Access control method, related device and system based on authority adaptation

Abstract

The present application discloses an access control method, related apparatus and system based on permission adaptation. In this method, when a subject device is accessing object device resources across devices, the subject device or the object device can map the permission information obtained according to the access control mechanism ACM of the subject device to a form that can be recognized by the ACM of the object device, and then the object device performs a permission check according to its own ACM, and accesses the corresponding resources after the check passes. This method can realize transparent and seamless cross-device resource access in a distributed system with different ACMs, so that devices can share resources with each other, meet the actual needs of users, and bring excellent user experience to users.

Description

Technical Field

[0001] The present application relates to the field of computer and communication technology, and in particular to an access control method based on permission adaptation, related devices and systems. Background Art

[0002] With the development of smart terminals, the types and number of devices in users' lives are increasing, and distributed scenarios where various devices are interconnected are gradually being realized. In distributed scenarios, applications (APPs) in various devices call each other and share resources, etc., which will become a future trend.

[0003] The access control mechanisms (ACMs) and capabilities of various electronic devices in distributed scenarios may be different, which poses challenges to cross-device resource access. Summary of the invention

[0004] The present application provides an access control method, related devices and systems based on permission adaptation, which can achieve transparent and seamless cross-device resource access, so that electronic devices can share resources with each other, meet the actual needs of users, and bring users an excellent user experience.

[0005] In a first aspect, an embodiment of the present application provides an access control method based on authority adaptation, which is applied to a communication system including a first device and a second device, wherein the first device has a first access control mechanism ACM and the second device has a second ACM.

[0006] The method provided in the first aspect may include: a first device sends an access request to a second device, the access request is used for the first device to access a first resource in the second device; the first device sends permission information based on a first ACM to the second device, and the second device maps the permission information based on the first ACM to permission information based on the second ACM; or, the first device maps the permission information based on the first ACM to permission information based on the second ACM, and sends permission information based on the second ACM to the second device; wherein the permission information is used to indicate a first permission required for the access request; the second device responds to the access request to access the first resource according to the permission information based on the second ACM.

[0007] In the method provided in the first aspect, the first device may be referred to as a subject device, and the second device may be referred to as an object device.

[0008] By implementing the method provided in the first aspect, permission adaptation between different ACMs can be performed to ensure that the object device can quickly and conveniently obtain the permissions required for the access request, and the confidentiality and integrity of the data in the object device can be ensured by object authentication to ensure data security. In addition, the method does not limit the identity of the electronic device, and the electronic device can have both the subject and the object identity. The method has no strict constraints, and the subject device and the object device do not need to install or download the same application, nor do they need to log in to the same account. For users, even when accessing resources across devices, they do not feel the changes across devices, and the user experience is better. In general, the method of the first aspect can realize transparent and seamless cross-device resource access in a distributed system with different access control mechanisms ACM, so that electronic devices can share resources with each other, meet the actual needs of users, and bring excellent user experience to users.

[0009] It can be seen from the method provided in the first aspect that the mapping of permission information can be performed by either the subject device or the object device. In some embodiments, the mapping function of permission information can be provided by the first application. That is, the subject device or the object device can run the first application to map the permission information based on the first ACM to the permission information based on the second ACM.

[0010] In conjunction with the first aspect, in some implementations, the permission information based on the first ACM sent by the first device to the second device, or the permission information based on the second ACM, is carried in the access request, which can reduce the interaction between the host and guest devices and improve the efficiency of cross-device resource access.

[0011] In combination with the first aspect, in other implementations, the permission information based on the first ACM or the permission information based on the second ACM sent by the first device to the second device may be sent separately from the access request. When sent separately, it may be sent before the access request or after the access request.

[0012] In combination with the first aspect, in some embodiments, the second device is installed with a callee, the callee is an application APP or a functional component, the APP is a program entity that implements multiple functions, and the functional component is a program entity that implements a single function. The access request is specifically used for the first device to call the callee in the second device to access the first resource. The first permission specifically includes: the permission of the first device to call the callee, and / or the permission to access the first resource.

[0013] In combination with the previous embodiment, in some embodiments, the first device is installed with a caller, which is an APP or a functional component. The access request is specifically used for the caller in the first device to call the callee in the second device to access the first resource. The first permission specifically includes: the permission of the caller in the first device to call the callee, and / or the permission to access the first resource.

[0014] In combination with the previous implementation, in some implementations, before the second device responds to the access request to access the first resource based on the permission information based on the second ACM, the first device may send the first application identity of the caller to the second device, and the second device maps the first application identity to the second application identity; or, the first device maps the first application identity to the second application identity and sends the second application identity to the second device; wherein the first application identity is used by the first device to identify the caller, and the second application identity is used by the second device to identify the caller; the second device associates and stores the second application identity and the permission information based on the second ACM. Afterwards, the second device determines the corresponding permission information based on the second ACM based on the second application identity of the caller in the access request, and accesses the first resource based on the permission information based on the second ACM.

[0015] Through the above implementation, the object device can associate and store the application identity of the caller in the object device and the permission information of the subject device based on the object device ACM. This makes it easier for the subsequent object device to find the permission information of the subject device based on the association relationship and decide whether to respond to the access request initiated by the subject device.

[0016] In the above implementation, the first application identity or the second application identity sent by the first device to the second device is carried in the access request, which can reduce the interaction between the host and guest devices and improve the efficiency of cross-device resource access.

[0017] In the above implementation, the first application identity or the second application identity sent by the first device to the second device may be sent separately from the access request, and when sent separately, may be sent before the access request or after the access request.

[0018] In combination with the above implementation, in some implementations, before the second device responds to the access request to access the first resource, the method further includes: the first device sends the caller's running state to the second device, and the caller's running state includes any one of the following: foreground running, background running, or stopped running. And, the second device will respond to the access request to access the first resource only when the caller's running state is foreground running.

[0019] Through the above implementation, the object device can decide whether to respond to the access request sent by the main device based on the running status of the caller in the main device, thereby avoiding the expansion of the caller's authority scope and avoiding problems such as data abuse and leakage.

[0020] In combination with the first aspect, in some embodiments, before the first device sends permission information based on the first ACM to the second device, it can also output first prompt information, and the first prompt information is used to prompt the user to grant the first permission; the first device receives the first operation and obtains the first permission in response to the first operation.

[0021] Through the above implementation, the main device can actively request the user to grant the first permission. Among them, the implementation form of the first prompt information may include but is not limited to: visual interface elements, voice commands, vibration signals, flash signals, etc. The implementation form of the first operation may include but is not limited to: operations acting on the user interface, preset voice commands or face images, operations acting on physical buttons, etc.

[0022] In combination with the first aspect, in some embodiments, before the second device responds to the access request to access the first resource, it can also determine the first permission based on the permission information based on the second ACM; the second device outputs second prompt information, and the second prompt information is used to prompt the user to grant the first permission; the second device receives the second operation, and obtains the first permission in response to the second operation.

[0023] Through the above implementation, the object device can directly obtain authorization from the user to access resources, rather than relying on the subject device to obtain authorization. This not only allows the object device to quickly and conveniently obtain the permissions required for the access request, but also ensures the rigor of cross-device resource access, avoids user misauthorization, and thus ensures the data security of the object device. The implementation form of the second prompt information and the second operation can refer to the implementation form of the first prompt information and the first operation mentioned above.

[0024] In combination with the first aspect, in some implementations, the first ACM or the second ACM is any one of the following: a permission-based ACM, a discretionary access control mechanism DAC, a capability-based ACM, a label-based ACM, or a context-based ACM.

[0025] In conjunction with the first aspect, in some implementations, the first device and the second device are configured with the same or different operating systems OS.

[0026] In the second aspect, the embodiment of the present application provides an access control method based on permission adaptation, which is applied to a second device. The method includes: the second device receives an access request sent by the first device, and the access request is used for the first device to access a first resource in the second device; the first device has a first access control mechanism ACM, and the second device has a second ACM; the second device receives permission information based on the first ACM sent by the first device, and maps the permission information based on the first ACM to permission information based on the second ACM; or, the second device receives permission information based on the second ACM sent by the first device, which is obtained by mapping the permission information based on the first ACM; wherein the permission information is used to indicate the first permission required for the access request; the second device responds to the access request to access the first resource according to the permission information based on the second ACM.

[0027] In the method provided in the second aspect, the first device may be referred to as a subject device, and the second device may be referred to as an object device.

[0028] By implementing the method provided in the second aspect, the object device can adapt permissions between different ACMs to ensure that the object device can quickly and easily obtain the permissions required for the access request, and ensure the confidentiality and integrity of the data in the object device through object authentication to ensure data security. In general, the method of the first aspect can achieve transparent and seamless cross-device resource access in a distributed system with different access control mechanisms ACM, so that electronic devices can share resources with each other, meet the actual needs of users, and bring users an excellent user experience.

[0029] In the method provided in the second aspect, the operations performed by the second device can refer to the relevant description on the second device side in the method provided in the first aspect, and will not be repeated here.

[0030] In the third aspect, the embodiment of the present application provides an access control method based on permission adaptation, which is applied to a first device. The method includes: the first device sends an access request to the second device, and the access request is used for the first device to access a first resource in the second device; the first device has a first access control mechanism ACM, and the second device has a second ACM; the first device sends permission information based on the first ACM to the second device, or the first device maps the permission information based on the first ACM to permission information based on the second ACM, and sends permission information based on the second ACM to the second device; wherein the permission information is used to indicate the first permission required for the access request.

[0031] In the method provided in the third aspect, the operations performed by the first device can refer to the relevant description on the first device side in the method provided in the first aspect, and will not be repeated here.

[0032] In a fourth aspect, an embodiment of the present application provides an electronic device, comprising: a memory and one or more processors; the memory is coupled to the one or more processors, the memory is used to store computer program code, the computer program code includes computer instructions, and the one or more processors call the computer instructions to enable the electronic device to execute a method such as the second aspect or any one of the implementation methods of the second aspect.

[0033] In a fifth aspect, an embodiment of the present application provides an electronic device, comprising: a memory and one or more processors; the memory is coupled to the one or more processors, the memory is used to store computer program code, the computer program code includes computer instructions, and the one or more processors call the computer instructions to enable the electronic device to execute a method such as the third aspect or any one of the implementation methods of the third aspect.

[0034] In a sixth aspect, an embodiment of the present application provides a communication system, comprising a first device and a second device, wherein the first device is used to execute a method such as the third aspect or any one of the implementation methods of the third aspect, or the second device is used to execute a method such as the second aspect or any one of the implementation methods of the second aspect.

[0035] In a seventh aspect, an embodiment of the present application provides a computer-readable storage medium, comprising instructions, which, when executed on an electronic device, enable the electronic device to execute a method as in the second aspect or any one of the implementations of the second aspect.

[0036] In an eighth aspect, an embodiment of the present application provides a computer program product. When the computer program product runs on a computer, it enables the computer to execute the method of the second aspect or any one of the implementation methods of the second aspect.

[0037] In a ninth aspect, an embodiment of the present application provides a computer-readable storage medium, comprising instructions, which, when executed on an electronic device, enable the electronic device to execute a method as in the third aspect or any one of the implementations of the third aspect.

[0038] In the tenth aspect, an embodiment of the present application provides a computer program product, which, when executed on a computer, enables the computer to execute the method of the third aspect or any one of the implementation modes of the third aspect.

[0039] By implementing the technical solution provided by this application, when the subject device accesses the resources of the object device across devices, the subject device or the object device can map the permission information obtained according to the access control mechanism ACM of the subject device to a form that can be recognized by the ACM of the object device. After that, the object device performs a permission check according to its own ACM and accesses the corresponding resources after the check passes. This method can achieve transparent and seamless cross-device resource access in a distributed system with different ACMs, so that devices can share resources with each other, meet the actual needs of users, and bring users an excellent user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 A schematic diagram of the structure of a communication system 10 provided in an embodiment of the present application;

[0041] Figure 2 A distributed scenario provided for an embodiment of the present application;

[0042] Figure 3A A hardware structure diagram of an electronic device provided in an embodiment of the present application;

[0043] Figure 3B A software structure diagram of an electronic device provided in an embodiment of the present application;

[0044] Figure 4 A flowchart of an access control method based on permission adaptation provided in an embodiment of the present application;

[0045] Figure 5 A user interface provided on the main device provided in the embodiment of the present application;

[0046] Fig. 6A A software structure diagram of the main device provided in the embodiment of the present application;

[0047] Figure 6B A software structure diagram of the object device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0048] The technical solutions in the embodiments of the present application will be described clearly and in detail below in conjunction with the accompanying drawings. In the description of the embodiments of the present application, unless otherwise specified, " / " means or, for example, A / B can mean A or B; "and / or" in the text is only a description of the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, "multiple" means two or more than two.

[0049] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as suggesting or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features, and in the description of the embodiments of the present application, unless otherwise specified, "plurality" means two or more.

[0050] The term "user interface (UI)" in the following embodiments of the present application refers to a medium interface for interaction and information exchange between an application or operating system and a user, which realizes the conversion between the internal form of information and the form acceptable to the user. The user interface is a source code written in a specific computer language such as Java and extensible markup language (XML). The interface source code is parsed and rendered on an electronic device, and finally presented as content that can be recognized by the user. The commonly used form of user interface is a graphical user interface (GUI), which refers to a user interface related to computer operation displayed in a graphical manner. It can be a visual interface element such as text, icons, buttons, menus, tabs, text boxes, dialog boxes, status bars, navigation bars, widgets, etc. displayed on the display screen of an electronic device.

