Authority management method and system for debugging function
By using permission management methods on industry-class terminals to generate and manage debugging authorization files, the problem of insufficient security in debugging function control is solved, and higher data security and flexible debugging function management is achieved.
Patent Information
- Application Number
- CN202411881596.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-19
- Publication Date
- 2025-03-28
AI Technical Summary
There is a problem of insufficient security in the debugging function control of existing industry-class terminals. Traditional methods are difficult to flexibly control the debugging function, and illegally obtaining passwords may affect data security.
A permission management method is adopted to work together through the client and the authorization management end to generate and manage debugging authorization files. The target terminal only executes debugging instructions after receiving the legal authorization file.
Improve the security of debugging functions. By generating and managing debugging authorization files, it is difficult to obtain authorization files, ensuring that the terminal cannot execute debugging instructions when it is not authorized, and data security is enhanced.
Smart Images
Figure CN119720152A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of authority management, and in particular to a method and system for authority management for debugging functions. Background Art
[0002] With the development of industry-related equipment such as financial digital services, government affairs and police affairs, more and more intelligent systems such as Android and OpenHarmony are used in industry-related terminals, such as cash registers and government service terminals. Unlike consumer terminals such as mobile phones, these industry-related terminals often cannot allow users to freely turn on USB debugging through the device settings function like consumer terminals after they are released to the market, so that developers can use adb commands (Android Debug Bridge) or hdc commands (HarmonyOS device connector) to debug the terminal. Therefore, the current common practice is to hide the switch for developer debugging in the industry-related terminal, and the debugging function can only be turned on in a specific way. However, this control method is not flexible enough, and each time the debugging function is turned on, a specific method needs to be repeated; or a specific password needs to be entered before the setting menu is entered to turn on the debugging function. However, under this control method, if the password is illegally obtained, it will affect the data security of the terminal, and there is a problem of insufficient control. Summary of the invention
[0003] The technical problem to be solved by the present invention is to provide a method and a terminal for managing the rights of a debugging function, which can improve the security of the debugging function management and control.
[0004] In order to solve the above technical problems, a technical solution adopted by the present invention is: A method for managing permissions for debugging functions, comprising: The client terminal obtains the terminal information of the target terminal in response to the user's permission application instruction, and sends the terminal information to the authorization management terminal to apply for the user's debugging permission for the target terminal; The authorization management end determines whether the user has the user authority to apply for the debugging authority according to the terminal information, and if so, generates a debugging authorization file according to the terminal information, and sends the debugging authorization file to the client; The client writes the debugging authorization file into the target terminal, so that the target terminal confirms whether to execute the debugging instruction sent by the user based on the debugging authorization file.
[0005] In order to solve the above technical problems, another technical solution adopted by the present invention is: A rights management system for debugging functions, comprising a client, an authorization management terminal and a target terminal, wherein the client comprises a first memory, a first processor and a first computer program stored in the first memory and running on the first processor; the authorization management terminal comprises a second memory, a second processor and a second computer program stored in the second memory and running on the second processor; the target terminal comprises a third memory, a third processor and a third computer program stored in the third memory and running on the third processor; The first processor executes the first computer program to implement the steps performed by the client of the above-mentioned method for managing rights for debugging functions; The second processor implements the steps performed by the authorization management end of the above-mentioned method for managing rights for debugging functions when executing the second computer program; The third processor executes the third computer program to implement the steps performed by the target terminal of the above-mentioned method for managing rights for debugging functions.
