A privacy protection method and device for target applications in a mobile terminal

Abstract

Embodiments of this specification provide a privacy protection method and apparatus for a target application in a mobile terminal, wherein the target application is divided into multiple functional modules. The method includes: in response to the execution of a first function in the target application, determining a first module to which the first function belongs from the multiple functional modules; and determining a first execution result of the first function based on a first privacy protection rule pre-set for the first module, wherein the first privacy protection rule is used to limit the privacy access behavior of the first module with respect to the mobile terminal.

Description

Technical Field

[0001] One or more embodiments of this specification relate to the field of data security and privacy protection, and more particularly, to a method and apparatus for privacy protection for a target application in a mobile terminal. Background Art

[0002] In recent years, with the widespread adoption of smart devices like mobile phones and the development of mobile computing technology, mobile privacy protection has become a hot topic for regulators and the industry. Currently, the industry's technical solutions for mobile privacy protection primarily rely on dynamic or static privacy access scanning of mobile applications, thereby restricting their privacy access. However, privacy protection does not necessarily mean prohibiting privacy access on mobile devices. Ensuring that applications can reasonably and healthily access mobile privacy while protecting the privacy of mobile users remains a challenge for the industry.

[0003] Therefore, an improved solution is needed to provide a more effective privacy protection method for mobile applications. Summary of the Invention

[0004] The embodiments in this specification aim to provide a more effective privacy protection method for mobile applications and address the deficiencies in the existing technology.

[0005] According to a first aspect, a privacy protection method for a target application in a mobile terminal is provided, wherein the target application is divided into multiple functional modules, and the method includes:

[0006] In response to execution of a first function in the target application, determining a first module to which the first function belongs from the plurality of functional modules;

[0007] A first execution result of the first function is determined according to a first privacy protection rule pre-set for the first module, wherein the first privacy protection rule is used to limit a privacy access behavior of the first module with respect to the mobile terminal.

[0008] In a possible implementation, the first privacy protection rule includes a plurality of privacy access rights of the mobile terminal and a plurality of privacy protection actions for the plurality of privacy access rights; wherein a single privacy access right corresponds to a single category of private data.

[0009] In a possible implementation, the plurality of privacy access rights include a first privacy access right for first category private data, where the first privacy access right is configured to be associated with a plurality of privacy access APIs requesting access to the first category private data.

[0010] In a possible implementation, the privacy access rights include one or more of: address book access right, geographic location access right, camera access right, recording access right, sensor access right, calendar access right, health data access right, Bluetooth access right, and installation list access right.

[0011] In a possible implementation, the privacy protection action includes one of: denying access, allowing access during application execution, prompting the user whether to allow access, intercepting function return values, modifying function return values, and modifying function parameters.

[0012] In a possible implementation, the first privacy protection rule further includes several scenario conditions for triggering the privacy protection action.

[0013] In one possible implementation, the scenario condition is determined based on the environmental state, which includes one or more of whether the application is in the foreground / background, the application's background residence time, the module's current URL, the module's current window, and the frequency of calling the privacy access API.

[0014] In one possible implementation, the scenario conditions include: whether the application is in the foreground / foreground / background, whether the application's background residence time reaches a predetermined first threshold, whether the application's current URL is a predetermined monitoring URL, whether the application's current window is a predetermined monitoring window, and whether the call frequency of the privacy access API reaches a predetermined second threshold. One or more of these.

[0015] In one possible implementation, the privacy protection action includes a cache priority search for the first privacy access permission setting;

[0016] Determining a first execution result of the first function according to the first privacy protection rule includes:

[0017] When it is determined that the first privacy API called by the first function belongs to the plurality of privacy access APIs associated with the first privacy access right, searching for a previous execution result of the first privacy API from a preset cache;

[0018] If the search is successful, the first execution result of the first function is determined based on the previous execution result.

[0019] In one possible implementation, the method further includes:

[0020] If the search is unsuccessful, the first execution result is determined based on the current execution result of the first function.

[0021] In one possible implementation, the method further includes:

[0022] The first execution result is stored in the cache.