[0051] In a distributed scenario, in order to protect user privacy, relevant technologies require that the called electronic device must obtain permission to access sensitive information, and can only access the sensitive information after the permission check is passed. Normally, the electronic device that initiates the call request can pass the permission to the called electronic device. However, since different OSs have different access control mechanisms and capabilities, this poses challenges to cross-device resource access, such as the inability to accurately understand permissions after permission transfer, permission loss, and other issues.

[0052] Communication systems composed of different operating systems (OS) can complete cross-device resource access and permission control, such as cloud service platforms, "relay" systems, etc.

[0053] Among them, the cloud service platform completes cross-device access control through role-based access control (RBAC). The cloud platform service provides external services through a unified service interface and shields internal device details. RBAC strictly constrains the identities of the subject device and the object device. The object device cannot access the data and capabilities of the subject device, and the subject device cannot provide services to the outside. That is, electronic devices in the cloud service platform cannot have both subject and object identities at the same time.

[0054] In the “Relay” system, multiple devices need to use the same account and install the same application to ensure cross-device access to resources. Such strict constraints limit cross-device resource access and poor user experience.

[0055] The following embodiments of the present application provide an access control method based on permission adaptation, which can be applied to a distributed system including multiple electronic devices. In this method, a subject device can send an access request to an object device, and the subject device obtains permission information required for the access request according to its own access control mechanism (ACM), and the object device can map the permission information into a form that can be recognized by its own access control mechanism ACM, and perform permission check according to its own access control mechanism, and after the permission check passes, respond to the access request to access the first resource.

[0056] In some other embodiments of the present application, the subject device may also map the permission information required for the access request obtained according to its own access control mechanism ACM in advance into a form that can be recognized by the ACM of the object device, and then send the permission information to the object device. In this way, the object device side does not need to perform mapping processing, which can reduce the operations on the object device side and improve the efficiency of the object device side in responding to access requests.

[0057] In the embodiment of the present application, the access control mechanism ACM of the subject device is different from the access control mechanism ACM of the object device. ACM can also be called access control technology, access control principle, etc., which is not limited here. For the convenience of description, the following description will be made as "access control mechanism" and "ACM".

[0058] For the specific definition and classification of ACM, the specific method of mapping the permission information of one ACM into a form recognizable by another ACM, etc., please refer to the detailed description of the subsequent method embodiments.

[0059] In some embodiments, the access request sent by the subject device is specifically used for a caller in the subject device to access a first resource in the object device.

[0060] In some implementations, the subject device may also send the application identity of the caller to the object device, and the object device may map the application identity of the caller to a local application identity, and then associate the local application identity with the permissions required for the access request. In this way, the object device may subsequently perform a permission check on the access request initiated by the caller based on the stored association relationship. For the specific content of the application identity, please refer to the detailed description of the subsequent method embodiments.

[0061] In some implementations, the subject device may also send the caller's operating status to the object device, so that the object device decides whether to respond to the access request initiated by the caller based on the caller's operating status. For the caller's operating status and the impact of the operating status on the object device's response to the access request, please refer to the detailed description of the subsequent method embodiments.

[0062] In some embodiments of the present application, the main device can autonomously obtain the permissions required for the access request according to its own access control mechanism ACM, or request the user to grant the permissions required for the access request, thereby obtaining the permission information required for the access request.

[0063] In some embodiments of the present application, the object device may request the user to grant the permission required for the access request based on the received permission information or based on the access request. Afterwards, the object device may respond to the access request to access the first resource after the user grants the permission. In this way, the object device being accessed can obtain authorization and access resources directly from the user, rather than relying on the subject device to obtain authorization. This not only enables the object device to quickly and conveniently obtain the permission required for the access request, but also ensures the rigor of cross-device resource access, avoids user mis-authorization, and thus ensures the data security of the object device.

[0064] The manner in which the subject device or the object device requests the user to grant the authority required for the access request may refer to the relevant description of the subsequent method embodiments.

[0065] By implementing the method provided in the embodiment of the present application, transparent and seamless cross-device resource access can be achieved in a distributed system with different access control mechanisms ACM, so that electronic devices can share resources with each other, meet the actual needs of users, and bring excellent user experience to users. Electronic devices in a distributed system are not subject to identity constraints and can have dual identities of subject and object at the same time. There are no strict constraints on cross-device access. The subject device and the object device do not need to install or download the same application, nor do they need to log in to the same account. For users, they can even not feel the changes across devices while accessing resources across devices, and the user experience is better. In addition, the method can perform permission adaptation between different ACMs to ensure that the object device can quickly and conveniently obtain the permissions required for the access request, and ensure the confidentiality and integrity of the data in the object device through object authentication to ensure data security.

[0066] In some embodiments of the present application, a first application may be installed in a subject device or an object device, and the first application is used to provide a function of mapping permission information of one access control mechanism ACM to permission information of another access control mechanism ACM. In other words, the subject device or the object device may run the first application to map the permission information obtained through the access control mechanism ACM of the subject device to a form that can be recognized by the ACM of the object device.

[0067] In some embodiments, the first application is further used to map the application identity of the caller to a local application identity of the object device.

[0068] The first application can be implemented as an application (APP), a component, a service, a functional component provided subsequently, and can also be implemented as an instance, a process or a thread. A process is an execution activity of an application on a computer. A thread is a single sequential control flow in the execution of an application. A process can include multiple threads, etc. The first application can be provided or developed by the manufacturer of the electronic device, or it can be provided or developed by a third party that is not the manufacturer of the electronic device.

[0069] The first application is just a term used in this embodiment. The meaning it represents has been recorded in this embodiment, and its name does not constitute any limitation to this embodiment. In addition, in some other embodiments of this application, the first application can also be called other terms such as engine, core, system service, etc. The subsequent embodiments of this application are uniformly described as "first application".

[0070] For definitions of subject devices, object devices, applications in distributed systems, etc., please refer to the relevant descriptions of the embodiments below.

[0071] Below, the communication system provided by the embodiment of the present application is first introduced.

[0072] like Figure 1 As shown, the embodiment of the present application provides a communication system 10. The communication system 10 includes: a plurality of electronic devices. The communication system 10 may also be referred to as a distributed system 10.

[0073] The multiple electronic devices included in the distributed system 10 are all intelligent terminal devices, which can be of various types. The embodiments of the present application do not limit the specific types of the multiple electronic devices. For example, the multiple electronic devices include mobile phones, and may also include tablet computers, desktop computers, laptop computers, handheld computers, notebook computers, large-screen TVs, smart screens, wearable devices, augmented reality (AR) devices, virtual reality (VR) devices, artificial intelligence (AI) devices, car machines, smart headphones, game consoles, and may also include Internet of Things (IOT) devices or smart home devices such as smart water heaters, smart lamps, smart air conditioners, cameras, etc. Without limitation, the multiple devices in the distributed system 10 may also include non-portable terminal devices such as laptop computers with touch-sensitive surfaces or touch panels, desktop computers with touch-sensitive surfaces or touch panels, and the like.

[0074] When multiple electronic devices in the distributed system 10 are all devices deployed in a home, the distributed system 10 can also be called a home distributed system.

[0075] Multiple electronic devices in the distributed system 10 can be connected by logging in to the same account. For example, multiple electronic devices can log in to the same Huawei account and remotely connect and communicate through the server.

[0076] Multiple electronic devices in the distributed system 10 can also log in to different accounts, but are connected by binding. After an electronic device logs in to an account, it can bind and log in to other electronic devices with different accounts or not logged in in the device management application, and then these electronic devices can communicate through the device management application.

[0077] Multiple electronic devices in the distributed system 10 can also establish connections by scanning QR codes, touching near field communication (NFC), searching for Bluetooth devices, etc., and there is no limitation here.

[0078] In general, the communication connections established between multiple electronic devices in the distributed system 10 may include but are not limited to: wired connections, wireless connections such as Bluetooth (BT) connections, wireless local area networks (WLAN) such as wireless fidelity point to point (Wi-Fi P2P) connections, near field communication (NFC) connections, infrared technology (IR) connections, and remote connections (such as connections established through a server), etc.

[0079] In addition, multiple electronic devices in a distributed system may also be connected and communicated in combination with any of the above-mentioned methods, and the embodiments of the present application do not impose any restrictions on this.

[0080] The electronic devices in the distributed system 10 can be further divided into thin devices and rich devices according to the device type. In the embodiment of the present application, a rich device may refer to an electronic device with a large memory and operating space, and a thin device may refer to an electronic device with limited memory and operating space.

[0081] When the distributed system 10 includes rich devices and thin devices, the rich devices and the thin devices can be connected by binding. For example, a device management application is installed in the rich device, and the device management application can be logged in through an account. Afterwards, the rich device can find a nearby thin device by scanning a QR code, NFC, Bluetooth, etc., and then bind the thin device to the account used by the rich device to log in to the device management application according to the user operation.

[0082] After the thin device and the rich device are bound, the rich device can manage the thin device through the device management application, for example, sending various instructions to the thin device to instruct the thin device to perform corresponding operations, etc. The rich device can be called a control device or a management device of the thin device.

[0083] After the thin device and the rich device are bound through the account of the rich device logging into the device management application, the thin device can use the account as its own owner account and use the owner account to join the distributed system and then communicate with other electronic devices in the distributed system.

[0084] In some embodiments, a thin device can directly establish a connection with other devices and communicate with other electronic devices. Each time the thin device communicates with other devices, it carries its own primary account. Other electronic devices can know that the device is a thin device through the primary account, and can query the control device of the thin device. In other embodiments, a thin device can communicate with other electronic devices through rich devices. For example, a thin device can send a message that it wants to send to other electronic devices to a rich device, which then forwards it to other electronic devices.

[0085] In the embodiment of the present application, when other electronic devices in the distributed system 10 access resources in the thin device, the control device of the thin device decides whether to allow the access.

[0086] Multiple electronic devices in the distributed system 10 may be configured with different software operating systems (OS). Electronic devices with different operating systems may be referred to as heterogeneous devices.

[0087] The multiple electronic devices may also be configured with the same software operating system, for example, they may all be configured with The software systems of multiple electronic devices are When the distributed system 10 is used, it can be regarded as a super terminal.

[0088] Among them, the operating system is the most basic system software, which is used to manage the computer's hardware, software and data resources, control program operation, improve the human-computer interface, provide support for other software, etc. The operating system is used to provide a user interface to facilitate interaction between users and electronic devices.

[0089] An operating system may also be called an operating platform, platform, or other names.

[0090] Operating systems include but are not limited to Etc. Among them, It is Huawei's Hongmeng system. According to the application field, the operating system can also be divided into desktop operating system, server operating system, embedded operating system, etc. In some embodiments, when the kernels of two operating systems are different, the two operating systems belong to different operating systems.

[0091] In the embodiment of the present application, each device in the distributed system 10 may install a traditional application (application, APP), such as a camera application, a gallery application, a setting application, etc. In the subsequent embodiments, the traditional APP may be referred to as APP for short.

[0092] In addition, the distributed system 10 provided in the embodiment of the present application can install a distributed application. The distributed application can be a system application or a third-party application, which is not limited here. System applications refer to applications provided or developed by manufacturers of electronic devices, and third-party applications refer to applications provided or developed by manufacturers of non-electronic devices. Manufacturers of electronic devices may include manufacturers, suppliers, providers or operators of the electronic devices. Manufacturers may refer to manufacturers that manufacture electronic devices with self-made or purchased parts and raw materials. Suppliers may refer to manufacturers that provide complete machines, raw materials or parts for the electronic devices. Operators may refer to manufacturers responsible for the distribution of the electronic devices.

[0093] Unlike apps that contain multiple capabilities, distributed applications support deployment in units of a single capability. A distributed application consists of one or more functional components.

[0094] A functional component is the smallest unit of capability that can run independently in an electronic device. It is a concept that abstractly encapsulates a single capability. An APP combines multiple functions together, while a functional component treats each function as a separate service-oriented basic capability and exists independently. In other words, a functional component is a program entity that implements a single function.

[0095] Each functional component can be downloaded, installed and run independently. Multiple functional components constituting the same distributed application can be deployed in the same electronic device in the distributed system 10 or in different electronic devices.

[0096] Functional component is just a term used in this embodiment. Its meaning has been recorded in this embodiment, and its name does not constitute any limitation to this embodiment. In addition, in some other embodiments of this application, functional component can also be called system component, system service, business function and other terms. Subsequent embodiments of this application are uniformly described as "functional component".

[0097] by For example, The functional components in can include the following two categories:

[0098] (1)Feature ability, FA.

[0099] FA is a functional component that includes one or more UI groups and can provide the ability to interact with users. For example, the navigation interface in a map application, the video call interface in an instant messaging application, etc. can be implemented as FA.

[0100] In some embodiments, FA is developed based on the MVVM (model-view-view-model) pattern, which separates the view UI from the business logic, and deploys the business logic code and the view UI code separately. For example, an electronic device can install the business logic code together with other apps, while the view UI code can be installed in other electronic devices. The device where the view UI code is located can communicate with the device where the business logic code is located to obtain the data required to display the UI.

