Resource operation control method, electronic device, chip and readable storage medium

Abstract

The embodiment of the present application provides a resource operation control method, which relates to the field of electronic devices. By obtaining the permission information and identification information of the device driver, and binding the permission information and identification information to a preset storage area, when the driver process running the device driver attempts to operate the hardware resource through the hardware resource access interface, it is determined based on the permission information stored in the preset storage area whether the driver process has the operation permission to operate the hardware resource. If it is determined that the operation permission is available, the driver process is allowed to operate the hardware resource through the hardware resource access interface; if the operation permission is not available, the operation of the hardware resource is refused. The embodiment of the present application also provides an electronic device, a chip, and a computer-readable storage medium. The present application can realize the operation permission control of hardware resources to prevent the driver from illegally accessing or operating hardware resources.

Description

Technical Field

[0001] The present application relates to the field of terminal technology, and in particular to a resource operation control method, electronic device, chip and computer-readable storage medium. Background Art

[0002] With the development of the information society, various smart devices have sprung up like mushrooms after a spring rain. In order to reduce the difficulty of smart device driver development, existing operating system providers provide a mobile normalized user-mode device driver development framework, which enables various driver codes to be developed using normalized interfaces in user mode. After providing the ability to develop drivers in user mode, providers of specific hardware (such as cameras) can develop their own drivers based on the standard interface definition of the provider, and upgrade the drivers after being certified by the provider. There is no need to integrate all the codes into the system version for development, which greatly simplifies the driver development process of the device vendor, facilitates the rapid update of drivers on the device, and reduces the difficulty of the provider integrating third-party driver codes. However, after opening the device driver development to third parties, it is impossible to conduct substantial review and control of the third-party driver codes, which may lead to illegal access of third-party drivers to other hardware resources. Summary of the invention

[0003] In view of this, it is necessary to provide a resource operation control method, which can overcome the above problems, implement access permission control for hardware resources, and prevent the driver from illegally accessing or operating hardware resources.

[0004] The first aspect of an embodiment of the present application discloses a resource operation control method, including: obtaining permission information and identification information of a device driver; binding the permission information of the device driver with the identification information to obtain an operation permission information pair, and storing the operation permission information pair in a preset storage area; when a driver process running the device driver attempts to operate a hardware resource through a hardware resource access interface, based on the operation permission information pair stored in the preset storage area, determining whether the driver process has the operation permission to operate the hardware resource; and when it is determined that the driver process has the operation permission to operate the hardware resource, allowing the driver process to operate the hardware resource through the hardware resource access interface.

[0005] By adopting this technical solution, the operation authority control of hardware resources can be realized, preventing the driver from illegally accessing or operating the hardware resources.

[0006] In a possible implementation, binding the permission information of the device driver with the identification information to obtain an operation permission information pair includes: converting the permission information into a bit number; representing the bit number with a number in a preset base, wherein the preset base includes any one of binary, octal, decimal, and hexadecimal; and binding the number corresponding to the permission information with the identification information to obtain the operation permission information pair.

[0007] By adopting this technical solution, the permission information can be converted into a digital form that is easy to store and storage space can be saved.

[0008] In a possible implementation manner, the method further includes: saving the identification information into a data structure in the device driver for storing driver attributes.

[0009] By adopting this technical solution, the identification information of the device driver can be saved in its attribute data structure, which is convenient for subsequent search of permission information based on the identification information.

[0010] In one possible implementation, the method further includes: obtaining identification information stored in the device driver, and finding permission information corresponding to the identification information from the preset storage area based on the identification information; and saving the permission information corresponding to the identification information into a private data structure of the driver process.

[0011] By adopting this technical solution, it is possible to dynamically bind permission information to a driver process, thereby preventing other processes from impersonating the driver process and illegally operating hardware resources.

[0012] In one possible implementation, when the driver process running the device driver attempts to operate the hardware resource through the hardware resource access interface, based on the operation permission information pair stored in the preset storage area, determining whether the driver process has the operation permission to operate the hardware resource, including: when the driver process running the device driver attempts to operate the hardware resource through the hardware resource access interface, based on the permission information stored in the private data structure of the driver process, determining whether the driver process has the operation permission to operate the hardware resource.

[0013] By adopting this technical solution, it is possible to determine whether the operation authority for operating the hardware resource is possessed based on the authority information bound to the driver process, thereby preventing other processes from impersonating the driver process and illegally operating the hardware resources.

[0014] In a possible implementation, the method further includes: when permission information corresponding to the identification information is saved in a private data structure of the driver process, deleting the identification information and the permission information of the device driver stored in the preset storage area.

[0015] By adopting this technical solution, dynamic binding of permission information and driver process can be achieved, avoiding the risk of cracking by brute force or other means caused by storing permission information in a fixed area.