[0006] The beneficial effect of the present invention is that after receiving the user's permission application instruction, the client will apply to the authorization management end for the user's debugging permission for the target terminal. The authorization management end will first verify whether the user has the user permission to apply for debugging permission. If the user has the user permission to apply for debugging permission, the authorization management end will generate a debugging authorization file. After the client writes the debugging authorization file to the target terminal, the target terminal will determine whether to execute the user's debugging instruction based on the debugging authorization file. Compared with the traditional debugging permission management method, the present invention controls the debugging function of the target terminal by generating a debugging authorization file. Since it is difficult to illegally obtain the debugging authorization file, and the target terminal cannot execute the relevant debugging instructions when the debugging authorization file is not written, the security of debugging function control is effectively improved. BRIEF DESCRIPTION OF THE DRAWINGS
[0007] Figure 1 A flowchart of a method for managing permissions for debugging functions provided by an embodiment of the present invention; Figure 2 A schematic diagram of a permission management dimension provided by an embodiment of the present invention; Figure 3 An architectural diagram of a method for managing permissions for debugging functions provided by an embodiment of the present invention; Figure 4 A flowchart of a method for querying the authorized duration of a terminal provided by an embodiment of the present invention; Figure 5 A flowchart of a method for a user to write an authorization file provided by an embodiment of the present invention; Figure 6A flowchart of a method for executing a debugging instruction by a terminal provided by an embodiment of the present invention; Figure 7 A schematic diagram of a distribution controllable terminal interface provided by an embodiment of the present invention; Figure 8 A schematic diagram of an authorized display interface of a terminal provided in an embodiment of the present invention; Fig. 9 A schematic diagram of an unauthorized display interface of a terminal provided by an embodiment of the present invention; Fig.10 A schematic diagram of the structure of a permission management system for debugging functions provided by an embodiment of the present invention; Description of labels: 100. A rights management system for debugging function; 101. Client; 102. Authorization management terminal; 103. Target terminal; 1011. First memory; 1021. First processor; 1021. Second memory; 1022. Second processor; 1031. Third memory; 1032. Third processor. DETAILED DESCRIPTION
[0008] In order to explain the technical content, achieved objectives and effects of the present invention in detail, the following is an explanation in conjunction with the implementation modes and the accompanying drawings.
[0009] An embodiment of the present invention provides a method for managing permissions for a debugging function, comprising: The client terminal obtains the terminal information of the target terminal in response to the user's permission application instruction, and sends the terminal information to the authorization management terminal to apply for the user's debugging permission for the target terminal; The authorization management end determines whether the user has the user authority to apply for the debugging authority according to the terminal information, and if so, generates a debugging authorization file according to the terminal information, and sends the debugging authorization file to the client; The client writes the debugging authorization file into the target terminal, so that the target terminal confirms whether to execute the debugging instruction sent by the user based on the debugging authorization file.
[0010] From the above description, it can be seen that the beneficial effect of the present invention is that after receiving the user's permission application instruction, the client will apply to the authorization management end for the user's debugging permission for the target terminal. The authorization management end will first verify whether the user has the user permission to apply for debugging permission. If the user has the user permission to apply for debugging permission, the authorization management end will generate a debugging authorization file. After the client writes the debugging authorization file to the target terminal, the target terminal will determine whether to execute the user's debugging instructions based on the debugging authorization file. Compared with the traditional debugging permission management method, the present invention controls the debugging function of the target terminal by generating a debugging authorization file. Since it is difficult to illegally obtain the debugging authorization file, and the target terminal cannot execute the relevant debugging instructions when the debugging authorization file is not written, the security of debugging function control is effectively improved.
[0011] Furthermore, before the client responds to the user's permission application instruction, it also includes: The client establishes a connection channel with the target terminal, and determines whether the target terminal has a debugging authority management function based on the connection channel; If so, the client obtains the authorized duration of the debugging permission of the target terminal, so that the user determines whether to send a permission application instruction based on the authorized duration.
[0012] As can be seen from the above description, the debugging permission applied by the user has a certain authorization period. If the debugging permission is within the authorization period, the user can debug the target terminal directly without having to use special development tools to open the debugging function or verify the user's permissions every time for debugging, which effectively improves the flexibility of debugging function management and control. In addition, the debugging authorization file written to the target terminal will expire after the authorization period, preventing the debugging authorization file from being illegally obtained, effectively improving the security of the debugging function.