[0023] In a possible implementation, determining the first module to which the first function belongs includes:

[0024] Get the function address / symbol of the first function;

[0025] The first module to which the first function belongs is determined according to the function address / symbol and a pre-established function-module mapping table between the function and the plurality of functional modules.

[0026] In a possible implementation, the function-module mapping table is established when the target application is compiled, at least according to the function modules included in the target application and the function addresses / symbols of the functions included in the function modules.

[0027] According to a second aspect, a privacy protection device for a target application in a mobile terminal is provided, wherein the target application is divided into multiple functional modules, and the method device includes:

[0028] a module determining unit configured to, in response to execution of a first function in the target application, determine a first module to which the first function belongs from the plurality of functional modules;

[0029] The rule execution unit is configured to determine a first execution result of the first function according to a first privacy protection rule pre-set for the first module, wherein the first privacy protection rule is used to limit the privacy access behavior of the first module with respect to the mobile terminal.

[0030] In a possible implementation, the first privacy protection rule includes a plurality of privacy access rights of the mobile terminal and a plurality of privacy protection actions for the plurality of privacy access rights; wherein a single privacy access right corresponds to a single category of private data.

[0031] In a possible implementation, the plurality of privacy access rights include a first privacy access right for first category private data, where the first privacy access right is configured to be associated with a plurality of privacy access APIs requesting access to the first category private data.

[0032] In a possible implementation, the privacy access rights include one or more of: address book access right, geographic location access right, camera access right, recording access right, sensor access right, calendar access right, health data access right, Bluetooth access right, and installation list access right.

[0033] In a possible implementation, the privacy protection action includes one of: denying access, allowing access during application execution, prompting the user whether to allow access, intercepting function return values, modifying function return values, and modifying function parameters.

[0034] In a possible implementation, the first privacy protection rule further includes several scenario conditions for triggering the privacy protection action.

[0035] In one possible implementation, the scenario condition is determined based on the environmental state, which includes one or more of whether the application is in the foreground / background, the application's background residence time, the module's current URL, the module's current window, and the frequency of calling the privacy access API.

[0036] In one possible implementation, the scenario conditions include: whether the application is in the foreground / foreground / background, whether the application's background residence time reaches a predetermined first threshold, whether the application's current URL is a predetermined monitoring URL, whether the application's current window is a predetermined monitoring window, and whether the call frequency of the privacy access API reaches a predetermined second threshold. One or more of these.

[0037] In one possible implementation, the privacy protection action includes a cache priority search for the first privacy access permission setting;

[0038] The rule execution unit is further configured as follows:

[0039] When it is determined that the first privacy API called by the first function belongs to the plurality of privacy access APIs associated with the first privacy access right, searching for a previous execution result of the first privacy API from a preset cache;

[0040] If the search is successful, the first execution result of the first function is determined based on the previous execution result.

[0041] In a possible implementation, the module determination unit is further configured to:

[0042] Get the function address / symbol of the first function;

[0043] The first module to which the first function belongs is determined according to the function address / symbol and a pre-established function-module mapping table between the function and the plurality of functional modules.

[0044] According to a third aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed in a computer, the computer is caused to execute the method described in the first aspect.

[0045] According to a fourth aspect, a computing device is provided, comprising a memory and a processor, wherein executable code is stored in the memory, and when the processor executes the executable code, the method described in the first aspect is implemented.

[0046] By utilizing one or more of the methods, apparatuses, computing devices, and storage media in the above aspects, the privacy access behavior of user mobile applications can be protected, and the applications can be guaranteed to use the privacy permissions of the mobile terminal safely and healthily. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0048] Figure 1 A schematic diagram illustrating a principle of a privacy protection method for a target application in a mobile terminal according to an embodiment of this specification;

[0049] Figure 2 A schematic diagram showing a scenario triggering condition according to an embodiment of this specification;

[0050] Figure 3 A schematic diagram illustrating a privacy protection action according to an embodiment of this specification;

[0051] Figure 4 A schematic diagram showing a function module mapping table according to an embodiment of this specification;

[0052] Figure 5 A schematic diagram illustrating cache priority lookup corresponding to cache objects and settings according to an embodiment of this specification;

[0053] Figure 6 A flowchart of a privacy protection method for a target application in a mobile terminal according to an embodiment of this specification is shown.

