Application authority management method and device, equipment, storage medium and program product
By obtaining and analyzing the behavioral data applied on mobile terminal devices and dynamically configuring permission management rules, the problem that static analysis tools cannot cope with dynamic threats is solved, real-time matching and enhanced security of application permission management on mobile terminal devices is achieved.
Patent Information
- Application Number
- CN202411403102.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-09
- Publication Date
- 2025-01-07
AI Technical Summary
In permission management, applications deployed on mobile terminal devices cannot match dynamic security threats in real time, resulting in permission control logic that cannot match the application's permission control needs in real time, which is prone to inadequate permission protection or abuse.
By obtaining application behavior data, extracting characteristics, predicting behavior risk levels, dynamically configure permission management rules, and adjusting permission management rules when abnormal conditions are detected, real-time management of application permissions, including functional module isolation and communication recovery.
It improves the authority management effect of applications on mobile terminal devices, can dynamically match permission control needs, enhances the ability to respond to dynamic threats, and reduces the problems of abuse of permissions and insufficient protection.
Smart Images
Figure CN119272307A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the technical field of application security management, and in particular to an application permission management method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Art
[0002] With the continuous development of science and technology, mobile terminal devices have been widely used in people's daily lives. At the same time, the applications deployed on mobile terminal devices face more serious security threats during operation as the transmission and access frequency increase. Therefore, permission management of applications deployed on mobile terminal devices is one of the effective means to prevent mobile terminal devices from becoming targets of network attacks.
[0003] At present, in the process of managing permissions for applications deployed on mobile terminal devices, different permission control logics are usually configured for different applications in advance. However, since the tool for configuring the permission control logic is a static analysis tool, and the security threats faced by the application during operation are dynamic, the permission control logic cannot match the permission control requirements of the application in real time, which makes it easy for application permission protection to be inadequate or permission abuse to occur. Therefore, the current permission management of applications deployed on mobile terminal devices is poor. Summary of the invention
[0004] Based on this, it is necessary to provide an application permission management method, device, computer equipment, computer-readable storage medium and computer program product to improve the poor application permission management effect of applications deployed on mobile terminal devices in response to the above technical problems.
[0005] In a first aspect, the present application provides an application permission management method, comprising:
[0006] Obtain application behavior data of the application to be managed deployed on the target terminal;
[0007] According to the application behavior data, a corresponding permission management rule is configured for the application to be managed, wherein the permission management rule is used to characterize the permission capability constraint when the application to be managed performs an operation;
[0008] When it is detected that the behavior of the application to be managed is abnormal, the application permissions of the application to be managed are managed by adjusting the permission management rules.
[0009] In one embodiment, configuring corresponding permission management rules for the application to be managed according to the application behavior data includes:
[0010] Extracting features from the application behavior data to obtain application behavior features of the application to be managed;
[0011] Predicting the behavior risk level of the application to be managed according to the application behavior characteristics;
[0012] According to the behavior risk level, corresponding permission management rules are configured for the application to be managed.
[0013] In one embodiment, configuring corresponding permission management rules for the application to be managed according to the behavior risk level includes:
[0014] According to the behavior risk level, query at least one functional permission requirement of the application to be managed;
[0015] The permission management rules are obtained by integrating the permission management conditions of each of the functional permission requirements.
[0016] In one embodiment, managing the application permissions of the application to be managed by adjusting the permission management rule includes:
[0017] Determining at least one application function module managed by the permission management rule;
[0018] By isolating the application function modules from each other, the application permissions of the application to be managed are managed.
[0019] In one embodiment, managing the application permissions of the application to be managed by adjusting the permission management rule includes:
[0020] Modifying the permission management rule according to the preset application isolation condition to obtain a modified permission management rule;
[0021] The application to be managed is isolated according to the modified permission management rule.
[0022] In one of the embodiments, after isolating the application to be managed according to the modified permission management rule, the method further includes:
[0023] When it is detected that the application to be managed passes the security verification, performing application isolation release on the application to be managed;
[0024] When it is detected that the isolation of the application to be managed is released, application communication of the application to be managed is restored.
