A method, device, computer device and storage medium for accessing permission data

Abstract

The application discloses a method and device for permission data access, a computer device and a storage medium. The application can be applied to various scenes such as cloud technology and intelligent transportation, and comprises the following steps: acquiring a first service identifier set; acquiring a permission data access request; if a target service identifier belongs to the first service identifier set, determining a target permission data type corresponding to a target application programming interface based on the target application programming interface indicated by the data access request; determining a permission data type corresponding to the target service identifier in the permission data access request based on a plurality of service identifiers in the first service identifier set; and if the target permission data type is included in the permission data type corresponding to the target service identifier, accessing permission data corresponding to the target permission data type. Through the above method, malicious third-party libraries can be effectively prevented from obtaining user permission data, user permission data leakage can be avoided, and the reliability of permission data access can be improved.

Description

Technical Field

[0001] This application relates to the field of terminal security technology, and in particular to a method, apparatus, computer device, and storage medium for accessing authorized data. Background Technology

[0002] With the rapid development of network technology, smart terminal devices are no longer limited to providing users with services such as calls and text messages; they can also offer various application services with functions such as location tracking and payment. However, while enjoying these convenient services, users also face problems such as the leakage of access data. For example, some service applications, for commercial purposes, request access permissions to read users' text message content, location information, and other data.

[0003] Currently, smart terminal devices can use closed-source third-party libraries, such as user interface design (UI) components, data parsing, and list management libraries. If these third-party libraries detect that the user has granted permission to an application to access relevant permission data, the process of calling the corresponding application programming interface (API) to obtain the permission data is lengthy due to code obfuscation. Therefore, the accuracy and timeliness of intercepting the third-party library's access to relevant permission data are reduced. Consequently, the third-party library may use asynchronous threads to read the user's permission data, such as by collecting the user's voice messages. After collecting and analyzing the user's voice messages, the third-party library may upload them to its server, leading to the leakage of permission data and increasing the likelihood of such leakage. Therefore, ensuring the reliability of permission data access has become a pressing issue that needs to be addressed. Summary of the Invention

[0004] This application provides a method, apparatus, computer device, and storage medium for accessing permission data. When the target service identifier belongs to the set of service identifiers that allow access to data, the target permission data type to be invoked by the access request is determined through the access request, as well as the specific service type that needs to invoke the permission data. Only when the permission data type corresponding to the service type includes the target permission data type is the permission data corresponding to the target permission data type invoked. Therefore, it effectively prevents malicious third-party libraries from obtaining user permission data, avoids leakage of user permission data, and improves the reliability of permission data access.

[0005] In view of this, the first aspect of this application provides a method for accessing authorized data, comprising:

[0006] Obtain a first set of business identifiers, wherein the first set of business identifiers includes multiple business identifiers, each business identifier uniquely indicates a business type, each business identifier corresponds to at least one permission data type, and each permission data type uniquely corresponds to an application programming interface.

[0007] Obtain a permission data access request, wherein the permission data access request includes a target business identifier and the permission data access request indicates a call to the target application programming interface;

[0008] If the target service identifier belongs to the first service identifier set, then the target permission data type corresponding to the target application programming interface is determined based on the target application programming interface indicated by the data access request.

[0009] Based on multiple business identifiers in the first business identifier set, determine the permission data type corresponding to the target business identifier in the permission data access request;

[0010] If the permission data type corresponding to the target business identifier includes the target permission data type, then access the permission data corresponding to the target permission data type.

[0011] A second aspect of this application provides a permissioned data access device, comprising:

[0012] The acquisition module is used to acquire a first set of business identifiers, wherein the first set of business identifiers includes multiple business identifiers, each business identifier uniquely indicates a business type, the business identifier corresponds to at least one permission data type, and each permission data type uniquely corresponds to an application programming interface.

[0013] The acquisition module is also used to acquire permission data access requests, wherein the permission data access request includes a target business identifier and the permission data access request indicates a call to the target application programming interface;

[0014] The determination module is used to determine the target permission data type corresponding to the target application programming interface based on the target application programming interface indicated by the data access request if the target service identifier belongs to the first service identifier set.

[0015] The determination module is also used to determine the data type of the permission data access request corresponding to the target business identifier based on multiple business identifiers in the first business identifier set.

[0016] The access module is used to access the permission data corresponding to the target permission data type if the permission data type corresponding to the target service identifier includes the target permission data type.

[0017] In one possible implementation, the access control device further includes a copy module;

[0018] Each type of permission data also uniquely corresponds to a preset access time range;

[0019] The module is also used to determine the access time of the permission data access request before the access module accesses the permission data corresponding to the target permission data type.

[0020] The access module is specifically used to access the permission data corresponding to the target permission data type if the permission data type corresponding to the target business identifier includes the target permission data type and the access time of the permission data access request is within the preset access time range corresponding to the target permission data type.

[0021] The copy module is used to copy the permission data corresponding to the target permission data type after the access module accesses the permission data corresponding to the target permission data type, and to copy the data generated within the preset access time range corresponding to the target permission data type.

[0022] In one possible implementation, each permission data type also uniquely corresponds to a preset data access duration;

[0023] The acquisition module is also used to obtain the access duration of the access to the permission data corresponding to the target permission data type when the access module accesses the permission data corresponding to the target permission data type.

[0024] The access module is also used to stop accessing the permission data corresponding to the target permission data type if the access duration for accessing the permission data corresponding to the target permission data type is greater than the preset access duration for the target permission data type.

[0025] In one possible implementation, the acquisition module is specifically used to acquire a set of permission data types, wherein the set of permission data types includes multiple permission data types;

[0026] Obtain a second set of service identifiers, wherein the second set of service identifiers includes multiple initial service identifiers;

[0027] Obtain an initialization permission setting request, wherein the initialization permission setting request includes the correspondence between each initial business identifier in the second business identifier set and multiple permission data types in the permission data type set;

[0028] Based on the correspondence included in the initialization permission setting request, a first set of business identifiers is generated.

[0029] In one possible implementation, the acquisition module is specifically used to acquire a third service identifier set, wherein the third service identifier set includes a first service identifier;

[0030] Obtain a service identifier addition request, wherein the service identifier addition request includes a second service identifier;

[0031] Based on the service identifier addition request, the second service identifier is added to the third service identifier set to generate the first service identifier set, wherein the first service identifier set includes the first service identifier and the second service identifier;

[0032] or,

[0033] The acquisition module is specifically used to acquire the fourth service identifier set, which includes the first service identifier, the second service identifier, and the third service identifier.

[0034] Obtain the service identifier removal request, wherein the service identifier removal request includes the third service identifier;

[0035] Based on the service identifier removal request, the third service identifier is removed from the fourth service identifier set to generate the first service identifier set, wherein the first service identifier set includes the first service identifier and the second service identifier.

[0036] In one possible implementation, the acquisition module is specifically used to acquire a fifth set of service identifiers, wherein the fifth set of service identifiers includes a first service identifier, and the first service identifier corresponds to a first permission data type;

[0037] Obtain permission data addition request, wherein the permission data addition request includes the correspondence between the first business identifier and the second permission data type;

[0038] Based on the permission data addition request, the correspondence between the first service identifier and the second permission data type is added to the fifth service identifier set to generate the first service identifier set, wherein the first service identifier set includes the first service identifier, and the first service identifier corresponds to the first permission data type and the second permission data type;

[0039] or,

[0040] The acquisition module is specifically used to acquire the sixth business identifier set, wherein the sixth business identifier set includes the first business identifier, and the first business identifier corresponds to the first permission data type, the second permission data type, and the third permission data type;

[0041] Obtain a permission data removal request, wherein the permission data removal request includes the correspondence between the first business identifier and the third permission data type;

[0042] Based on the permission data removal request, the correspondence between the first service identifier and the third permission data type is removed from the sixth service identifier set to generate the first service identifier set, wherein the first service identifier set includes the first service identifier, and the first service identifier corresponds to the first permission data type and the second permission data type.

[0043] In one possible implementation, the access control device further includes a creation module;

[0044] A creation module is used to create a first distribution channel and a second distribution channel. The first distribution channel is used to handle authorized data access requests, and the second distribution channel is used to handle non-authorized data access requests.

[0045] A third aspect of this application provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the methods described in the above aspects.

[0046] A fourth aspect of this application provides a computer device, characterized in that it includes: a memory, a transceiver, a processor, and a bus system; wherein the memory is used to store a program; the processor is used to execute the program in the memory to implement the methods described in the above aspects; and the bus system is used to connect the memory and the processor to enable the memory and the processor to communicate.

[0047] A fifth aspect of this application provides a computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the methods described in the above aspects.