[0054] Figure 7 A structural diagram of a privacy protection device for a target application in a mobile terminal according to an embodiment of this specification is shown. DETAILED DESCRIPTION

[0055] The solution provided in this invention will be described below with reference to the accompanying drawings.

[0056] As mentioned above, mobile privacy protection is currently a hot topic of concern to regulators and the industry. Currently, some mobile terminal manufacturers usually provide users with privacy authorization capabilities for different privacy access rights for different applications APP through mobile operating systems or dedicated application management programs. For example, in the privacy protection solutions provided by some manufacturers, users are given choices such as YES / NO for most privacy access rights, that is, the choice of allowing access or not allowing access. For some of the privacy access rights, more detailed choices may be provided, such as allowing the APP to call privacy permissions during use, allowing the APP to call permissions in the background all the time, etc. Some manufacturers also provide, for example, capturing all privacy access behaviors of all applications and displaying the captured behavior information to users, so as to help users make choices such as allowing access or not allowing access based on this information.

[0057] However, a drawback of these solutions is that they all apply control to the entire application. This approach can prevent legitimate privacy access attempts, potentially preventing some legitimate functionality. On the other hand, without control, there's no way to limit the abuse of privacy within applications, creating a difficult dilemma for users.

[0058] In order to solve the above technical problems, the embodiments of this specification provide a privacy protection method and apparatus for a target application in a mobile terminal. Figure 1 The following is a schematic diagram showing the principle of a privacy protection method for a target application in a mobile terminal according to an embodiment of this specification. Figure 1 , explaining the main idea of ​​this method. This method can be divided into two stages:

[0059] In the first stage, each functional module of the application is matched with the pre-set privacy protection rules.

[0060] First, the various privacy access API (Application Programming Interface) functions on the mobile terminal are divided according to the type of privacy access data. For example, in one embodiment, all privacy access APIs on the mobile terminal can be divided into groups such as address book access, location access, camera access, audio recording access, sensor access, calendar access, health data access, Bluetooth access, and installation list access based on the type of privacy data they access. In one example, the six location access APIs on an iOS terminal—startUpdatingLocation, stopUpdatingLocation, startMonitoringSignificantLocationChanges, stopMonitoringSignificantLocationChanges, requestWhenInUseAuthorization, and requestAlwaysAuthorization—can be divided into API groups corresponding to location access. Similarly, APIs related to address book access, camera access, audio recording access, etc. can also be grouped separately. Furthermore, each API group can be associated with the privacy access rights corresponding to the privacy data it requests access to (in this specification, privacy access rights refer to access rights for a category of privacy data). In other words, all privacy access APIs are grouped according to the type of privacy access data.

[0061] After determining the API groups corresponding to the various privacy access rights on the mobile terminal, multiple privacy protection actions for the multiple privacy access rights can be formulated as privacy protection rules. The privacy protection action here refers to the control action for privacy access behavior. In one embodiment, for example, it can be one of allowing / denying access, allowing access during application operation, prompting the user whether to allow access, intercepting API function return values, modifying function return values, etc. A privacy protection rule includes multiple privacy protection actions for multiple privacy access rights. In one example, privacy protection rule A, for example, has privacy protection actions for multiple privacy access rights: the protection action for address book access is to prompt the user whether to allow access, the protection action for camera access is to allow access during application operation, the protection action for health data access is to deny access, etc. In one example, a variety of different privacy protection rules can be formulated, in which different privacy protection actions for multiple privacy access rights can be defined.

[0062] According to one embodiment, when setting a privacy protection rule, in addition to setting privacy protection actions for multiple privacy access rights, the scenario conditions for triggering the privacy protection actions can also be set. For example, in one example, a privacy protection rule that is set may include that when the application is in the foreground, the protection action for camera access is to allow access. In other words, whether the application is in the foreground is a prerequisite for determining whether camera access is allowed. In different embodiments, multiple scenario conditions for privacy protection actions for different privacy access rights can be set according to the operating environment on the terminal, for example, whether the application is in the foreground / front and back, whether the application's background residence time exceeds a predetermined time, whether the call frequency of the privacy access API exceeds a warning value, etc. In one embodiment, for example, several privacy protection rules can also be set, including different settings for privacy protection actions for multiple privacy access rights and their triggering conditions.