[0016] In a possible implementation, saving the permission information corresponding to the identification information in the private data structure of the driver process includes: if the driver process includes multiple security areas of different levels, saving the permission information corresponding to the identification information to the highest level security area of ​​the driver process.

[0017] By adopting this technical solution, when a driving process includes multiple security areas of different levels, permission information can be saved to the highest level security area of ​​the driving process, thereby improving the security of process operation.

[0018] In one possible implementation, when the driver process running the device driver attempts to operate the hardware resource through the hardware resource access interface, based on the operation permission information pair stored in the preset storage area, determining whether the driver process has the operation permission to operate the hardware resource includes: when the driver process running the device driver attempts to operate the hardware resource through the hardware resource access interface, obtaining the identification information stored in the device driver; and finding the permission information corresponding to the identification information from the preset storage area based on the identification information, and determining whether the driver process has the operation permission to operate the hardware resource based on the permission information found.

[0019] By adopting this technical solution, for devices with low security requirements, it can be achieved that whether the driving process has the operation authority to operate the hardware resources can be directly determined based on the authority information stored in the preset storage area.

[0020] In a possible implementation, the method further includes: generating a random number using a preset random number generation algorithm, and generating a hash ID using the random number as a seed; and defining the hash ID as identification information of the device driver.

[0021] By adopting this technical solution, it is possible to use random numbers to generate hash IDs and use them as identification information for device drivers, thereby improving the security of system operation.

[0022] In a possible implementation manner, the identification information of the device driver is any one of the device driver ID, the device driver name, the driver process ID that runs the device driver, and the driver process name that runs the device driver.

[0023] By adopting this technical solution, for devices with low security requirements, the device driver ID or name, or the driver process ID or name can be directly used as the identification information of the device driver, saving storage space.

[0024] In a possible implementation, the method further includes: when it is determined that the driver process does not have the operation authority to operate the hardware resource, refusing the driver process to operate the hardware resource through the hardware resource access interface.

[0025] By adopting this technical solution, when it is determined that the driver process does not have the operation authority to operate the hardware resource, the driver process is denied to operate the hardware resource.

[0026] In a possible implementation, the obtaining the permission information of the device driver includes: reading the permission configuration information of the device driver, and parsing the permission configuration information to obtain the permission information of the device driver.

[0027] By adopting this technical solution, it is possible to obtain the permission information of the device driver by parsing the read permission configuration information, which is convenient for subsequent permission checking.

[0028] In a second aspect, an embodiment of the present application provides a computer-readable storage medium, including computer instructions. When the computer instructions are executed on an electronic device, the electronic device executes the resource operation control method as described in the first aspect.

[0029] In a third aspect, an embodiment of the present application provides an electronic device, comprising a processor and a memory, wherein the memory is used to store instructions, and the processor is used to call the instructions in the memory so that the electronic device executes the resource operation control method described in the first aspect.

[0030] In a fourth aspect, an embodiment of the present application provides a computer program product. When the computer program product is run on a computer, the computer executes the resource operation control method as described in the first aspect.

[0031] In a fifth aspect, an embodiment of the present application provides a device having the function of implementing the electronic device behavior in the method provided in the first aspect above. The function can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions.

[0032] It can be understood that the computer-readable storage medium described in the second aspect, the electronic device described in the third aspect, the computer program product described in the fourth aspect, and the device described in the fifth aspect all correspond to the method of the first aspect. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding methods provided above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 A schematic diagram of a flow chart of a resource operation control method provided in an embodiment of the present application;

[0034] Figure 2 A schematic diagram of a system architecture for implementing resource operation control for an electronic device provided in an embodiment of the present application;

[0035] Figure 3 A schematic diagram of a system architecture for implementing resource operation control of an electronic device provided in another embodiment of the present application;

[0036] Figure 4 A schematic diagram of a system architecture for implementing resource operation control of an electronic device provided in yet another embodiment of the present application;

[0037] Figure 5 A schematic diagram of a system architecture for implementing resource operation control of an electronic device provided in yet another embodiment of the present application;

[0038] Figure 6 A flowchart of a driver management program control method provided in an embodiment of the present application;

[0039] Figure 7 A schematic diagram of the structure of a possible electronic device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0040] It should be noted that in this application, "at least one" means one or more, and "more than one" means two or more than two. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. The terms "first", "second", "third", "fourth", etc. (if any) in the specification, claims and drawings of this application are used to distinguish similar objects, rather than to describe a specific order or sequence.

[0041] To facilitate understanding, some illustrations of concepts related to the embodiments of the present application are given by way of example for reference.