[0048] As can be seen from the above technical solutions, the embodiments of this application have the following advantages:

[0049] This application provides a method for accessing permission data. First, a first set of service identifiers is obtained. This set includes multiple service identifiers, each uniquely indicating a service type. Each service identifier corresponds to at least one permission data type, and each permission data type uniquely corresponds to an application programming interface (API). Then, a permission data access request is obtained. This request includes a target service identifier and indicates a call to a target API. If the target service identifier belongs to the first set of service identifiers, the target permission data type corresponding to the target API is determined based on the API indicated by the data access request. Furthermore, based on the multiple service identifiers in the first set of service identifiers, the permission data type corresponding to the target service identifier in the permission data access request is determined. If the permission data type corresponding to the target service identifier includes the target permission data type, the permission data corresponding to the target permission data type is accessed. By using the above method, when the target business identifier belongs to the set of business identifiers that allow access to data, the target permission data type to be called by the access request is determined by the access request, as well as the specific business type that needs to call the permission data. Only when the permission data type corresponding to the business type includes the target permission data type will the permission data corresponding to the target permission data type be called. Therefore, it effectively prevents malicious third-party libraries from obtaining user permission data, avoids the leakage of user permission data, and improves the reliability of permission data access. Attached Figure Description

[0050] Figure 1 This is a system schematic diagram of a method for accessing permission data in an embodiment of this application;

[0051] Figure 2 A flowchart illustrating a method for accessing authorized data provided in an embodiment of this application;

[0052] Figure 3 A schematic diagram of an embodiment of the method for accessing permission data provided in this application;

[0053] Figure 4 A schematic diagram of another embodiment of the method for accessing permission data provided in this application;

[0054] Figure 5 This is a schematic diagram of the structure of a permission data access device provided in an embodiment of this application;

[0055] Figure 6 This is a schematic diagram of one embodiment of the server in this application;

[0056] Figure 7 This is a schematic diagram of one embodiment of the terminal device in this application. Detailed Implementation

[0057] This application provides a method, apparatus, computer device, and storage medium for accessing permission data. When the target service identifier belongs to the set of service identifiers that allow access to data, the target permission data type to be invoked by the access request is determined through the access request, as well as the specific service type that needs to invoke the permission data. Only when the permission data type corresponding to the service type includes the target permission data type is the permission data corresponding to the target permission data type invoked. Therefore, it effectively prevents malicious third-party libraries from obtaining user permission data, avoids leakage of user permission data, and improves the reliability of permission data access.

[0058] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a particular order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented, for example, in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “corresponding to,” and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0059] With the rapid development of network technology, smart terminal devices are no longer limited to providing users with services such as calls and text messages; they can also offer various application services with functions such as location tracking and payment. However, while enjoying these convenient services, users also face problems such as the leakage of access data. For example, some service applications, for commercial purposes, request access permissions to read users' text message content, location information, and other data. Based on this, on some smart terminal devices, the device can read the permission data requested by the application to locate the executable file, then parse the executable file to obtain the relevant code call information, compare the executable file with private functions, or functions that are not allowed to be called according to the review requirements to determine the text similarity, thereby establishing an API and permission mapping table. In specific applications, different types of permission information are used, and the application's usage of permission information is output, thus obtaining permission information and permission mapping table, thereby determining whether the application is allowed to access certain permission data. However, the aforementioned method requires splitting a string into multiple substrings and then concatenating them. These substrings may come from dynamic distribution by the server. After concatenation, a class object is initialized through reflection to call privacy functions. Therefore, the split strings cannot be obtained during matching because these substrings do not exist locally, which may lead to matching failure and thus cannot accurately guarantee access to permission data, thereby reducing the reliability of permission data access. Secondly, smart terminal devices can also use closed-source third-party libraries, such as UI components, data parsing libraries, and list management libraries. If these third-party libraries detect that the user has consented to the application obtaining relevant permission data, the API calls for obtaining the permission data are lengthy due to code obfuscation. This reduces the accuracy and timeliness of intercepting the third-party libraries' acquisition of relevant permission data. Consequently, the third-party libraries may use asynchronous threads to read the user's permission data, such as obtaining the user's voice messages. After collecting and analyzing the user's voice messages, the third-party library uploads them to its server, leading to the leakage of permission data and increasing the possibility of permission data leakage. Therefore, ensuring the reliability of permission data access has become an urgent problem to be solved. Based on this, this application provides a method for accessing permission data, which can effectively prevent malicious third-party libraries from obtaining user permission data, avoid leakage of user permission data, and thus improve the reliability of permission data access.

[0060] First, for ease of understanding, some terms or concepts involved in the embodiments of this application will be explained.

[0061] I. Runtime

[0062] Runtime refers to deferring the determination of data types from compile time to runtime. During program execution, the data is eventually converted into runtime C language code. Through the runtime mechanism, methods can be modified or replaced during program execution.

[0063] The application scenarios of this application embodiment are described below. It is understood that the permission data access method can be executed by a terminal device or a server. In practice, when the permission data access method is deployed on a terminal device, the terminal device, upon receiving a permission data access request, can directly process the request using the permission data access method provided in this application embodiment to determine whether access is possible. In this case, the terminal device does not need to be connected to the network, thus better protecting the reliability of user permission data access, and making the permission data access process more convenient. When the permission data access method is deployed on a server, the server can, based on the permission data access request sent by the terminal device, determine whether access is possible using the permission data access method provided in this application embodiment. This allows for more efficient processing of permission data access requests based on the server's hardware performance, thereby improving the efficiency of processing permission data access requests and further enhancing the reliability of permission data access.

[0064] The following describes the method for accessing permission data provided in this application embodiment, using a terminal device as the execution subject as an example. Please refer to... Figure 1 , Figure 1 This is a system diagram illustrating a method for accessing permission data in an embodiment of this application, such as... Figure 1 As shown, the permission data access system includes a server and a terminal device. The terminal device can obtain a first set of service identifiers through a communication connection with the server, and then process the obtained permission data access requests. When the target service identifier belongs to the first set of service identifiers, the target permission data type corresponding to the target application programming interface is determined, and the target permission data type is included in the permission data type corresponding to the target service identifier. The permission data corresponding to the target permission data type is then accessed.

[0065] It should be noted that, Figure 1 The servers in this context can be independent physical servers, server clusters or distributed systems composed of multiple physical servers, or cloud servers providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. Terminal devices can be... Figure 1The devices shown include tablets, laptops, PDAs, mobile phones, personal computers (PCs), and smart voice interaction devices. Terminal devices may also include, but are not limited to, smart home appliances and in-vehicle terminals. The terminal devices and servers can be directly or indirectly connected via wireless networks, wired networks, or removable storage media. The aforementioned wireless networks use standard communication technologies and / or protocols. The wireless network is typically the Internet, but can also be any network, including but not limited to Bluetooth, Local Area Network (LAN), Metropolitan Area Network (MAN), Wide Area Network (WAN), mobile, private networks, or any combination of virtual private networks. In some embodiments, custom or dedicated data communication technologies may be used to replace or supplement the aforementioned data communication technologies. The removable storage media may be a Universal Serial Bus (USB) flash drive, external hard drive, or other removable storage media.

[0066] Secondly, although Figure 1 Only five terminal devices and one server are shown, but it should be understood that... Figure 1 The examples provided are for understanding this solution only; the actual number of terminal devices and servers should be determined flexibly based on the specific circumstances.

[0067] Secondly, the embodiments of this invention can be applied to various scenarios, including but not limited to cloud technology, intelligent transportation, and assisted driving. Cloud technology refers to a hosting technology that unifies hardware, software, network, and other resources within a wide area network (WAN) or local area network (LAN) to achieve data computation, storage, processing, and sharing. Cloud technology is a general term for network technology, information technology, integration technology, management platform technology, and application technology applied based on the cloud computing business model. It can form resource pools, be used on demand, and is flexible and convenient. Cloud computing technology will become an important support. The backend services of technical network systems require a large amount of computing and storage resources, such as video websites, image websites, and many portal websites. With the rapid development and application of the Internet industry, in the future, every item may have its own identification mark, which will need to be transmitted to the backend system for logical processing. Data of different levels will be processed separately, and various industry data will all require strong system support, which can only be achieved through cloud computing.

[0068] Cloud computing refers to the delivery and usage model of IT infrastructure, meaning obtaining necessary resources in an on-demand and easily scalable manner through a network. In a broader sense, cloud computing refers to the delivery and usage model of services, meaning obtaining necessary services in an on-demand and easily scalable manner through a network. These services can be IT and software related, internet-related, or other services. Cloud computing is a product of the development and integration of traditional computer and network technologies such as grid computing, distributed computing, parallel computing, utility computing, network storage technologies, virtualization, and load balancing.

[0069] With the development of the internet, real-time data streams, and the diversification of connected devices, as well as the demands for search services, social networks, mobile commerce, and open collaboration, cloud computing has rapidly developed. Unlike previous parallel distributed computing, cloud computing will fundamentally revolutionize the entire internet model and enterprise management model.

[0070] Artificial intelligence cloud services are generally also known as AIaaS (AI as a Service). This is currently a mainstream service model for artificial intelligence platforms. Specifically, AIaaS platforms break down several common AI services and provide them as independent or packaged services in the cloud. This service model is similar to opening an AI-themed marketplace: all developers can access and use one or more AI services provided by the platform through API interfaces. Some experienced developers can also use the AI ​​framework and AI infrastructure provided by the platform to deploy and maintain their own dedicated cloud AI services.

[0071] Furthermore, cloud security refers to the collective term for security software, hardware, users, organizations, and security cloud platforms based on cloud computing business models. Cloud security integrates emerging technologies and concepts such as parallel processing, grid computing, and unknown virus behavior detection. Through a large network of clients, it monitors abnormal software behavior on the network, obtains the latest information on Trojans and malware on the Internet, sends it to the server for automatic analysis and processing, and then distributes solutions for viruses and Trojans to each client.

[0072] The main research areas of cloud security include: 1. Cloud computing security: This focuses on how to ensure the security of the cloud itself and various applications on it, including cloud computer system security, secure storage and isolation of user data, user access authentication, information transmission security, network attack protection, and compliance auditing. 2. Cloudification of security infrastructure: This research focuses on how to use cloud computing to build and integrate security infrastructure resources, and optimize security protection mechanisms. This includes building large-scale security incident and information collection and processing platforms through cloud computing technology to achieve the collection and correlation analysis of massive amounts of information, thereby improving the ability to control and manage network-wide security incidents and risks. 3. Cloud security services: This research focuses on various security services provided to users based on cloud computing platforms, such as antivirus services.

