Access permission authorization method and device, terminal equipment and storage medium

Abstract

The invention is suitable for the technical field of information processing, and provides an access permission authorization method and device, terminal equipment and a storage medium. According to the method, the access information of the target application is acquired and input into the authorization information in response to the permission authorization instruction of the target application; storing the authorization information to an authority controller; the permission controller is used for receiving a file access instruction of the target application and determining the file access permission of the target application according to the authorization information; the authorization information can be stored in the permission controller before the target application initiates the file access instruction, so that the judgment on whether the target application has the file access permission is completed only in the permission controller, the file access instruction and the file information carried by the file access instruction are prevented from being interacted among a plurality of system hierarchies, and the user experience is improved. Therefore, the switching frequency of the CPU context is reduced, the resource overhead in response to the file access request is reduced, and the file access speed and the overall performance of the terminal equipment are improved.

Description

Technical Field

[0001] The present application belongs to the field of information processing technology, and in particular, relates to a method, apparatus, terminal device and storage medium for authorizing access rights. Background Art

[0002] With the rapid development of electronic technology, terminal devices have become an indispensable tool for learning, working and entertainment in life. As the functions of terminal devices become more and more abundant, users' security awareness is gradually improving. Currently, terminal devices usually have file access permissions to determine whether any application or temporary user has the permission to access the relevant files, so as to protect user privacy and information security.

[0003] In the prior art, when any application initiates a file access request, the file access request and the relevant information of the target file need to be sent to the kernel space, which is then forwarded by the kernel space to the user space for access permission judgment, and the judgment result is fed back to the kernel space to determine whether to grant access permission to any of the above applications. This requires the terminal device to copy and transfer the file access request and the relevant information of the target file multiple times, and the interaction between the kernel space and the user space requires two CPU context switches, resulting in a large amount of resource overhead, affecting the overall performance of the terminal device. Therefore, how to reduce resource overhead when responding to file access requests has become a problem that needs to be solved urgently. Summary of the invention

[0004] In view of this, embodiments of the present application provide a method, apparatus, terminal device and storage medium for authorizing access rights to solve the problem of excessive resource overhead in responding to file access requests in the prior art.

[0005] A first aspect of an embodiment of the present application provides a method for authorizing access rights, which is applied to a terminal device, and the method includes:

[0006] In response to the permission authorization instruction of the target application, obtaining access information of the target application and entering it into the authorization information; the authorization information is used to record the application with file access rights;

[0007] The authorization information is stored in a permission controller; the permission controller is used to receive a file access instruction from the target application, determine the file access permission of the target application according to the authorization information, and return the authorization result of the file access permission to the target application.

[0008] In one embodiment, in response to the permission authorization instruction of the target application, obtaining the access information of the target application and entering it into the authorization information includes:

[0009] In response to the permission authorization instruction of the target application, acquiring an application identifier of the target application and metadata information of the target file indicated by the permission authorization instruction;

[0010] The application identification of the target application and the metadata information of the target file are entered into the authorization information.

[0011] In one embodiment, the permission controller is further configured to return metadata information of the target file to the target application after determining that the target application has file permissions.

[0012] In one embodiment, the metadata information of the target file includes the file name and storage path of the target file.

[0013] In one embodiment, the system layer of the terminal device includes a user space and a kernel space, the target application runs in the user space, the user space is used to respond to the permission authorization instruction of the target application and enter the access information into the authorization information, and send the authorization information to the permission controller; the permission controller runs in the kernel space.

[0014] In one embodiment, the user space includes an application layer; the application layer includes at least one target application, and after the target application initiates a permission authorization instruction, the application layer forwards the permission authorization instruction and the access information of the target application to a permission manager, and the permission manager is used to manage authorization information.

[0015] In one embodiment, the user space includes a framework layer, the framework layer includes a permission manager, and the permission manager is used to enter the access information of the target application into the authorization information according to the permission authorization instruction, and send the authorization information to the permission controller.

