each of the newly added control permissions in the permission policy list of the second policy configuration file one by one, changes the permission restrictions until the application can run normally. The security control file monitors the newly started permissions and the information sent by them and sends them to the server, and generates the second policy configuration file with the adjusted permission policy list into a third policy configuration file. The security control file adds a mark to the third policy configuration file and pushes it together with the version information of the corresponding application to the server. The server stores the marked third policy configuration file and the version information of the corresponding application.

[0139] According to a preferred embodiment, the server selects the first policy configuration file, the second policy configuration file, or the third policy configuration file that matches the version information of the application fed back by the security control file and pushes it to the security control file in the application.

[0140] After the security control file is set in the application program, it is triggered to start based on the operation of the application program. After the security control file starts, it sends the version information of the application program to the server. If the server stores the records of the version information of the application program and its corresponding final policy configuration file, it sends the corresponding first policy configuration file, second policy configuration file, or third policy configuration file to the security control file. If the server has no record of the version information of the application program fed back by the security control file, it sends the first policy configuration file with a universal scope to it.

[0141] According to a preferred embodiment, the server pushes update information to the security control file according to the control failure permission information and the corresponding version information of the application program fed back by the security control file, so as to update the security control file.

[0142] The security control file feeds back the version information of the application program and the situation of permission control failure to the server. The R & D team of the security control system modifies and improves the security control file according to the version information of the application program and the permission control situation recorded by the server to achieve better compatibility and universality. The modified application program can achieve full compatibility and applicability within a certain period of time. The R & D team of the security control system sets the updated security control file in the server 10 or the component module 20. After the update, the component module 20 sets the latest security control file for the application program.

[0143] According to a preferred embodiment, the security control file calculates and judges the startup times and time of the restricted permissions during the operation of the application program based on the policy requirements of the first policy configuration file or the second policy configuration file, and intercepts the restricted information sent by the restricted permissions. The security control file recalculates and judges the startup times and time of the restricted permissions during the operation of the application program based on the operation obstacles of the application program, thereby generating the third policy configuration file and pushing the recalculated and judged startup times and time of the restricted permissions and the restricted information to the server for storage.

[0144] According to a preferred embodiment, the security control file determines the restricted permissions by comparing the permission information listed in the permission policy list in the policy configuration file with the permission information applied by the application program. The control instruction of the security control file is triggered based on the startup of the restricted permissions, so as to prevent the startup of the restricted permissions and / or intercept the restricted information sent by the restricted permissions.

[0145] According to a preferred embodiment, in the case where the security control file loses the signal connection with the server, the security control file adds the to-be-controlled permission information of the application that is not recorded in the permission policy list of the first policy configuration file to the permission policy list and sets it to the prohibited state, thereby generating the second policy configuration file. The security control file adjusts the permission policy list of the second policy configuration file based on the running obstacle of the application, thereby generating the third policy configuration file.

[0146] After the security control file is set in the application, the application with the control function can be independently published and used without being associated with the server. In the case where the security control file loses the signal connection with the server, the security control file can control the application without the information pushed by the server. The security control file is set with a default policy configuration file. The security control file can still control the permission behavior and malicious behavior of the application according to the default policy configuration file.

[0147] If the security control file finds that there is to-be-controlled permission information of the application that is not recorded in the permission policy list of the first policy configuration file, it adds the to-be-controlled permission information to the permission control list and sets it to the prohibited state, thereby generating the second policy configuration file. Since some necessary permissions are prohibited, the application has a running obstacle. The security control file adjusts the permission policy list of the second policy configuration file based on the running obstacle of the application, and adjusts the newly added restricted permissions that affect the running of the application to the allowed state, so that the application can run normally. The adjusted second policy configuration file generates the third policy configuration file.

[0148] Compared with the program that relies on the security system for security management, this system overcomes the disadvantage of the application relying on the security program for permission setting. The application processed by this system will actively control all permission requests of the application without affecting the running of the application. This system does not require the user to actively manage the permissions and behaviors of the application software, making it more convenient and simple for the user to run the application.

[0149] It should be noted that the above specific embodiments are exemplary. Those skilled in the art can come up with various solutions inspired by the disclosure content of the present invention, and these solutions also belong to the disclosure scope of the present invention and fall within the protection scope of the present invention. Those skilled in the art should understand that the description and drawings of the present invention are illustrative and do not constitute a limitation on the claims. The protection scope of the present invention is defined by the claims and their equivalents.

Claims

1. A method for adjusting application permissions, characterized in that The method at least includes: After setting the security control file that controls the application permissions based on the policy configuration file in the form of code at the initial position where the application running in the form of program coding exists, select the first policy configuration file, the second policy configuration file, or the third policy configuration file that matches it according to the version information of the application fed back by the security control file and push it to the security control file in the application. The security control file triggered based on the operation of the application restricts the permissions of the application according to the first policy configuration file pushed by the server. Based on the permission information and running status of the application fed back by the security control file, adjust the permission policy list of the pushed first policy configuration file, add new permissions, so as to generate a second policy configuration file containing the updated permission policy list, and the server pushes the second policy configuration file to the security control file of the corresponding application. The security control file adjusts the permission policy list of the second policy configuration file based on the running obstacles of the application, so as to generate a third policy configuration file. The security control file marks the third policy configuration file and the version information of its corresponding application and pushes it to the server for storage.

2. The method for adjusting application program permissions according to claim 1, wherein The method further includes: The security control file calculates and judges the start times and time of restricting permissions during the operation of the application based on the policy requirements of the first policy configuration file or the second policy configuration file, and intercepts the restriction information sent by the restricted permissions.

3. The method for adjusting application program permissions according to claim 2, wherein The method further includes: When the security control file controls the permissions of the application based on the first policy configuration file, the security control file feeds back the permissions not listed in the permission policy list to the server.

4. The method for adjusting application program permissions according to any one of claims 1 to 3, characterized in that, The method of setting the security control file at the initial position where the application runs includes: Disassembling, reverse assembling, and / or reverse compiling the application to be controlled into program coding. Setting the code of the security control file at the initial position or initialization node position where it runs in the program coding. Forward compiling the program coding with the security control file set into an application controlled by the security control file.

5. An adjustment system for an adjustment method of application program permissions described in any one of claims 1 to 4, characterized in that, Including a server, a placement module, and a security control file. After the placement module sets the security control file at the initial position where the application runs, the server selects the first policy configuration file, the second policy configuration file, or the third policy configuration file that matches it according to the version information of the application fed back by the security control file and pushes it to the security control file in the application.

6. The adjustment system according to claim 5, wherein The system further includes a compilation module. The compilation module disassembles, reverse assembles, and / or reverse compiles the application to be controlled into program coding.

7. A server based on application permission security control is used to implement the adjustment method of application program permissions described in any one of claims 1 to 4, and is characterized in that, The server is configured to: In response to the policy configuration file request information sent by the security control file in the application, the server pushes the latest first policy configuration file to the security control file. The server adjusts the first policy configuration file to the second policy configuration file based on the to-be-controlled permission information of the application marked and fed back by the security control file. Receive and store a third policy configuration file generated by the security control file by adjusting the permission policy list of the second policy configuration file based on the running obstacles of the application program.

8. The server based on application permission security control according to claim 7, wherein, The server is further configured to: Select a first policy configuration file, a second policy configuration file, or a third policy configuration file that matches the version information of the application program fed back by the security control file and push it to the security control file in the application program.

Images