[0063] Then, after obtaining several privacy protection rules, each functional module of the mobile application can be matched to the privacy protection rules, or in other words, a corresponding privacy protection rule can be assigned or set for each functional module. Thus, the privacy access behavior of each functional module on the terminal will be limited by the privacy protection rule it matches. For example, in one example, application 1 has functional modules 1, 2, and 3, and they match privacy protection rules A, B, and C, respectively. The privacy access behavior of functional modules 1, 2, and 3 is then limited by privacy protection rules A, B, and C, respectively. Furthermore, if privacy protection rules A, B, and C set different protection actions for the same privacy access rights under the same trigger conditions, functional modules 1, 2, and 3 may also obtain different privacy access rights in the same operating environment scenario. For example, if privacy protection rule A allows camera access when the application is in the foreground, while privacy protection rule B prohibits camera access when the application is in the foreground, then when the application is in the foreground, functional module 1 can access the camera, but functional module 2 cannot. Since privacy protection rules can include privacy protection actions and their triggering conditions for multiple privacy access rights, the protection of privacy access behaviors of functional modules can be defined according to the privacy protection rules, without having to set them separately for each privacy access right or even for each privacy access API contained in each privacy access right. Figure 1 As shown, when the first privacy protection rule matches the first module, various privacy access behaviors of the first module (such as location access, address book access, camera access, etc.) can be limited according to the first privacy protection rule.

[0064] In the second phase, during application runtime, the execution results of functions within each module are determined based on the privacy protection rules matched by each module. A module's execution unit is typically a function, and the module's privacy access behavior is typically specific to the execution of that function. However, during actual production, the application runtime can typically obtain the function address or function symbol of the currently executing function through the function stack, but the functional module to which the function belongs cannot be determined. Therefore, in one embodiment, for example, during the application's compilation phase, code scanning can be performed to establish a function-module mapping table based on the various functional modules included in the application and the function addresses / symbols of the functions within each functional module. Furthermore, during application runtime, the obtained function address / symbol can be used to determine the application module to which the function corresponding to the function address / symbol belongs based on the function-module mapping table. This allows the execution result of the function to be determined based on the privacy protection rules of the application module. Figure 4 A schematic diagram showing a function module mapping table according to an embodiment of this specification.

[0065] In a specific embodiment, the execution result can be determined based on whether the currently executed function belongs to the privacy access API associated with the aforementioned various privacy access rights, and whether the privacy protection rules matched by the function module to which the currently executed function belongs are further determined. Figure 1 If the first function included in the first module is API1 for location access, the execution result of the first function can be determined based on the first privacy protection rule matched by the first module. For example, the protection action to be implemented can be determined based on whether the current operating environment meets the trigger scenario condition 1 of the first privacy protection rule for location access rights, thereby determining the execution result of the first function. In an example, the trigger scenario condition 1 can be, for example, Figure 2 The application's background residency time is shown to be greater than 30 seconds, and the privacy protection action is, for example, to deny access. That is, when the first function is executed, if the application has been in the background for more than 30 seconds, the first function cannot obtain the current terminal location information. If the application has been in the background for less than 30 seconds, the first function can obtain the current terminal location information. In various embodiments, the execution result of the first function can be controlled, for example, using hooking technology.

[0066] In a specific embodiment, the previous execution results of the privacy access API function can also be put into the cache, and a setting of preferentially searching from the cache can be added to the privacy protection rule (for example, by setting the corresponding privacy protection action, such as Figure 3As shown, the cached content can be used as the execution result of the API function, without requiring actual system-level terminal privacy access. This can meet the privacy needs of applications / modules to a certain degree of accuracy, while also reducing the frequency of system-level privacy access on the terminal. Frequent API access can often indicate the risk of abnormal privacy access, and reducing access frequency can reduce this risk. Therefore, while meeting the normal needs of applications / modules, terminal privacy can be protected from frequent access, thereby protecting user privacy.