[0016] A first aspect of an embodiment of the present application provides a method for authorizing access rights, by responding to a permission authorization instruction of a target application, obtaining access information of a target application and entering it into the authorization information; storing the authorization information in a permission controller; the permission controller is used to receive a file access instruction of the target application, and determine the file access rights of the target application based on the authorization information, and return the authorization result of the file access rights to the target application; before the target application initiates a file access instruction, the authorization information can be stored in the permission controller, so that the judgment of whether the target application has file access rights is completed only in the permission controller, avoiding the interaction of file access instructions and the file information they carry between multiple system levels, thereby reducing the number of CPU context switching times, reducing resource overhead when responding to file access requests, and improving file access speed and the overall performance of the terminal device.

[0017] The second aspect of an embodiment of the present application provides a terminal device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method for authorizing access rights provided by the first aspect of the embodiment of the present application when executing the computer program.

[0018] A third aspect of an embodiment of the present application provides an access rights authorization device, including:

[0019] An entry module, for obtaining access information of the target application and entering it into authorization information in response to a permission authorization instruction of the target application; the authorization information is used to record applications with file access rights;

[0020] The authorization module is used to store the authorization information in the permission controller; the permission controller is used to receive the file access instruction of the target application, determine the file access permission of the target application according to the authorization information, and return the authorization result of the file access permission to the target application.

[0021] A fourth aspect of an embodiment of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the steps of the method for authorizing access rights provided in the first aspect of the embodiment of the present application are implemented.

[0022] It can be understood that the beneficial effects of the second to fourth aspects mentioned above can be found in the relevant description of the first aspect mentioned above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0024] Figure 1 This is a schematic diagram of the structure of a terminal device provided in an embodiment of the present application;

[0025] Figure 2 This is a schematic diagram of the architecture of an operating system running on a terminal device provided in an embodiment of the present application;

[0026] Figure 3 This is a schematic diagram of a first flow chart of a method for authorizing access rights provided in an embodiment of the present application;

[0027] Figure 4 This is a second flow chart of the method for authorizing access rights provided in an embodiment of the present application;

[0028] Figure 5 It is a schematic diagram of a scenario for authorizing access rights when the system level of a terminal device provided by an embodiment of the present application includes a user space and a kernel space;

[0029] Figure 6 It is a schematic diagram of a scenario for authorizing access rights when the system layer of the terminal device provided by the embodiment of the present application includes a user layer, a framework layer and a kernel layer;

[0030] Figure 7 It is a schematic diagram of a scenario when a target application and a permission controller perform file access interaction provided by an embodiment of the present application;

[0031] Figure 8 It is a structural schematic diagram of a brightness control device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0032] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0033] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or combinations thereof.

[0034] It should also be understood that the term “and / or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0035] As used in the specification and appended claims of this application, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce [described condition or event] is detected" or "in response to detecting [described condition or event]", depending on the context.

[0036] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0037] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0038] In an application, when any application initiates a file access request, the file access request and the relevant information of the target file need to be sent to the kernel space, which is then forwarded to the user space for access permission judgment, and the judgment result is fed back to the kernel space to determine whether to grant access permission to any of the above applications. This requires the terminal device to copy and transfer the file access request and the relevant information of the target file multiple times, and the interaction between the kernel space and the user space requires two CPU context switches, resulting in a large amount of resource overhead, affecting the overall performance of the terminal device. Therefore, how to reduce resource overhead when responding to file access requests has become a problem that needs to be solved urgently.

[0039] In response to the above technical problems, an embodiment of the present application provides an access rights authorization method, which can store authorization information in a permission controller before the target application initiates a file access instruction, so that the judgment of whether the target application has file access rights is completed only in the permission controller, avoiding the interaction of file access instructions and the file information they carry between multiple system levels, thereby reducing the number of CPU context switching times, reducing resource overhead when responding to file access requests, and improving file access speed and the overall performance of the terminal device.

[0040] The authorization method for access rights provided in the embodiments of the present application can be applied to terminal devices. The terminal device can be a mobile phone, a tablet computer, a wearable device, a vehicle-mounted device, an augmented reality (AR) / virtual reality (VR) device, a notebook computer, an ultra-mobile personal computer (UMPC), a netbook, a personal digital assistant (PDA), etc. The embodiments of the present application do not impose any restrictions on the specific type of the terminal device.