[0101] FA supports page template capabilities, such as Empty Ability, Login Ability, Setting Ability, etc. FA uses scripting language (javascript, JS) to provide a declarative development model, uses HTML and cascading style sheet (CSS) declarative programming language as the development language for page layout and page style, and supports ECMAScript-standard JS language to provide page business logic.

[0102] FA has the capabilities of free installation, independent operation, cross-device UI migration, cross-device binary migration, etc. FA also has the characteristics of multi-terminal deployment and distributed execution.

[0103] FA can call AA or APP to achieve more and more complex functions.

[0104] (2) Particle ability, PA.

[0105] PA is a functional component without UI, which can provide support for FA. For example, PA can provide computing power as a background service, or provide data access capability as a data warehouse. For example, beauty function, positioning function, audio and video encoding and decoding function, etc. can be encapsulated as PA.

[0106] PA also has features such as multi-terminal deployment and distributed execution. PA is only dependent on system services and has no dependencies with other PAs.

[0107] PA actually encapsulates remote virtualization, remote calling, PA management, cross-platform compatibility, security and other implementations, and opens cross-device service enablement and invocation to developers, so that other devices can call the computing power of this device and collaborate with other devices to complete computing work. PA supports Service Ability, Data Ability, etc. Service Ability is used to provide the ability to run tasks in the background. Data Ability is used to provide unified data access abstraction to the outside world.

[0108] PA can call FA or APP to achieve more and more complex functions.

[0109] It is understandable that "FA" and "PA" are just words used in this embodiment, and in other embodiments of the present application, they can also be referred to as other terms. For example, "PA" and "FA" can also be referred to as other terms such as atomic capability (AA), atomic application, meta-capability, atomic service, feature capability, etc.

[0110] Multiple functional components that make up a distributed application can be developed or provided by the same developer or by multiple developers separately. There is no restriction here. Different developers jointly developing functional components can improve the development efficiency of distributed applications.

[0111] In the embodiments of the present application, the functional component provides a standardized interface for external invocation. The APP can call the functional component. In some cases, the functional component can also call other functional components or APPs. In addition, the called functional component can also continue to call other functional components or APPs. This multi-level calling method can be called a chain call.

[0112] After each device in the distributed system 10 establishes a communication connection, each device will synchronize the functional component information and APP information of other devices in the distributed system. Specifically, each device can synchronize the names of the functional components and APPs installed by itself to other devices, so as to facilitate the subsequent calling of the FA, PA and other functional components of other devices in the distributed system 10. In some other embodiments, each device can also synchronize its own device identification, device type, etc. to other devices in the distributed system.

[0113] refer to Figure 2 , Figure 2 A possible distributed remote teaching service scenario is exemplified.

[0114] like Figure 2 As shown in the figure, the distributed system includes electronic devices such as smartphones, tablets, and smart screens. Each device in the distributed system is connected to each other. Smartphones, tablets, and smart screens can be configured with different software operating systems (OS). For example, smartphones and tablets can be configured with System, smart screen can be configured system.

[0115] An "online classroom" is installed in a smart phone. "Online classroom" is an application installed in an electronic device that provides teachers and students with various functions required for remote classes. The embodiment of the present application does not limit its name. "Online classroom" may include the following functional components: a blackboard functional component, a whiteboard functional component, an audio and video codec functional component, and a network connection functional component. Among them, the blackboard functional component and the whiteboard functional component belong to FA, and the audio and video codec functional component and the network connection functional component belong to PA. The blackboard functional component provides the function of remotely explaining courses. The whiteboard functional component provides the function of remotely answering questions. The audio and video codec functional component provides video and audio codec functions.

[0116] On the teacher's side, when using the "Online Classroom" on a smartphone, the teacher can migrate or switch the blackboard function components to the smart screen, and explain the course on the smart screen.

[0117] On the student side, when students use the "Online Classroom" on their smartphones, they can migrate or switch the whiteboard function components to their tablets to answer questions on the tablets.

[0118] Migrating or switching a functional component from one device A to another device B can include the following two types: 1. UI migration. When the view UI and business logic of FA are separated, device A can run the business logic code, which can trigger device B to run the view UI code. To the user, it seems that the functional component has been migrated from device A to device B. 2. Overall migration. Overall migration means that after device B downloads and installs the functional component from device A or from the network, it runs the functional component and provides corresponding functions.

[0119] In this remote teaching business scenario, the "online classroom" is the caller, and the whiteboard function component in the tablet computer and the blackboard function component in the smart screen are the callees.

[0120] Figure 2 Another possible distributed video call service scenario is also shown.

[0121] like Figure 2 As shown, the smart phone may also be installed with other distributed applications, such as instant messaging applications. Instant messaging applications may provide video calls, voice calls and other communication functions. Instant messaging applications may include the following functional components: video call functional component, audio and video codec functional component, and network connection functional component.

[0122] When users use instant messaging apps on their smartphones, they can migrate or switch the app's video call function component to a smart screen, thereby using the smart screen's camera and display to make video calls.

[0123] The blackboard function component in the above-mentioned "online classroom" and the video call function component in the instant messaging application can be the same function component. In other words, the function component in the smart screen can be called by the "online classroom" and instant messaging applications installed on the smartphone respectively.

[0124] In this video call service scenario, the instant messaging application is the caller, and the video call function component in the smart screen (i.e., the video call function component) is the callee.

[0125] It should be noted that if Figure 2 The business scenarios shown are only used to assist in describing the technical solutions of the embodiments of the present application. Figure 2 The distributed system shown may include more terminal devices, more or fewer functional components may be deployed in each device, and each distributed application may include more or fewer functional components.

[0126] pass Figure 1 The distributed system 10 shown, and Figure 2 The distributed scenario shown can integrate the software and hardware capabilities of different devices to achieve a smart full-scenario experience.

[0127] In some embodiments, after each device in the distributed system 10 establishes a communication connection, each device will synchronize the functional component information and APP information of other devices in the distributed system. Specifically, each device can synchronize the names of the functional components and APPs installed by itself to other devices, so that the APPs, functional components, etc. of other devices can be called in the distributed system 10 later.

[0128] In the subsequent embodiments of the present application: the party that initiates the call to the functional component or APP can be called the caller. The caller can be, for example, APP, FA or PA. The initial initiator of the entire call chain can be called the first caller. The first caller can be, for example, APP or FA. For example, the call chain is: APP1 calls PA1, PA1 calls PA2, PA2 calls FA1, then APP1 is the first caller. For another example, the call chain is: FA1 calls PA1, PA1 calls PA2, then FA1 is the first caller.

[0129] In the entire call chain, the party called in the middle and the party called at the end can be called the callee. The callee can be, for example, APP, FA or PA.

[0130] In some embodiments of the present application, the caller may also be referred to as a subject application, and the callee may also be referred to as an object application.

[0131] In the call chain, the caller and the callee can be deployed in the same electronic device or in different electronic devices.

[0132] The device where the caller is located is called the subject device, and the device where the callee is located is called the object device.

[0133] The application referred to in the following embodiments of the present application may include an APP or a functional component.

[0134] In the distributed system 10 provided in the embodiment of the present application:

[0135] The subject device is used to send an access request to the object device, and the subject device obtains the permission information required for the access request according to its own access control mechanism ACM.

[0136] The object device is used to map the permission information into a form recognizable by its own access control mechanism ACM, and perform a permission check according to its own access control mechanism. After the permission check passes, it responds to the access request to access the first resource.

[0137] In some embodiments, the subject device is used to map the permission information required for the access request obtained according to its own access control mechanism ACM in advance into a form recognizable by the ACM of the object device, and then send the permission information to the object device.

[0138] In some embodiments, the subject device is also used to send the application identity of the caller to the object device, and the object device is used to map the application identity of the caller to a local application identity, and then associate the local application identity with the permissions required for the access request, and subsequently perform a permission check on the access request initiated by the caller based on the stored association relationship.

[0139] In some implementations, the subject device is further used to send the running status of the caller to the object device, and the object device is further used to decide whether to respond to the access request initiated by the caller according to the running status of the caller.

[0140] In some embodiments, the main device is used to autonomously obtain the authority required for the access request according to its own access control mechanism ACM, or request the user to grant the authority required for the access request, thereby obtaining the permission information required for the access request.

[0141] In some embodiments, the object device is used to request the user to grant the permission required for the access request according to the received permission information or according to the access request. Afterwards, the object device can respond to the access request to access the first resource after the user grants the permission.

[0142] For the specific implementation of the operations performed by each electronic device in the distributed system 10, reference may be made to the relevant description of the subsequent method embodiments, which will not be repeated here.

[0143] refer to Figure 3A , Figure 3A A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application. The electronic device may be Figure 1 Any electronic device in the distributed system 10 shown. The electronic device can be a main device or a guest device.

[0144] like Figure 3A As shown, the electronic device may include a processor 110, an external memory interface 120, an internal memory 121, a universal serial bus (USB) interface 130, a charging management module 140, a power management module 141, a battery 142, an antenna 1, an antenna 2, a mobile communication module 150, a wireless communication module 160, an audio module 170, a speaker 170A, a receiver 170B, a microphone 170C, an earphone interface 170D, a sensor module 180, a button 190, a motor 191, an indicator 192, a camera 193, a display screen 194, and a subscriber identification module (SIM) card interface 195, etc. The sensor module 180 may include a pressure sensor 180A, a gyroscope sensor 180B, an air pressure sensor 180C, a magnetic sensor 180D, an acceleration sensor 180E, a distance sensor 180F, a proximity light sensor 180G, a fingerprint sensor 180H, a temperature sensor 180J, a touch sensor 180K, an ambient light sensor 180L, a bone conduction sensor 180M, etc.

[0145] It is to be understood that the structure illustrated in the embodiments of the present application does not constitute a specific limitation on the electronic device. In other embodiments of the present application, the electronic device may include more or fewer components than shown in the figure, or combine certain components, or split certain components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0146] The processor 110 may include one or more processing units, for example, the processor 110 may include an application processor (AP), a modem processor, a graphics processor (GPU), an image signal processor (ISP), a controller, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU), etc. Different processing units may be independent devices or integrated into one or more processors.

[0147] The controller can generate operation control signals according to the instruction operation code and timing signal to complete the control of instruction fetching and execution.

[0148] The processor 110 may also be provided with a memory for storing instructions and data. In some embodiments, the memory in the processor 110 is a cache memory. The memory may store instructions or data that the processor 110 has just used or cyclically used. If the processor 110 needs to use the instruction or data again, it may be directly called from the memory. This avoids repeated access, reduces the waiting time of the processor 110, and thus improves the efficiency of the system.

[0149] The wireless communication function of the electronic device can be implemented through antenna 1, antenna 2, mobile communication module 150, wireless communication module 160, modem processor and baseband processor.

[0150] Antenna 1 and antenna 2 are used to transmit and receive electromagnetic wave signals. Each antenna in the electronic device can be used to cover a single or multiple communication frequency bands. Different antennas can also be reused to improve the utilization of the antennas. For example, antenna 1 can be reused as a diversity antenna for a wireless local area network. In some other embodiments, the antenna can be used in combination with a tuning switch.

[0151] The mobile communication module 150 can provide solutions for wireless communications including 2G / 3G / 4G / 5G, etc., applied to electronic devices. The mobile communication module 150 may include at least one filter, a switch, a power amplifier, a low noise amplifier (LNA), etc. The mobile communication module 150 can receive electromagnetic waves from the antenna 1, and filter, amplify, and process the received electromagnetic waves, and transmit them to the modulation and demodulation processor for demodulation. The mobile communication module 150 can also amplify the signal modulated by the modulation and demodulation processor, and convert it into electromagnetic waves for radiation through the antenna 1. In some embodiments, at least some of the functional modules of the mobile communication module 150 can be set in the processor 110. In some embodiments, at least some of the functional modules of the mobile communication module 150 can be set in the same device as at least some of the modules of the processor 110.

[0152] The modem processor may include a modulator and a demodulator. Among them, the modulator is used to modulate the low-frequency baseband signal to be sent into a medium-high frequency signal. The demodulator is used to demodulate the received electromagnetic wave signal into a low-frequency baseband signal. The demodulator then transmits the demodulated low-frequency baseband signal to the baseband processor for processing. After the low-frequency baseband signal is processed by the baseband processor, it is passed to the application processor. The application processor outputs a sound signal through an audio device (not limited to a speaker 170A, a receiver 170B, etc.), or displays an image or video through a display screen 194. In some embodiments, the modem processor may be an independent device. In other embodiments, the modem processor may be independent of the processor 110 and be set in the same device as the mobile communication module 150 or other functional modules.

[0153] The wireless communication module 160 can provide wireless communication solutions including wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) networks), bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), infrared (IR), etc., which are applied to electronic devices. The wireless communication module 160 can be one or more devices integrating at least one communication processing module. The wireless communication module 160 receives electromagnetic waves via the antenna 2, demodulates and filters the electromagnetic wave signals, and sends the processed signals to the processor 110. The wireless communication module 160 can also receive the signal to be sent from the processor 110, modulate the frequency, amplify it, and convert it into electromagnetic waves for radiation through the antenna 2.