[0067] In summary, the advantages of using this method are as follows: First, privacy access rights can be allocated in a detailed manner based on the functional modules of the application. Compared with the existing privacy access rights allocation for the entire application, the modular privacy access rights allocation within the application can utilize the differentiation of the access requirements for privacy data within the application to more accurately implement differentiated control. Therefore, it can more conveniently and effectively control the reasonable use of device permissions by the application while protecting user privacy. Second, the permission access API is grouped according to different abstract privacy access rights, and then the privacy access rights are matched to the functional modules of the application. This eliminates the need to consider the specific call relationships of a large number of APIs in each permission match, greatly reducing the workload of permission configuration. Third, through the API execution result caching mechanism, the application can obtain relatively accurate return results while limiting the frequency of application access to device privacy permissions to a reasonable range, avoiding the risk of excessive application access to device privacy and avoiding poor performance such as application unavailability and crashes when there are no results.

[0068] The detailed process of this method is described below. Figure 6 FIG2 shows a flow chart of a privacy protection method for a target application in a mobile terminal according to an embodiment of this specification. Figure 6 Said method comprises at least the following steps:

[0069] Step 61: In response to execution of a first function in the target application, determining a first module to which the first function belongs from the plurality of functional modules;

[0070] Step 62: Determine a first execution result of the first function according to a first privacy protection rule pre-set for the first module, wherein the first privacy protection rule is used to limit the privacy access behavior of the first module with respect to the mobile terminal.

[0071] First, in step 61 , in response to the execution of a first function, a module to which the first function belongs is determined from a plurality of functional modules.

[0072] The target application is an application (or application program) on a mobile terminal. Typically, an application can be composed of multiple functional modules. In different embodiments, the application can be further divided into different functional modules based on, for example, business details, functional classification, or architectural design objectives. This specification does not limit the principles and specific methods for dividing the functional modules of the target application.

[0073] A function is a component of an application's running program. It generally refers to a program or code that can be directly referenced by another program or code. In different embodiments, an application may include different types of functions, such as global functions, static functions, and member functions. It may also include functions that simply call other functions, such as the main function. This specification does not limit this.

[0074] In this step, the first function can be any function of the target application. Usually, when the application is running, the function will be pushed into the function stack for execution. In different embodiments, depending on the different operating systems installed on the mobile terminal, the function address or function symbol of the executed function can usually be obtained through the function stack. For example, on a mobile terminal with an IOS system installed, the function address of the function can be obtained through the function stack. On a mobile terminal with an Android system installed, the function symbol (symbol) of the function can be obtained through the function stack. However, the function module to which the executed function belongs cannot usually be known through the function stack. Therefore, in one embodiment, the function address / symbol of the first function can be obtained; based on the function address / symbol and the pre-established function-module mapping table between the function and the multiple function modules, the first module to which the first function belongs is determined. In a specific embodiment, the function-module mapping table can be established, for example, when the target application is compiled, at least based on the function modules included in the target application and the function addresses / symbols of the functions included in the function modules.

[0075] Then, in step 22, a first execution result of the first function is determined according to a first privacy protection rule that matches the first module.

[0076] In this step, the privacy protection rule is used to limit the privacy access behavior of the functional module to the mobile terminal. The first privacy protection rule can be a privacy protection rule that matches the first module among multiple pre-set privacy protection rules.

[0077] Specifically, a privacy protection rule can set privacy protection actions for multiple privacy access rights on a mobile terminal. Therefore, in one embodiment, a first privacy protection rule can include multiple privacy access rights for the mobile terminal and multiple privacy protection actions for each of these privacy access rights; wherein a single privacy access right corresponds to a single category of private data.

[0078] In different embodiments, different mobile terminals may have a large number of identical / different privacy access APIs, which can be categorized based on the type of private data accessed by these APIs. Furthermore, different privacy access rights are determined based on the type of private data accessed, and all privacy access APIs are then grouped according to the privacy access rights corresponding to the type of private data they access. Grouping APIs by privacy access rights allows for unified configuration of corresponding protection actions and triggering scenarios for APIs within the same group, eliminating the need to configure them for each API. This significantly simplifies the complexity and workload of configuring privacy access rights. Furthermore, APIs within the same group request similar / identical privacy data types, so setting the same protection actions and triggering conditions for them is statistically reasonable in actual production scenarios. Therefore, in one embodiment, the multiple privacy access rights may include a first privacy access right for a first category of private data, configured to be associated with multiple privacy access APIs requesting access to the first category of private data. In one embodiment, the multiple privacy access rights may include one or more of: address book access right, location access right, camera access right, recording access right, sensor access right, calendar access right, health data access right, Bluetooth access right, and installed list access right.