[0041] Figure 1 The schematic diagram of the structure of the terminal device 1 is shown as an example. The terminal device 1 includes a processor 10, a memory 20, an audio module 30, a camera module 40, a sensor module 50, an input module 60, a display module 70, a wireless communication module 80, and a power module 90. The audio module 30 may include a speaker 31 and a microphone 32, the camera module 40 may include a short-focus camera 41, a long-focus camera 42, and a flash 43, the sensor module 50 may include an infrared sensor 51, an acceleration sensor 52, a position sensor 53, a fingerprint sensor 54, and an iris sensor 55, the input module 60 may include a touch panel 61 and an external input unit 62, and the wireless communication module 80 may include wireless communication units such as Bluetooth, optical wireless communication (Optical Wireless), mobile communication (Mobile Communications), wireless local area network (Wireless Local Area Network, WLAN), near field communication (Near Field Communication, NFC) and ZigBee protocol (ZigBee).

[0042] In applications, the processor 10 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.

[0043] In application, the memory 20 may be an internal storage unit of the terminal device in some embodiments, such as a hard disk or memory of the terminal device. The memory 20 may also be an external storage device of the terminal device in other embodiments, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the terminal device. Further, the memory 20 may also include both an internal storage unit of the terminal device and an external storage device. The memory 20 is used to store computer programs 21 such as an operating system, an application program, and a boot loader (BootLoader). The memory 20 may also be used to temporarily store data that has been output or is to be output.

[0044] In application, the display module 70 can be a flat screen, a curved screen or a flexible screen, specifically a folding screen. The folding screen may include at least one flexible screen, or the folding screen may include at least one flexible screen and at least one flat screen or curved screen. The embodiment of the present application does not impose any restrictions on the specific type of the display module 70.

[0045] It is to be understood that the structure illustrated in the embodiment of the present application does not constitute a specific limitation on the terminal device 1. In other embodiments of the present application, the terminal device 1 may include more or fewer components than those illustrated, or may combine certain components, or different components, such as a graphics processor, etc. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0046] like Figure 2 As shown, the architecture diagram of the operating system running on the terminal device 1 provided in the embodiment of the present application, the layered architecture can divide the operating system into multiple layers, and the layers communicate with each other through software interfaces. In some embodiments, the operating system can be divided from top to bottom into an application layer 100, a framework layer 200, a system runtime layer 300, a hardware abstraction layer 400, and a Linux kernel layer 500.

[0047] It should be noted that the type of the operating system may be an Android system, an operating system customized based on the Android system, or other different types of operating systems. The embodiments of the present application do not impose any limitation on the specific type of the operating system.

[0048] In the application, the five layers of the operating system are introduced as follows:

[0049] The application layer 100 may include built-in applications 120 built into the system and upper layer applications 110 provided by third-party application providers. The application programs of the application layer 100 may interact directly with users to implement different functions provided by the application programs. For example, the application layer 100 may specifically include built-in applications such as email, phone, calendar, camera, contacts, and Bluetooth, and upper layer applications such as map positioning, food delivery, and video playback.

[0050] The framework layer (Application Framwork) 200 may include an application programming interface (API) and a programming framework. The application programming interface may be used to provide an interface for operating system developers to develop applications, and may also be used to call corresponding basic services for applications in the application layer when implementing different functions. For example, the framework layer may include different types of application programming interfaces such as window managers, content providers, phone managers, positioning managers, and view systems.

[0051] The window manager is used to manage window programs. Specifically, it can be used to obtain the window size, determine whether there is a status bar, lock the screen, capture the screen, etc.

[0052] Content providers are used to store and retrieve data and make the data accessible to applications. The data may include videos, images, audio, call logs, contacts, browsing history, and bookmarks.