[0154] In some embodiments, the antenna 1 of the electronic device is coupled to the mobile communication module 150, and the antenna 2 is coupled to the wireless communication module 160, so that the electronic device can communicate with the network and other devices through wireless communication technology. The wireless communication technology may include global system for mobile communications (GSM), general packet radio service (GPRS), code division multiple access (CDMA), wideband code division multiple access (WCDMA), time division code division multiple access (TD-SCDMA), long term evolution (LTE), BT, GNSS, WLAN, NFC, FM, and / or IR technology. The GNSS may include global positioning system (GPS), global navigation satellite system (GLONASS), Beidou navigation satellite system (BDS), quasi-zenith satellite system (QZSS) and / or satellite based augmentation system (SBAS).

[0155] The electronic device implements the display function through a GPU, a display screen 194, and an application processor. The GPU is a microprocessor for image processing, which connects the display screen 194 and the application processor. The GPU is used to perform mathematical and geometric calculations for graphics rendering. The processor 110 may include one or more GPUs that execute program instructions to generate or change display information.

[0156] The display screen 194 is used to display images, videos, etc. The display screen 194 includes a display panel. The display panel can be a liquid crystal display (LCD), an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode or an active-matrix organic light-emitting diode (AMOLED), a flexible light-emitting diode (FLED), Miniled, MicroLed, Micro-oLed, a quantum dot light-emitting diode (QLED), etc. In some embodiments, the electronic device may include 1 or N display screens 194, where N is a positive integer greater than 1.

[0157] The electronic device can realize the shooting function through ISP, camera 193, video codec, GPU, display screen 194 and application processor.

[0158] ISP is used to process the data fed back by camera 193. For example, when taking a photo, the shutter is opened, and the light is transmitted to the camera photosensitive element through the lens. The light signal is converted into an electrical signal, and the camera photosensitive element transmits the electrical signal to ISP for processing and converts it into an image visible to the naked eye. ISP can also perform algorithm optimization on the noise, brightness, and skin color of the image. ISP can also optimize the exposure, color temperature and other parameters of the shooting scene. In some embodiments, ISP can be set in camera 193.

[0159] The camera 193 is used to capture still images or videos. The object generates an optical image through the lens and projects it onto the photosensitive element. The photosensitive element can be a charge coupled device (CCD) or a complementary metal-oxide-semiconductor (CMOS) phototransistor. The photosensitive element converts the optical signal into an electrical signal, and then passes the electrical signal to the ISP to be converted into a digital image signal. The ISP outputs the digital image signal to the DSP for processing. The DSP converts the digital image signal into an image signal in a standard RGB, YUV or other format. In some embodiments, the electronic device may include 1 or N cameras 193, where N is a positive integer greater than 1.

[0160] Digital signal processors are used to process digital signals. In addition to processing digital image signals, they can also process other digital signals. For example, when an electronic device selects a frequency point, a digital signal processor is used to perform Fourier transform on the frequency point energy.

[0161] Video codecs are used to compress or decompress digital videos. Electronic devices can support one or more video codecs. In this way, electronic devices can play or record videos in multiple coding formats, such as Moving Picture Experts Group (MPEG) 1, MPEG2, MPEG3, MPEG4, etc.

[0162] NPU is a neural network (NN) computing processor. By drawing on the structure of biological neural networks, such as the transmission mode between neurons in the human brain, it can quickly process input information and continuously self-learn. NPU can realize applications such as intelligent cognition of electronic devices, such as image recognition, face recognition, voice recognition, text understanding, etc.

[0163] The internal memory 121 may include one or more random access memories (RAM) and one or more non-volatile memories (NVM).

[0164] Random access memory may include static random-access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM, for example, the fifth generation DDR SDRAM is generally referred to as DDR5 SDRAM), etc.; non-volatile memory may include disk storage devices and flash memory.

[0165] The random access memory can be directly read and written by the processor 110, and can be used to store executable programs (such as machine instructions) of the operating system or other running programs, and can also be used to store user and application data.

[0166] The non-volatile memory may also store executable programs and user and application data, etc., and may be loaded into the random access memory in advance for direct reading and writing by the processor 110 .

[0167] The external memory interface 120 can be used to connect to an external non-volatile memory to expand the storage capacity of the electronic device. The external non-volatile memory communicates with the processor 110 through the external memory interface 120 to implement a data storage function. For example, files such as music and videos are stored in the external non-volatile memory.

[0168] The electronic device can implement audio functions such as music playing and recording through the audio module 170, the speaker 170A, the receiver 170B, the microphone 170C, the headphone jack 170D, and the application processor.

[0169] The audio module 170 is used to convert digital audio information into analog audio signal output, and is also used to convert analog audio input into digital audio signals. The audio module 170 can also be used to encode and decode audio signals. In some embodiments, the audio module 170 can be arranged in the processor 110, or some functional modules of the audio module 170 can be arranged in the processor 110.

[0170] The speaker 170A, also called a "speaker", is used to convert an audio electrical signal into a sound signal. The electronic device can listen to music or listen to a hands-free call through the speaker 170A.

[0171] The receiver 170B, also called a "earpiece", is used to convert audio electrical signals into sound signals. When the electronic device receives a call or voice message, the voice can be received by placing the receiver 170B close to the human ear.

[0172] Microphone 170C, also called "microphone" or "microphone", is used to convert sound signals into electrical signals. When making a call or sending a voice message, the user can make a sound by putting his mouth close to the microphone 170C to input the sound signal into the microphone 170C. The electronic device can be provided with at least one microphone 170C. In other embodiments, the electronic device can be provided with two microphones 170C, which can not only collect sound signals but also realize noise reduction function. In other embodiments, the electronic device can also be provided with three, four or more microphones 170C to realize the collection of sound signals, noise reduction, identification of sound sources, and realization of directional recording function, etc.

[0173] The fingerprint sensor 180H is used to collect fingerprints. Electronic devices can use the collected fingerprint characteristics to achieve fingerprint unlocking, access application locks, fingerprint photography, fingerprint call answering, etc.

[0174] The key 190 includes a power key, a volume key, etc. The key 190 can be a mechanical key or a touch key. The electronic device can receive key input and generate key signal input related to user settings and function control of the electronic device.

[0175] Motor 191 can generate vibration prompts.

[0176] Indicator 192 may be an indicator light, which may be used to indicate charging status, power changes, messages, missed calls, notifications, etc.

[0177] The pressure sensor 180A is used to sense the pressure signal and can convert the pressure signal into an electrical signal. In some embodiments, the pressure sensor 180A can be disposed on the display screen 194 .

[0178] The touch sensor 180K is also called a "touch control device". The touch sensor 180K can be set on the display screen 194, and the touch sensor 180K and the display screen 194 form a touch screen, also called a "touch control screen". The touch sensor 180K is used to detect touch operations acting on or near it. The touch sensor can pass the detected touch operation to the application processor to determine the type of touch event. Visual output related to the touch operation can be provided through the display screen 194. In other embodiments, the touch sensor 180K can also be set on the surface of the electronic device, which is different from the position of the display screen 194.

[0179] when Figure 3A When the electronic device shown is the main device:

[0180] The mobile communication module 150 or the wireless communication module 160 can be used to establish a communication connection with other electronic devices (such as object devices) in the distributed system 10. The specific method of establishing a communication connection can be referred to Figure 1 Related description in .

[0181] The mobile communication module 150 or the wireless communication module 160 can also be used to receive functional component information and APP information synchronized by other electronic devices (such as object devices) after establishing a communication connection with other electronic devices (such as object devices). It can also be used to receive the application identity of each application (such as a caller) in the electronic device sent by other electronic devices (such as object devices). It can also be used to synchronize the application identity of each application in the main device to other electronic devices (such as object devices).

[0182] The internal memory 121 can be used to store functional component information and APP information synchronized with other electronic devices (such as object devices), and can also be used to store the application identities of each application in the electronic device sent by other electronic devices, and can also be used to store the application identities of each application in the main device, etc.

[0183] In some embodiments, the mobile communication module 150 or the wireless communication module 160 may also be used to send an access request to the object device, and the subject device obtains the permission information required for the access request according to its own access control mechanism ACM.

[0184] In some embodiments, the processor 110 is used to pre-map the permission information required for the access request obtained according to the access control mechanism ACM of the subject device into a form that can be recognized by the ACM of the object device, and the mobile communication module 150 or the wireless communication module 160 can also be used to send the mapped permission information to the object device.

[0185] In some embodiments, the mobile communication module 150 or the wireless communication module 160 may also be used to send the running status of the caller to the object device.

[0186] The display screen 194 may also be used to display a user interface displayed on the main device provided in subsequent embodiments.

[0187] The operations performed by each module in the main device can be referred to the detailed description of the subsequent method embodiments.

[0188] when Figure 3A When the electronic device shown is the object device:

[0189] The mobile communication module 150 or the wireless communication module 160 can be used to establish a communication connection with other electronic devices (such as a main device) in the distributed system 10. The specific method of establishing a communication connection can be referred to in Figure 1 Related description.

[0190] The mobile communication module 150 or the wireless communication module 160 can also be used to synchronize functional component information and APP information to other electronic devices after establishing a communication connection with other electronic devices. It can also be used to send the application identity of each application in the object device to other electronic devices. It can also be used to receive the application identity of each application (such as a caller) in the electronic device sent by other electronic devices (such as a main device).

[0191] The internal memory 121 stores functional component information and APP information synchronized by other electronic devices (such as the main device), and can also be used to store the application identity of each application in the object device, as well as the application identity of each application (such as the caller) sent by other electronic devices, etc.

[0192] The mobile communication module 150 or the wireless communication module 160 may also be used to receive an access request sent by the subject device for invoking a first resource in the object device.

[0193] In some embodiments, the mobile communication module 150 or the wireless communication module 160 may also be used to receive the permission information required for the access request obtained by the subject device according to the access control mechanism ACM of the subject device. The processor 110 is used to map the permission information into a form recognizable by the access control mechanism ACM of the object device, and perform a permission check according to the access control mechanism of the object device, and respond to the access request to access the first resource after the permission check passes.

[0194] In some embodiments, the mobile communication module 150 or the wireless communication module 160 may also be used to receive permission information sent by the subject device and mapped to a form recognizable by the ACM of the object device. The processor 110 is used to perform a permission check according to the permission information and the access control mechanism ACM of the object device, and respond to the access request to access the first resource after the permission check passes.

[0195] In some embodiments, the processor 110 is also used to map the caller's application identity to a local application identity, and then store the local application identity and the permission required for the access request in the internal memory 121, and subsequently perform a permission check on the access request initiated by the caller based on the stored association relationship.

[0196] In some embodiments, the mobile communication module 150 or the wireless communication module 160 may also be used to receive the operation status of the caller sent by the main device. The processor 110 may also be used to determine whether to respond to the access request initiated by the caller according to the operation status of the caller.

[0197] The display screen 194 may also be used to display a user interface displayed on the object device provided in subsequent embodiments.

[0198] The operations performed by each module in the object device may refer to the detailed description of the subsequent method embodiments.

[0199] refer to Figure 3B , Figure 3B A schematic diagram of the software structure of an electronic device provided in an embodiment of the present application. The electronic device may be Figure 1 Any electronic device in the distributed system 10 shown. The electronic device can be a main device or a guest device.

[0200] The software system of the electronic device may adopt a layered architecture, an event-driven architecture, a micro-core architecture, a micro-service architecture, or a cloud architecture. For example, the software system of the electronic device includes but is not limited to Linux or other operating systems.

[0201] The layered architecture divides the software into several layers, each with clear roles and division of labor. The layers communicate with each other through software interfaces. In some embodiments, the Android system is divided into four layers, from top to bottom: the application layer, the application framework layer, the Android runtime and system library, and the kernel layer.

[0202] The application layer can include a series of application packages.

[0203] like Figure 3B As shown, the application package may include APPs, such as first application, camera, gallery, calendar, call, map, navigation, WLAN, Bluetooth, music, video, short message, etc. The application layer may also include functional components, such as FA, PA, etc.

[0204] The first application is used to map the permission information of one access control mechanism ACM to the permission information of another access control mechanism ACM. In some embodiments, the first application is also used to map the application identity of the caller to the local application identity of the object device. For a detailed introduction of the first application, please refer to the relevant description above, which will not be repeated here.

[0205] The application framework layer provides an application programming interface (API) and a programming framework for the applications in the application layer. The application framework layer includes some predefined functions.

[0206] like Figure 3B As shown, the application framework layer may include a window manager, a content provider, a view system, a phone manager, a resource manager, a notification manager, and the like.

[0207] The window manager is used to manage window programs. The window manager can obtain the display screen size, determine whether there is a status bar, lock the screen, capture the screen, etc.

[0208] Content providers are used to store and retrieve data and make it accessible to applications. The data may include videos, images, audio, calls made and received, browsing history and bookmarks, phone books, etc.

[0209] The view system includes visual controls, such as controls for displaying text, controls for displaying images, etc. The view system can be used to build applications. A display interface can be composed of one or more views. For example, a display interface including a text notification icon can include a view for displaying text and a view for displaying images.

[0210] The phone manager is used to provide communication functions for electronic devices, such as the management of call status (including answering, hanging up, etc.).

[0211] The resource manager provides various resources for applications, such as localized strings, icons, images, layout files, video files, and so on.