[0073] For easier understanding, please refer to Figure 2 , Figure 2 Please refer to the flowchart illustrating a method for accessing authorized data provided in this application embodiment. Figure 2 The process of accessing authorized data is divided into three stages: environment initialization, permission item construction, and access request processing. The functions and processes of each stage will be described below:

[0074] In the environment initialization phase A1, a first and a second traffic distribution channel are created. The first channel handles access requests for authorized data, while the second channel handles non-authorized data access requests. Then, a set of authorized data types and a second set of business identifiers are obtained. At this point, the set of authorized data types includes multiple authorized data types, and the second set of business identifiers includes multiple initial business identifiers. No correspondence is established between the initial business identifiers and the authorized data types. Next, an initialization permission setting request, generated based on user requirements, is obtained. This request includes the correspondence between each initial business identifier in the second set of business identifiers and the multiple authorized data types in the set of authorized data types. Based on this correspondence, a first set of business identifiers is generated, thus completing the environment initialization.

[0075] In the permission item construction phase A2, the following four methods are used to implement permission data access. First, each business identifier in the first business identifier set uniquely indicates a business type. The business identifier carried in the permission data access request must exist in the first business identifier set to determine whether the current business type can access the data. Based on this, each business identifier corresponds to at least one permission data type, and each permission data type uniquely corresponds to an application programming interface (API). Therefore, the target permission data type is determined by the target API indicated by the permission data access request to determine whether the current business type can access the permission data corresponding to the target permission data type. Furthermore, each permission data type also uniquely corresponds to a preset access time range. Access to the permission data corresponding to the target permission data type is only possible if the access time of the permission data access request is within the preset access time range corresponding to the target permission data type. Additionally, the access to the permission data corresponding to the target permission data type will be copied, along with any data generated within the preset access time range. Finally, each permission data type also uniquely corresponds to a preset data access duration. Therefore, if the access duration of the permission data corresponding to the target permission data type exceeds the preset data access duration, access to the permission data corresponding to the target permission data type will be stopped.

[0076] In the access request processing stage A3, the system's permission API methods are hooked using runtime to obtain the permission data access method provided in this embodiment, thereby monitoring the calls to the permission API. Based on this, permission data access requests can be obtained, and the request indicates a call to the target application programming interface. The target permission data type corresponding to the target application programming interface is then matched, and permission data access is implemented through the four methods set in the permission item construction stage A2.

[0077] Based on the above introduction, the following section uses a terminal device as the execution subject to describe the method for accessing permission data in this application. Please refer to [link / reference]. Figure 3 , Figure 3 A schematic diagram of an embodiment of the method for accessing permission data provided in this application is shown below. Figure 3 As shown, the method includes:

[0078] 101. Obtain the first set of business identifiers.

[0079] In this embodiment, the terminal device obtains a first service identifier set, which includes multiple service identifiers. Each service identifier uniquely indicates a service type, and each service identifier corresponds to at least one permission data type. Furthermore, each permission data type uniquely corresponds to an application programming interface (API). This first service identifier set represents the set of service identifiers that the terminal device is allowed to access different permission data types; that is, the service type indicated by each service identifier in the first service identifier set can access the corresponding permission data type.

[0080] Specifically, different service identifiers indicate different service types, but the permission data types corresponding to different service identifiers can be the same or different. The aforementioned permission data types include, but are not limited to, microphone permission data types, camera permission data types, album permission data types, contact book permission data types, Bluetooth permission data types, location permission data types, and network permission data types. In practical applications, permission data types can also include permission data types for accessing clipboard text data and calendar permission data types. The specific permission data types need to be determined according to user needs and actual application scenarios, and will not be listed exhaustively here.

[0081] For example, if the first service identifier set includes service identifier "1" and service identifier "2", and service identifier "1" indicates a video playback service type, and service identifier "2" indicates a voice input service type, then service identifier "1" can correspond to Bluetooth permission data type, location permission data type, and network permission data type, while service identifier "2" can correspond to microphone permission data type and network permission data type. It should be understood that the foregoing example is only for understanding this solution, and the permission data types corresponding to different services need to be determined according to user needs and actual application scenarios. Therefore, the foregoing example should not be construed as a limitation of this application.

[0082] 102. Obtain permission data access request.

[0083] In this embodiment, the terminal device uses runtime to hook the system's permission API methods to obtain the permission data access method provided in this embodiment, thereby monitoring all application programming interface (API) calls. Based on this, when a user needs to access permission data corresponding to a target permission data type, a permission data access request can be generated based on the permission data access operation. This permission data access request includes a target service identifier and indicates a call to the target API. Since the terminal device can monitor all API calls, it can obtain the permission data access request when it indicates a call to the target API.

[0084] For example, if a user needs to wear Bluetooth headphones to play video and audio data while using the video playback service, they will request access to Bluetooth permission data corresponding to the Bluetooth permission data type. Therefore, the user will request access to Bluetooth permission data on the video playback service operation page, generating a permission data access request including a target service identifier "1". The target service identifier "1" uniquely indicates the video playback service type, and this permission data access request indicates a call to the Bluetooth application programming interface (API). Secondly, if a user needs to use the microphone of the terminal device for voice input, they will request access to microphone permissions corresponding to the microphone permission data type. Therefore, the user will request access to microphone permission data on the voice input service operation page, generating a permission data access request including a target service identifier "2". The target service identifier "2" uniquely indicates the voice input service type, and this permission data access request indicates a call to the microphone application programming interface (API). It should be understood that the above examples are only for understanding this solution. The permission data access request needs to be determined based on the actual application scenario, the user's actual permission data access needs, and the specific service. Therefore, the above examples should not be construed as limitations of this application.

[0085] 103. If the target service identifier belongs to the first service identifier set, then determine the target permission data type corresponding to the target application programming interface based on the target application programming interface indicated by the data access request.

[0086] In this embodiment, after the terminal device obtains the permission data access request including the target service identifier in step 102, it first performs a preliminary judgment to determine whether the target service identifier in the permission data access request belongs to the first service identifier set obtained in step 101. In other words, it determines whether the service type indicated by the current target service identifier can access the data. Since the first service identifier set is a set of service identifiers that the terminal device is allowed to access different permission data types, if the target service identifier belongs to the first service identifier set, it means that the target service type indicated by the target service identifier can access the data type. At this time, the terminal device will determine the target permission data type corresponding to the target application programming interface (API) based on the target API indicated by the data access request. Conversely, if the target service identifier does not belong to the first service identifier set, it means that the target service type indicated by the target service identifier cannot access the data type. Therefore, the permission data access process will be directly terminated, thereby preventing the target service type from executing the step of obtaining permission data.

[0087] For example, if the first service identifier set includes service identifier "1" and service identifier "2", and the target service identifier included in the data access request is "3", the target service identifier "3" uniquely indicates the album service type, and the permission data access request indicates a call to the Bluetooth application programming interface, then the target service identifier "3" does not belong to the first service identifier set, and the terminal device will directly terminate the permission data access process. Secondly, if the target service identifier included in the data access request is "1", the target service identifier "1" uniquely indicates the video playback service type, and the permission data access request indicates a call to the Bluetooth application programming interface, then the target service identifier "1" belongs to the first service identifier set. The terminal device will further determine the Bluetooth permission data type corresponding to the Bluetooth application programming interface based on the Bluetooth application programming interface indicated by the data access request. It should be understood that the foregoing examples are only for understanding this solution. Whether to execute the target permission data type needs to be determined based on the specific target service identifier and the first service identifier set, and the specific target permission data type needs to be determined based on the specific target application programming interface. Therefore, the foregoing examples should not be construed as limitations of this application.

[0088] 104. Based on multiple business identifiers in the first business identifier set, determine the permission data type corresponding to the target business identifier in the permission data access request.

[0089] In this embodiment, since the first service identifier set obtained in step 101 includes multiple service identifiers and each service identifier corresponds to at least one permission data type, the terminal device determines the permission data type corresponding to the target service identifier in the permission data access request based on the aforementioned multiple service identifiers, specifically based on the permission data type corresponding to each service identifier.

[0090] For example, if the first set of service identifiers includes service identifier "1" and service identifier "2", and service identifier "1" corresponds to Bluetooth permission data type, location permission data type, and network permission data type, and service identifier "2" corresponds to microphone permission data type and network permission data type. Based on this, if the target service identifier in the permission data access request is "1", it means that the permission data type corresponding to the target service identifier "1" is Bluetooth permission data type, location permission data type, and network permission data type. If the target service identifier in the permission data access request is "2", it means that the permission data type corresponding to the target service identifier "2" is microphone permission data type and network permission data type. It should be understood that the above examples are only for understanding this solution, and the specific permission data type corresponding to the target service identifier needs to be determined based on the permission data types corresponding to multiple service identifiers. Therefore, the above examples should not be construed as limitations of this application.

[0091] 105. If the permission data type corresponding to the target business identifier includes the target permission data type, then access the permission data corresponding to the target permission data type.

[0092] In this embodiment, after the terminal device determines the permission data type corresponding to the target service identifier in step 104, it will determine whether the target permission data type corresponding to the target application programming interface determined in step 103 exists within the permission data type corresponding to the target service identifier. In other words, it will determine whether the target service type indicated by the target service identifier can access the target permission data type. Based on this, if the permission data type corresponding to the target service identifier includes the target permission data type, then the target service type indicated by the target service identifier can access the target permission data type, and therefore the terminal device accesses the permission data corresponding to the target permission data type. Conversely, if the permission data type corresponding to the target service identifier does not include the target permission data type, then the target service type indicated by the target service identifier cannot access the permission data corresponding to the target permission data type, and therefore the terminal device will directly terminate the permission data access process, thereby avoiding obtaining the permission data corresponding to the target permission data type.