[0025] In a second aspect, the present application also provides an application permission management device, including:
[0026] An acquisition module, used to acquire application behavior data of the application to be managed deployed on the target terminal;
[0027] A configuration module, configured to configure corresponding permission management rules for the application to be managed according to the application behavior data, wherein the permission management rules are used to characterize permission capability constraints when the application to be managed performs operations;
[0028] The management module is used to manage the application permissions of the application to be managed by adjusting the permission management rules when abnormal behavior of the application to be managed is detected.
[0029] In one embodiment, the configuration module is further used to:
[0030] Extracting features from the application behavior data to obtain application behavior features of the application to be managed;
[0031] Predicting the behavior risk level of the application to be managed according to the application behavior characteristics;
[0032] According to the behavior risk level, corresponding permission management rules are configured for the application to be managed.
[0033] In one embodiment, the configuration module is further used to:
[0034] According to the behavior risk level, query at least one functional permission requirement of the application to be managed;
[0035] The permission management rules are obtained by integrating the permission management conditions of each of the functional permission requirements.
[0036] In one embodiment, the management module is further configured to:
[0037] Determining at least one application function module managed by the permission management rule;
[0038] By isolating the application function modules from each other, the application permissions of the application to be managed are managed.
[0039] In one embodiment, the management module is further configured to:
[0040] Modifying the permission management rule according to the preset application isolation condition to obtain a modified permission management rule;
[0041] The application to be managed is isolated according to the modified permission management rule.
[0042] In one embodiment, the application rights management device is further used for:
[0043] When it is detected that the application to be managed passes the security verification, performing application isolation release on the application to be managed;
[0044] When it is detected that the isolation of the application to be managed is released, application communication of the application to be managed is restored.
[0045] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:
[0046] Acquire application behavior data of the application to be managed deployed on the target terminal; configure corresponding permission management rules for the application to be managed according to the application behavior data, wherein the permission management rules are used to characterize the permission capability constraints of the application to be managed when operating; when abnormal behavior of the application to be managed is detected, manage the application permissions of the application to be managed by adjusting the permission management rules.
[0047] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:
[0048] Acquire application behavior data of the application to be managed deployed on the target terminal; configure corresponding permission management rules for the application to be managed according to the application behavior data, wherein the permission management rules are used to characterize the permission capability constraints of the application to be managed when operating; when abnormal behavior of the application to be managed is detected, manage the application permissions of the application to be managed by adjusting the permission management rules.
[0049] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:
[0050] Acquire application behavior data of the application to be managed deployed on the target terminal; configure corresponding permission management rules for the application to be managed according to the application behavior data, wherein the permission management rules are used to characterize the permission capability constraints of the application to be managed when operating; when abnormal behavior of the application to be managed is detected, manage the application permissions of the application to be managed by adjusting the permission management rules.
[0051] The above-mentioned application permission management method, device, computer equipment, computer-readable storage medium and computer program product first collect application behavior data of the application to be managed deployed on the target terminal, and then configure the permission management rules of the permission capability constraints of the application to be managed when the application to be managed is operated through the application behavior data. Finally, when the behavior of the application to be managed is detected to be abnormal, the application permission of the application to be managed is managed by adjusting the permission management rules. Since the application behavior data is the dynamic behavior data of the application to be managed deployed on the target terminal when it is operated, the purpose of configuring dynamic permission control logic for the application to be managed can be achieved by configuring the corresponding permission management rules for the application to be managed. At the same time, when it is further detected that the behavior of the application to be managed is abnormal, the application permission of the application to be managed can be managed by dynamically adjusting the permission management rules in real time. Therefore, the permission control logic can match the permission control requirements of the application in real time, that is, it overcomes the technical defect that the tool for configuring the permission control logic is a static analysis tool, and the security threats faced during the application operation are dynamic, which makes it easy to have the problem of insufficient application permission protection or permission abuse. Therefore, the permission management effect of the application deployed on the mobile terminal device is improved. BRIEF DESCRIPTION OF THE DRAWINGS
[0052] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.
[0053] Figure 1 A flowchart of an application rights management method in one embodiment;
[0054] Figure 2 A flowchart of an application rights management method in one embodiment;
[0055] Figure 3 is a structural block diagram of an application rights management device in one embodiment;
[0056] Figure 4 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION
[0057] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.