[0212] The notification manager enables applications to display notification information in the status bar. It can be used to convey notification-type messages and can disappear automatically after a short stay without user interaction. For example, the notification manager is used to notify download completion, message reminders, etc. The notification manager can also be a notification that appears in the system top status bar in the form of a chart or scroll bar text, such as notifications of applications running in the background, or a notification that appears on the screen in the form of a dialog window. For example, a text message is displayed in the status bar, a prompt sound is emitted, an electronic device vibrates, an indicator light flashes, etc.

[0213] Android Runtime includes core libraries and virtual machines. Android runtime is responsible for scheduling and management of the Android system.

[0214] The core library consists of two parts: one part is the function that needs to be called by the Java language, and the other part is the Android core library.

[0215] The application layer and the application framework layer run in a virtual machine. The virtual machine executes the Java files of the application layer and the application framework layer as binary files. The virtual machine is used to perform functions such as object life cycle management, stack management, thread management, security and exception management, and garbage collection.

[0216] The system library may include multiple functional modules, such as surface manager, media library, 3D graphics processing library (such as OpenGL ES), 2D graphics engine (such as SGL), etc.

[0217] The surface manager is used to manage the display subsystem and provide the fusion of 2D and 3D layers for multiple applications.

[0218] The media library supports playback and recording of a variety of commonly used audio and video formats, as well as static image files, etc. The media library can support a variety of audio and video encoding formats, such as: MPEG4, H.264, MP3, AAC, AMR, JPG, PNG, etc.

[0219] The 3D graphics processing library is used to implement 3D graphics drawing, image rendering, compositing, and layer processing.

[0220] A 2D graphics engine is a drawing engine for 2D drawings.

[0221] The kernel layer is the layer between hardware and software. The kernel layer contains at least display driver, camera driver, audio driver, and sensor driver.

[0222] Before introducing in detail the access control method based on permission adaptation provided in the embodiment of the present application, the access control mechanism ACM involved in the embodiment of the present application is first introduced.

[0223] Access control mechanism ACM is a security mechanism used to ensure that authorized users can access the required resources while denying unauthorized users access to resources. In other words, ACM is used to prevent unauthorized access to resources, which provides restrictions on the subject's access rights to the object.

[0224] The implementation principle of the access control mechanism ACM is that after the user authorizes, the access control mechanism will control the user's access to a certain resource according to the pre-set rules. Access is only allowed when the rules allow it, and access behaviors that violate the pre-set security rules will be denied. The access control mechanism ACM determines what the user can do, and also determines what the application or process with a certain user identity can do.

[0225] The access control mechanism ACM involves the processes of applying for permissions, recording permissions, transferring permissions, checking permissions, and other resource access processes. It provides electronic devices with ways to apply for permissions, record permissions, transfer permissions, check permissions, and access resources based on permissions. In other words, electronic devices need to access their own resources through the access control mechanism ACM. Electronic devices with different access control mechanisms ACM have different ways of applying for permissions, recording permissions, transferring permissions, and checking permissions.

[0226] The resources accessed by the access control mechanism may include one or more of the following: software resources, hardware resources, peripherals or peripheral resources of the electronic device, etc. Among them:

[0227] Hardware resources are related to the hardware configured in the electronic device, and may include, for example, cameras, sensors, audio devices, display screens, motors, flashlights, etc., which the electronic device possesses.

[0228] Software resources are related to the software configured in electronic devices, and may include, for example, memory resources, computing capabilities (such as beauty algorithm capabilities, audio and video encoding and decoding capabilities), network capabilities, device connection capabilities, device discovery capabilities, data transmission capabilities, etc. of electronic devices. Furthermore, the software resources may include photo taking services, recording services, fingerprint authentication services, sports health services, playback services, SMS services, voice recognition services, video call services, etc. provided by electronic devices. Software resources may include system resources and third-party resources, which are not limited here.

[0229] Peripherals refer to devices that are connected to electronic devices and are used to transmit, transfer, and store data and information. Peripherals may include, for example, accessories of electronic devices, such as a mouse, an external display, a Bluetooth headset, a keyboard, and smart watches and smart bracelets managed by the electronic device. The resources of peripherals may include hardware resources and software resources. For hardware resources and software resources, please refer to the relevant description above.

[0230] The way to access resources using the access control mechanism can be to obtain information, modify information or complete a certain function, which generally includes operations such as reading, adding, deleting, writing, modifying, and executing.

[0231] The following are some examples of access control mechanisms ACM:

[0232] 1. Permission-based access control mechanism

[0233] The permission-based access control mechanism describes the resources that a user can access. Electronic devices can perform permission checks and resource access based on the permission-based access control mechanism.

[0234] In the permission-based access control mechanism, a specific permission is described as:

[0235] <users-permission:name=“permission.CALL_PHONE”>

[0236] <users-permission:name=“permission.INTERNET”>

[0237] <users-permission:name=“permission.WRITE_EXTERNAL_STORAGE”>

[0238] In the above example, the user has the following permissions: phone service, network service, and SD write.

[0239] 2. Discretionary access control (DAC) mechanism

[0240] DAC limits access to objects based on the identification of the subject or the subject group to which the subject belongs. Autonomy means that the subject can autonomously grant access rights or parts of access rights to other subjects, that is, access rights are transferable. DAC is usually represented based on a matrix, that is, an access control list (ACL). A row in the matrix represents all the permissions of a subject, and a column represents all the permissions on an object. The elements in the matrix are the access rights of the subject corresponding to the row of the element to the object in the column of the element. In specific implementation, DAC usually expresses access control information based on the rows or columns of the matrix.

[0241] In some embodiments, ugo-based DAC can also be used for access control. Specifically, each file or resource has corresponding permission attributes, and the permission attributes are divided into three groups: owner, group, and other groups. Each user belongs to at least one user group, and some users can belong to multiple groups. The ugo-based DAC describes the file in the following way: describing the permissions that the owner of the file has on it (owner permissions), the permissions that other users of the group to which the file belongs have on the file (group permissions), and the permissions that other users who are neither the owner of the file nor in the same group as the file owner have (other permissions).

[0242] For example, in a specific example, the permission is described as:

[0243] -rwxr-xr-x 1root root 290465Jan 27 10:33core / res / Manifest.xml

[0244] The above shows seven types of information, from left to right: permissions, number of files, owner, group, file size, creation date, and file name.

[0245] That is, for the file core / res / Manifest.xml, the owner user has the permission to read, write, and execute, the group user has the permission to read, execute, but not write, and the other group users have the permission to read, execute, but not write.

[0246] 3. Capability-based access control mechanism

[0247] In capability-based ACM, the access control information of an access subject is the identity of the target it can access and the operations it can perform on the target. The access subject can pass the access control information directly to the object so that the object can perform permission checks.

[0248] Exemplarily, the permission information of resources in the capability-based ACM can be described in the following form:

[0249] <capabilities><iot:Capabilities Name="systemManagement” / >< / capabilities>

[0250] A specific example is:

[0251] <capabilities>

[0252] <Capabilities Name="privateNetworkClientServer” / >

[0253] <ucap:Capabilities Name="enterpriseAuthentication” / >

[0254] <ucap:Capabilities Name="musicLibrary” / >

[0255] <ucap:Capabilities Name="phoneCall” / >

[0256] In the above example, a principal has access to package authentication, music library, and phone functionality.

[0257] From the above ACMs, we can see that the implementation principles, permission recording methods, etc. of different ACMs are different.

[0258] Not limited to the several ACMs listed above, in specific implementations, the electronic devices in the embodiments of the present application may also use other ACMs, such as tag-based access control mechanisms, context-based access control mechanisms, etc., which are not limited here.

[0259] In the above description of the access control mechanism ACM, the user refers to files, but can actually refer to devices, applications, etc.

[0260] In some embodiments of the present application, different operating systems (OS) may correspond to different access control mechanisms ACM, that is, electronic devices with different OS have different access control mechanisms ACM. Optionally, the ACM of the same OS in different versions may also be different. or Electronic devices can use permission-based access control mechanisms, with Electronic devices can use ugo-based DAC mechanisms, with Electronic devices can use capability-based access control mechanisms, etc.

[0261] In some embodiments, electronic devices with the same OS may have different access control mechanisms ACM, and electronic devices with different OS may have the same access control mechanism ACM, which is not limited here.

[0262] based on Figure 2 The distributed system 10 shown, Figure 3A The hardware structure of the electronic device shown, Figure 3B The software structure of the electronic device shown, and the access control mechanism ACM introduced above, and the access control method based on permission adaptation provided in an embodiment of the present application are introduced in detail below.

[0263] refer to Figure 4 , Figure 4 A flowchart of an access control method based on permission adaptation provided in an embodiment of the present application.

[0264] like Figure 4 As shown, the method may include the following steps:

[0265] S101, electronic devices in a distributed system establish communication connections with each other.

[0266] The embodiments of the present application do not limit the way to establish communication connections between electronic devices in a distributed system. For example, communication connections can be established by logging into the same account, binding devices, scanning QR codes, etc. The embodiments of the present application do not limit the types of communication connections established between electronic devices. For example, they may include wired connections, wireless connections such as Bluetooth connections, Wi-Fi P2P connections, NFC connections, IR connections, and remote connections, etc. For details, please refer to Figure 2 Related description in .

[0267] In some embodiments, after the electronic devices in the distributed system are connected, they can also synchronize functional component information and APP information with each other. For example, an electronic device can send its installed functional component information and APP information, such as identification, etc., to other connected electronic devices. The functional components or APPs that can be called are declared or defined by the developer during the development stage. The callable here only means that the functional components or APPs can be called by the caller, not open or authorized to a certain device for calling.

[0268] In optional step S102, each electronic device in the distributed system synchronizes first information with each other.

[0269] In the embodiment of the present application, the first information synchronized between the electronic devices in the distributed system includes the permission information of the electronic device. The first information may also include: the application identity of each application in the electronic device, and / or the running status of each application.

[0270] The following describes in detail each item of the first information of the electronic device.

[0271] 1. Permission information of electronic devices.

[0272] The permission information applied in the electronic device is used to indicate the permissions possessed by the electronic device.

[0273] The permissions of the electronic device include: the permission to call the callee in other devices, and / or the permission to access certain resources in other devices.

[0274] In some embodiments, the permissions of the electronic device specifically include: permissions for the electronic device to call applications in other devices and / or access certain resources.

[0275] In some embodiments, the permissions of the electronic device specifically include: permissions for applications in the electronic device to call applications in other devices and / or access certain resources. This is also the permission of each application in the electronic device.

[0276] The authority information of the electronic device can also be used to indicate the validity period of the authority possessed by the electronic device. The validity period of the authority can include, for example, one-time validity, permanent validity, validity within a week, validity within a month, validity within the first area, etc., which are not limited here.

[0277] For application of permissions in electronic devices, please refer to the relevant descriptions of subsequent steps.

[0278] It is understandable that electronic devices perform permission access control according to their own access control mechanism ACM. Therefore, the permission information of each electronic device is applied for and recorded by the electronic device according to its own ACM, and is information that the electronic device can identify using its own ACM. Therefore, the permission information of each electronic device can also be referred to as permission information based on its own ACM, or simply permission information based on its own ACM. For the principles of different ACMs and the implementation of permission information, please refer to the relevant content in the previous article.

[0279] 2. Application Identity

[0280] In the embodiment of the present application, one or more applications may be installed in the electronic device. The application may include an APP and may also include a functional component. Each application has a corresponding application identity.

[0281] The application identity is used by electronic devices to distinguish different applications. In other words, different applications have different application identities.

[0282] Different applications can be called different applications, for example, APP1 and APP2, functional component 1 and functional component 2 belong to different applications. Different electronic devices where applications are located can also be called different applications, for example, APP1 in device 1 and APP1 in device 2 belong to different applications.

[0283] For an electronic device, the application corresponding to the application identity that it can identify may be installed locally in the electronic device or may not be installed in the electronic device. For an electronic device, the application identity may also be referred to as the application identity applied in the electronic device or the application identity applied locally in the electronic device.

[0284] For an application installed in an electronic device, the local application identity of the application in the electronic device may include one or more of the following: first information, user information, or device information.

[0285] (1) The first information may include one or more of the following: an application identity (APP ID), a process identifier (PID), or an application security level.

[0286] APP ID is used to identify an application. The same application shares the same APP ID on different devices.

[0287] PID is the identity of an instance. When an electronic device runs an application, it starts an instance of the application and assigns a unique PID to the instance.

[0288] The application security level can be divided according to different granularities. For example, the application security level can be roughly divided into three levels: high, medium, and low. In some embodiments, the security level of the application can be set by the user. In other embodiments, the electronic device can determine the security level of the application based on any one or more of the following: (1) The device security capabilities required when the application is running. The higher the device security capabilities required when the application is running, the higher the application security level. (2) The services provided by the application. The more confidential the data involved in the services provided by the application, the higher the security level of the application. (3) The category of the application. The security level of the system application is higher than the security level of the third-party application.

[0289] In the same electronic device, the APP ID, PID and application security level of different applications can be different.

[0290] (2) User information may include one or more of the following: the identifier of the user to which the application belongs (user ID, UID), the login account (account ID) of the device where the application is located, or the system account (system ID).

[0291] The UID is used to identify the user to whom the application belongs. Typically, the electronic device will assign different UIDs to different installed applications for distinction. In some embodiments, the users to whom the application belongs can be divided into different types, such as the owner user, secondary user, guest user, etc.

[0292] The login account (account ID) refers to the account currently logged into the operating system of the electronic device, such as the Huawei account used to log into the operating system of a Huawei mobile phone. The login account (account ID) can also be called a cloud account.