[0093] For example, if service identifier "1" corresponds to Bluetooth permission data type, location permission data type, and network permission data type, and service identifier "2" corresponds to microphone permission data type and network permission data type, then: If a data access request carries service identifier "1" and indicates a Bluetooth application programming interface (API), which corresponds to a Bluetooth permission data type, the terminal device will access the Bluetooth permission data corresponding to the Bluetooth permission data type because service identifier "1" corresponds to Bluetooth permission data type, location permission data type, and network permission data type, and the Bluetooth permission data type belongs to the permission data type corresponding to service identifier "1". Secondly, if a data access request carries service identifier "2" and indicates a Bluetooth API, which corresponds to a Bluetooth permission data type, the terminal device will directly terminate the permission data access process because service identifier "2" corresponds to Bluetooth permission data type, location permission data type, and network permission data type, and the Bluetooth permission data type does not belong to the permission data type corresponding to service identifier "2". This avoids obtaining the Bluetooth permission data corresponding to the Bluetooth permission data type, thus preventing the leakage of user permission data. It should be understood that the foregoing example is only for understanding this solution. Whether to access the permission data corresponding to the target permission data type needs to be determined based on the specific permission data type corresponding to the target business identifier and the actual target permission data type. Therefore, the foregoing example should not be construed as a limitation of this application.

[0094] In this application embodiment, a method for accessing permission data is provided. Using the above method, when the target business identifier belongs to the set of business identifiers that allow access to data, the target permission data type to be called by the access request is determined through the access request, and the specific business type that needs to call the permission data is determined. Only when the permission data type corresponding to the business type includes the target permission data type is the permission data corresponding to the target permission data type called. Therefore, it effectively prevents malicious third-party libraries from obtaining user permission data, avoids leakage of user permission data, and improves the reliability of permission data access.

[0095] Optionally, in the above Figure 3 Based on the corresponding embodiments, in an optional embodiment of the permission data access method provided in this application, each permission data type also uniquely corresponds to a preset access time range;

[0096] Before accessing the permission data corresponding to the target permission data type, the methods for accessing permission data also include:

[0097] Determine the access time for permission-based data access requests;

[0098] If the permission data type corresponding to the target service identifier includes the target permission data type, then access the permission data corresponding to the target permission data type, specifically including:

[0099] If the permission data type corresponding to the target business identifier includes the target permission data type, and the access time of the permission data access request is within the preset access time range corresponding to the target permission data type, then the permission data corresponding to the target permission data type is accessed.

[0100] After accessing the permission data corresponding to the target permission data type, the methods for accessing permission data also include:

[0101] Copy the permission data corresponding to the target permission data type, and the data generated within the preset access time range corresponding to the target permission data type.

[0102] This embodiment provides another method for accessing permission data. In this method, each permission data type also uniquely corresponds to a preset access time range. This preset access time range indicates the time range during which the permission data corresponding to the permission data type can be accessed. For example, the preset access time range for the microphone permission data type is 9:00 to 18:00, meaning that the microphone permission data corresponding to the microphone permission data type can be accessed between 9:00 and 18:00. Similarly, the preset access time range for the camera permission data type is 8:00 to 20:00, meaning that the camera permission data corresponding to the camera permission data type can be accessed between 8:00 and 20:00. And the preset access time range for the Bluetooth permission data type is 8:00 to 21:00, meaning that the Bluetooth permission data corresponding to the Bluetooth permission data type can be accessed between 8:00 and 21:00. Other permission data types, such as album permission data type, contact permission data type, Bluetooth permission data type, location permission data type, and network permission data type, can also correspond to a preset access time range. The preset access time ranges corresponding to different permission data types can be the same or different, which is not limited here. In practical applications, each permission data type can also uniquely correspond to a preset access date. This preset access date indicates the specific date on which the permission data corresponding to the permission data type can be accessed. For example, it may indicate that access is only allowed from Monday to Friday, or only allowed on weekends. This will not be elaborated or given in detail here, but it is similar to the preset access time range.

[0103] Based on this, please refer to Figure 4 , Figure 4 Another schematic diagram illustrating the method for accessing permission data provided in this application, as shown in the following example. Figure 4 As shown, in step B1, the terminal device obtains the first service identifier set through a method similar to that in the aforementioned embodiments, and in step B2, it obtains the permission data access request through a method similar to that in the aforementioned embodiments. These details will not be repeated here.

[0104] Then, before the terminal device accesses the permission data corresponding to the target permission data type, that is, when obtaining the permission data access request in step B2, the access time of the permission data access request can also be determined in step B3. Furthermore, in step B4, using a method similar to the aforementioned embodiments, when the target service identifier belongs to the first service identifier set, the target permission data type corresponding to the target application programming interface is determined based on the target application programming interface indicated by the data access request; this will not be elaborated further here. And in step B5, using a method similar to the aforementioned embodiments, the permission data type corresponding to the target service identifier in the permission data access request is determined based on multiple service identifiers in the first service identifier set; this will not be elaborated further here.

[0105] Further, in step B6, the terminal device determines whether the permission data type corresponding to the target service identifier includes the target permission data type using a method similar to that in the aforementioned embodiments. The specific implementation is similar to the aforementioned embodiments and will not be repeated here. If the terminal device can determine that the permission data type corresponding to the target service identifier includes the target permission data type, it further needs to determine whether the access time of the permission data access request is within the preset access time range corresponding to the target permission data type. If the access time of the permission data access request is within the preset access time range corresponding to the target permission data type, then the permission data requested by the permission data access request can be accessed during that time period, and therefore the terminal device accesses the permission data corresponding to the target permission data type. Conversely, if the access time of the permission data access request is not within the preset access time range corresponding to the target permission data type, then the target service type indicated by the target service identifier cannot access the permission data corresponding to the target permission data type. Therefore, the terminal device will directly terminate the permission data access process, thereby avoiding obtaining the permission data corresponding to the target permission data type.

[0106] For example, if service identifier "1" corresponds to Bluetooth permission data type, location permission data type, and network permission data type, and the preset access time range for the Bluetooth permission data type is 8:00 to 21:00, the preset access time range for the location permission data type is 10:00 to 18:00, and the preset access time range for the network permission data type is 6:00 to 23:00, then if a data access request carries service identifier "1", and the access time of the data access request is 9:00, and the data access request indicates the Bluetooth application programming interface (API), which corresponds to the Bluetooth permission data type, then because service identifier "1" corresponds to Bluetooth permission data type, location permission data type, and network permission data type, and the Bluetooth permission data type belongs to the permission data type corresponding to service identifier "1", and the access time of the data access request at 9:00 is within the preset access time range of 8:00 to 21:00 corresponding to the Bluetooth permission data type, the terminal device will access the Bluetooth permission data corresponding to the Bluetooth permission data type.

[0107] Secondly, if the data access request carries a service identifier "1", and the access time of the data access request is 20:00, and the data access request indicates a location application programming interface (API), which corresponds to a location permission data type, since service identifier "1" corresponds to Bluetooth permission data type, location permission data type, and network permission data type, and the location permission data type belongs to the permission data type corresponding to service identifier "1", but the access time of the data access request, 20:00, is not within the preset access time range of 10:00 to 18:00 corresponding to the location permission data type, the terminal device will directly terminate the permission data access process, thereby avoiding obtaining the Bluetooth permission data corresponding to the Bluetooth permission data type and thus avoiding the leakage of user permission data. It should be understood that the above example is only for understanding this solution. Whether to access the permission data corresponding to the target permission data type needs to be determined based on the specific permission data type corresponding to the target service identifier, the actual target permission data, and the actual access time of the permission data access request and the specific preset access time range corresponding to the target permission data type. Therefore, the above example should not be construed as a limitation of this application.

[0108] Furthermore, in step B7, the permission data type corresponding to the target service identifier includes the target permission data type, and the access time of the permission data access request is within the preset access time range corresponding to the target permission data type. After accessing the permission data corresponding to the target permission data type, the terminal device can also copy the data generated within the preset access time range corresponding to the target permission data type.

[0109] In this embodiment of the application, another method for accessing permission data is provided. Using the above method, when the permission data type corresponding to the business type includes the target permission data type, it is further determined whether the access time of the permission data access request is within the preset access time range corresponding to the target permission data type. This further strengthens the restriction requirements for access permission data. Thus, the permission data corresponding to the target permission data type is only called when the aforementioned judgment requirements are met. This further strengthens the ability to prevent malicious third-party libraries from obtaining user permission data, thereby further avoiding the leakage of user permission data and further improving the reliability of permission data access.

[0110] Optionally, in the above Figure 3 Based on the corresponding embodiments, in an optional embodiment of the permission data access method provided in this application, each permission data type also uniquely corresponds to a preset data access duration;

[0111] When accessing permission data corresponding to a target permission data type, the methods for accessing permission data also include:

[0112] Get the access duration of the permission data corresponding to the access target permission data type;

[0113] If the access duration for the permission data corresponding to the target permission data type exceeds the preset access duration for the target permission data type, then access to the permission data corresponding to the target permission data type will be stopped.