[0013] Furthermore, the terminal information includes a terminal type; Before the client sends the terminal information to the authorization management end to apply for the user's debugging authority for the target terminal, the method further includes: The client sends the terminal type and the debugging function information applied by the user to the authorization management end to obtain the review-free duration of the debugging function information; If the authorization duration applied by the user is longer than the review-free duration, the client submits a review application for the authorization duration to the administrator; If the review is passed, the client sends the terminal information to the authorization management end to apply for the user's debugging authority for the target terminal.
[0014] From the above description, it can be seen that if the authorization duration applied by the user is longer than the exemption period, the administrator needs to review to confirm whether the authorization duration applied by the user is reasonable, so as to avoid the problem that the authorization duration is set too long and the debugging permission cannot be effectively managed.
[0015] Furthermore, the terminal information includes a terminal identification; The authorization management end determines whether the user has the user authority to apply for the debugging authority according to the terminal information, including: The authorization management terminal queries whether the debuggable terminal list of the user contains the terminal identification of the target terminal, and if so, determines that the user has the user authority to apply for the debugging authority.
[0016] From the above description, it can be seen that each user is pre-configured with a corresponding debuggable terminal. Only when the target terminal belongs to the user's debuggable terminal can the user apply for debugging permission. Otherwise, the user cannot apply for debugging permission, thereby improving the control of debugging permission.
[0017] Furthermore, it also includes: The authorization management terminal obtains a first terminal identifier and a second terminal group corresponding to the user from a rights management database, where the second terminal group includes a plurality of second terminal identifiers; The authorization management terminal determines the user group to which the user belongs, and obtains a third terminal identifier and a fourth terminal group corresponding to the user group in the authority management database, wherein the fourth terminal group includes a plurality of fourth terminal identifiers; The authorization management end generates the debuggable terminal list based on the first terminal identifier, the second terminal identifier, the third terminal identifier, and the fourth terminal identifier.
[0018] From the above description, it can be seen that the authorization management end performs multi-dimensional authority management on users and target terminals, that is, it is limited that a certain user can control a specified terminal, a certain user can control a specified terminal group, a certain user group can control a specified terminal, and a certain user group can control a specified terminal group, so that the administrator can flexibly manage users and target terminals. When the terminal identifier of the target terminal exists in the user's authority under any dimension, the user has the user authority to apply for debugging authority.
[0019] Furthermore, the authorization management terminal generates a debugging authorization file according to the terminal information, including: The authorization management end and the file management end perform two-way identity authentication. If the authentication is successful, the file management end generates a debugging authorization file according to the authorization duration and the terminal information, and signs the debugging authorization file.
[0020] From the above description, it can be seen that the authorization management end and the file management end perform two-way identity authentication to ensure the security of data transmission. At the same time, the debugging authorization file is generated based on the file management end, which effectively increases the difficulty of illegal acquisition of the debugging authorization file, and the debugging authorization file is protected by a signature to ensure the data integrity and accuracy of the debugging authorization file.
[0021] Furthermore, it also includes: The authorization management end determines the target location of the debugging authorization file in the target terminal according to the debugging function information and the terminal type, and writes the target location into the debugging authorization file through the file management end.
[0022] As can be seen from the above description, different debugging function information and terminal types determine the writing location of the debugging authorization file in the target terminal, so that the target terminal can control the debugging function based on the debugging authorization file.
[0023] Furthermore, the client writing the debugging authorization file into the target terminal includes: The client generates a write instruction according to the debugging authorization file and sends the instruction to the target terminal; The target terminal verifies the signature of the debugging authorization file according to a preset digital certificate; If the verification is successful, the target terminal parses the debugging authorization file to obtain the target location, and writes the parsed file information into the target location.
[0024] From the above description, it can be seen that when the debugging authorization file is written to the target terminal, the signature needs to be verified to prevent illegal files from being written to the target terminal, thereby ensuring the data security of the target terminal.
[0025] Further, the target terminal confirms whether to execute the debugging instruction sent by the user based on the debugging authorization file, including: The target terminal detects whether the debugging instruction sent by the user is an authorization instruction; If so, confirming whether the debugging instruction is authorized according to the debugging authorization document; If authorized, execute the debugging instruction; If not authorized, the debugging instruction will not be executed.