[0058] First of all, it should be understood that the applications deployed on mobile terminal devices will become the main target of network attacks when they involve the transmission and access of a large amount of sensitive data. Therefore, the security of mobile applications has become the focus of attention of enterprises and users. At present, in the process of permission management for mobile applications, a combination of static analysis, permission control and dynamic behavior monitoring is usually used to obtain application information through API (Application Programming Interface) and analysis tools, and use static analysis tools to identify code vulnerabilities. However, due to the lack of dynamic analysis tools to monitor the runtime behavior of applications and the lack of accuracy in the security assessment of applications, current mobile applications are insufficient in dealing with complex attacks. The shortcomings of static analysis tools that cannot respond to dynamic threats in real time will make it difficult for the permission management mechanism to effectively solve the problem of permission abuse. In addition, dynamic analysis tools lack effective isolation and recovery mechanisms when facing complex cross-module attacks and network threats, resulting in limited overall protection capabilities. That is, the static permission control logic cannot match the permission control requirements of applications in real time, which makes it easy to have inadequate application permission protection or permission abuse. Therefore, there is an urgent need for an application permission management method that improves the permission management effect of applications deployed on mobile terminal devices.
[0059] In one embodiment, Figure 1 As shown, a method for application permission management is provided. This embodiment takes the method applied to a terminal as an example. The terminal includes but is not limited to a personal computer, a laptop, a smart phone, and a tablet computer. The terminal includes an acquisition module, a configuration module, and a management module. The acquisition module is used to acquire the application behavior data of the application to be managed deployed on the target terminal. The configuration module is used to configure corresponding permission management rules for the application to be managed according to the application behavior data, wherein the permission management rules are used to characterize the permission capability constraints when the application to be managed is operated. The management module is used to manage the application permissions of the application to be managed by adjusting the permission management rules when the application to be managed is detected to be abnormal. Through the information interaction between the acquisition module, the configuration module and the management module, a dynamic permission control logic can be configured for the application to be managed. At the same time, when it is further detected that the application to be managed has abnormal behavior, the permission management rules can be dynamically adjusted in real time to manage the application permissions of the application to be managed, so that the permission control logic can match the permission control requirements of the application in real time to improve the permission management effect of the application deployed on the mobile terminal device. It can be understood that the method can also be applied to a server, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps:
[0060] Step 202: Acquire application behavior data of the application to be managed deployed on the target terminal.
[0061] It should be noted that the target terminal refers to the executor of the application permission management method. It can be understood that there are multiple mobile applications installed on the target terminal, and the permission management requirements of different mobile applications may be the same or different. Different applications will generate application behavior data when running, among which the application behavior data may specifically be the application's permission request, data access, and network behavior, etc. The application to be managed refers to the application deployed on the target terminal waiting for permission management.
[0062] It should be noted that before obtaining the application behavior data of different applications to be managed, the applications to be managed deployed on the target terminal are first identified. For example, in one feasible method, all mobile applications installed on the target terminal can be identified by calling an API, and then each mobile application can be treated as an application to be managed. The application behavior data such as permission requests, data access, and network behavior of different applications to be managed are then collected separately, and finally an application risk assessment is performed based on the application behavior data.
[0063] As an example, step 202 includes: identifying all mobile applications deployed on the target terminal by calling an API interface, treating all mobile applications as applications to be managed, and collecting permission request data, data access data, and network behavior data of each mobile application.
[0064] Step 204: configure corresponding permission management rules for the application to be managed according to the application behavior data, wherein the permission management rules are used to represent permission capability constraints when the application to be managed performs operations.
[0065] It should be noted that in order to build a comprehensive mobile terminal application security management framework, after collecting the application behavior data of the application to be managed deployed on the target terminal, the API is called again to identify the application and evaluate the risks of application permission requests, data access and network behavior, so as to dynamically configure the corresponding permission management rules for the application to be managed. The permission management rules are used to characterize the permission capability constraints of the application to be managed when operating. For example, in one feasible method, minimum permission management is implemented for the application to be managed, and the application permissions of different applications to be managed can be dynamically adjusted. It can be understood that when facing multiple different applications to be managed, different permission management rules can be configured for multiple applications to be managed, or the same permission management rules can be configured for multiple applications to be managed.