[0053] The phone manager is used to provide communication functions of the terminal device 1, such as management of call status, including answering and hanging up calls, etc.;

[0054] The positioning manager is used to obtain the location information of the terminal device 1, which may include different types of location information such as satellite location information (obtained through the global positioning system), network location information (obtained through a network positioning service), and fused location information (obtained through a fused positioning service);

[0055] The view system is used to provide visual controls, such as controls for displaying text and controls for displaying pictures, and is also used to build applications for displaying the application layer 100. The view system can run multiple visual controls at the same time, so that the terminal device can display multiple views at the same time, for example, a view that displays text and a view that displays pictures at the same time.

[0056] The system runtime layer (Native) 300 may include a C / C++ library 310 and an Android runtime library 320, wherein the C / C++ library 310 may include a drawing function library, a font engine, a rendering engine, a multimedia library, and a database engine, etc. The drawing function library may be OpenGL For Embedded Systems 3D (a 3D open graphics library running on embedded systems); the font engine is used to provide different fonts, and may be FreeType (a portable font engine); the rendering engine is used to render two-dimensional graphics or three-dimensional graphics, and may be Skia Graphics Library (an engine for rendering two-dimensional graphics); the multimedia library (Media Framework) is used to support the playback, recording, and playback of audio and video in different formats; the database engine is used to provide storage functions for different types of databases, so that different types of data can be stored in different types of databases according to actual needs, or different types of data can be stored in a unified database.

[0057] The Android runtime 320 may include core libraries (Core Libraries) and an Android runtime environment (Android Runtime, ART), wherein after the Android 5.0 system, the Dalvik virtual machine is replaced by ART. The core library provides most of the functions of the Java language core library, so that developers can use the Java language to write Android applications. Compared with the Java Virtual Machine (Java Virtual Machine, JVM), the Dalvik virtual machine is specially customized for mobile devices, allowing multiple virtual machine instances to run simultaneously in limited memory, and each Dalvik application is executed as an independent Linux process. Independent processes can prevent all programs from being closed when the virtual machine crashes. The mechanism of ART, which replaces the Dalvik virtual machine, is different from Dalvik. Under Dalvik, every time an application runs, the bytecode needs to be converted into machine code by a just-in-time compiler, which slows down the running efficiency of the application. In the ART environment, when the application is installed for the first time, the bytecode will be pre-compiled into machine code, making it a truly local application.

[0058] The Hardware Abstraction Layer (HAL) 400 is an interface layer between the operating system kernel and the hardware circuit. Its purpose is to abstract the hardware. In order to protect the intellectual property rights of hardware manufacturers, it hides the hardware interface details of a specific platform, thereby providing a virtual hardware platform for the operating system, making it hardware-independent and portable on multiple platforms. From the perspective of software and hardware testing, the testing of software and hardware can be completed based on the hardware abstraction layer, so that the testing of software and hardware can be carried out in parallel.

[0059] The Linux kernel layer 500 can be used to provide system services of the operating system, including security services, memory management, process management, network protocol stack, driver model and other services of the operating system.

[0060] Understandably, Figure 2 The architecture diagram of an operating system is only shown by way of example. The operating system architecture can also be four-layer or six-layer, wherein the architecture of a four-layer operating system may include: an application layer, a framework layer, a system runtime layer and a Linux kernel layer; the architecture of a six-layer operating system may include: an application layer, a framework layer, a system runtime layer, a hardware abstraction layer, a Linux kernel layer and a hardware device layer. The embodiment of the method of the present application does not impose any limitation on the number of architecture layers and the specific architecture of the operating system.

[0061] like Figure 3 As shown, the access authorization method provided in the embodiment of the present application is applied to a terminal device, and includes the following steps S301 and S302:

[0062] Step S301: In response to the permission authorization instruction of the target application, the access information of the target application is obtained and entered into the authorization information; the authorization information is used to record the application with file access rights.

[0063] In the application, the target application can initiate a permission authorization instruction, which can be initiated by the user, or by the terminal device asking the user whether to grant access rights, or by the terminal device actively initiating when automatically configuring to adjust the access rights of the target application. It is easy to understand that the target application can initiate a permission authorization instruction, or initiate an access rights closing instruction to flexibly adjust the access rights according to actual needs. The execution process of the access rights closing instruction can refer to the execution process of the permission authorization instruction, and will not be repeated here.