[0026] From the above description, it can be seen that since some debugging instructions are regular instructions, users are allowed to execute them without authorization. For permission instructions, the target terminal needs to confirm whether the user is authorized before executing the relevant instructions, thereby improving the security of the debugging function.
[0027] Another embodiment of the present invention provides a rights management system for debugging functions, including a client, an authorization management end, and a target terminal, wherein the client includes a first memory, a first processor, and a first computer program stored in the first memory and running on the first processor; the authorization management end includes a second memory, a second processor, and a second computer program stored in the second memory and running on the second processor; the target terminal includes a third memory, a third processor, and a third computer program stored in the third memory and running on the third processor; The first processor executes the first computer program to implement the steps performed by the client of the above-mentioned method for managing rights for debugging functions; The second processor implements the steps performed by the authorization management end of the above-mentioned method for managing rights for debugging functions when executing the second computer program; The third processor executes the third computer program to implement the steps performed by the target terminal of the above-mentioned method for managing rights for debugging functions.
[0028] From the above description, it can be seen that the beneficial effect of the present invention is that after receiving the user's permission application instruction, the client will apply to the authorization management end for the user's debugging permission for the target terminal. The authorization management end will first verify whether the user has the user permission to apply for debugging permission. If the user has the user permission to apply for debugging permission, the authorization management end will generate a debugging authorization file. After the client writes the debugging authorization file to the target terminal, the target terminal will determine whether to execute the user's debugging instructions based on the debugging authorization file. Compared with the traditional debugging permission management method, the present invention controls the debugging function of the target terminal by generating a debugging authorization file. Since it is difficult to illegally obtain the debugging authorization file, and the target terminal cannot execute the relevant debugging instructions when the debugging authorization file is not written, the security of debugging function control is effectively improved.
[0029] The above-mentioned method and system for managing the rights of the debugging function of the present invention can be applied to industry terminals to implement security control of the debugging function, which is described below through specific implementation methods: Please refer to Figure 1 , Embodiment 1 of the present invention is: A method for managing permissions for debugging functions, comprising: S1. In response to a user's permission application instruction, the client obtains terminal information of a target terminal and sends the terminal information to an authorization management terminal to apply for the user's debugging permission for the target terminal.
[0030] It should be noted that the client is physically connected to the target terminal.
[0031] S2. The authorization management end determines whether the user has the user authority to apply for the debugging authority according to the terminal information. If so, a debugging authorization file is generated according to the terminal information, and the debugging authorization file is sent to the client.
[0032] The terminal information includes a terminal identifier.
[0033] Specifically, in step S2, the authorization management end determines whether the user has the user authority to apply for the debugging authority according to the terminal information, including: S21. The authorization management terminal queries whether the debuggable terminal list of the user contains the terminal identification of the target terminal. If so, it is determined that the user has the user authority to apply for the debugging authority.
[0034] Specifically, the authorization management end obtains a first terminal identifier and a second terminal group corresponding to the user in a rights management database, wherein the second terminal group includes multiple second terminal identifiers; the authorization management end determines the user group to which the user belongs, and obtains a third terminal identifier and a fourth terminal group corresponding to the user group in the rights management database, wherein the fourth terminal group includes multiple fourth terminal identifiers; the authorization management end generates the debuggable terminal list based on the first terminal identifier, the second terminal identifier, the third terminal identifier, and the fourth terminal identifier.
[0035] In some embodiments, Figure 2 As shown, the dimensions of permission management between users and terminals include: 1. A certain user can control a specified terminal, that is, one user corresponds to one terminal. 2. A certain user can control a specified terminal group, that is, one user corresponds to multiple terminals. 3. A certain user group can control a specified terminal, that is, multiple users correspond to one terminal. 4. A certain user group can control a specified terminal group, that is, multiple users correspond to multiple terminals.
[0036] In some embodiments, the terminal identifier includes the CPUID (central processing unit identifier) and SN (serial number) of the target terminal. In this embodiment, the terminal identifier used to determine the user's rights is SN. The client sends the user's account information and the SN of the target terminal to the authorization management end. The authorization management end searches the authority management database according to the account information and SN to determine the list of debuggable terminals. Based on the above authority management dimensions, it can be known that when the debuggable terminal of the user in any authority management dimension includes the SN of the target terminal, it can be determined that the user has the user right to apply for debugging rights.