[0293] System ID refers to the account number assigned to each electronic device in the distributed system 10 by the distributed system 10, which is used to identify each electronic device in the distributed system 10. The system ID can be derived based on the login account number. In some embodiments, if there are multiple electronic devices in the distributed system 10 with the same login account number, the distributed system 10 can assign the same system ID to the multiple electronic devices. The distributed system 10 can also assign different system IDs to electronic devices with different login accounts. In some embodiments, if the distributed system 10 includes an electronic device that has not been logged in, such as an electronic device that joins the distributed system 10 by scanning a QR code but does not use a login account to log in to the operating system, the electronic device currently has no login account number, then the distributed system 10 can assign a default system ID to the electronic device.

[0294] In some embodiments, if the distributed system 10 is configured for all electronic devices in Software system, the system account (system ID) assigned to each electronic device by the distributed system 10 can be called the Hongmeng system account (HOS system ID, HosID).

[0295] In the same electronic device, the UIDs in the application identities of different applications may be different, while the login account (accountID) and the system account (system ID) are the same.

[0296] (3) The device information may include one or more of the following: the device ID of the device where the application is located, the device security level, or the location of the device.

[0297] The device ID is used to uniquely identify a device. For example, the device ID can be a mobile equipment identifier (MEID), an international mobile equipment identity (IMEI), a medium access control (MAC) address, etc.

[0298] Device security levels can be divided according to different granularities. For example, device security levels can be roughly divided into three levels: high, medium, and low. The device security level is mainly determined by the software and hardware configuration of the electronic device itself. The higher the security capabilities provided by the software and hardware configuration of the electronic device, the higher the device security level.

[0299] The location of the device can be obtained by the electronic device through outdoor navigation technology such as global satellite navigation technology, indoor positioning technology such as Wi-Fi, Bluetooth, infrared, ultra-wideband, RFID, ZigBee, ultrasonic and other positioning technologies.

[0300] In the same electronic device, the device ID, device security level or device location in the application identities of different applications are the same.

[0301] 3. Application running status

[0302] The electronic device may continuously or periodically monitor the running status of each application.

[0303] The running status of an application may include: foreground running, background running, and stopped running. Among them, the provider of the user interface currently displayed by the electronic device is the foreground running application. The application that the electronic device is currently running but does not provide a user interface is the background running application. The application that the electronic device has run before but is not currently running is a stopped application. In an electronic device, the number of applications running in the foreground, background, or stopped can be one or more, and there is no restriction here.

[0304] Among the first information synchronized between the electronic devices mentioned above, some information is fixed, and some information may change dynamically with user operations or device operation. For example, the APP ID and device ID in the application identity will not change, but the login account (account ID), system account (system ID), application security level, device security level or device location, application running status, permission information, etc. in the application identity may change.

[0305] When S102 is specifically executed, after each electronic device in the distributed system establishes a connection with each other, they can first synchronize their respective first information with each other based on the connection. In some embodiments, when the first information of the electronic device in the distributed system changes, the updated complete first information or the changed part of the first information can be sent to other connected electronic devices. In other embodiments, each electronic device in the distributed system can also periodically synchronize the complete first information or the changed part of the first information with each other. In some embodiments, the changed part of the first information can be transmitted in the form of a hash value.

[0306] S103: The subject device generates an access request, where the access request is used by a caller in the subject device to access a first resource in the object device.

[0307] The main device can be any electronic device in the distributed system 10.

[0308] The subject device and the object device have different access control mechanisms ACM. In some embodiments, the subject device and the object device have different operating systems OS.

[0309] In the embodiment of the present application, a caller is installed in the main device, and the caller can be an APP or a functional component. The definitions of APP and functional components can refer to the relevant description above.

[0310] In some embodiments, the subject device may generate an access request in response to a received user operation during the running of the caller. For example, when a user uses a video call application on a subject device (such as a mobile phone), the user may input a user operation to trigger the subject device to generate an access request for accessing the camera and display screen of the object device to conduct a video call.

[0311] In other embodiments, the subject device may also autonomously generate access requests for the object device in some cases while running the caller. For example, when the subject device is running a food delivery application, it may autonomously generate an access request for calling the positioning function in the object device to obtain positioning data. For example, the subject device may generate an access request for the instant messaging application in the subject device to call the video call function component and camera resources in the object device (such as a smart screen) by default every time a video call is made.

[0312] In some embodiments of the present application, when running the caller, the subject device can autonomously select an electronic device as the object device from multiple electronic devices providing the first resource, or select an electronic device as the object device in response to a received user operation.

[0313] For example, if the caller APP1 in the main device A generates an access request for accessing camera resources, if the devices B and C connected to the main device A can both provide camera resources, the main device A can select device C with a higher device security level as the object device, or arbitrarily select a device as the object device.

[0314] In some embodiments of the present application, the access request generated by the subject device is specifically used for the caller in the subject device to call the callee in the object device to access the first resource in the object device. The object device is installed with the callee, which may be an APP or a functional component.

[0315] In some embodiments of the present application, the subject device can autonomously select an application as the callee from among the applications that provide the first resource on the object device, or select an application as the callee in response to a received user operation. Among the applications installed on the object device, if the function of the application includes accessing the first resource, the application is the application that provides the first resource.

[0316] For example, if the caller APP1 in the main device A generates an access request for accessing camera resources, if there are two functional components FA1 and FA2 that provide the first resource in the object device C, the main device A can select the functional component FA1 with a higher application security level as the callee, or select any functional component as the callee.

[0317] Based on the above description, it can be seen that the access request generated by the main device may include: the application identity of the caller and the identifier of the first resource. If the main device determines the callee, the access request may also include the application identity of the callee. In some embodiments, the access request may also include: the identifier of the main device and the identifier of the object device.

[0318] The identifier of the subject device or the object device can be a device type, a device model, a device name, etc., which is not limited in the present embodiment. The device type here can be viewed from the device form, for example, including mobile phones, tablet computers, smart headphones, IOT devices or smart home devices, etc.

[0319] For the application identity of the caller and the application identity of the callee, reference may be made to the relevant description on the application identity in 102 .

[0320] In the embodiment of the present application, the first resource may be any resource in the object device, depending on the requirements of the subject device. The classification and specific content of the resources in the object device can refer to the relevant description above. The first resource may include one or more resources, which are not limited here.

[0321] In some cases, the application identity of the callee and the identifier of the first resource may be the same. For example, when the first resource is a camera, the application identity of the callee may also be the identifier of the camera, indicating that the callee is a camera application.

[0322] In optional step S104, the main device determines whether it has the authority required for the access request.

[0323] In some embodiments of the present application, the main device may first execute S103 and then execute S104.

[0324] In other embodiments of the present application, the main device may also execute S104 first, and then execute S103 if the execution result of S104 is yes. That is, the main device may first determine whether it has the authority required for the access request, and only generate the access request if it is yes.

[0325] The authority required for the access request generated by the subject device includes: the authority to call the callee in the object device, and / or the authority to access the first resource in the object device.

[0326] In some embodiments, the permission required for the access request specifically includes: permission for the subject device to call the callee in the object device and / or to access the first resource. When the permission required for the access request includes permission to call the callee, it can be considered that the permission includes permission to call the callee to perform various operations, and therefore also includes permission to access the first resource.

[0327] In some embodiments, the permissions required for the access request specifically include: permissions for the caller to call the callee in the object device and / or access the first resource.

[0328] In some embodiments, the permissions required for the access request specifically include: permissions for a caller in a subject device to call a callee in an object device and / or access a first resource.

[0329] In some embodiments of the present application, the subject device may directly apply to the user for the permission required for the access request after generating the access request. In other embodiments, the subject device may apply to the user for permission after generating the access request if the execution result of S104 is no, which can reduce the interaction between the subject device and the user and improve the efficiency of cross-device resource calls in the distributed system. After the subject device applies to the user for the permission required for the access request, it can directly execute the subsequent steps of S104.

[0330] It is not limited to the subject device obtaining the permission required for the access request. In some other embodiments, the subject device may also receive the permission required for the access request from the object device, or obtain the permission required for the access request in advance.

[0331] In S104, the main device can use the authorization method supported by both the main device and the caller to request the user to grant the permissions required for the access request generated by itself during the operation of the caller. The authorization method may include but is not limited to: pop-up authorization, fingerprint verification authorization, face verification authorization, voice command authorization, key authorization, etc., which are not limited here.

[0332] The types of authorization methods supported by an electronic device depend on the hardware and / or software configuration of the electronic device. For example, support for pop-up authorization requires the electronic device to be equipped with a display screen. Support for fingerprint verification authorization requires the electronic device to be equipped with a fingerprint sensor. Support for face verification authorization requires the electronic device to be equipped with a camera and a face recognition algorithm. Support for voice command authorization requires the electronic device to be equipped with a microphone or other sound pickup device. Support for button authorization requires the electronic device to be equipped with physical buttons.

[0333] Whether the caller meets the authorization conditions depends on the function of the caller itself. For example, when the caller can provide a user interface, the caller can support pop-up authorization. For another example, when the caller can call a fingerprint sensor, the caller can support fingerprint verification authorization.

[0334] When the main device supports pop-up authorization, a prompt message can be output on the display screen, which is used to prompt the permissions required for the access request. Afterwards, the main device can detect the user operation acting on the display screen, and in response to the user operation, obtain the permissions required for the access request.

[0335] refer to Figure 5 , Figure 5 The user interface 51 displayed when the main device requests user authorization by means of a pop-up box authorization is exemplified.

[0336] The user interface 51 displays: a window 701. The window 701 displays: prompt information 701a, a control 701b, and a control 701c.

[0337] Prompt information 701a is used to prompt the user to grant the caller in the subject device the authority to call the callee in the object device to access the first resource. Prompt information 701a can be, for example, the text "Do you agree that the instant messaging application in the mobile phone can call the camera in the smart screen?", where the text "mobile phone" indicates the subject device, "instant messaging application" indicates the caller, "smart screen" indicates the object application, "camera" indicates that the callee is a camera application, and the first resource is a camera resource. Not limited to the form shown in prompt information 506a, the specific content of prompt information 506 depends on the authority required for the access request, which is not limited here.

[0338] Control 701b can be used to monitor user operations, and the authorized device responds to the user operations and successfully obtains permission for the instant messaging application in the mobile phone to call the camera in the smart screen.

[0339] Control 701c can be used to monitor user operations, and the authorized device responds to the user operation and learns that the instant messaging application in the mobile phone has not yet obtained permission to call the camera in the smart screen.

[0340] In some embodiments, more controls may be displayed in the user interface 51 for the user to choose to grant permissions of different validity periods, such as one-time permissions, permanent permissions, and the like.

[0341] like Figure 5 As shown, the main device receives the user operation acting on the control 701b, and obtains the permission for the instant messaging application in the mobile phone to call the camera in the smart screen.

[0342] When the main device supports fingerprint verification authorization, the fingerprint sensor can be used to collect the user's fingerprint, and the collected fingerprint is compared with the preset fingerprint. If the two fingerprints are consistent, the main device obtains the permission required for the access request. In some embodiments, the main device can preset multiple fingerprints, and when different preset fingerprints are collected, the permission required for the access request with different validity periods is obtained.

[0343] When the main device supports face verification authorization, it can collect the user's face image through the camera and compare the collected face image with the preset face image. If the two are consistent, the main device obtains the permission required for the access request.

[0344] When the main device supports voice command authorization, it can collect the voice command input by the user through a microphone, a receiver or other sound pickup device, and compare the collected voice command with the preset voice command. If the two are consistent, the main device obtains the permission required for the access request. In some embodiments, the main device can preset multiple voice commands, and when different preset voice commands are collected, it obtains the permission required for the access request with different time limits.

[0345] When the main device supports key authorization, the user's pressing operation can be collected through the physical key. If a preset pressing operation (such as a single pressing operation, a long pressing operation, a continuous double pressing operation, etc.) is collected on the physical key, the main device obtains the permission required for the access request. In some embodiments, the main device can preset multiple pressing operations, and when different preset pressing operations are collected, the permission required for the access request with different time limits is obtained.

[0346] That is, the main device can output the first prompt information to prompt the user to grant the permission required for the access request, and after receiving the first operation, respond to the first operation to obtain the permission required for the access request. The first prompt information can be, for example, Figure 5 The prompt information 701a in the figure, etc., the first operation may include, for example, acting on Figure 5 The user operation of the middle control 701b, preset voice commands, preset face images, etc. are not limited here.

[0347] If the judgment result of S104 is yes, the subsequent steps are executed.

[0348] In optional step S105, the subject device maps the permission information based on the subject device from the form of ACM based on the subject device to the form of ACM based on the object device.

[0349] In some embodiments, the subject device may also map the application identity of the caller in the subject device to the application identity of the caller in the object device.

[0350] When the subject device performs mapping processing, the specific implementation is the same as when the object device performs mapping processing. For the specific implementation of S105, please refer to the relevant description of the subsequent S107, which will not be repeated here. In some embodiments, the subject device can run the first application to perform the mapping of permission information and the mapping operation of application identity. For the specific implementation of the first application, please refer to the previous and subsequent related descriptions, which will not be repeated here.