[0114] This embodiment provides another method for accessing permission data. In this method, each permission data type also uniquely corresponds to a preset data access duration. This preset data access duration indicates the duration for which the permission data corresponding to the permission data type can be accessed. For example, the preset data access duration for the microphone permission data type is 30 seconds (s), meaning the microphone permission data corresponding to the microphone permission data type can be accessed for 30 seconds. Similarly, the preset data access duration for the camera permission data type is 30 minutes (min), meaning the camera permission data corresponding to the camera permission data type can be accessed for 30 minutes. And the preset data access duration for the Bluetooth permission data type is 1 hour (h), meaning the Bluetooth permission data corresponding to the Bluetooth permission data type can be accessed for 1 hour. Other permission data types, such as album permission data type, contact permission data type, Bluetooth permission data type, location permission data type, and network permission data type, can also correspond to a preset data access duration. The preset data access durations corresponding to different permission data types can be the same or different, which is not limited here.

[0115] Based on this, when a terminal device accesses permission data corresponding to a target permission data type, it can also obtain the access duration of that access. It should be understood that the terminal device obtains the access duration in real-time and continuously; that is, as long as the terminal device is accessing the permission data corresponding to the target permission data type, it will continuously and in real-time record the access duration. This access duration is the time between the start time of the terminal device's access to the permission data corresponding to the target permission data type and the time at which the access is currently being performed. Furthermore, the terminal device will determine the difference between the access duration of the access to the permission data corresponding to the target permission data type and the preset access duration for that data. When the access duration of the access to the permission data corresponding to the target permission data type is greater than the preset access duration, it indicates that the time allowed for access to that permission data has been exceeded. Therefore, the terminal device will directly stop accessing the permission data corresponding to the target permission data type to avoid continuing to obtain that data. Conversely, if the access duration for the permission data corresponding to the target permission data type is less than the preset access duration for the target permission data type, it means that the access duration for that permission data is still within the time limit. Therefore, the terminal device will continue to access the permission data corresponding to the target permission data type based on its needs.

[0116] For example, if the service identifier "1" corresponds to Bluetooth permission data type, location permission data type, and network permission data type, and the preset data access duration for the Bluetooth permission data type is 1 hour, for the location permission data type it is 10 minutes, and for the network permission data type it is 6 hours, then if the Bluetooth permission data corresponding to the Bluetooth permission data type is accessed through the Bluetooth application programming interface (API) and the access duration is 40 minutes, the duration of the Bluetooth permission data access is still less than the preset data access duration, so access to the permission data corresponding to the Bluetooth permission data type can continue. Secondly, if the location permission data corresponding to the location permission data type is accessed through the location API and the access duration is 10 minutes plus 2 seconds, the duration of the location permission data access is now greater than the preset data access duration for the Bluetooth permission data type, so access to the location permission data corresponding to the location permission data type is stopped. It should be understood that the above examples are only for understanding this solution; access to the permission data corresponding to the target permission data type needs to be flexibly determined according to the actual situation, therefore the above examples should not be construed as limitations of this application.

[0117] In this embodiment of the application, another method for accessing permission data is provided. Using the above method, when accessing permission data corresponding to the target permission data type, the access duration of the permission data is monitored in real time. If the access duration exceeds the preset data access duration, the access to the permission data is stopped, so as to achieve real-time security monitoring of permission data during the access data access process and further improve the reliability of permission data access.

[0118] Optionally, in the above Figure 3 Based on the corresponding embodiments, in one optional embodiment of the permission data access method provided in this application, obtaining the first service identifier set specifically includes:

[0119] Retrieve the set of permission data types, where the set of permission data types includes multiple permission data types;

[0120] Obtain a second set of service identifiers, wherein the second set of service identifiers includes multiple initial service identifiers;

[0121] Obtain an initialization permission setting request, wherein the initialization permission setting request includes the correspondence between each initial business identifier in the second business identifier set and multiple permission data types in the permission data type set;

[0122] Based on the correspondence included in the initialization permission setting request, a first set of business identifiers is generated.

[0123] This embodiment provides a method for obtaining a first set of service identifiers. In this method, the terminal device obtains the first set of service identifiers through initialization. First, the terminal device creates a set of permission data types based on different permission data types. Then, different permission data types have corresponding access logic. That is, each permission data type requires the construction of a corresponding permission instance before access to the application programming interface (API) corresponding to the permission data type can be performed. Therefore, after the construction of the permission instance corresponding to each permission data type, the API corresponding to the permission data type can be called through the permission instance. The subsequent steps are similar to those in the previous embodiment. For example, the permission data type set includes microphone permission data types, camera permission data types, album permission data types, contact book permission data types, Bluetooth permission data types, location permission data types, and network permission data types.

[0124] Secondly, the server can also obtain a second set of service identifiers, which includes multiple initial service identifiers. At this point, no correspondence has been established between the initial service identifiers and the permission data types. The second set of service identifiers includes initial service identifier "1" and initial service identifier "2". Here, initial service identifier "1" is only used to indicate the video playback service type, and initial service identifier "2" indicates the voice input service type.

[0125] Based on this, the user determines the correspondence between the service types indicated by different initial service identifiers and the permission data types according to their needs, in order to generate an initial permission setting request. This initial permission setting request includes the correspondence between each initial service identifier in the second service identifier set and multiple permission data types in the permission data type set. The terminal device then obtains the initial permission setting request. For example, the initial permission setting request includes the correspondence between initial service identifier "1" and Bluetooth permission data types, location permission data types, and network permission data types, and the correspondence between initial service identifier "2" and microphone permission data types and network permission data types.

[0126] Therefore, the terminal device can generate a first service identifier set based on the correspondence included in the initialization permission setting request. This involves establishing a correspondence between the multiple permission data types in the permission data type set and the multiple service identifiers in the second service identifier set, thereby generating the first service identifier set described in the foregoing embodiments. It should be understood that the foregoing examples are only for understanding this solution, and the specific method for creating the first service identifier set needs to be determined based on actual circumstances. Therefore, the foregoing examples should not be construed as limiting this application.

[0127] In this embodiment of the application, a method for obtaining a first set of service identifiers is provided. By using the above method, multiple initial service identifiers that do not have a corresponding relationship with the permission data type are initialized, so that the obtained set of service identifiers can include the correspondence between service identifiers and permission data types. Each permission data type has a corresponding application programming interface (API). This allows for accurate location of the specific permission data type for a specific service access during actual permission data access based on the correspondence between service identifiers and permission data types, as well as the correspondence between permission data types and application programming interfaces, thereby improving the reliability of permission data access.

[0128] Optionally, in the above Figure 3 Based on the corresponding embodiments, in one optional embodiment of the permission data access method provided in this application, obtaining the first service identifier set specifically includes:

[0129] Obtain the third service identifier set, wherein the third service identifier set includes the first service identifier;

[0130] Obtain a service identifier addition request, wherein the service identifier addition request includes a second service identifier;

[0131] Based on the service identifier addition request, the second service identifier is added to the third service identifier set to generate the first service identifier set, wherein the first service identifier set includes the first service identifier and the second service identifier;

[0132] or,

[0133] Obtain the first set of business identifiers, specifically including:

[0134] Obtain the fourth service identifier set, wherein the fourth service identifier set includes the first service identifier, the second service identifier, and the third service identifier;

[0135] Obtain the service identifier removal request, wherein the service identifier removal request includes the third service identifier;

[0136] Based on the service identifier removal request, the third service identifier is removed from the fourth service identifier set to generate the first service identifier set, wherein the first service identifier set includes the first service identifier and the second service identifier.

[0137] In this embodiment, another method for obtaining a first set of service identifiers is provided, in which multiple service identifiers included in the set of service identifiers can be added or removed.

[0138] In one implementation, the terminal device obtains a third service identifier set, which includes a first service identifier. It should be understood that the third service identifier set may also include a third service identifier and a fourth service identifier, but it does not include a second service identifier. When a user agrees to access certain permission data types for the service type indicated by the second service identifier, the user will perform a service identifier addition operation for the service type indicated by the second service identifier. This causes the terminal device to obtain a service identifier addition request, which includes the second service identifier. It should be understood that the second service identifier corresponds to at least one permission data type. Therefore, based on the service identifier addition request, the terminal device determines that a second service identifier needs to be added, and adds the second service identifier to the third service identifier set to generate a first service identifier set. The resulting first service identifier set will include both the first and second service identifiers.

[0139] Alternatively, in another implementation, the terminal device obtains a fourth service identifier set, which includes a first service identifier, a second service identifier, and a third service identifier. When a user needs to remove the service type indicated by the third service identifier and its corresponding permission data type, the user will perform a service identifier removal operation on the service type indicated by the third service identifier, causing the terminal device to obtain a service identifier removal request. This service identifier removal request includes the third service identifier, which should be understood to correspond to at least one permission data type. Therefore, based on the service identifier removal request, the terminal device determines that the third service identifier needs to be removed, removes the third service identifier from the fourth service identifier set, and also removes the correspondence between the third service identifier and the permission data type, thereby generating a first service identifier set. The resulting first service identifier set will include the first service identifier and the second service identifier.

[0140] In this application embodiment, another method for obtaining a first set of business identifiers is provided. Using the above method, the identifiers that need to be added or removed can be determined directly through the business identifier addition request or the business identifier removal request, so that the business identifier can be added or removed from the original set of business identifiers. This method has a weak intrusion into the original code or project, thereby improving the flexibility and reliability of obtaining the business identifier set.