[0037] The terminal information also includes the terminal type.
[0038] Specifically, in step S2, the authorization management terminal generates a debugging authorization file according to the terminal information, including: S22, the authorization management end and the file management end perform two-way identity authentication. If the authentication is successful, the file management end generates a debugging authorization file according to the authorization duration applied by the user and the terminal information, and signs the debugging authorization file.
[0039] In some embodiments, the authorization management end and the file management end perform two-way identity authentication via SSL (Secure Sockets Layer).
[0040] In some embodiments, different signature certificates and signature algorithms are selected according to the terminal type to sign the debugging authorization file. In this way, different certificates and algorithms are used to sign the debugging authorization file according to the characteristics of different terminal types to ensure that the authorization file can be successfully written into the target terminal.
[0041] Specifically, the method further includes: S23: The authorization management end determines a target location of the debugging authorization file in the target terminal according to the debugging function information and the terminal type, and writes the target location into the debugging authorization file through the file management end.
[0042] In some embodiments, the target location includes TEE (Trusted Execution Environment), REE (Regular Execution Environment), and RPMB (Replay Protected Memory Block). Different terminal types can store debug authorization files in different locations. For example, smart devices such as cash registers are configured with TEE, so the debug authorization file can be stored in the TEE. Lightweight devices such as QR code payment terminals are not configured with TEE, so the debug authorization file can only be stored in the REE.
[0043] S3. The client writes the debugging authorization file into the target terminal, so that the target terminal confirms whether to execute the debugging instruction sent by the user based on the debugging authorization file.
[0044] Specifically, in step S3, the client writing the debugging authorization file into the target terminal includes: S31. The client generates a write instruction according to the debugging authorization file and sends the instruction to the target terminal.
[0045] S32: The target terminal verifies the signature of the debugging authorization file according to a preset digital certificate.
[0046] In some embodiments, the target terminal obtains a CA file (digital certificate file) corresponding to the signature of the authorization file, verifies the certificate chain of the signature certificate of the debugging authorization file according to the CA file, and verifies the signature of the debugging authorization file.
[0047] S33: If the verification is successful, the target terminal parses the debugging authorization file to obtain the target location, and writes the parsed file information into the target location.
[0048] In some embodiments, if the writing of the file information is completed, a prompt message is returned to inform the user that the writing of the debugging authorization file is completed.
[0049] Specifically, in step S3, the target terminal confirms whether to execute the debugging instruction sent by the user based on the debugging authorization file, including: S34. The target terminal detects whether the debugging instruction sent by the user is an authorization instruction.
[0050] S35: If yes, confirm whether the debugging instruction is authorized according to the debugging authorization file.
[0051] S36: If authorized, execute the debugging instruction.
[0052] S37: If not authorized, the debugging instruction is not executed.
[0053] Embodiment 2 of the present invention is: A method for managing permissions for debugging functions, which differs from the first embodiment in that: Before step S1, the method further includes: S101: A client creates a connection channel with a target terminal, and determines whether the target terminal has a debugging authority management function based on the connection channel.
[0054] S102: If yes, the client obtains the authorized duration of the debugging permission of the target terminal, so that the user determines whether to send a permission application instruction based on the authorized duration.
[0055] In some embodiments, the authorized duration is the remaining authorized duration of the debugging permission. The user can choose to increase or decrease the authorization duration based on the authorized duration. For example, when the remaining authorization duration of the target terminal cannot support the developer to complete all debugging instructions, the developer can increase the authorization duration and send a permission application instruction based on the increased authorization duration to ensure that the device can execute the developer's debugging instructions. When the developer completes the development and debugging function, the developer needs to reduce the authorization duration before the device is recycled; or, the developer repairs the device or troubleshoots the problem for the user. When the repair or troubleshooting is completed, the developer needs to reduce the authorization duration; send a permission application instruction based on the reduced authorization duration to ensure that the device will not leak out in a debuggable form. When the remaining authorization duration of the target terminal can support the developer to complete all debugging instructions, the developer does not need to adjust the authorization duration, so there is no need to send a permission application instruction, and the developer can directly debug the target terminal.