[0064] In the application, after the terminal device monitors the target application initiating the permission authorization instruction, it can obtain the access information of the target application. The access information can represent the identity of the target application and the target file that the target application intends to access. The access information is written into the authorization information, and the authorization information is used to record the applications with file access rights, that is, the applications recorded in the authorization information all have file access rights. It should be noted that the permission scope of the file access rights can be to allow the corresponding application to access at least one specified target file, or to allow the corresponding application to access all files in the terminal device. The specific permission scope of the file access rights can be set according to actual needs. The embodiment of the present application does not impose any restrictions on the specific permission scope of the file access rights.

[0065] Step S302, storing the authorization information in the permission controller; the permission controller is used to receive the file access instruction of the target application, determine the file access permission of the target application according to the authorization information, and return the authorization result of the file access permission to the target application.

[0066] In the application, after the authorization information is entered into the access information of the target application, the authorization information can be sent and stored in the permission controller. The permission controller is used to receive the file access instruction of the target application and to control the issuance of file access rights. Specifically, after receiving the file access instruction, the permission controller can check whether the access information of the target application is recorded in the authorization information. If so, it means that the target application has initiated the permission authorization instruction, then the target application is granted file access rights, and the authorization result is fed back to the target application, so that the target application can use the authorization result as a credential to access the target file; if not, it means that the target application has not initiated the permission authorization instruction, and the target application is not granted file access rights.

[0067] In one embodiment, the permission controller is also used to generate permission granting notification information when it is determined that the target application does not have file access permissions. The permission granting notification information is used to inform the user that the target application does not have file access permissions, and to generate an initiation link for the permission granting instruction to facilitate the user to quickly initiate the permission granting instruction.

[0068] In the application, by responding to the permission authorization instruction of the target application, the access information of the target application is obtained and entered into the authorization information; the authorization information is stored in the permission controller; the permission controller is used to receive the file access instruction of the target application, and determine the file access permission of the target application according to the authorization information, and return the authorization result of the file access permission to the target application; before the target application initiates the file access instruction, the authorization information can be stored in the permission controller, so that the judgment of whether the target application has the file access permission is completed only in the permission controller, avoiding the interaction of the file access instruction and the file information it carries between multiple system levels, thereby reducing the number of CPU context switching times, reducing the resource overhead when responding to file access requests, and improving the file access speed and the overall performance of the terminal device.

[0069] like Figure 4 As shown, in one embodiment, based on Figure 3 The corresponding embodiment includes the following steps S401 to S403:

[0070] Step S401: In response to a permission authorization instruction of a target application, an application identifier of the target application and metadata information of a target file indicated by the permission authorization instruction are obtained;

[0071] Step S402: Enter the application identifier of the target application and the metadata information of the target file into the authorization information.

[0072] In the application, the access information of the target application may specifically include the application identifier of the target application and the metadata information (Metadata) of the target file indicated by the permission authorization instruction. The application identifier (ApplicationIdentifier) ​​of the target application can be a unique identifier, the package name of the installation file, or the developer's public key certificate. Specifically, it can be UID (User Identification). The metadata information of the target file may include the file name, storage path and / or system-defined kernel file structure (Struct Stat) of the target file. Specifically, the target file may be a multimedia file in a terminal device, and the embodiment of the present application does not impose any restrictions on the file type of the target file.

[0073] In one embodiment, reference Figure 5 and Figure 6 As shown, the system layer of the terminal device includes user space and kernel space. The user space is used to respond to the permission authorization instruction of the target application and enter the access information into the authorization information, and send the authorization information to the permission controller; the permission controller runs in the kernel space.