[0066] As an example, step 204 includes: identifying the behavior risk level of the application to be managed by analyzing the application behavior data, and querying the permission management rules pre-set for the application to be managed based on the behavior risk level as an index.
[0067] Step 206: When it is detected that the behavior of the application to be managed is abnormal, the application permissions of the application to be managed are managed by adjusting the permission management rules.
[0068] It should be noted that after configuring the corresponding permission management rules for the application to be managed deployed on the target terminal, it is also necessary to monitor the application operation and data transmission behavior in real time, that is, a behavior monitoring module is deployed on the target terminal, and then the application operation and data transmission behavior of the application to be managed are tracked in real time through the behavior monitoring module, security threats are identified through logs and anomaly detection, and security threats are discovered and responded to in a timely manner. The behavior monitoring module comprehensively analyzes the application's operation logs, data access records, and network communication behaviors, thereby identifying abnormal behaviors that endanger the terminal and data security. It can be understood that when the application behavior data of the application to be managed suddenly changes, it can be determined that the behavior of the application to be managed is abnormal. In the case of abnormal behavior of the application to be managed, the permission management rules can be actively changed to manage the application permissions of the application to be managed. For example, in an implementable manner, it is assumed that the permission management rule of the current application to be managed is the first permission management rule, and the first permission management rule is replaced by the second permission management rule, wherein the permission restriction level of the application to be managed under the first permission management rule is lower than that of the second permission management rule, and the first permission management rule and the second permission management rule are both pre-set permission management rules with different permission restriction levels.
[0069] It should be noted that the behavior monitoring module can detect abnormal behavior in a timely manner and respond quickly by continuously monitoring the application's operation logs, data access records and network communication behaviors. Once a security threat is discovered, the application's permissions are immediately restricted or its communication with external servers is blocked, and the application is isolated and runs in a sandbox. This real-time monitoring and automatic response mechanism greatly improves the efficiency of responding to security threats and ensures that application behavior is always within the scope of security policies.
[0070] As an example, step 206 includes: when it is detected that the behavior of the application to be managed is abnormal, managing the application permissions of the application to be managed by replacing the permission management rules.
[0071] In the above-mentioned application permission management method, firstly, all mobile applications deployed on the target terminal are identified by calling the API interface, and after identifying the application to be managed, the application behavior data of the application to be managed is collected, and then according to the application behavior data, the permission management rules dynamically configured for the application to be managed are queried, wherein the permission management rules are used to characterize the permission capability constraints when the application to be managed is operated, and finally, when the application behavior data of the application to be managed detects that the behavior of the application to be managed is abnormal, the application permissions of the application to be managed are managed by replacing the permission management rules, because the application behavior data is the dynamic behavior data of the application to be managed deployed on the target terminal when it is operated, and then by configuring the corresponding permissions for the application to be managed Management rules can achieve the purpose of configuring dynamic permission control logic for the application to be managed. At the same time, when it is further detected that the application to be managed has abnormal behavior, the permission management rules can be dynamically adjusted in real time to manage the application permissions of the application to be managed. Therefore, the permission control logic can match the permission control requirements of the application in real time. That is, it overcomes the technical defects that the permission control logic cannot match the permission control requirements of the application in real time, which makes it easy to have inadequate application permission protection or permission abuse problems, because the tool for configuring the permission control logic is a static analysis tool, while the security threats faced by the application during operation are dynamic. Therefore, the permission management effect of applications deployed on mobile terminal devices is improved.