[0056] Before the client sends the terminal information to the authorization management end to apply for the user's debugging authority for the target terminal, the method further includes: S103: The client sends the terminal type and the debugging function information applied for by the user to the authorization management end to obtain the review-free time length of the debugging function information.
[0057] S104: If the authorization duration applied for by the user is longer than the review-free duration, the client submits a review application for the authorization duration to the administrator.
[0058] If the authorization duration applied by the user is not greater than the review-free duration, the client sends the terminal information to the authorization management end to apply for the user's debugging authority for the target terminal.
[0059] S105: If the audit is passed, the client sends the terminal information to the authorization management end to apply for the user's debugging authority for the target terminal.
[0060] In some embodiments, after the review is passed, the client will send a notification to the user's registered mobile phone number. After receiving the notification, the user sends the terminal information to the authorization management end based on the client to apply for the user's debugging permission for the target terminal.
[0061] Please refer to Figures 3 to 9 , Embodiment 3 of the present invention is: The permission management method for debugging function in the above-mentioned embodiment 2 is applied in actual scenarios.
[0062] like Figure 3As shown, the target terminal includes an operation and maintenance module, a rights management module, and a debugging execution module. The operation and maintenance module communicates with the client based on a specific protocol to implement functions such as querying the debugging rights management function and transmitting data instructions. The rights management module is used to implement functions such as writing authorized files and querying authorization information. The debugging execution module adds a permission detection function for debugging instructions based on the native adb / hdc module. When the client does not have debugging permissions, only specific adb / hdc instructions are allowed to execute.
[0063] The authorization management end includes a terminal management module, a user management module, and an authorization management module. The terminal management module is used to implement functions such as input and query of terminal information that needs to be managed. The user management module is used to implement functions such as user registration and login, as well as user grouping, roles, and role authority allocation. The authorization management module is used to implement the setting and authentication of debugging permissions.
[0064] The file management terminal includes an identity authentication module and a file generation module. The identity authentication module is used to authenticate the identity of the authorization management terminal. The file generation module is used to generate authorization files.
[0065] The client is the main interface for user operations and is used to implement functions such as permission application, management, and writing authorized files to the terminal.
[0066] Specifically, Figures 4 to 6 Shown include: Step 1: The user applies for account registration through the user management module of the authorization management terminal. The administrator reviews the user's account registration application and pre-assigns a user group and a controllable terminal to the user. The interface for the administrator to pre-assign a controllable terminal to the user is as follows: Figure 7 shown.
[0067] Step 2: The user logs in to the account through the client, and the client is physically connected to the terminal.
[0068] Step 3: The client queries the terminal through the operation and maintenance module of the terminal whether the terminal supports the debugging permission management function. If the terminal does not support it, the process ends; if the terminal supports it, execute step 4.
[0069] Step 4: The client queries and parses the authorization information through the terminal's operation and maintenance module and the authority management module to obtain the remaining authorization time for the debugging authority. If the terminal has been authorized, the remaining authorization time is displayed, such as Figure 8 If the terminal is not authorized, the unauthorized prompt page will be displayed, such as Fig. 9 As shown, the user is prompted to write the authorization file to the terminal, that is, execute the following steps 5 to 15.
[0070] Step 5: The user initiates a permission application instruction on the client based on the applied authorization duration and current account information, and the client obtains the CPUID, SN and model of the terminal through the terminal's operation and maintenance module.
[0071] Step 6: The client queries the review-free time on the authorization management terminal according to the debugging function and terminal model that the user has applied for authorization, and displays the queried review-free time. If the remaining authorization time after the user is added exceeds the review-free time, the subsequent steps can only be performed after the administrator reviews it.