[0042] Reference Figure 1As shown, a resource operation control method provided in an embodiment of the present application is applied to an electronic device 100, and the electronic device 100 may be a mobile phone, a computer, a smart watch, etc. In this embodiment, the resource operation control method may include:

[0043] 11. Get the permission information and identification information of the device driver.

[0044] In some embodiments, the device driver may refer to a hard disk driver, a graphics card driver, a screen driver, etc. of the electronic device 100. The permission information is a description of the hardware resources that the device driver can operate (such as read operation, write operation, pull-up operation, pull-down operation, open operation, close operation, etc.), for example, it records whether the device driver can operate hardware resources such as general purpose input output (GPIO), integrated circuit bus (I2C), serial peripheral interface (SPI), etc., or can read GPIO, write I2C, etc.

[0045] In some embodiments, the permission information of the device driver can be obtained by reading the permission configuration information of the device driver and parsing the permission configuration information, and the permission configuration information can be saved in a text file, a device tree file or a file in other formats. The permission information recorded in the permission configuration information can be expressed in the form of GPIO = "write", I2C = "read" (can read GPIO, write I2C), or Permission = ["GPIO", "I2C"] (can read and write GPIO, I2C), or Write_permission = ["GPIO", "I2C"] (can write GPIO, I2C) and the like.

[0046] In some embodiments, the permission configuration information of the device driver can be read and parsed when the electronic device 100 is powered on. When the permission information of multiple device drivers is parsed, the multiple permission information obtained by parsing can be temporarily stored in a designated storage area, or the permission information can be converted into other easy-to-store forms such as numbers before being temporarily stored. The permission information of multiple device drivers can be temporarily stored in one or more files.

[0047] In some embodiments, each hardware resource may be represented by 1 to 2 bits, and then the permission information of the hardware resource may be converted into numbers for representation. The numbers may be binary, octal, decimal, hexadecimal, etc.

[0048] For example, Bit0 to Bit7 can be used to represent hardware resources such as GPIO, SPI, I2C, High Performance Parallel Interface (HIPPI), Serial Advanced Technology Attachment (SATA), Peripheral Component Interconnect (PCI), Peripheral Component Interconnect Express (PCIe), and Universal Serial Bus (USB), as shown in Table 1 below:

[0049] Table 1

[0050] Bit7 Bit6 Bit5 Bit4 Bit3 Bit2 Bit1 Bit0 USB PCIe PCI SATA HIPPI I2C SPI GPIO

[0051] For the above 8 supported hardware resources, a one-bit data length can be used to indicate whether they can be operated. For example, the binary number "1" represents that the hardware resource can be operated, and the number "0" represents that the hardware resource cannot be operated. For example, the Bit0 to Bit7 corresponding to the permission information of device driver A is "00000011", which means that the permission information of device driver A has the permission to operate GPIO and SPI, but does not have the permission to operate I2C, HIPPI, SATA, PCI, PCIe and USB. The Bit0 to Bit7 "00000011" corresponding to the permission information of device driver A can be converted into the hexadecimal number "0x3", that is, the permission information of device driver A can be expressed as "0x3".

[0052] In actual system use, you can select an appropriate data length to represent permissions based on the capabilities of the hardware resources. For example, you can use two-bit data length or three-bit data length to represent permissions. For example, the binary number "10" represents that the hardware resource can be read, the number "01" represents that the hardware resource can be written, the binary number "11" represents that the hardware resource can be read and written, and the binary number "00" represents that the hardware resource cannot be operated.

[0053] In some embodiments, the identification information of the device driver can be obtained when the device driver is started, or the identification information of each device driver in the electronic device 100 can be obtained when the electronic device 100 is powered on. The identification information of the device driver can refer to information that can uniquely identify the device driver, such as the device driver ID, the device driver name, the driver process ID running the device driver, or the driver process name running the device driver.

[0054] In some embodiments, for application scenarios with high security requirements, a hash ID can also be used as the identification information of the device driver. Specifically, for the current device driver, a preset random number generator can be used to generate a random number, and a fixed-length hash ID is generated using the random number as a seed, and the hash ID is defined as the identification information of the device driver. For example, the hash ID generation function of OpenSSL can be used to generate a 64-bit hash ID. The random number generation algorithm used by the random number generator can be selected according to actual needs and is not limited here.

[0055] 12. Binding the permission information and identification information of the device driver to obtain an operation permission information pair, and storing the operation permission information pair in a preset storage area.

[0056] In some embodiments, the identification information of the device driver may be saved in a data structure related to the device driver, and the specific data structure of the device driver to be saved in may be preset according to actual needs. For example, the identification information of the device driver may be saved in a data structure in the device driver for storing driver attributes.