[0072] In one embodiment, Figure 2 As shown, according to the application behavior data, the corresponding permission management rules are configured for the application to be managed, including:
[0073] Step 302, extracting features from the application behavior data to obtain application behavior features of the application to be managed;
[0074] It should be noted that in order to improve the accuracy of the analysis of the application behavior to be managed, after obtaining the application behavior data of the application to be managed, the application behavior features of the application to be managed are extracted and marked by introducing a neural network algorithm. For example, in one feasible method, after obtaining the application behavior data through the API interface, an application behavior database is established, and Fortify and App Scan tools are used to detect code security and permissions. Relic monitors the dynamic behavior of the application to be managed, captures system resources and network interaction data, and extracts and marks application behavior features in combination with a neural network algorithm. It can be understood that the steps of the neural network algorithm may include data collection, feature extraction, model training and risk prediction. The model structure includes an input layer, a hidden layer and an output layer. The input layer is used to receive the application behavior data of the application to be managed, the hidden layer extracts features from the application behavior data of the application to be managed, and the output layer is used to give a prediction result of the behavior risk level. In the process of feature extraction of application behavior data and prediction of the behavior risk level of the application to be managed, the calculation formula mainly involves the calculation of the loss function and the gradient descent algorithm for model training. Fortify is a static code analysis tool for detecting security vulnerabilities and defects in the code. AppScan is a security scanning tool for automatically detecting security issues in applications, such as permission abuse and function mismatch. New Relic is an application performance management tool for monitoring and analyzing the runtime application behavior of the application to be managed, wherein the application behavior can specifically be resource usage and network interaction.
[0075] As an example, step 302 includes: extracting features from application behavior data using a preset behavior risk level prediction model to obtain application behavior features of the application to be managed.
[0076] Step 304: predicting the behavior risk level of the application to be managed based on the application behavior characteristics.
[0077] It should be noted that the preset behavior risk level prediction model is a trained model, which can predict the risk level of the application to be managed in real time and provide accurate security assessment. It can be understood that the loss function of the preset behavior risk level prediction model is used to evaluate the difference between the model prediction and the actual label, and guide the direction of model training. The gradient descent algorithm optimizes the preset behavior risk level prediction model by calculating the gradient of the loss function with respect to the model parameters, and updating the parameters to minimize the loss function. The parameters represent the mapping relationship from input to output of the preset behavior risk level model in the neural network, and their values determine how the model processes the data.
[0078] As an example, step 304 includes: inputting the application behavior characteristics into a preset risk level prediction model, and predicting the behavior risk level of the application to be managed by the preset risk level prediction model.
[0079] Step 306: Configure corresponding permission management rules for the application to be managed according to the behavior risk level.
[0080] It should be noted that after predicting the behavioral risk level of the application to be managed, the corresponding permission management rules can be configured for the application to be managed based on the real-time behavioral risk level of the application to be managed. For example, in one feasible method, assuming that the behavioral risk level of the application to be managed includes three risk levels: low, medium and high, and permission management rule 1, permission management rule 2 and permission management rule 3 are pre-configured, then when the predicted behavioral risk level is a low behavioral risk level, permission management rule 1 is configured for the application to be managed; when the predicted behavioral risk level is a medium behavioral risk level, permission management rule 2 is configured for the application to be managed; when the predicted behavioral risk level is a high behavioral risk level, permission management rule 3 is configured for the application to be managed.
[0081] As an example, step 306 includes: according to the behavior risk level, querying the preset permission management rules pre-configured for the application to be managed, and using the preset permission management rules as the permission management rules.
[0082] In this embodiment, the application data is first feature extracted through a preset behavior risk level prediction model to obtain application behavior features of the application to be managed, and then the current behavior risk level of the application to be managed is predicted based on the application behavior features and the preset risk level prediction model. Finally, depending on the current behavior risk level, corresponding permission management rules are configured for the application to be managed. This can achieve the purpose of utilizing application behavior features that accurately reflect the real-time behavior of the application to be managed to configure permission management rules that conform to the real-time application behavior of the current application to be managed. Therefore, it lays a foundation for improving the permission management effect of applications deployed on mobile terminal devices.
[0083] In one embodiment, according to the behavior risk level, corresponding permission management rules are configured for the application to be managed, including:
[0084] According to the behavior risk level, at least one functional permission requirement of the application to be managed is queried; and the permission management rules are obtained by integrating the permission management conditions of each functional permission requirement.