[0072] Step 7: If the remaining authorization time after the user is added does not exceed the review-free time or the review-free time application has been approved, the client sends the CPUID, SN, and account information to the authorization management end and applies for the authorization file.
[0073] Step 8: The authorization management terminal detects whether the user has the user authority to write the authorization file to the terminal. If the user has the user authority, the authorization management terminal applies to the file management terminal for the authorization file.
[0074] Step 9: The authorization management end and the file management end authenticate the identities of both parties through SSL two-way authentication.
[0075] Step 10: The authorization management terminal sends the CPUID, SN, the requested authorization duration, and the location where the authorization file needs to be written to the file management terminal. The location where the authorization file needs to be written is determined by the authorization management terminal based on the requested debugging function and terminal model, and can be written to REE, TEE, or RPMB.
[0076] Step 11: The file management terminal writes the terminal's CPUID, SN, authorization time, and the writing location of the authorization file into the authorization file, and signs the authorization file.
[0077] Step 12: The signed authorization file is sent back to the client.
[0078] Step 13: The client sends an authorization file write instruction to the operation and maintenance module of the terminal.
[0079] Step 14: The operation and maintenance module of the terminal calls the authority management module to verify the certificate chain of the signature certificate of the authorization file according to the preset CA file, and verifies the signature of the authorization file.
[0080] Step 15: If the signature verification is passed, the rights management module parses the content of the authorization file and writes the parsed authorization file to the corresponding location according to the writing location of the authorization file. After the writing is completed, the writing result is returned.
[0081] Step 16: The user enters a debugging instruction on the command line page of the instruction initiator. After receiving the debugging instruction, the debugging execution module of the terminal determines whether the debugging instruction is an authorized instruction.
[0082] Step 17: If the debugging instruction is not an authorized instruction, the debugging execution module of the terminal executes the debugging instruction.
[0083] Step 18. If the debugging instruction is an authorization instruction, the terminal's authorization management module checks the authorization file to confirm whether the debugging instruction is authorized. If authorized, the terminal's debugging execution module executes the debugging instruction and returns execution success information to the client. If not authorized, the terminal's debugging execution module does not execute the debugging instruction and returns execution error information to the client.
[0084] Please refer to Fig.10 , Embodiment 4 of the present invention is: A rights management system 100 for debugging function, comprising a client 101, an authorization management terminal 102 and a target terminal 103, wherein the client 101 comprises a first memory 1011, a first processor 1012 and a first computer program stored in the first memory 1011 and running on the first processor 1012; the authorization management terminal 102 comprises a second memory 1021, a second processor 1022 and a second computer program stored in the second memory 1021 and running on the second processor 1022; the target terminal 103 comprises a third memory 1031, a third processor 1032 and a third computer program stored in the third memory 1031 and running on the third processor 1032; When the first processor 1012 executes the first computer program, the steps performed by the client of the method for managing the rights of the debugging function in the first to third embodiments are implemented; When the second processor 1022 executes the second computer program, the steps performed by the authorization management end of the method for managing the rights of the debugging function in embodiments 1 to 3 are implemented; When the third processor 1032 executes the third computer program, the steps performed by the target terminal of the method for managing the rights of the debugging function according to the first to third embodiments are implemented.
[0085] In summary, the present invention provides a method and system for managing the rights of debugging functions, which manages the debugging rights of the terminal by writing an authorization file. When a user needs to debug a terminal, the terminal can be checked to determine whether it is within the authorization time by checking the authorization file of the terminal. If the terminal is within the authorization time, the user's use of adb / hdc instructions is consistent with the native situation, and no special development tools are required or every time debugging is required, and no permission verification is required for each debugging, which effectively improves the flexibility and convenience of debugging function management. If the terminal is not within the authorization time, the user can apply for debugging rights from the authorization management end, and the authorization management end will first verify whether the user has the user rights to apply for debugging rights. If the user has the user rights to apply for debugging rights, the authorization management end will generate an authorization file for the user to write to the terminal, and the terminal will determine whether to execute the user's debugging instructions based on the written authorization file. Since the authorization file is protected by a signature, only a legitimate management end can sign the authorization file, effectively ensuring the security of the authorization file. Compared with the traditional debugging permission management method, the present invention controls the debugging function of the terminal by generating an authorization file. Since it is difficult to illegally obtain the authorization file, and the target terminal cannot execute related debugging instructions when the debugging authorization file is not written, the security of debugging function management is effectively improved.