[0079] In different embodiments, the privacy protection actions for different privacy access rights in the set privacy protection rules can be the same / different types. In one embodiment, the privacy protection action can be one of: denying access, allowing access during application operation, prompting the user whether to allow access, intercepting function return value, modifying function return value, and modifying function parameters. Among them, intercepting function return value means preventing the API corresponding to the privacy access right from passing its return value to the calling function of the API. Modifying function return value means modifying the return value passed by the above-mentioned API to its calling function. Modifying function parameters means modifying the calling parameters passed by the calling function of the API to the API.

[0080] The operating scenario of a mobile application is often a key concern for users in determining whether their private data can be accessed. For example, some users may believe that access to location information or the camera is acceptable when the application is in the foreground, but be confused and disallowed by similar access when the application is in the background. To more precisely implement privacy access protection based on the specific operating scenario of the application, in various embodiments, the privacy protection rules may also include several scenario conditions that trigger the privacy protection action. In one embodiment, the scenario conditions may be determined based on the environmental state. In various embodiments, the environmental state may include, for example, one or more of: whether the application is in the foreground / background, the application's background dwell time, the module's current URL, the module's current window, and the frequency of calls to the privacy access API. Furthermore, in various embodiments, the scenario conditions may include, for example, one or more of: whether the application is in the foreground / background, whether the application's background dwell time reaches a predetermined first threshold, whether the application's current URL is a predetermined monitoring URL, whether the application's current window is a predetermined monitoring window, and whether the frequency of calls to the privacy access API reaches a predetermined second threshold.

[0081] As mentioned above, you can also use the cached API execution results so that when you call the same API later, you can directly obtain the previous API execution results from the cache, for example, within a predetermined time range. This ensures the reasonable needs of the application within a certain time accuracy and avoids the risk of high-frequency privacy access. Therefore, in one embodiment, the privacy protection action can be a cache priority search set for the first privacy access right. When it is determined that the first privacy API called by the first function belongs to several privacy access APIs associated with the first privacy access right, the previous execution result of the first privacy API can be searched from the pre-set cache; if the search is successful, the first execution result of the first function is determined based on the previous execution result.

[0082] If the cache does not contain a previous execution result for the same API, the API can be executed directly to obtain a timely execution result. Therefore, in one embodiment, if the search is unsuccessful, the first execution result is determined based on the current execution result of the first privacy API. After obtaining the current execution result, it can be saved to the cache for direct use in subsequent calls to the same API. Therefore, in one embodiment, the current execution result can also be stored in the cache.

[0083] Since the private information required by the application is often time-sensitive, expired information often loses its value. In order to ensure the validity of the information in the cache. In one embodiment, Figure 5As shown, a timestamp indicating the previous execution time can be added to the previous execution results of each API in the cache. When the same API is subsequently executed, the timestamp determines whether to use the previous execution result. In one embodiment, a cache cycle can also be set to update the cache, for example, updating the cache every 30 seconds. In different examples, for example, API updates can be automatically executed upon expiration, or updated only when called, etc.

[0084] The above-described embodiment of this specification provides a privacy protection method for a target application in a mobile terminal. Another embodiment of this specification also provides a privacy protection device for a target application in a mobile terminal. Figure 6 FIG1 shows a structural diagram of a privacy protection device for a target application in a mobile terminal according to an embodiment of the present specification. The target application is divided into multiple functional modules, such as Figure 7 As shown, the apparatus 700 includes:

[0085] a module determining unit 71 configured to, in response to execution of a first function in the target application, determine a first module to which the first function belongs from the plurality of functional modules;

[0086] The rule execution unit 72 is configured to determine a first execution result of the first function according to a first privacy protection rule pre-set for the first module, wherein the first privacy protection rule is used to limit the privacy access behavior of the first module with respect to the mobile terminal.