[0085] It should be noted that the application to be managed usually contains multiple functional modules, and different functional modules may have different requirements for permission restrictions. In order to more finely constrain the permission capabilities when operating the managed application, the different functional permission requirements of the application to be managed can be queried separately, and the permission management conditions matched by the different functional permission requirements can be configured to obtain the permission management rules of the application to be managed. For example, in an implementable manner, according to the behavioral risk level shown by the application behavior data, a personalized security policy is formulated and implemented for the application to be managed, minimum permission management is implemented, application permissions are dynamically adjusted, and application access to sensitive data and functions is restricted. That is, the configuration module deployed by the permission management device can review the permission requests of the application to be managed one by one, and limit the minimum permissions of the application to be managed to be consistent with the functional requirements.
[0086] As an example, at least one functional permission requirement of the application to be managed is queried with the behavior risk level as an index; the permission management conditions of each functional permission requirement are integrated into a permission management rule. Since the configuration module deployed by the permission management device can review the permission requests of the application to be managed one by one, and limit the minimum permissions of the application to be managed to be consistent with the functional requirements, that is, the permission management rules are configured based on the functional permission requirements of the application to be managed, so the purpose of fine-grained permission management of the application to be managed can be achieved. Therefore, while laying the foundation for improving the permission management effect of the application deployed on the mobile terminal device, the management fineness of the permission management of the application to be managed is improved.
[0087] In one embodiment, the application permissions of the application to be managed are managed by adjusting the permission management rules, including:
[0088] At least one application function module managed by the permission management rule is determined; and application permissions of the application to be managed are managed by isolating the application function modules from each other.
[0089] It should be noted that when the managed application behaves abnormally, different managed applications may have different isolation requirements. For example, in one feasible method, a micro-isolation module can be deployed in the application permission management device. The micro-isolation module logically isolates different functional modules of the managed application through a functional module division mechanism, and applies independent security policies to each functional module to prevent network attacks from expanding horizontally between modules. That is, the micro-isolation module is executed when needed to isolate and recover the attacked managed application.
[0090] As an example, at least one application function module managed by the permission management rule is determined; the application permissions of the application to be managed are managed by isolating the application function modules from each other. In the process of managing the application permissions of the application to be managed, by deploying a micro-isolation module on the application permission management device, and then formulating independent security policies for different application function modules, different application function modules are isolated from each other, thereby achieving the purpose of avoiding network attacks from expanding horizontally between different application function modules, thereby improving the security of permission management of applications deployed on mobile terminal devices.
[0091] In one embodiment, the application permissions of the application to be managed are managed by adjusting the permission management rules, including:
[0092] According to the preset application isolation conditions, the permission management rules are modified to obtain the modified permission management rules; according to the modified permission management rules, the application to be managed is isolated.
[0093] It should be noted that in the process of managing the application permissions of the application to be managed, if it is necessary to isolate the entire application to be managed, an endpoint isolation and recovery module can be deployed on the application permission management device. The endpoint isolation and recovery module is used to automatically isolate the attacking application when the application to be managed deployed on the target terminal is attacked by a network attack, restrict its network and device access, and restore system functions through an automatic repair mechanism. After the device security is verified, the isolation is lifted and its normal connection with the network and other devices is restored. It can be understood that the endpoint isolation and recovery module is executed when needed to isolate and recover the terminal that has been attacked by the network, that is, it intervenes when a behavioral security threat is detected in the application to be managed, and performs isolation and recovery operations on the application to be managed.
[0094] As an example, a preset application isolation condition is obtained, and the isolation level of the permission management rule is modified according to the preset application isolation condition to obtain a modified permission management rule; and the application to be managed is isolated according to the modified permission management rule.
[0095] In one embodiment, after isolating the application to be managed according to the modified permission management rule, the method further includes:
[0096] When it is detected that the application to be managed has passed the security verification, the isolation of the application to be managed is released; when it is detected that the isolation of the application to be managed is released, the application communication of the application to be managed is restored.
[0097] It should be noted that, since network threats are dynamic, after the managed applications are relatively isolated or mutually isolated, the issue of application permission recovery of the managed applications will also be involved. For example, in one feasible method, after the application permissions of the managed applications are managed by adjusting the permission management rules, the managed applications can be further subjected to periodic security verification, and if the managed applications pass the security verification, the application isolation of the managed applications can be lifted. At the same time, in order to ensure that the managed applications can communicate normally with other applications, the application communication of the managed applications can be restored.