[0141] Optionally, in the above Figure 3 Based on the corresponding embodiments, in one optional embodiment of the permission data access method provided in this application, obtaining the first service identifier set specifically includes:

[0142] Obtain the fifth set of service identifiers, wherein the fifth set of service identifiers includes the first service identifier, and the first service identifier corresponds to the first permission data type;

[0143] Obtain permission data addition request, wherein the permission data addition request includes the correspondence between the first business identifier and the second permission data type;

[0144] Based on the permission data addition request, the correspondence between the first service identifier and the second permission data type is added to the fifth service identifier set to generate the first service identifier set, wherein the first service identifier set includes the first service identifier, and the first service identifier corresponds to the first permission data type and the second permission data type;

[0145] or,

[0146] Obtain the first set of business identifiers, specifically including:

[0147] Obtain the sixth set of service identifiers, wherein the sixth set of service identifiers includes the first service identifier, and the first service identifier corresponds to the first permission data type, the second permission data type, and the third permission data type;

[0148] Obtain a permission data removal request, wherein the permission data removal request includes the correspondence between the first business identifier and the third permission data type;

[0149] Based on the permission data removal request, the correspondence between the first service identifier and the third permission data type is removed from the sixth service identifier set to generate the first service identifier set, wherein the first service identifier set includes the first service identifier, and the first service identifier corresponds to the first permission data type and the second permission data type.

[0150] This embodiment provides another method for obtaining a first set of service identifiers, in which the permission data type corresponding to each service identifier included in the service identifier set can be added or removed. The following explanation will take an example where the first set of service identifiers includes a first service identifier, and the first service identifier corresponds to a first permission data type and a second permission data type.

[0151] In one implementation, the terminal device acquires a fifth service identifier set, which includes a first service identifier and corresponds to a first permission data type. For example, the fifth service identifier set includes a first service identifier "1", and the first service identifier "1" corresponds to a Bluetooth permission data type (the first permission data type). Based on this, when a user wants the service type indicated by the first service identifier to access more permission data types, the user will perform a permission data addition operation on the second permission data type, so that the terminal device acquires a permission data addition request. This permission data addition request includes the correspondence between the first service identifier and the second permission data type. For example, the permission data addition request includes the correspondence between the first service identifier "1" and the location permission data type (the second permission data type).

[0152] Therefore, based on the permission data addition request, the terminal device adds the correspondence between the first service identifier and the second permission data type to the fifth service identifier set to generate the first service identifier set. As shown in the previous example, the correspondence between the first service identifier "1" and the location permission data type (second permission data type) is added to the fifth service identifier set including the first service identifier "1". The resulting first service identifier set includes the first service identifier, and the first service identifier corresponds to both the first permission data type and the second permission data type. That is, the first service identifier set includes the first service identifier "1", and the first service identifier "1" corresponds to both the Bluetooth permission data type (first permission data type) and the location permission data type (second permission data type).

[0153] Alternatively, in another implementation, the terminal device acquires a sixth service identifier set, which includes a first service identifier and corresponds to a first permission data type, a second permission data type, and a third permission data type. For example, the sixth service identifier set includes a first service identifier "1," and the first service identifier "1" corresponds to a Bluetooth permission data type (first permission data type), a location permission data type (second permission data type), and a network permission data type (third permission data type). Based on this, when a user wishes to reduce the permission data types accessed by the service type indicated by the first service identifier, and determines to reduce the third permission data type, the user will perform a permission data removal operation on the third permission data type, so that the terminal device acquires a permission data removal request. This permission data removal request includes the correspondence between the first service identifier and the third permission data type. For example, a permission data addition request includes the correspondence between the first service identifier "1" and the network permission data type (third permission data type).

[0154] Therefore, based on the permission data removal request, the terminal device removes the correspondence between the first service identifier and the third permission data type from the sixth service identifier set to generate the first service identifier set. At this time, the first service identifier set includes the first service identifier, and the first service identifier corresponds to the first permission data type and the second permission data type. Based on the aforementioned example customer, the correspondence between the first service identifier "1" and the network permission data type (third permission data type) is removed from the sixth service identifier set including the first service identifier "1". The resulting first service identifier set includes the first service identifier, and the first service identifier corresponds to the first permission data type and the second permission data type. That is, the first service identifier set includes the first service identifier "1", and the first service identifier "1" corresponds to the Bluetooth permission data type (first permission data type) and the location permission data type (second permission data type).

[0155] In this application embodiment, another method for obtaining a first set of permission data is provided. Using the above method, the identifiers that need to be added or removed can be determined directly through permission data addition requests or permission data removal requests, thereby adding or removing the permission data in the original set of business identifiers. This method has a weaker intrusiveness to the original code or project, thereby improving the flexibility and reliability of obtaining the set of business identifiers.

[0156] Optionally, in the above Figure 3 Based on the corresponding embodiments, in an optional embodiment of the permission data access method provided in this application, the permission data access method further includes:

[0157] Create a first routing channel and a second routing channel, wherein the first routing channel is used to handle authorized data access requests and the second routing channel is used to handle non-authorized data access requests.

[0158] In this embodiment, the terminal device can also create a first routing channel and a second routing channel, wherein the first routing channel is used to process authorized data access requests, and the second routing channel is used to process non-authorized data access requests. Specifically, the terminal device in Figure 2 As shown, multiple routing channels are created during the environment initialization phase. Different routing channels are used to handle authorized data access requests and non-authorized data access requests respectively. This allows the creation process of the application programming interface for access permission data to be handled uniformly by the sub-thread that handles authorized data access requests. Therefore, it will not block the main thread from handling interactive events for non-authorized data access requests, and the parameters or pop-ups for authorized data access are preloaded.

[0159] It should be understood that when multiple permission data access requests call the same application programming interface at the same time, the terminal device can also create a serial queue to control the execution calls related to permission data access methods, so as to ensure that the normal calls and data processing of other application programming interfaces are not affected.

[0160] In this embodiment of the application, another method for accessing permission data is provided. By using the above method, the creation process of the application programming interface for access permission data is uniformly handled by a sub-thread that handles permission data access requests. Therefore, it will not block the main thread from processing interactive events for non-permission data access requests, thus ensuring the efficiency of data processing and the reliability of permission data access.

[0161] Figure 5 This is a schematic diagram of the structure of a permission data access device provided in an embodiment of this application, as shown below. Figure 5 As shown, the access control data device 500 includes:

[0162] The acquisition module 501 is used to acquire a first set of service identifiers, wherein the first set of service identifiers includes multiple service identifiers, each service identifier uniquely indicates a service type, the service identifier corresponds to at least one permission data type, and each permission data type uniquely corresponds to an application programming interface.

[0163] The acquisition module 501 is also used to acquire permission data access requests, wherein the permission data access requests include a target business identifier and the permission data access requests indicate the invocation of the target application programming interface.

[0164] The determination module 502 is used to determine the target permission data type corresponding to the target application programming interface based on the target application programming interface indicated by the data access request if the target service identifier belongs to the first service identifier set.

[0165] The determining module 502 is also used to determine the permission data type corresponding to the target service identifier in the permission data access request based on multiple service identifiers in the first service identifier set;

[0166] Access module 503 is used to access the permission data corresponding to the target permission data type if the permission data type corresponding to the target service identifier includes the target permission data type.

[0167] Optionally, in the above Figure 5 Based on the corresponding embodiments, in another embodiment of the permission data access device provided in this application, the permission data access device 500 further includes a copy module 504;

[0168] Each type of permission data also uniquely corresponds to a preset access time range;

[0169] The determination module 502 is also used to determine the access time of the permission data access request before the access module 503 accesses the permission data corresponding to the target permission data type.

[0170] Access module 503 is specifically used to access the permission data corresponding to the target permission data type if the permission data type corresponding to the target business identifier includes the target permission data type and the access time of the permission data access request is within the preset access time range corresponding to the target permission data type.

[0171] The copy module 504 is used to copy the data generated within the preset access time range corresponding to the target permission data type after the access module 503 accesses the permission data corresponding to the target permission data type.

[0172] Optionally, in the above Figure 5 Based on the corresponding embodiments, in another embodiment of the permission data access device 500 provided in this application, each permission data type also uniquely corresponds to a preset data access duration;

[0173] The acquisition module 501 is also used to acquire the access duration of the access to the permission data corresponding to the target permission data type when the access module 503 accesses the permission data corresponding to the target permission data type.

[0174] The access module 503 is also used to stop accessing the permission data corresponding to the target permission data type if the access time for accessing the permission data corresponding to the target permission data type is greater than the preset access time for the target permission data type.

[0175] Optionally, in the above Figure 5 Based on the corresponding embodiments, in another embodiment of the permission data access device 500 provided in this application, the acquisition module 501 is specifically used to acquire a permission data type set, wherein the permission data type set includes multiple permission data types;

[0176] Obtain a second set of service identifiers, wherein the second set of service identifiers includes multiple initial service identifiers;

[0177] Obtain an initialization permission setting request, wherein the initialization permission setting request includes the correspondence between each initial business identifier in the second business identifier set and multiple permission data types in the permission data type set;

[0178] Based on the correspondence included in the initialization permission setting request, a first set of business identifiers is generated.

[0179] Optionally, in the above Figure 5 Based on the corresponding embodiments, in another embodiment of the permission data access device 500 provided in this application, the acquisition module 501 is specifically used to acquire a third service identifier set, wherein the third service identifier set includes a first service identifier;

[0180] Obtain a service identifier addition request, wherein the service identifier addition request includes a second service identifier;

[0181] Based on the service identifier addition request, the second service identifier is added to the third service identifier set to generate the first service identifier set, wherein the first service identifier set includes the first service identifier and the second service identifier;

[0182] or,

[0183] The acquisition module 501 is specifically used to acquire the fourth service identifier set, wherein the fourth service identifier set includes the first service identifier, the second service identifier, and the third service identifier;

[0184] Obtain the service identifier removal request, wherein the service identifier removal request includes the third service identifier;

[0185] Based on the service identifier removal request, the third service identifier is removed from the fourth service identifier set to generate the first service identifier set, wherein the first service identifier set includes the first service identifier and the second service identifier.