[0351] S106, the subject device sends the access request to the object device, and may also send the permission information of the subject device based on the ACM of the subject device, or the mapped permission information of the subject device based on the ACM of the object device to the object device.

[0352] If the subject device executes S105 , the subject device may send the mapped information to the object device. If the subject device does not execute S105 , the subject device may send the obtained original information to the object device.

[0353] In some embodiments, the subject device may also send the application identity of the caller in the subject device to the object device, or the application identity of the caller in the object device obtained after mapping.

[0354] In some embodiments, the subject device may also send the running status of the caller to the object device.

[0355] In some embodiments, the access request sent by the main device may carry other information sent in the above-mentioned optional embodiments, such as the permission information of the main device based on the ACM of the main device, or the permission information of the main device based on the ACM of the object device after mapping, the application identity of the caller in the main device, or the application identity of the caller in the object device after mapping, the running status of the caller, etc.

[0356] In some other embodiments, the other information carried in the above-mentioned access request can be sent separately from the access request, or can be sent together with the access request. When sent separately, it can be sent before the access request or after the access request, which is not limited here.

[0357] In some embodiments, if the subject device obtains the permission required for the access request, it may also send permission information required for the access request to the object device, where the permission information indicates the permission required for the access request.

[0358] In S106, the main device sends other information sent in the above optional embodiment to the object device, so that it is unnecessary to perform the operation of S102, thereby reducing the interaction between the main and object devices and improving the efficiency of cross-device resource calls.

[0359] In optional operation S107, the object device maps the received permission information of the subject device from a form based on the ACM of the subject device to a form based on the ACM of the object device.

[0360] If the object device receives the permission information of the subject device based on the ACM of the subject device, the object device can execute S107. That is, the object device maps the permission information based on the ACM of the subject device to the permission information based on the ACM of the object device. The permission information of the subject device in the form of the ACM of the subject device can be sent from the subject device to the object device in S102, or can be sent from the subject device to the object device in S106.

[0361] When S107 is specifically executed, the object device can obtain or identify the permissions of the subject device based on the permission information based on the ACM of the subject device, and then configure or record the permissions of the subject device locally on the object device according to the ACM of the object device, so that the object device can locally identify the permissions of the subject device.

[0362] The mapping strategy or mapping rule between the permission information is determined according to the specific implementation principle of the ACM of the subject and object devices, and is not specifically limited here. The mapping between the permission information can also be called the change, transformation, adjustment, etc. of the permission information.

[0363] In some embodiments, the object device may also map the application identity of the caller in the subject device to the application identity of the caller in the object device.

[0364] In an embodiment of the present application, if an electronic device has an application installed, the application identity of the application in the electronic device can be mapped to the application identity of the application in other electronic devices, so that other electronic devices can also identify the application in the electronic device based on the application identity.

[0365] Specifically, according to a certain strategy, the application identity of the application in the device where the application is installed can be mapped to the local application identity of other electronic devices to achieve the purpose of distinguishing different applications in other electronic devices. The strategy can be, for example, to perform certain processing on the application identity of the application in the device where the application is installed, such as adding the ID of the other electronic device after the application identity, multiplying the UID in the application identity by 10, and using the processed result as the application identifier of the application in other electronic devices.

[0366] For example, suppose that device 1 has application 1 installed, and device 2 has application 2 installed. Both device 1 and device 2 assign application identities to each application according to the rules in the Android system, such as selecting a UID in the range of 10000-19999 as the application identity. Device 1 may use UID=10000 as the application identity of application 1, and device 2 may use UID=10000 as the application identity of application 2. Then, for device 2, the application identity of application 1 in device 1 (i.e., UID=10000) and the application identity of application 2 in device 1 (i.e., UID=10000) are the same, and device 2 cannot distinguish between application 1 and application 2 based on this. In an embodiment of the present application, the application identity of application 1 in device 1 can be multiplied by 10, that is, UID=100000 is used as the application identity of application 1 installed in device 1 in device 2, so that device 2 can distinguish between application 1 and application 2.

[0367] If the object device receives the application identity based on the caller in the subject device, the object device can map the application identity of the caller in the subject device to the application identity of the caller in the object device. The application identity of the caller in the object device obtained after mapping is used by the object device to locally identify the relevant information of the caller. The application identity of the caller in the subject device can be sent from the subject device to the object device in S102, or sent from the subject device to the object device in S106.

[0368] The mapping strategy or mapping rule between application identities is not specifically limited here. The mapping between application identities can also be called the change, transformation, adjustment, etc. of application identities.

[0369] In some embodiments, when executing S107, the object device may also associate and store the application identity of the caller in the object device and the permission information of the subject device based on the object device ACM. This makes it easier for the subsequent object device to find the permission information of the subject device based on the association relationship and decide whether to respond to the access request initiated by the subject device.

[0370] In some embodiments, S107 may be implemented by the object device running the first application, that is, the mapping function of the permission information and the mapping function of the application identity may be provided by the first application. For the specific implementation of the first application, please refer to the relevant description above, which will not be repeated here.

[0371] S108, the object device determines whether it has the authority required by the access request sent by the subject device according to its own access control mechanism ACM.

[0372] The authority required for the access request generated by the subject device includes: the authority to call the callee in the object device, and / or the authority to access the first resource in the object device.

[0373] In some embodiments, the permission required for the access request specifically includes: permission for the subject device to call the callee in the object device and / or to access the first resource. When the permission required for the access request includes permission to call the callee, it can be considered that the permission includes permission to call the callee to perform various operations, and therefore also includes permission to access the first resource.

[0374] In some embodiments, the permissions required for the access request specifically include: permissions for the caller to call the callee in the object device and / or access the first resource.

[0375] In some embodiments, the permissions required for the access request specifically include: permissions for a caller in a subject device to call a callee in an object device and / or access a first resource.

[0376] Specifically, when S108 is executed, the object device may check whether the permission information of the subject device mapped in a form based on the object device ACM includes the permission required by the access request sent by the subject device.

[0377] In some embodiments, the object device can find the permission information corresponding to the caller according to the information stored in association in S107, and then determine whether the permission corresponding to the caller includes the permission required for the access request. For example, if the permission required for the access request is the permission of the caller in the subject device to access the first resource, the object device will locally search for the permission corresponding to the caller in the subject device, and determine whether the permission corresponding to the caller in the subject device includes the permission required for the access request.

[0378] In some embodiments, if the execution result of S108 is no, or after obtaining the permission information of the main device based on the object device ACM and before S108, the object device can use the authorization method supported by both the object device and the callee during the operation of the callee to request the user to grant the permission required for the received access request. In this way, the accessed object device can obtain authorization and access resources directly from the user, rather than relying on the main device to obtain authorization. This not only allows the object device to quickly and conveniently obtain the permission required for the access request, but also ensures the rigor of cross-device resource access, avoids user mistaken authorization, and thus ensures the data security of the object device. The way in which the object device requests user authorization is similar to the way in which the main device requests user authorization. For details, please refer to the relevant description of S104. For example, the user interface displayed when the object device requests user authorization can refer to Figure 5 .

[0379] When the above embodiment is specifically implemented, the object device may first determine the permission required for the access request based on the permission information of the subject device based on the object device ACM, and then output the second prompt information to prompt the user to grant the permission. Afterwards, the object device may receive the second operation and obtain the permission in response to the second operation.

[0380] The object device and the subject device may have different operating systems OS. In some embodiments of the present application, the subject device and the object device can use the personalized methods provided by their respective OS to request authorization from the user. This can maintain the personalized experience of different OSs without making relevant improvements to each electronic device in the distributed system. In other embodiments of the present application, the subject device and the object device can use the same method to request authorization from the user, which can provide a consistent experience to the user and make the user experience better.

[0381] After the object device obtains the permission required for the access request granted by the user, the permission required for the access request can be locally configured or recorded on the object device according to the ACM of the object device, and subsequent steps can be directly executed.

[0382] If the judgment result of S108 is yes, the subsequent steps are executed.

[0383] S109: The object device responds to the access request.

[0384] In some embodiments, the object device may directly respond to the access request if the judgment result of S108 is yes.

[0385] In some implementations, the guest device may respond to the access request after the user grants the required permissions for the access request on the guest device.

[0386] Furthermore, in some embodiments, the object device may also determine whether to respond to the access request in combination with the running state of the caller. The running state of the caller may include: foreground running, background running, and stopped running. The running state of the caller may be sent by the subject device to the object device in S102 or S106.

[0387] In some embodiments, if the first resource to be accessed by the access request is a sensitive resource, the object device determines whether to respond to the access request in combination with the operating state of the caller. In this way, access to the first resource must depend on the operating state of the caller, which can avoid the expansion of the caller's authority. Here, sensitive resources can refer to resources that will pose a greater risk to user privacy if leaked, such as resources with a privacy level higher than a threshold, such as cameras, audio equipment, photo albums, etc.

[0388] Specifically, when the running status of the caller in the main device changes, the authority scope of the main device will also change accordingly. It is necessary to ensure that the object device performs relevant operations within the authority scope of the main device after the change, so as to avoid the expansion of the caller's authority scope and avoid problems such as data abuse and leakage.

[0389] For example, a video call application in the subject device, as a caller, calls the camera in the object device. When the video call application is running in the foreground, it has the camera call permission, and the object device can respond to the access request to call its own camera. However, when the video call application in the subject device becomes the background, it no longer has the camera call permission, and the object device can no longer respond to the access permission of the subject device to call the camera.

[0390] Therefore, in some embodiments, if the caller's running status is background running or stopped running, the object device may refuse to respond to the access request sent by the main device; when the caller's running status is foreground running, the object device will respond to the access request sent by the main device.

[0391] When S109 is specifically executed, the object device can create an instance of the callee for the caller in the subject device in response to the access request sent by the subject device, and run the instance to access the first resource. In some embodiments, if the instance of the callee already exists in the object device, the object device does not need to recreate the instance of the callee, and can directly run the instance to access the first resource.

[0392] In an embodiment of the present application, an instance is an APP or functional component in a running state. An instance can refer to a process or a thread. The electronic device will allocate physical addresses in random access memory (RAM) to different instances in units of processes. When the electronic device needs to run an instance, it will find the space in RAM corresponding to the instance according to the virtual address and run the instance in the space. Among them, the virtual address is mapped to the physical address assigned to the instance by the electronic device, and the mapping relationship is stored in the controller of the electronic device. In other words, the instance uses the virtual address to find the actual storage location of the memory data.

[0393] In the embodiment of the present application, the object device responds to the access request to access the first resource, which may specifically include one or more of the following:

[0394] 1. The object device runs an instance of the callee created by the caller, accesses the first resource to perform a series of operations, such as displaying a video call interface through a display screen, capturing images through a camera, performing computing operations, image processing, obtaining location information, etc.

[0395] 2. The object device sends the access result of the first resource to the main device, for example, sending the image captured by the camera to the main device, so that the main device can send it to the other end device of the video call with it, or sending the calculation result and the obtained location information to the main device, etc.

[0396] 3. The object device receives the data sent by the subject device, uses the data to access the first resource, and performs a series of operations. For example, the object device can receive an image captured by the other end device of the video call sent by the subject device, and display the image in the video call interface of the display screen.

[0397] Here, the operation performed by the object device in response to the access request to access the first resource can be determined by the default of the object device, by the user on the object device side, or by the access request sent by the subject device side, and there is no restriction here.

[0398] Through the above Figure 4 The access control method based on permission adaptation shown can realize transparent and seamless cross-device resource access in a distributed system with different access control mechanisms ACM, so that electronic devices can share resources with each other, meet the actual needs of users, and bring excellent user experience to users. Electronic devices in distributed systems are not subject to identity constraints and can have dual identities of subject and object at the same time. There are no strict constraints on cross-device access. The subject device and the object device do not need to install or download the same application, nor do they need to log in to the same account. For users, they can even not feel the changes across devices while accessing resources across devices, and the user experience is better. In addition, the method can perform permission adaptation between different ACMs to ensure that the object device can quickly and conveniently obtain the permissions required for the access request, and ensure the confidentiality and integrity of the data in the object device through object authentication to ensure data security.

[0399] As can be seen from the above description, in some embodiments of the present application, the mapping of permission information and the mapping of application identity can be performed by the object device. Figure 4 In the method shown, it is not necessary to execute S105. In S107, the object device maps the permission information based on the ACM of the subject device to the permission information based on the ACM of the object device, and maps the application identity of the caller in the subject device to the application identity of the caller in the object device.

[0400] The subject device may send to the object device: the authority information of the subject device mapped to the ACM format of the object electronic device and the application identity of the caller in the object device, and the object device does not need to execute S107.

[0401] In other embodiments of the present application, the mapping of permission information and the mapping of application identity may not be performed by the object device, but by the subject device. Figure 4 In the method shown, in S105 the subject device may send to the object device: permission information of the subject device in the form of ACM mapped to the object electronic device and the application identity of the caller in the object device, while the object device does not need to execute S107.

[0402] In some embodiments, Figure 4 In the access control method based on permission adaptation shown, in S102, each electronic device can synchronize the following information with each other: permission information of the electronic device in the form of ACM mapped to other electronic devices, and application identities of the electronic device applied in other electronic devices.

[0403] In some embodiments of the present application, a two-way authentication method can be used to perform Figure 4 The access control method based on permission adaptation is shown. Specifically, before the subject device sends an access request, S104 is executed, and before the object device responds to the access request, S108 is executed. Through the dual authentication of subject and object, the risk of malicious attacks on the subject device and / or the object device can be avoided, and the data security of the object device can be further guaranteed.