[0057] In some embodiments, when the permission information and identification information of the device driver are obtained, the permission information and identification information of the device driver can be bound to obtain an operation permission information pair, and the operation permission information pair is stored in a preset storage area. For example, the permission information of device driver A is represented by a hexadecimal number "0x3", the identification information of device driver A is "hash_ID1", and the operation permission information pair corresponding to device driver A is represented by<hash_ID1,0x3> The “hash_ID1” in the operation permission information pair is actually a 64-bit hash ID. For the sake of convenience, it is only represented by the symbol “hash_ID1”.

[0058] In some embodiments, the operating system loaded into the electronic device 100 generally divides one or more secure storage areas to store key information. The preset storage area may refer to a secure storage area, which may be a storage device controlled by dedicated hardware, or an area controlled by a secure OS such as a trusted execution environment (TEE) operating system (OS), or a storage area with higher security than the current device driver running space, for example, relative to user-mode programs, the kernel can be considered a secure storage area.

[0059] 13. When a driver process running the device driver program attempts to operate a hardware resource through a hardware resource access interface, determining whether the driver process has the operation authority to operate the hardware resource based on the operation authority information pair stored in the preset storage area.

[0060] In some embodiments, when a device driver needs to be started, a process may be created first, and the device driver may be assigned to run on the process, thereby executing the device driver.

[0061] The hardware resource may refer to the hardware resource that the current driver process attempts to operate, such as GPIO, I2C, SPI and other hardware resources. When the driver process of the device driver attempts to operate the hardware resource through the hardware resource access interface, it can be determined whether the driver process has the operation permission to operate the hardware resource based on the operation permission information pair stored in the preset storage area. Specifically, the driver process can obtain permissions based on the identification information saved by the device driver. The way to obtain permissions can be: through system security call to the secure storage area, and according to the identification information saved by the device driver, the permission information corresponding to the identification information is searched from the secure storage area, and then based on the permission information found, it is determined whether the driver process has the operation permission to operate the hardware resource. If the operation permission is obtained, the hardware resource can be operated normally; otherwise, if the operation permission is not obtained, the operation of the hardware resource is refused.

[0062] In some embodiments, when the permission information corresponding to the identification information stored by the device driver is found in the secure storage area, the permission information can also be saved in the private data structure of the driver process. For example, the private data structure is a priv data structure. If the device driver contains multiple access or operation permission information, a sub-data structure specifically used to store the multiple access or operation permission information can also be newly created in the priv data structure, and the permission information can be saved in the sub-data structure.

[0063] In some embodiments, if the driver process has multiple security zones of different levels, the permission information can be stored in the security zone with the highest security level. For example, on a Linux platform, if the kernel memory space is the security zone with the highest security level, the permission information can be stored in the kernel memory space of the driver process.

[0064] In some embodiments, a read-write lock can be set for the secure storage area to avoid mutual exclusion protection problems when multiple threads or multiple processes perform read and write operations on the secure storage area. The read-write lock can allow multiple processes or multiple threads to read the secure storage area, but only allow one process or thread to write to the secure storage area.

[0065] In some embodiments, in order to improve system security and prevent permission information from being stored in a fixed storage area and cracked by violence or other means, when the permission information corresponding to the identification information is saved in the private data structure of the driver process, the data corresponding to the identification information stored in the secure storage area can be deleted, that is, the identification information and the permission information corresponding to the identification information stored in the secure storage area are deleted. At the same time, since the driver process of the device driver is dynamically created, the permission information is stored in the private data structure of the dynamically created driver process. When the driver process exits, or an exception occurs, or it is attacked, or destroyed, the permission information is destroyed together to avoid leakage of permission information, further improving system security.

[0066] In some embodiments, when the driver process exits abnormally, the relevant data of the driver process will be destroyed, and the permission information saved by the driver process will also be cleared. When the driver management program detects that the driver process exits abnormally, it can re-acquire the permission information corresponding to the device driver, store the regenerated operation permission information pair in the secure storage area, re-create a new driver process, and re-save the permission information in the private data structure of the driver process, thereby realizing dynamic binding of permission information and the driver process, and preventing other processes from impersonating the driver process and illegally operating hardware resources.

[0067] It can be understood that for electronic devices 100 that do not require high security, the identification information and permission information can also be kept in the secure storage area. When the driver process of the device driver attempts to operate the hardware resource through the hardware resource access interface, it can directly go to the secure storage area to find the permission information corresponding to the identification information to perform permission verification. The permission information corresponding to the identification information can be saved in the private data structure of the driver process, or it may not be saved in the private data structure of the driver process.