[0098] As an example, security verification is periodically performed on the managed application, and when it is detected that the managed application has passed the security verification, the application isolation of the managed application is released; when it is detected that the managed application has been released from isolation, the application communication of the managed application is restored. Since after the application permissions of the managed application are managed by adjusting the permission management rules, security verification is periodically performed on the managed application, and when the managed application has passed the security verification, the application isolation of the managed application is released and the application communication is restored, etc., so that the managed application can maintain normal communication before and after facing security threats, and thus further improves the permission management effect of applications deployed on mobile terminal devices.
[0099] In an implementable way, the application permission management module deploys risk assessment, permission management, behavior monitoring, anomaly detection, micro-isolation, and endpoint isolation and recovery modules to form a comprehensive mobile application security management framework. It identifies and evaluates the risks of application permission requests, data access, and network behaviors by calling APIs, implements minimum permission management, dynamically adjusts application permissions, monitors application operations and data transmission behaviors in real time, and strictly restricts high-risk applications and automatically isolates and recovers attacked terminals. It also introduces neural network algorithms to predict and assess application behaviors in real time, and uses micro-isolation technology to logically isolate different functional modules of the application to prevent lateral attacks. The expansion significantly improves the security and stability of mobile applications in the terminal environment; the data of the application to be managed mainly comes from the mobile applications installed on the target terminal. During the data processing, the data flow is as follows: first, the risk assessment module identifies the application and assesses the risk through the API, and then the permission management module formulates a security policy based on the risk assessment results and dynamically adjusts the application permissions. The behavior monitoring module then tracks the application operation in real time, identifies security threats through logs and anomaly detection, and further analyzes the application behavior through the anomaly detection module, identifies anomalies and triggers the response mechanism. Finally, the security assessment report can be output, the application permissions of the application to be managed can be adjusted, and the attacked terminal can be isolated and restored.
[0100] It can be understood that the above-mentioned application permission management method ensures that each application obtains only the minimum permissions required for its function through the risk assessment module, avoiding excessive expansion of permissions; through fine-grained permission management and dynamic permission adjustment mechanism, it can monitor permission usage behavior in real time and limit permission access of high-risk applications; this greatly reduces the risk of application abuse of permissions and unauthorized access to sensitive data, thereby improving the overall security of the device; through the behavior monitoring module, by continuously monitoring the application's operation logs, data access records and network communication behaviors, it can detect abnormal behaviors in time and respond quickly; once a security threat is found, the permissions of the application are immediately restricted or its communication with external servers is blocked. The system detects and isolates the application in a sandbox. This real-time monitoring and automatic response mechanism greatly improves the efficiency of responding to security threats, ensures that application behavior is always within the scope of security policies, and introduces micro-isolation technology and endpoint isolation mechanism to logically isolate different functional modules of the application to prevent horizontal expansion of attacks. Even if a module is attacked, other modules can still run safely. This modular security protection strategy, combined with automatic isolation and repair of attacked terminals, significantly improves the overall security and stability of the terminal, ensuring that the device can still operate normally in the face of complex threats. That is, the above-mentioned application permission management method improves the permission management effect of applications deployed on mobile terminal devices from different dimensions.
[0101] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.
[0102] Based on the same inventive concept, the embodiment of the present application also provides an application permission management device for implementing the above-mentioned application permission management method. The implementation solution provided by the device to solve the problem is similar to the implementation solution recorded in the above-mentioned method, so the specific limitations in one or more application permission management device embodiments provided below can refer to the limitations of the application permission management method above, and will not be repeated here.
[0103] In an exemplary embodiment, Figure 3As shown, an application permission management device is provided, including: an acquisition module 401, a configuration module 402 and a management module 403, wherein:
[0104] The acquisition module 401 is used to acquire the application behavior data of the application to be managed deployed on the target terminal;
[0105] Configuration module 402, configured to configure corresponding permission management rules for the application to be managed according to the application behavior data, wherein the permission management rules are used to characterize permission capability constraints when the application to be managed performs operations;
[0106] The management module 403 is used to manage the application permissions of the application to be managed by adjusting the permission management rules when abnormal behavior of the application to be managed is detected.