[0186] Optionally, in the above Figure 5 Based on the corresponding embodiments, in another embodiment of the permission data access device 500 provided in this application, the acquisition module 501 is specifically used to acquire a fifth service identifier set, wherein the fifth service identifier set includes a first service identifier, and the first service identifier corresponds to a first permission data type;

[0187] Obtain permission data addition request, wherein the permission data addition request includes the correspondence between the first business identifier and the second permission data type;

[0188] Based on the permission data addition request, the correspondence between the first service identifier and the second permission data type is added to the fifth service identifier set to generate the first service identifier set, wherein the first service identifier set includes the first service identifier, and the first service identifier corresponds to the first permission data type and the second permission data type;

[0189] or,

[0190] The acquisition module 501 is specifically used to acquire the sixth business identifier set, wherein the sixth business identifier set includes the first business identifier, and the first business identifier corresponds to the first permission data type, the second permission data type and the third permission data type;

[0191] Obtain a permission data removal request, wherein the permission data removal request includes the correspondence between the first business identifier and the third permission data type;

[0192] Based on the permission data removal request, the correspondence between the first service identifier and the third permission data type is removed from the sixth service identifier set to generate the first service identifier set, wherein the first service identifier set includes the first service identifier, and the first service identifier corresponds to the first permission data type and the second permission data type.

[0193] Optionally, in the above Figure 5 Based on the corresponding embodiments, in another embodiment of the permission data access device 500 provided in this application, the permission data access device 500 further includes a creation module 505;

[0194] Create module 505 to create a first distribution channel and a second distribution channel. The first distribution channel is used to process authorized data access requests, and the second distribution channel is used to process non-authorized data access requests.

[0195] This application also provides another permission data access device. Permission data access devices can be deployed on servers or terminal devices. This application uses a permission data access device deployed on a server as an example for explanation. Please refer to... Figure 6 , Figure 6This is a schematic diagram of one embodiment of the server in this application. As shown in the figure, the server 1000 can vary significantly due to different configurations or performance. It may include one or more central processing units (CPUs) 1022 (e.g., one or more processors) and memory 1032, and one or more storage media 1030 (e.g., one or more mass storage devices) for storing application programs 1042 or data 1044. The memory 1032 and storage media 1030 can be temporary or persistent storage. The program stored in the storage media 1030 may include one or more modules (not shown in the figure), each module may include a series of instruction operations on the server. Furthermore, the CPU 1022 may be configured to communicate with the storage media 1030 and execute the series of instruction operations in the storage media 1030 on the server 1000.

[0196] Server 1000 may also include one or more power supplies 1026, one or more wired or wireless network interfaces 1050, one or more input / output interfaces 1058, and / or one or more operating systems 1041, such as Windows Server. TM Mac OS X TM Unix TM Linux TM FreeBSD TM etc.

[0197] The steps performed by the server in the above embodiments can be based on this Figure 6 The server structure shown.

[0198] The server includes 1022 CPUs used for performing tasks such as... Figure 3 The illustrated embodiments and Figure 3 The corresponding embodiments.

[0199] This application also provides a terminal device, such as Figure 7 As shown, for ease of explanation, only the parts related to the embodiments of this application are shown. For specific technical details not disclosed, please refer to the method section of the embodiments of this application. The following explanation uses a mobile phone as an example of a terminal device:

[0200] Figure 7 This is a block diagram illustrating a portion of the structure of a mobile phone related to the terminal provided in the embodiments of this application. (Reference) Figure 7The mobile phone includes components such as a radio frequency (RF) circuit 1110, a memory 1120, an input unit 1130, a display unit 1140, a sensor 1150, an audio circuit 1160, a wireless fidelity (WiFi) module 1170, a processor 1180, and a power supply 1190. Those skilled in the art will understand that... Figure 7 The mobile phone structure shown does not constitute a limitation on the mobile phone and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0201] The following is combined with Figure 7 A detailed introduction to each component of a mobile phone:

[0202] RF circuit 1110 can be used for receiving and transmitting signals during information transmission or calls. Specifically, it receives downlink information from the base station and processes it with processor 1180; additionally, it transmits uplink data to the base station. Typically, RF circuit 1110 includes, but is not limited to, an antenna, at least one amplifier, a transceiver, a coupler, a low-noise amplifier (LNA), a duplexer, etc. Furthermore, RF circuit 1110 can also communicate wirelessly with networks and other devices. The aforementioned wireless communication can use any communication standard or protocol, including but not limited to Global System for Mobile communication (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Long Term Evolution (LTE), email, Short Messaging Service (SMS), etc.

[0203] The memory 1120 can be used to store software programs and modules. The processor 1180 executes various mobile phone functions and data processing by running the software programs and modules stored in the memory 1120. The memory 1120 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, applications required for at least one function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, phonebook, etc.). In addition, the memory 1120 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0204] The input unit 1130 can be used to receive input numerical or character information, and to generate key signal inputs related to the object settings and function control of the mobile phone. Specifically, the input unit 1130 may include a touch panel 1131 and other input devices 1132. The touch panel 1131, also known as a touch screen, can collect touch operations on or near the object (such as operations performed by the object using a finger, stylus, or any suitable object or accessory on or near the touch panel 1131), and drive the corresponding connection device according to a pre-set program. Optionally, the touch panel 1131 may include two parts: a touch detection device and a touch controller. The touch detection device detects the touch position of the object and detects the signal generated by the touch operation, and transmits the signal to the touch controller; the touch controller receives touch information from the touch detection device, converts it into touch point coordinates, and sends it to the processor 1180, and can also receive and execute commands sent by the processor 1180. In addition, the touch panel 1131 can be implemented using various types such as resistive, capacitive, infrared, and surface acoustic wave. In addition to the touch panel 1131, the input unit 1130 may also include other input devices 1132. Specifically, other input devices 1132 may include, but are not limited to, one or more of the following: physical keyboard, function keys (such as volume control buttons, power buttons, etc.), trackball, mouse, joystick, etc.

[0205] Display unit 1140 can be used to display information input by an object or information provided to an object, as well as various menus of the mobile phone. Display unit 1140 may include display panel 1141, optionally configured as a Liquid Crystal Display (LCD), Organic Light-Emitting Diode (OLED), or similar display panel 1141. Further, touch panel 1131 may cover display panel 1141. When touch panel 1131 detects a touch operation on or near it, it transmits the information to processor 1180 to determine the type of touch event. Subsequently, processor 1180 provides corresponding visual output on display panel 1141 based on the type of touch event. Although in Figure 7 In this embodiment, the touch panel 1131 and the display panel 1141 are two separate components to realize the input and output functions of the mobile phone. However, in some embodiments, the touch panel 1131 and the display panel 1141 can be integrated to realize the input and output functions of the mobile phone.

[0206] The mobile phone may also include at least one sensor 1150, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor may include an ambient light sensor and a proximity sensor. The ambient light sensor can adjust the brightness of the display panel 1141 according to the ambient light level, and the proximity sensor can turn off the display panel 1141 and / or the backlight when the phone is moved to the ear. As a type of motion sensor, an accelerometer sensor can detect the magnitude of acceleration in various directions (generally three axes). When stationary, it can detect the magnitude and direction of gravity and can be used for applications that recognize the phone's posture (such as landscape / portrait switching, related games, magnetometer posture calibration), vibration recognition-related functions (such as pedometer, taps), etc. Other sensors that may be configured in the mobile phone, such as gyroscopes, barometers, hygrometers, thermometers, and infrared sensors, are not described in detail here.

[0207] Audio circuit 1160, speaker 1161, and microphone 1162 provide an audio interface between the device and the mobile phone. Audio circuit 1160 converts received audio data into electrical signals and transmits them to speaker 1161, where speaker 1161 converts them into sound signals for output. On the other hand, microphone 1162 converts collected sound signals into electrical signals, which are received by audio circuit 1160, converted into audio data, and then processed by processor 1180 before being transmitted via RF circuit 1110 to, for example, another mobile phone, or the audio data can be output to memory 1120 for further processing.

[0208] WiFi is a short-range wireless transmission technology. A mobile phone using the WiFi module 1170 can help users send and receive emails, browse web pages, and access streaming media, providing them with wireless broadband internet access. Although Figure 7 WiFi module 1170 is shown, but it is understood that it is not an essential component of a mobile phone.

[0209] The processor 1180 is the control center of the mobile phone, connecting various parts of the phone through various interfaces and lines. It executes various functions and processes data by running or executing software programs and / or modules stored in the memory 1120, and by calling data stored in the memory 1120. Optionally, the processor 1180 may include one or more processing units; preferably, the processor 1180 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may not be integrated into the processor 1180.

[0210] The mobile phone also includes a power supply 1190 (such as a battery) that supplies power to various components. Preferably, the power supply can be logically connected to the processor 1180 through a power management system, thereby enabling functions such as charging, discharging, and power consumption management through the power management system.

[0211] Although not shown, mobile phones may also include a camera, Bluetooth module, etc., which will not be elaborated here.

[0212] In this embodiment of the application, the processor 1180 included in the terminal is used to perform, for example... Figure 3 The illustrated embodiments and Figure 3 The corresponding embodiments.

[0213] This application also provides a computer-readable storage medium storing a computer program that, when run on a computer, causes the computer to perform the aforementioned actions. Figure 3 The steps performed by the terminal device in the method described in the illustrated embodiment.

[0214] This application also provides a computer program product including a program, which, when run on a computer, causes the computer to perform the aforementioned actions. Figure 3 The steps performed by the terminal device in the method described in the illustrated embodiment.

[0215] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0216] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, at least two units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between apparatuses or units through some interfaces, and may be electrical, mechanical, or other forms.