[0068] In some embodiments, when the driver process needs to operate hardware resources, the hardware resource operation can be performed through the hardware resource access interface provided by the driver management program. The driver management program may refer to a collection of a series of programs provided to the device driver to operate hardware resources, start the driver process, and handle the abnormality of the driver process. The driver management program may be a collection of some processes, static libraries or shared libraries, or it may be some other common driver management program packages in the industry. When operating the hardware resource, the hardware resource access interface first reads the permission information stored in the driver process, and determines whether the hardware resource can be operated based on the permission information. For example, when the hardware resource is GPIO, when the driver process is ready to operate GPIO, it first checks the permission information bound in the private data structure of the driver process to see whether it has the permission to operate GPIO. If it has the permission, the driver process can be allowed to operate GPIO normally; otherwise, if it does not have the permission, the driver process is denied to operate GPIO.

[0069] 14. When it is determined that the driver process has the operation authority to operate the hardware resource, allow the driver process to operate the hardware resource through the hardware resource access interface.

[0070] 15. When it is determined that the driver process does not have the operation authority to operate the hardware resource, deny the driver process from operating the hardware resource through the hardware resource access interface.

[0071] In some embodiments, after the driver process completes the hardware resource operation, it can enter a waiting state and wait for other operation requests sent by the system. When the operation request of the driver process includes a new hardware resource operation request, it is necessary to re-check the authority, and the operation can only be performed normally if the operation authority of the hardware resource is obtained.

[0072] In some embodiments, the device driver may not perform hardware resource operations after startup. At this time, the driver process can enter a waiting state. When there is a need to operate hardware resources, the driver process will perform a permission check. Only when it has the operation permission for the hardware resource can it operate normally.

[0073] In some embodiments, when the driver management program is started, some device drivers may not be loaded and started, but loaded and started only when there is a need. For example, under normal circumstances, when the driver management program is started, all device drivers in the driver list can be loaded and started in sequence, and for the device driver of the hot-plug device in the driver list, loading and starting may not be performed first, and when the hot-plug device is detected to be connected, the device driver of the hot-plug device is started. That is, when waiting for a device driver startup request, the device driver is started, and then the permission information is obtained, the permission information is stored, and the permission check is performed before operating the hardware resources.

[0074] The above-mentioned resource operation control method can realize the operation permission control of the hardware underlying resources, thereby improving the security and reliability of the device driver operating the hardware resources, and preventing the device driver from illegally accessing or operating the hardware resources, or other illegal processes or illegal programs from illegally accessing or operating the hardware resources.

[0075] Reference Figure 2 As shown, a schematic diagram of a system architecture for implementing resource operation control of an electronic device 100 provided in one embodiment of the present application.

[0076] The driver management program 101 can parse the permission configuration file 102 (a file storing permission configuration information) to obtain the permission information Pemissions_1 of the device driver program A1.

[0077] For the device driver A1, the random number generator 103 may generate a random number, and further generate a hash identifier Hash_ID1 based on the random number, and save the hash identifier Hash_ID1 into the relevant data structure of the device driver A1.

[0078] The driver management program 101 binds the permission information Pemissions_1 and the hash identifier Hash_ID1 to form an operation permission information pair<Hash_ID1,Pemissions_1> , and then apply the operation permission information to<Hash_ID1,Pemissions_1> Stored in secure storage area 104.

[0079] For the device driver A1, the driver management program 101 may create a driver process 105 to run the device driver A1.

[0080] When the driver management program 101 starts the driver process 105 to run the device driver program A1, the driver process 105 can query the permission information corresponding to the hash identifier Hash_ID1 stored in the secure storage area 104 based on the hash identifier Hash_ID1 saved by the device driver program A1, that is, the permission information Pemissions_1 can be found in the secure storage area 104 based on the hash identifier Hash_ID1 saved by the device driver program A1, and the permission information Pemissions_1 can be saved in the private data structure of the driver process 105.

[0081] When the permission information Pemissions_1 is stored in the private data structure of the driver process 105, the operation permission information stored in the secure storage area 104 can be used to<Hash_ID1,Pemissions_1> Deletion can avoid the risk of permission information being stored in a fixed storage area and being cracked by brute force or other means.

[0082] When the driver process 105 operates the hardware resource 107 ( Figure 2 When the hardware resources 107 include SPI, GPIO, and I2C as an example, the hardware resource access interface 106 can perform a permission check to determine whether the driver process 105 has the operation permission for the corresponding hardware resources based on the permission information Pemissions_1 stored in the private data structure of the driver process 105; if it is considered that the driver process 105 has the operation permission, the driver process 105 can operate the corresponding hardware resources normally, otherwise, the driver process 105 is denied to operate the corresponding hardware resources.

[0083] It can be understood that for other device drivers, their resource operation control methods are the same as that of the device driver A1, and will not be described in detail here.

[0084] Reference Figure 3 FIG. 1 is a schematic diagram of a system architecture of an electronic device 100 implementing resource operation control according to another embodiment of the present application. Figure 2 In contrast, the operation permission information pair can always be retained in the secure storage area 104 .