[0087] In one embodiment, the first privacy protection rule may include several privacy access rights of the mobile terminal and several privacy protection actions for the several privacy access rights; wherein a single privacy access right corresponds to a single category of private data.

[0088] In one embodiment, the plurality of privacy access rights may include a first privacy access right for first category private data, where the first privacy access right is configured to be associated with a plurality of privacy access APIs requesting access to the first category private data.

[0089] In one embodiment, the privacy access rights may include one or more of: contact book access right, geographic location access right, camera access right, recording access right, sensor access right, calendar access right, health data access right, Bluetooth access right, and installation list access right.

[0090] In one embodiment, the privacy protection action may include: denying access, allowing access during application execution, prompting the user whether to allow access, intercepting function return values, modifying function return values, and modifying function parameters.

[0091] In one embodiment, the first privacy protection rule may further include several scenario conditions for triggering the privacy protection action.

[0092] In one embodiment, the scenario condition can be determined based on the environmental status, which includes one or more of whether the application is in the foreground / background, the application background residence time, the current URL of the module, the current window of the module, and the call frequency of the privacy access API.

[0093] In one embodiment, the scenario conditions may include: whether the application is in the foreground / foreground / background, whether the application's background residence time reaches a predetermined first threshold, whether the application's current URL is a predetermined monitoring URL, whether the application's current window is a predetermined monitoring window, and whether the call frequency of the privacy access API reaches a predetermined second threshold. One or more of these.

[0094] In one embodiment, the privacy protection action may include a cache-first search for the first privacy access permission setting;

[0095] The rule execution unit can be further configured as follows:

[0096] When it is determined that the first privacy API called by the first function belongs to the plurality of privacy access APIs associated with the first privacy access right, searching for a previous execution result of the first privacy API from a preset cache;

[0097] If the search is successful, the first execution result of the first function is determined based on the previous execution result.

[0098] In one embodiment, the module determination unit may be further configured to:

[0099] Get the function address / symbol of the first function;

[0100] The first module to which the first function belongs is determined according to the function address / symbol and a pre-established function-module mapping table between the function and the plurality of functional modules.

[0101] On another aspect, the present specification provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed in a computer, the computer is caused to execute any one of the above methods.

[0102] On another aspect, the present specification provides a computing device, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, any one of the above methods is implemented.

[0103] It should be understood that the descriptions such as “first” and “second” in this article are only used to distinguish similar concepts for the sake of simplicity of description and do not have any other limiting effect.

[0104] Those skilled in the art will appreciate that, in one or more of the above examples, the functions described herein may be implemented using hardware, software, firmware, or any combination thereof. When implemented using software, these functions may be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0105] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent replacements, improvements, etc. made on the basis of the technical solution of the present invention should be included in the scope of protection of the present invention.

Claims

1. A privacy protection method for a target application in a mobile terminal, wherein the target application is divided into multiple functional modules, the method comprising: In response to execution of a first function in the target application, determining a first module to which the first function belongs from the plurality of functional modules; A first execution result of the first function is determined based on a first privacy protection rule pre-set for the first module, wherein the first privacy protection rule is used to limit the privacy access behavior of the first module with respect to the mobile terminal; the first privacy protection rule includes a plurality of privacy access rights of the mobile terminal and a plurality of privacy protection actions with respect to the plurality of privacy access rights; wherein a single privacy access right corresponds to a single category of privacy data, the plurality of privacy access rights include a first privacy access right with respect to a first category of privacy data, and the first privacy access right is configured to be associated with a plurality of privacy access APIs requesting access to the first category of privacy data.

2. The method according to claim 1, wherein The several privacy access rights include: one or more of: address book access right, geographic location access right, camera access right, recording access right, sensor access right, calendar access right, health data access right, Bluetooth access right and installation list access right.

3. The method according to claim 1, wherein The privacy protection action includes one of: denying access, allowing access during application operation, prompting the user whether to allow access, intercepting function return values, modifying function return values, and modifying function parameters.

4. The method according to claim 1, wherein The first privacy protection rule also includes several scenario conditions that trigger the privacy protection action.