[0217] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across at least two network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0218] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0219] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0220] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A method for accessing authorized data, characterized in that, include: Obtain a first set of service identifiers, wherein the first set of service identifiers includes multiple service identifiers, each service identifier uniquely indicates a service type, the service identifier corresponds to at least one permission data type, and each permission data type uniquely corresponds to an application programming interface; Obtain a permission data access request, wherein the permission data access request includes a target business identifier and the permission data access request indicates a call to the target application programming interface; If the target service identifier belongs to the first service identifier set, then the target permission data type corresponding to the target application programming interface is determined based on the target application programming interface indicated by the data access request. Based on the multiple business identifiers in the first business identifier set, determine the permission data type corresponding to the target business identifier in the permission data access request; If the permission data type corresponding to the target service identifier includes the target permission data type, then access the permission data corresponding to the target permission data type.

2. The method according to claim 1, characterized in that, Each type of permission data also uniquely corresponds to a preset access time range; Before accessing the permission data corresponding to the target permission data type, the method further includes: Determine the access time of the permission data access request; If the permission data type corresponding to the target service identifier includes the target permission data type, then accessing the permission data corresponding to the target permission data type includes: If the permission data type corresponding to the target service identifier includes the target permission data type, and the access time of the permission data access request is within the preset access time range corresponding to the target permission data type, then the permission data corresponding to the target permission data type is accessed. After accessing the permission data corresponding to the target permission data type, the method further includes: Copy the permission data corresponding to the target permission data type, and the data generated within the preset access time range corresponding to the target permission data type.

3. The method according to claim 1 or 2, characterized in that, Each type of permission data also uniquely corresponds to a preset data access duration; When accessing the permission data corresponding to the target permission data type, the method further includes: Get the access duration of the permission data corresponding to the access target permission data type; If the access duration for accessing the permission data corresponding to the target permission data type is greater than the preset access duration for the target permission data type, then access to the permission data corresponding to the target permission data type will be stopped.

4. The method according to claim 1, characterized in that, The acquisition of the first service identifier set includes: Obtain a set of permission data types, wherein the set of permission data types includes multiple permission data types; Obtain a second set of service identifiers, wherein the second set of service identifiers includes multiple initial service identifiers; Obtain an initialization permission setting request, wherein the initialization permission setting request includes the correspondence between each initial service identifier in the second service identifier set and the multiple permission data types in the permission data type set; Based on the correspondence included in the initialization permission setting request, the first service identifier set is generated.

5. The method according to claim 1, characterized in that, The acquisition of the first service identifier set includes: Obtain a third service identifier set, wherein the third service identifier set includes a first service identifier; Obtain a service identifier addition request, wherein the service identifier addition request includes a second service identifier; Based on the service identifier addition request, the second service identifier is added to the third service identifier set to generate the first service identifier set, wherein the first service identifier set includes the first service identifier and the second service identifier; or, The acquisition of the first service identifier set includes: Obtain a fourth set of service identifiers, wherein the fourth set of service identifiers includes a first service identifier, a second service identifier, and a third service identifier; Obtain a service identifier removal request, wherein the service identifier removal request includes the third service identifier; Based on the service identifier removal request, the third service identifier is removed from the fourth service identifier set to generate the first service identifier set, wherein the first service identifier set includes the first service identifier and the second service identifier.

6. The method according to claim 1, characterized in that, The acquisition of the first service identifier set includes: Obtain a fifth set of service identifiers, wherein the fifth set of service identifiers includes a first service identifier, and the first service identifier corresponds to a first permission data type; Obtain permission data addition request, wherein the permission data addition request includes the correspondence between the first business identifier and the second permission data type; Based on the permission data addition request, the correspondence between the first service identifier and the second permission data type is added to the fifth service identifier set to generate the first service identifier set, wherein the first service identifier set includes the first service identifier, and the first service identifier corresponds to the first permission data type and the second permission data type; or, The acquisition of the first service identifier set includes: Obtain a sixth set of service identifiers, wherein the sixth set of service identifiers includes a first service identifier, and the first service identifier corresponds to a first permission data type, a second permission data type, and a third permission data type; Obtain a permission data removal request, wherein the permission data removal request includes the correspondence between the first service identifier and the third permission data type; Based on the permission data removal request, the correspondence between the first service identifier and the third permission data type is removed from the sixth service identifier set to generate the first service identifier set, wherein the first service identifier set includes the first service identifier, and the first service identifier corresponds to the first permission data type and the second permission data type.

7. The method according to claim 1, characterized in that, The method further includes: A first routing channel and a second routing channel are created, wherein the first routing channel is used to process the authorized data access request, and the second routing channel is used to process the non-authorized data access request.

8. A permission data access device, characterized in that, The access control device includes: The acquisition module is used to acquire a first set of service identifiers, wherein the first set of service identifiers includes multiple service identifiers, each service identifier uniquely indicates a service type, the service identifier corresponds to at least one permission data type, and each permission data type uniquely corresponds to an application programming interface. The acquisition module is further configured to acquire a permission data access request, wherein the permission data access request includes a target business identifier and the permission data access request indicates a call to the target application programming interface. The determination module is used to determine the target permission data type corresponding to the target application programming interface based on the target application programming interface indicated by the data access request if the target service identifier belongs to the first service identifier set. The determining module is further configured to determine the permission data type corresponding to the target service identifier in the permission data access request based on the plurality of service identifiers in the first service identifier set; The access module is used to access the permission data corresponding to the target permission data type if the permission data type corresponding to the target service identifier includes the target permission data type.

9. The apparatus according to claim 8, characterized in that, The device also includes a copy module; Each type of permission data also uniquely corresponds to a preset access time range; The determining module is further configured to determine the access time of the permission data access request before accessing the permission data corresponding to the target permission data type; The access module is specifically used to access the permission data corresponding to the target permission data type if the permission data type corresponding to the target service identifier includes the target permission data type and the access time of the permission data access request is within the preset access time range corresponding to the target permission data type. The copy module is used to copy the data generated within a preset access time range corresponding to the target permission data type after accessing the permission data corresponding to the target permission data type.

10. The apparatus according to claim 8 or 9, characterized in that, Each type of permission data also uniquely corresponds to a preset data access duration; The acquisition module is also used to acquire the access duration of accessing the permission data corresponding to the target permission data type when accessing the permission data corresponding to the target permission data type. The access module is further configured to stop accessing the permission data corresponding to the target permission data type if the access duration for accessing the permission data corresponding to the target permission data type is greater than the preset data access duration corresponding to the target permission data type.

11. The apparatus according to claim 8, characterized in that, The acquisition module is specifically used for: Obtain a set of permission data types, wherein the set of permission data types includes multiple permission data types; Obtain a second set of service identifiers, wherein the second set of service identifiers includes multiple initial service identifiers; Obtain an initialization permission setting request, wherein the initialization permission setting request includes the correspondence between each initial service identifier in the second service identifier set and the multiple permission data types in the permission data type set; Based on the correspondence included in the initialization permission setting request, the first service identifier set is generated.

12. The apparatus according to claim 8, characterized in that, The acquisition module is specifically used for: Obtain a third service identifier set, wherein the third service identifier set includes a first service identifier; Obtain a service identifier addition request, wherein the service identifier addition request includes a second service identifier; Based on the service identifier addition request, the second service identifier is added to the third service identifier set to generate the first service identifier set, wherein the first service identifier set includes the first service identifier and the second service identifier; or, The acquisition module is specifically used for: Obtain a fourth set of service identifiers, wherein the fourth set of service identifiers includes a first service identifier, a second service identifier, and a third service identifier; Obtain a service identifier removal request, wherein the service identifier removal request includes the third service identifier; Based on the service identifier removal request, the third service identifier is removed from the fourth service identifier set to generate the first service identifier set, wherein the first service identifier set includes the first service identifier and the second service identifier.

13. The apparatus according to claim 8, characterized in that, The acquisition module is specifically used for: Obtain a fifth set of service identifiers, wherein the fifth set of service identifiers includes a first service identifier, and the first service identifier corresponds to a first permission data type; Obtain permission data addition request, wherein the permission data addition request includes the correspondence between the first business identifier and the second permission data type; Based on the permission data addition request, the correspondence between the first service identifier and the second permission data type is added to the fifth service identifier set to generate the first service identifier set, wherein the first service identifier set includes the first service identifier, and the first service identifier corresponds to the first permission data type and the second permission data type; or, The acquisition module is specifically used for: Obtain a sixth set of service identifiers, wherein the sixth set of service identifiers includes a first service identifier, and the first service identifier corresponds to a first permission data type, a second permission data type, and a third permission data type; Obtain a permission data removal request, wherein the permission data removal request includes the correspondence between the first service identifier and the third permission data type; Based on the permission data removal request, the correspondence between the first service identifier and the third permission data type is removed from the sixth service identifier set to generate the first service identifier set, wherein the first service identifier set includes the first service identifier, and the first service identifier corresponds to the first permission data type and the second permission data type.

14. The apparatus according to claim 8, characterized in that, The device also includes a creation module; The creation module is used to create a first distribution channel and a second distribution channel, wherein the first distribution channel is used to process the authorized data access request, and the second distribution channel is used to process the non-authorized data access request.

15. A computer device, characterized in that, include: Memory, transceiver, processor, and bus system; The memory is used to store programs; The processor is used to execute the program in the memory to implement the method of any one of claims 1 to 7; The bus system is used to connect the memory and the processor to enable communication between the memory and the processor.

16. A computer-readable storage medium comprising instructions which, when executed on a computer, cause the computer to perform the method as claimed in any one of claims 1 to 7.

17. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the method as described in any one of claims 1 to 7.

Images