[0074] In the application, the user space may include the application layer, framework layer and system runtime layer of the terminal device, the kernel space may include the hardware abstraction layer and Linux kernel layer of the terminal device, and the permission controller may specifically run in the Linux kernel layer. The specific interaction method between the user space and the kernel space is described below:

[0075] Figure 5 The schematic diagram of the scenario of access permission authorization when the system level of the terminal device includes a user space 600 and a kernel space 700 is exemplarily shown; Figure 6 The schematic diagram of the scenario of access permission authorization is shown as an example when the system layer of the terminal device includes the user layer 100, the framework layer 200 and the Linux kernel layer 500. Among them, 610 represents the target application, 611 represents the authorization information, 620 represents the permission manager, and 710 represents the permission controller.

[0076] In the application, the user space may include an application layer, and the application layer may include at least one target application. After the target application initiates a permission authorization instruction, the application layer forwards the permission authorization instruction and the access information of the target application to the permission manager, and the permission manager is used to manage the authorization information.

[0077] In the application, the user space may further include a framework layer, the framework layer includes a permission manager, the permission manager is used to enter the access information of the target application into the authorization information according to the permission authorization instruction, and send the authorization information to the permission controller.

[0078] In the application, the following is an illustrative description of the specific implementation methods of the access authorization method in the system and at each level:

[0079] a. Define an array structure at the framework layer: used to store the application identifier and metadata information of the target application. Specifically, it can be a key-value pair array key-value, where the key is a custom string and the corresponding value is used to store information. For example, if the key is "Uid", the corresponding value contains the application identifier of all applications with file access rights; if the key is "Metadata", the corresponding value contains the metadata information of all target files.

[0080] b. Generate object files at the Linux kernel layer: The above object files are used to store authorization information. The object files can be created through the interface provided by ConfigFS (a memory-based file system at the Linux kernel layer, used to manage kernel objects);

[0081] c. Add attributes to the above object files to map the array structure: For example, assuming that the target files are all multimedia files, set the attribute "Media_Provider" (multimedia information provider) and include the file "Media_Data", establish the mapping between "Media_Data" and the above array structure, and realize the mapping between the framework layer and the Linux kernel layer, that is, the mapping between the user space and the kernel space;

[0082] d. Define the read and write operation interface: You can define a read function read and a write function write respectively. The read function read is used to read the "Media_Data" in the Linux kernel layer, thereby reading the corresponding key-value and sending the read metadata information to the target application in the application layer; the write function write is used to enter the application identifier and metadata information of the target application in the framework layer and map it to the "Media_Data" in the Linux kernel layer.

[0083] Step S403, store the authorization information in the permission controller; the permission controller is used to receive the file access instruction of the target application, and determine the file access permission of the target application according to the authorization information, and return the authorization result of the file access permission and the metadata information of the target file to the target application.

[0084] In the application, the permission controller can directly return the metadata information of the target file based on the authorization result of the file access rights, so that the target application can quickly obtain the target file according to the metadata information, thereby improving the access efficiency of the target file. And by directly determining the file access rights of the target application through the permission controller, the interaction between the Linux kernel layer and the framework layer is reduced, thereby reducing two CPU context switches, and improving the speed of judging and granting file access rights while reducing resource overhead.

[0085] Figure 7 The schematic diagram exemplarily shows a scenario in which the target application 610 interacts with the permission controller 710 in file access.

[0086] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0087] like Figure 8As shown, the embodiment of the present application also provides an access authorization device 8, which is used to execute the steps in the above-mentioned access authorization method embodiment applied to the terminal device. The access authorization device can be a virtual appliance in the terminal device, which is run by the processor of the terminal device, or it can be the terminal device itself.

[0088] like Figure 8 As shown, the access authorization device 8 provided in the embodiment of the present application includes:

[0089] The input module 81 is used to obtain the access information of the target application and input it into the authorization information in response to the permission authorization instruction of the target application; the authorization information is used to record the application with the file access permission;

[0090] The authorization module 82 is used to store the authorization information in the permission controller; the permission controller is used to receive the file access instruction of the target application, determine the file access permission of the target application according to the authorization information, and return the authorization result of the file access permission to the target application.