5. The method according to claim 4, wherein The scenario condition is determined based on the environment state, which includes one or more of whether the application is in the foreground / background, the application background residence time, the current URL of the module, the current window of the module, and the calling frequency of the privacy access API.

6. The method according to claim 5, wherein: The scenario conditions include: whether the application is in the foreground / foreground / background, whether the application's background residence time reaches a predetermined first threshold, whether the application's current URL is a predetermined monitoring URL, whether the application's current window is a predetermined monitoring window, and whether the call frequency of the privacy access API reaches a predetermined second threshold. One or more of these.

7. The method according to claim 1, wherein The privacy protection action includes a cache priority search for the first privacy access permission setting; Determining a first execution result of the first function according to the first privacy protection rule includes: When it is determined that the first privacy API called by the first function belongs to the plurality of privacy access APIs associated with the first privacy access right, searching for a previous execution result of the first privacy API from a preset cache; If the search is successful, the first execution result of the first function is determined based on the previous execution result.

8. The method according to claim 7, further comprising: If the search is unsuccessful, the first execution result is determined based on the current execution result of the first privacy API.

9. The method according to claim 8, further comprising: The current execution result is stored in the cache.

10. The method according to claim 1, wherein Determining the first module to which the first function belongs includes: Get the function address / symbol of the first function; The first module to which the first function belongs is determined according to the function address / symbol and a pre-established function-module mapping table between the function and the plurality of functional modules.

11. The method according to claim 10, wherein: The function-module mapping table is established when the target application is compiled, at least according to the function modules included in the target application and the function addresses / symbols of the functions included in the function modules.

12. A privacy protection device for a target application in a mobile terminal, wherein the target application is divided into multiple functional modules, the device comprising: a module determining unit configured to, in response to execution of a first function in the target application, determine a first module to which the first function belongs from the plurality of functional modules; A rule execution unit is configured to determine a first execution result of the first function based on a first privacy protection rule pre-set for the first module, wherein the first privacy protection rule is used to limit the privacy access behavior of the first module with respect to the mobile terminal; the first privacy protection rule includes a plurality of privacy access rights for the mobile terminal, and a plurality of privacy protection actions for the plurality of privacy access rights; wherein a single privacy access right corresponds to a single category of privacy data, the plurality of privacy access rights include a first privacy access right for a first category of privacy data, and the first privacy access right is configured to be associated with a plurality of privacy access APIs requesting access to the first category of privacy data.

13. The device according to claim 12, wherein The several privacy access rights include: one or more of: address book access right, geographic location access right, camera access right, recording access right, sensor access right, calendar access right, health data access right, Bluetooth access right and installation list access right.

14. The device according to claim 12, wherein The privacy protection action includes one of: denying access, allowing access during application operation, prompting the user whether to allow access, intercepting function return values, modifying function return values, and modifying function parameters.

15. The device according to claim 12, wherein The first privacy protection rule also includes several scenario conditions that trigger the privacy protection action.

16. The device according to claim 15, wherein The scenario condition is determined based on the environment state, which includes one or more of whether the application is in the foreground / background, the application background residence time, the current URL of the module, the current window of the module, and the calling frequency of the privacy access API.

17. The device according to claim 16, wherein The scenario conditions include: whether the application is in the foreground / foreground / background, whether the application's background residence time reaches a predetermined first threshold, whether the application's current URL is a predetermined monitoring URL, whether the application's current window is a predetermined monitoring window, and whether the call frequency of the privacy access API reaches a predetermined second threshold. One or more of these.

18. The device according to claim 12, wherein The privacy protection action includes a cache priority search for the first privacy access permission setting; The rule execution unit is further configured as follows: When it is determined that the first privacy API called by the first function belongs to the plurality of privacy access APIs associated with the first privacy access right, searching for a previous execution result of the first privacy API from a preset cache; If the search is successful, the first execution result of the first function is determined based on the previous execution result.

19. The device according to claim 12, wherein The module determination unit is further configured as follows: Get the function address / symbol of the first function; The first module to which the first function belongs is determined according to the function address / symbol and a pre-established function-module mapping table between the function and the plurality of functional modules.

20. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 11.

21. A computing device comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method according to any one of claims 1 to 11 is implemented.

Images