[0085] In this scenario, the permission information Pemissions_1 does not need to be stored in the private data structure of the driver process 105. When the driver process 105 operates the hardware resource 107 through the hardware resource access interface 106, the hardware resource access interface 106 can directly perform a permission check based on the operation permission information stored in the secure storage area 104, that is, the permission information Pemissions_1 can be directly found in the secure storage area 104 based on the hash identifier Hash_ID1 saved by the device driver program A1, and it is determined whether the driver process 105 has the operation permission of the corresponding hardware resource according to the found permission information Pemissions_1; if it is considered that the driver process 105 has the operation permission, the driver process 105 can operate the corresponding hardware resource normally, otherwise, the driver process 105 is refused to operate the corresponding hardware resource.

[0086] In some embodiments, for an electronic device 100 with a small memory space or low security requirements, if the hash identifier Hash_ID1 occupies more storage space, the device driver ID, device driver name, driver process ID, driver process name, etc. can also be directly used as identification information.

[0087] Reference Figure 4 As shown, another embodiment of the present application provides a schematic diagram of a system architecture of an electronic device 100 for implementing resource operation control. Figure 4 In the example, the driver process ID is used as the identification information of the device driver program A1.

[0088] The driver management program 101 can parse the permission configuration file 102 to obtain the permission information Pemissions_1 of the device driver program A1.

[0089] For the device driver A1, the driver management program 101 may create a driver process 105 to run the device driver A1, and may save the process identifier Process_ID1 of the driver process 105 into a related data structure of the device driver A1.

[0090] The driver management program 101 can bind the permission information Pemissions_1 and the process identifier Process_ID1 to form an operation permission information pair.<Process_ID1,Pemissions_1> , and then apply the operation permission information to<Process_ID1,Pemissions_1> Stored in secure storage area 104.

[0091] When the driver management program 101 starts the driver process 105 to run the device driver program A1, the driver process 105 can query the permission information corresponding to the process identifier Process_ID1 stored in the secure storage area 104 based on the process identifier Process_ID1 saved by the device driver program A1, that is, the permission information Pemissions_1 can be found in the secure storage area 104 based on the process identifier Process_ID1 saved by the device driver program A1, and the permission information Pemissions_1 can be saved in the private data structure of the driver process 105.

[0092] When the permission information Pemissions_1 is stored in the private data structure of the driver process 105, the operation permission information stored in the secure storage area 104 can be used to<Process_ID1,Pemissions_1> Deletion can avoid the risk of permission information being stored in a fixed storage area and being cracked by brute force or other means.

[0093] When the driver process 105 operates the hardware resource 107 ( Figure 4 When the hardware resources 107 include SPI, GPIO, and I2C as an example, the hardware resource access interface 106 can perform a permission check to determine whether the driver process 105 has the operation permission for the corresponding hardware resources based on the permission information Pemissions_1 stored in the private data structure of the driver process 105; if it is determined that the driver process 105 has the operation permission, the driver process 105 can operate the corresponding hardware resources normally; if it is determined that the driver process 105 does not have the operation permission, the driver process 105 is denied to operate the corresponding hardware resources.

[0094] Reference Figure 5 FIG. 1 is a schematic diagram of a system architecture of an electronic device 100 implementing resource operation control according to another embodiment of the present application. Figure 4 In contrast, the rights information pair may be retained in the secure storage area 104 at all times.

[0095] In this scenario, the permission information Pemissions_1 does not need to be stored in the private data structure of the driver process 105. When the driver process 105 operates the hardware resource 107 through the hardware resource access interface 106, the hardware resource access interface 106 can directly perform a permission check based on the operation permission information stored in the secure storage area 104, that is, the permission information Pemissions_1 can be directly found in the secure storage area 104 based on the process identifier Process_ID1 saved by the device driver program A1, and it is determined whether the driver process 105 has the operation permission of the corresponding hardware resource according to the found permission information Pemissions_1; if it is considered that the driver process 105 has the operation permission, the driver process 105 can operate the corresponding hardware resource normally, and if it is considered that the driver process 105 does not have the operation permission, the driver process 105 is denied to operate the corresponding hardware resource.

[0096] like Figure 6 As shown, a driver management program control method provided in an embodiment of the present application is applied to an electronic device 100. In this embodiment, the driver management program control method may include:

[0097] 61. Start the driver management program 101 and control the driver management program 101 to read the permission configuration information according to a preset storage path, and parse the permission configuration information to create a device data structure.

[0098] In some embodiments, the driver management program 101 can be started when the electronic device 100 is turned on. The preset storage path is the file path where the permission configuration information is currently stored, and the preset storage path can be set according to actual needs.