[0107] In one embodiment, the configuration module 402 is further configured to:
[0108] Feature extraction is performed on the application behavior data to obtain application behavior features of the application to be managed; based on the application behavior features, a behavior risk level of the application to be managed is predicted; and based on the behavior risk level, corresponding permission management rules are configured for the application to be managed.
[0109] In one embodiment, the configuration module 402 is further configured to:
[0110] According to the behavior risk level, at least one functional permission requirement of the application to be managed is queried; and the permission management rule is obtained by integrating the permission management conditions of each functional permission requirement.
[0111] In one embodiment, the configuration module 403 is used to:
[0112] Determine at least one application function module managed by the permission management rule; and manage the application permissions of the application to be managed by isolating the application function modules from each other.
[0113] In one embodiment, the configuration module 403 is further used to:
[0114] According to the preset application isolation conditions, the permission management rules are modified to obtain modified permission management rules; according to the modified permission management rules, the application to be managed is isolated.
[0115] In one embodiment, the application rights management device is further used for:
[0116] When it is detected that the application to be managed passes the security verification, the application isolation of the application to be managed is released; when it is detected that the isolation of the application to be managed is released, the application communication of the application to be managed is restored.
[0117] Each module in the above-mentioned application rights management device can be implemented in whole or in part by software, hardware or a combination thereof. Each of the above-mentioned modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.
[0118] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as shown in FIG. Figure 4 As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected via a system bus, and the communication interface, the display unit and the input device are connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, it implements an application permission management method. Those skilled in the art can understand that Figure 4 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.
[0119] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.
[0120] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.
[0121] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.
[0122] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.
[0123] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.
[0124] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.
Claims
1. A method for managing application permissions, characterized in that: The method comprises: Obtain application behavior data of the application to be managed deployed on the target terminal; According to the application behavior data, a corresponding permission management rule is configured for the application to be managed, wherein the permission management rule is used to characterize the permission capability constraint when the application to be managed performs an operation; When it is detected that the behavior of the application to be managed is abnormal, the application permissions of the application to be managed are managed by adjusting the permission management rules.
2. The method according to claim 1, characterized in that The configuring corresponding permission management rules for the application to be managed according to the application behavior data includes: Extracting features from the application behavior data to obtain application behavior features of the application to be managed; Predicting the behavior risk level of the application to be managed according to the application behavior characteristics; According to the behavior risk level, corresponding permission management rules are configured for the application to be managed.
3. The method according to claim 2, characterized in that The configuring corresponding permission management rules for the application to be managed according to the behavior risk level includes: According to the behavior risk level, query at least one functional permission requirement of the application to be managed; The permission management rules are obtained by integrating the permission management conditions of each of the functional permission requirements.
4. The method according to claim 1, characterized in that Managing the application permissions of the application to be managed by adjusting the permission management rules includes: Determining at least one application function module managed by the permission management rule; By isolating the application function modules from each other, the application permissions of the application to be managed are managed.
5. The method according to claim 1, characterized in that Managing the application permissions of the application to be managed by adjusting the permission management rules includes: Modifying the permission management rule according to the preset application isolation condition to obtain a modified permission management rule; The application to be managed is isolated according to the modified permission management rule.
6. The method according to claim 5, characterized in that After isolating the application to be managed according to the modified permission management rule, the method further includes: When it is detected that the application to be managed passes the security verification, performing application isolation release on the application to be managed; When it is detected that the isolation of the application to be managed is released, application communication of the application to be managed is restored.
7. An application rights management device, characterized in that: The device comprises: An acquisition module, used to acquire application behavior data of the application to be managed deployed on the target terminal; A configuration module, configured to configure corresponding permission management rules for the application to be managed according to the application behavior data, wherein the permission management rules are used to characterize permission capability constraints when the application to be managed performs operations; The management module is used to manage the application permissions of the application to be managed by adjusting the permission management rules when abnormal behavior of the application to be managed is detected.
8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.
9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.
10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.