[0091] In one embodiment, the entry module 81 includes:

[0092] A first input unit, configured to obtain, in response to a permission authorization instruction of a target application, an application identifier of the target application and metadata information of a target file indicated by the permission authorization instruction;

[0093] The second input unit is used to input the application identification of the target application and the metadata information of the target file into the authorization information.

[0094] In application, each module in the access authority authorization device 8 may be a software program module, or may be implemented by different logic circuits integrated in a processor, or may be implemented by multiple distributed processors.

[0095] It should be noted that the information interaction, execution process and other contents between the above-mentioned modules are based on the same concept as the method embodiment of the present application. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0096] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example for illustration. In practical applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. The functional modules in the embodiment can be integrated into a processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The above-mentioned integrated modules can be implemented in the form of hardware or in the form of software functional modules. In addition, the specific names of the functional modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the modules in the above-mentioned system can refer to the corresponding process in the method embodiment, which will not be repeated here.

[0097] The embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in the embodiment of the authorization method for implementing the above-mentioned various access rights are implemented.

[0098] If the integrated module is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When the computer program is executed by the processor, the steps of the above-mentioned method embodiments can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable storage medium may at least include: any entity or device that can carry the computer program code to the camera terminal device, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electric carrier signal, a telecommunication signal, and a software distribution medium. For example, a USB flash drive, a mobile hard disk, a disk or an optical disk.

[0099] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0100] Those of ordinary skill in the art will appreciate that the modules and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0101] In the embodiments provided in the present application, it should be understood that the disclosed terminal device and method can be implemented in other ways. For example, the terminal device embodiments described above are only schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules, which can be electrical, mechanical or other forms.

[0102] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A method for authorizing access rights, characterized in that: Applied to a terminal device, the method comprises: In response to the permission authorization instruction of the target application, obtaining access information of the target application and entering it into the authorization information; the authorization information is used to record the application with file access rights; The authorization information is stored in a permission controller; the permission controller is used to receive a file access instruction from the target application, determine the file access permission of the target application according to the authorization information, and return the authorization result of the file access permission to the target application.

2. The method for authorizing access rights according to claim 1, characterized in that: The step of obtaining access information of the target application and entering the access information into the authorization information in response to the permission authorization instruction of the target application includes: In response to the permission authorization instruction of the target application, acquiring an application identifier of the target application and metadata information of the target file indicated by the permission authorization instruction; The application identification of the target application and the metadata information of the target file are entered into the authorization information.

3. The method for authorizing access rights according to claim 2, characterized in that: The permission controller is further configured to return metadata information of the target file to the target application after determining that the target application has file permissions.

4. The method for authorizing access rights according to claim 2, characterized in that: The metadata information of the target file includes the file name and storage path of the target file.

5. The method for authorizing access rights according to any one of claims 1 to 4, characterized in that: The system layer of the terminal device includes a user space and a kernel space. The target application runs in the user space. The user space is used to respond to the permission authorization instruction of the target application and enter the access information into the authorization information, and send the authorization information to the permission controller; the permission controller runs in the kernel space.

6. The method for authorizing access rights according to claim 5, characterized in that: The user space includes an application layer; the application layer includes at least one target application. After the target application initiates a permission authorization instruction, the application layer forwards the permission authorization instruction and the access information of the target application to the permission manager, and the permission manager is used to manage the authorization information.

7. The method for authorizing access rights according to claim 5, characterized in that: The user space includes a framework layer, and the framework layer includes a permission manager. The permission manager is used to enter the access information of the target application into the authorization information according to the permission authorization instruction, and send the authorization information to the permission controller.

8. A terminal device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method for authorizing access rights according to any one of claims 1 to 7 are implemented.

9. An access rights authorization device, characterized in that: include: An input module, configured to obtain access information of the target application and input the access information into the authorization information in response to the permission authorization instruction of the target application; The authorization information is used to record applications that have file access permissions; The authorization module is used to store the authorization information in the permission controller; the permission controller is used to receive the file access instruction of the target application, determine the file access permission of the target application according to the authorization information, and return the authorization result of the file access permission to the target application.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method for authorizing access rights according to any one of claims 1 to 7 are implemented.

Images