[0099] In some embodiments, the permission configuration information may be as shown in the following code:

[0100]

[0101]

[0102] The "permissions" field in the above code represents the permission information of the device driver, and the string following the "permissions" field represents the hardware resources that the device driver can operate. For example, permissions = "gpio, spi" means that the two hardware resources gpio and spi can be operated.

[0103] In some embodiments, parsing the permission configuration information to create a device data structure may refer to extracting multiple key fields and the strings following them from the permission configuration information, and storing the multiple key fields and the strings following them in a data structure, and the data structure storing the multiple key fields and the strings following them is the device data structure. Multiple key fields can be set according to actual needs, such as including the "hostId", "hostName", "driverId", "driverName", "deviceId", "deviceName", "serviceName", "driverPath", "permissions" fields in the above code, etc.

[0104] In some embodiments, a device permission tree structure can also be constructed by parsing the permission configuration information, so as to facilitate the subsequent startup of the device driver based on the device permission tree structure. For example, the first-level node of the device permission tree structure is "root", the second-level node is "host", the third-level node is "driver", and the fourth-level node is "device".

[0105] 62. Control the driver management program 101 to start the device driver program based on the device data structure.

[0106] In some embodiments, the driver management program 101 can create a new process according to the device data structure, and assign host0 to the new process to run, and the host0 process can then create a child process or thread to run the device driver under its node, such as running the device driver of device device0 to start device device0. Similarly, the driver management program 101 can also create a new process according to the device data structure, and assign host1 to the new process to run, and the host1 process can then create a child process or thread to run the device driver under its node, such as running the device driver of device device1 to start device device1.

[0107] In some embodiments, after the driver management program 101 starts the host0 process or the host1 process, the subsequent execution steps can be controlled by the host0 process or the host1 process. When starting the device driver of each device, the host0 process or the host1 process will obtain and judge permissions to determine whether it has the operating permission to operate hardware resources.

[0108] refer to Figure 7 , is a schematic diagram of the hardware structure of the electronic device 100 provided in the embodiment of the present application. Figure 7As shown, the electronic device 100 may include a processor 1001, a memory 1002, and a communication bus 1003. The memory 1002 is used to store one or more computer programs 1004. The one or more computer programs 1004 are configured to be executed by the processor 1001. The one or more computer programs 1004 include instructions, and the above instructions can be used to implement the above resource operation control method or drive management program control method in the electronic device 100.

[0109] It is understandable that the structure shown in this embodiment does not constitute a specific limitation on the electronic device 100. In other embodiments, the electronic device 100 may include more or fewer components than shown, or combine or separate some components, or arrange the components differently.

[0110] The processor 1001 may include one or more processing units, for example, the processor 1001 may include an application processor (AP), a graphics processing unit (GPU), an image signal processor (ISP), a controller, a video codec, a DSP, a CPU, a baseband processor, and / or a neural-network processing unit (NPU), etc. Different processing units may be independent devices or integrated into one or more processors.

[0111] The processor 1001 may also be provided with a memory for storing instructions and data. In some embodiments, the memory in the processor 1001 is a cache memory. The memory may store instructions or data that the processor 1001 has just used or circulated. If the processor 1001 needs to use the instruction or data again, it may be directly called from the memory. This avoids repeated access, reduces the waiting time of the processor 1001, and thus improves the efficiency of the system.

[0112] In some embodiments, the processor 1001 may include one or more interfaces. The interface may include an inter-integrated circuit (I2C) interface, an inter-integrated circuit sound (I2S) interface, a pulse code modulation (PCM) interface, a universal asynchronous receiver / transmitter (UART) interface, a mobile industry processor interface (MIPI), a general-purpose input / output (GPIO) interface, a SIM interface, and / or a USB interface, etc.

[0113] In some embodiments, memory 1002 may include high-speed random access memory and may also include non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0114] This embodiment also provides a computer storage medium, in which computer instructions are stored. When the computer instructions are executed on an electronic device, the electronic device executes the above-mentioned related method steps to implement the resource operation control method in the above-mentioned embodiment.

[0115] This embodiment also provides a computer program product. When the computer program product runs on a computer, it enables the computer to execute the above-mentioned related steps to implement the resource operation control method in the above-mentioned embodiment.

[0116] In addition, an embodiment of the present application also provides a device, which may specifically be a chip, component or module, and the device may include a connected processor and memory; wherein the memory is used to store computer-executable instructions, and when the device is running, the processor may execute the computer-executable instructions stored in the memory so that the chip executes the resource operation control method in the above-mentioned method embodiments.

[0117] Among them, the first electronic device, computer storage medium, computer program product or chip provided in this embodiment is used to execute the corresponding method provided above. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding method provided above, and will not be repeated here.