[0404] In some embodiments, if the guest device is a thin device, the above Figure 4 Any one or more operations in S107-S108 in the method shown may be executed by the control device of the thin device, and when the main device accesses resources in the thin device, the control device may forward messages.

[0405] In the above Figure 4 In the access control method shown:

[0406] The subject device may be referred to as a first device, and the object device may be referred to as a second device.

[0407] The ACM of the subject device may be referred to as a first ACM, and the ACM of the object device may be referred to as a second ACM.

[0408] The application identity of the caller in the subject device may be referred to as a first application identity, and the application identity of the caller in the object device may be referred to as a second application identity.

[0409] The permission required for the access request sent by the main device can be called the first permission, and the specific content of the first permission can refer to the relevant description above.

[0410] refer to Fig. 6A , Fig. 6A A schematic diagram of the software structure of the main device provided in the embodiment of the present application. The main device may be Figure 4 The main device in the embodiment.

[0411] like Fig. 6A As shown, the main device may include the following modules: application management module, permission access control module, application information management module, and communication module. Among them:

[0412] The application management module is used to manage various applications in the main device. When the main device generates an access request for accessing resources in other devices, the application management module is used to select a cross-device access control module in the permission access control module to perform permission check.

[0413] The permission access control module may include a local access control module and a cross-device access control module. The local access control module is used to perform permission checks on access requests to access local resources of the subject device. The cross-device access control module is used to perform permission checks on access requests to access resources in the object device, that is, to determine whether to initiate the access request to the object device. For the specific operation of the cross-device access control module to perform permission checks, please refer to the relevant description in the above method embodiment.

[0414] The application information management module may include: an application identity mapping module, a context management module, a permission mapping module, and an information synchronization module.

[0415] The application identity mapping module is used to map the application identity in the subject device to the application identity in the object device.

[0416] The context management module is used to manage the running status of each application in the main device.

[0417] The permission mapping module is used to map the permission information required for the access request from a form recognizable by the ACM in the subject device to a form recognizable by the ACM in the object device.

[0418] The information synchronization module is used to send the application identity in the main device (such as the application identity of the caller), the running status of each application (such as the running status of the caller), and the permission information of the access request that can be recognized by the ACM in the main device to the object device.

[0419] In some embodiments, the information synchronization module is used to send the application identity in the mapped object device (such as the application identity of the caller), the running status of each application (such as the running status of the caller), and the permission information that can be recognized by the ACM in the mapped object device to the object device.

[0420] The communication module is used to establish a connection and communicate with the object device.

[0421] Fig. 6A For illustrative purposes only, the main device provided in the embodiment of the present application may also include more or fewer modules, which are not limited here. For example, the main device may also include an application identity management module for evaluating or obtaining the application identity of each application in the main device, an application identity library for storing application identities, and so on.

[0422] Fig. 6A The modules in the main device mentioned above can be located in Figure 3B The application layer, application framework layer, system service layer, kernel layer, etc. in the electronic device shown are not limited here.

[0423] refer to Figure 6B , Figure 6B A schematic diagram of the software structure of the object device provided in the embodiment of the present application. The object device may be Figure 4 The object device in the embodiment.

[0424] like Figure 6B As shown, the object device may include the following modules: application management module, permission access control module, application information management module, and communication module. Among them:

[0425] The application management module is used to manage the various applications in the object device and the applications mapped from the subject device. When the object device receives the access request sent by the subject device, the application management module is used to select the cross-device access control module in the permission access control module to perform permission check.

[0426] The permission access control module may include a local access control module and a cross-device access control module. The local access control module is used to perform permission checks on access requests generated locally by the object device. The cross-device access control module is used to perform permission checks on access requests sent by other devices, that is, to determine whether to respond to the access request initiated by the subject device. For the specific operation of the cross-device access control module to perform permission checks, please refer to the relevant description in the above method embodiment.

[0427] The application information management module may include: an application identity mapping module, a context management module, a permission mapping module, and an information synchronization module.

[0428] The application identity mapping module is used to map the application identity sent by the subject device to the application identity in the object device.

[0429] The context management module is used to manage the running status of each application in the object device, and the running status of each application in the main device sent by the main device.

[0430] The permission mapping module is used to map the permission information required for the access request sent by the subject device from a form recognizable by the ACM in the subject device to a form recognizable by the ACM in the object device.

[0431] The information synchronization module is used to receive the application identity sent by the main device (such as the application identity of the caller), the running status of each application (such as the running status of the caller), and the permission information of the access request that can be recognized by the ACM in the main device.

[0432] In some embodiments, the information synchronization module is used to receive the application identity (such as the application identity of the caller) in the mapped object device sent by the main device, the running status of each application (such as the running status of the caller), and the permission information that can be recognized by the ACM in the mapped object device.

[0433] The communication module is used to establish a connection and communicate with the object device.

[0434] Figure 6B For illustrative purposes only, the object device provided in the embodiment of the present application may also include more or fewer modules, which are not limited here. For example, the object device may also include an application identity management module for evaluating or obtaining the application identity of each application in the object device, an application identity library for storing application identities, and the like.

[0435] Figure 6B The modules in the mentioned object device can be located in Figure 3B The application layer, application framework layer, system service layer, kernel layer, etc. in the electronic device shown are not limited here.

[0436] The various implementation modes of the present application can be combined arbitrarily to achieve different technical effects.

[0437] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state disk (SSD)), etc.

[0438] Those skilled in the art can understand that to implement all or part of the processes in the above-mentioned embodiments, the processes can be completed by computer programs to instruct related hardware, and the programs can be stored in computer-readable storage media. When the programs are executed, they can include the processes of the above-mentioned method embodiments. The aforementioned storage media include: ROM or random access memory RAM, magnetic disk or optical disk and other media that can store program codes.

[0439] In short, the above is only an embodiment of the technical solution of this application, and is not intended to limit the protection scope of this application. Any modification, equivalent replacement, improvement, etc. made according to the disclosure of this application shall be included in the protection scope of this application.< / capabilities>

Claims

1. An access control method based on authority adaptation, characterized in that: The method is applied to a communication system including a first device and a second device, the first device has a first ACM, the second device has a second ACM, the ACM is an access control mechanism, and devices with different ACMs have different ways of recording permissions, the method comprising: The first device sends an access request to the second device, where the access request is used by the first device to access a first resource in the second device; The first device sends permission information based on the first ACM to the second device, and the second device maps the permission information based on the first ACM to permission information based on the second ACM; Alternatively, the first device maps the permission information based on the first ACM to the permission information based on the second ACM, and sends the permission information based on the second ACM to the second device; The permission information is used to indicate the first permission required for the access request; The second device responds to the access request to access the first resource according to the permission information based on the second ACM.

2. The method according to claim 1, characterized in that The permission information based on the first ACM sent by the first device to the second device, or the permission information based on the second ACM is carried in the access request.

3. The method according to claim 1, characterized in that The second device is installed with a callee, the callee is an application APP or a functional component, the APP is a program entity that implements multiple functions, and the functional component is a program entity that implements a single function; The access request is specifically used by the first device to call the callee in the second device to access the first resource; The first permission specifically includes: permission for the first device to call the callee, and / or permission to access the first resource.

4. The method according to claim 3, characterized in that The first device is installed with a caller, and the caller is the APP or the functional component; The access request is specifically used by the caller in the first device to call the callee in the second device to access the first resource; The first permission specifically includes: permission for the caller in the first device to call the callee, and / or permission to access the first resource.

5. The method according to claim 4, characterized in that Before the second device responds to the access request to access the first resource according to the permission information based on the second ACM, the method further includes: The first device sends the first application identity of the caller to the second device, and the second device maps the first application identity to a second application identity; Alternatively, the first device maps the first application identity to the second application identity, and sends the second application identity to the second device; The first application identity is used by the first device to identify the caller, and the second application identity is used by the second device to identify the caller; The second device associates and stores the second application identity with the permission information based on the second ACM; The second device responds to the access request to access the first resource according to the permission information based on the second ACM, specifically including: The second device determines the corresponding permission information based on the second ACM according to the second application identity of the caller in the access request, and accesses the first resource according to the permission information based on the second ACM.

6. The method according to claim 4, characterized in that Before the second device responds to the access request to access the first resource, the method further includes: the first device sends the running state of the caller to the second device, and the running state of the caller includes any one of the following: foreground running, background running, or stopped running; The second device responds to the access request to access the first resource, specifically including: when the running state of the caller is foreground running, the second device responds to the access request to access the first resource.

7. The method according to any one of claims 1 to 6, characterized in that: Before the first device sends the permission information based on the first ACM to the second device, the method further includes: The first device outputs first prompt information, where the first prompt information is used to prompt a user to grant the first permission; The first device receives a first operation, and acquires the first permission in response to the first operation.

8. The method according to any one of claims 1 to 6, characterized in that: Before the second device responds to the access request to access the first resource, the method further includes: The second device determines the first permission according to the permission information based on the second ACM; The second device outputs second prompt information, where the second prompt information is used to prompt the user to grant the first permission; The second device receives the second operation, and acquires the first permission in response to the second operation.

9. The method according to any one of claims 1 to 6, characterized in that: The first ACM or the second ACM is any one of the following: a permission-based ACM, a discretionary access control mechanism DAC, a capability-based ACM, a label-based ACM or a context-based ACM.

10. The method according to any one of claims 1 to 6, characterized in that: The first device and the second device are configured with the same or different operating systems OS.

11. An access control method based on authority adaptation, characterized in that: The method is applied to a second device, and the method includes: The second device receives an access request sent by the first device, where the access request is used by the first device to access a first resource in the second device; the first device has a first ACM, and the second device has a second ACM, where ACM is an access control mechanism, and devices with different ACMs record permissions differently; The second device receives the permission information based on the first ACM sent by the first device, and maps the permission information based on the first ACM to the permission information based on the second ACM; Or, the second device receives permission information based on the second ACM sent by the first device and obtained by mapping permission information based on the first ACM; The permission information is used to indicate the first permission required for the access request; The second device responds to the access request to access the first resource according to the permission information based on the second ACM.

12. The method according to claim 11, characterized in that The permission information based on the first ACM received by the second device, or the permission information based on the second ACM is carried in the access request.

13. The method according to claim 11, characterized in that The second device is installed with a callee, the callee is an application APP or a functional component, the APP is a program entity that implements multiple functions, and the functional component is a program entity that implements a single function; The access request is specifically used by the first device to call the callee in the second device to access the first resource; The first permission specifically includes: permission for the first device to call the callee, and / or permission to access the first resource.

14. The method according to claim 13, characterized in that The first device is installed with a caller, and the caller is the APP or the functional component; The access request is specifically used by the caller in the first device to call the callee in the second device to access the first resource; The first permission specifically includes: permission for the caller in the first device to call the callee, and / or permission to access the first resource.

15. The method according to claim 14, characterized in that Before the second device responds to the access request to access the first resource according to the permission information based on the second ACM, the method further includes: The second device receives the first application identity of the caller sent by the first device, and maps the first application identity to a second application identity; Alternatively, the second device receives the second application identity sent by the first device and obtained by mapping the first application identity; The first application identity is used by the first device to identify the caller, and the second application identity is used by the second device to identify the caller; The second device associates and stores the second application identity with the permission information based on the second ACM; The second device responds to the access request to access the first resource according to the permission information based on the second ACM, specifically including: The second device determines the corresponding permission information based on the second ACM according to the second application identity of the caller in the access request, and accesses the first resource according to the permission information based on the second ACM.

16. The method according to claim 14, characterized in that Before the second device responds to the access request to access the first resource, the method further includes: the second device receives the running status of the caller sent by the first device, the running status of the caller including any one of the following: foreground running, background running or stopped running; The second device responds to the access request to access the first resource, specifically including: when the running state of the caller is foreground running, the second device responds to the access request to access the first resource.

17. The method according to any one of claims 11 to 16, characterized in that: Before the second device responds to the access request to access the first resource, the method further includes: The second device determines the first permission according to the permission information based on the second ACM; The second device outputs second prompt information, where the second prompt information is used to prompt the user to grant the first permission; The second device receives the second operation, and acquires the first permission in response to the second operation.

18. The method according to any one of claims 11 to 16, characterized in that: The first ACM or the second ACM is any one of the following: a permission-based ACM, a discretionary access control mechanism DAC, a capability-based ACM, a label-based ACM or a context-based ACM.

19. The method according to any one of claims 11 to 16, characterized in that: The first device and the second device are configured with the same or different operating systems OS.

20. An electronic device, characterized in that: include: A memory and one or more processors; the memory is coupled to the one or more processors, the memory is used to store computer program code, the computer program code includes computer instructions, and the one or more processors call the computer instructions to enable the electronic device to execute the method as described in any one of claims 11-19.

21. A computer-readable storage medium comprising instructions, characterized in that: When the instructions are executed on an electronic device, the electronic device is caused to execute the method as claimed in any one of claims 11 to 19.

22. A computer program product, characterized in that When the computer program product is run on a computer, the computer is caused to execute the method according to any one of claims 11 to 19.

23. A communication system, characterized in that: The communication system comprises: a first device and a second device, wherein the second device is used to execute the method according to any one of claims 11 to 19.

Images