[0118] Through the description of the above implementation methods, technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0119] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0120] The unit described as a separate component may or may not be physically separated, and the component shown as a unit may be one physical unit or multiple physical units, that is, it may be located in one place or distributed in multiple different places. Some or all of the units may be selected according to actual needs to achieve the purpose of the embodiment.

[0121] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0122] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium, including several instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor (processor) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), disk or optical disk and other media that can store program code.

[0123] The above description is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application.

Claims

1. A resource operation control method, characterized in that: include: Obtaining permission information and identification information of the device driver; Binding the permission information of the device driver with the identification information to obtain an operation permission information pair, storing the operation permission information pair in a preset storage area, and storing the identification information in a data structure associated with the device driver; When a driver process running the device driver attempts to operate a hardware resource through a hardware resource access interface, determining whether the driver process has the operation permission to operate the hardware resource based on the identification information of the device driver stored in the data structure and the operation permission information pair stored in the preset storage area; and When it is determined that the driver process has the operation authority to operate the hardware resource, the driver process is allowed to operate the hardware resource through the hardware resource access interface.

2. The resource operation control method according to claim 1, characterized in that: The step of binding the permission information of the device driver with the identification information to obtain an operation permission information pair includes: Converting the permission information into bits; Representing the number of bits in a preset number system, wherein the preset number system includes any one of binary, octal, decimal, and hexadecimal; and The number corresponding to the permission information is bound to the identification information to obtain the operation permission information pair.

3. The resource operation control method according to claim 1 or 2, characterized in that: The data structure is a data structure for storing driver attributes of the device driver.

4. The resource operation control method according to claim 3, characterized in that: The method further comprises: Acquire identification information stored in the device driver, and find permission information corresponding to the identification information from the preset storage area according to the identification information; and The permission information corresponding to the identification information is saved in a private data structure of the driving process.

5. The resource operation control method according to claim 4, characterized in that: When the driver process running the device driver program attempts to operate the hardware resource through the hardware resource access interface, determining whether the driver process has the operation permission to operate the hardware resource based on the operation permission information pair stored in the preset storage area includes: When a driver process running the device driver program attempts to operate the hardware resource through the hardware resource access interface, it is determined whether the driver process has the operation permission to operate the hardware resource based on the permission information stored in the private data structure of the driver process.

6. The resource operation control method according to claim 4, characterized in that: The method further comprises: When the permission information corresponding to the identification information is saved in the private data structure of the driving process, the identification information and the permission information of the device driver stored in the preset storage area are deleted.

7. The resource operation control method according to claim 4, characterized in that: The step of saving the permission information corresponding to the identification information into a private data structure of the driver process includes: If the driving process includes a plurality of security areas of different levels, the permission information corresponding to the identification information is saved in the highest level security area of ​​the driving process.

8. The resource operation control method according to claim 3, characterized in that: When the driver process running the device driver program attempts to operate the hardware resource through the hardware resource access interface, determining whether the driver process has the operation permission to operate the hardware resource based on the operation permission information pair stored in the preset storage area includes: When a driver process running the device driver attempts to operate a hardware resource through a hardware resource access interface, obtaining identification information stored in the device driver; and According to the identification information, authority information corresponding to the identification information is found in the preset storage area, and based on the found authority information, it is determined whether the driving process has the operation authority to operate the hardware resource.

9. The resource operation control method according to claim 1, characterized in that: The method further comprises: Generate a random number using a preset random number generation algorithm, and generate a hash ID using the random number as a seed; and The hash ID is defined as identification information of the device driver.

10. The resource operation control method according to claim 1, characterized in that: The identification information of the device driver is any one of the device driver ID, the device driver name, the driver process ID that runs the device driver, and the driver process name that runs the device driver.

11. The resource operation control method according to claim 1, characterized in that: The method further comprises: When it is determined that the driver process does not have the operation authority to operate the hardware resource, the driver process is denied to operate the hardware resource through the hardware resource access interface.

12. The resource operation control method according to claim 1, characterized in that: The obtaining of permission information of the device driver includes: The permission configuration information of the device driver is read, and the permission configuration information is parsed to obtain the permission information of the device driver.

13. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and when the computer instructions are executed on an electronic device, the electronic device executes the resource operation control method according to any one of claims 1 to 12.

14. An electronic device, characterized in that: The electronic device comprises a processor and a memory, the memory is used to store instructions, and the processor is used to call the instructions in the memory, so that the electronic device executes the resource operation control method according to any one of claims 1 to 12.

15. A chip coupled to a memory in an electronic device, characterized in that: The chip is used to control the electronic device to execute the resource operation control method according to any one of claims 1 to 12.

Images