[0086] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent transformations made using the contents of the present invention's specification and drawings, or directly or indirectly applied in related technical fields, are also included in the patent protection scope of the present invention.
Claims
1. A method for managing the rights of a debugging function, characterized in that: include: The client terminal obtains the terminal information of the target terminal in response to the user's permission application instruction, and sends the terminal information to the authorization management terminal to apply for the user's debugging permission for the target terminal; The authorization management end determines whether the user has the user authority to apply for the debugging authority according to the terminal information, and if so, generates a debugging authorization file according to the terminal information, and sends the debugging authorization file to the client; The client writes the debugging authorization file into the target terminal, so that the target terminal confirms whether to execute the debugging instruction sent by the user based on the debugging authorization file.
2. The method according to claim 1, characterized in that Before the client responds to the user's permission application instruction, it also includes: The client establishes a connection channel with the target terminal, and determines whether the target terminal has a debugging authority management function based on the connection channel; If so, the client obtains the authorized duration of the debugging permission of the target terminal, so that the user determines whether to send a permission application instruction based on the authorized duration.
3. The method according to claim 1, characterized in that The terminal information includes the terminal type; Before the client sends the terminal information to the authorization management end to apply for the user's debugging authority for the target terminal, the method further includes: The client sends the terminal type and the debugging function information applied by the user to the authorization management end to obtain the review-free duration of the debugging function information; If the authorization duration applied by the user is longer than the review-free duration, the client submits a review application for the authorization duration to the administrator; If the review is passed, the client sends the terminal information to the authorization management end to apply for the user's debugging authority for the target terminal.
4. The method according to claim 1, characterized in that: The terminal information includes a terminal identifier; The authorization management end determines whether the user has the user authority to apply for the debugging authority according to the terminal information, including: The authorization management terminal queries whether the debuggable terminal list of the user contains the terminal identification of the target terminal, and if so, determines that the user has the user authority to apply for the debugging authority.
5. The method according to claim 4, characterized in that Also includes: The authorization management terminal obtains a first terminal identifier and a second terminal group corresponding to the user from a rights management database, where the second terminal group includes a plurality of second terminal identifiers; The authorization management terminal determines the user group to which the user belongs, and obtains a third terminal identifier and a fourth terminal group corresponding to the user group in the authority management database, wherein the fourth terminal group includes a plurality of fourth terminal identifiers; The authorization management end generates the debuggable terminal list based on the first terminal identifier, the second terminal identifier, the third terminal identifier, and the fourth terminal identifier.
6. The method according to claim 3, characterized in that The authorization management end generates a debugging authorization file according to the terminal information, including: The authorization management end and the file management end perform two-way identity authentication. If the authentication is successful, the file management end generates a debugging authorization file according to the authorization duration and the terminal information, and signs the debugging authorization file.
7. The method according to claim 6, characterized in that Also includes: The authorization management end determines the target location of the debugging authorization file in the target terminal according to the debugging function information and the terminal type, and writes the target location into the debugging authorization file through the file management end.
8. The method according to claim 7, characterized in that The client writing the debugging authorization file into the target terminal includes: The client generates a write instruction according to the debugging authorization file and sends the instruction to the target terminal; The target terminal verifies the signature of the debugging authorization file according to a preset digital certificate; If the verification is successful, the target terminal parses the debugging authorization file to obtain the target location, and writes the parsed file information into the target location.
9. The method according to claim 1, characterized in that: The target terminal confirming whether to execute the debugging instruction sent by the user based on the debugging authorization file includes: The target terminal detects whether the debugging instruction sent by the user is an authorization instruction; If so, confirming whether the debugging instruction is authorized according to the debugging authorization document; If authorized, executing the debugging instruction; If not authorized, the debugging instruction will not be executed.
10. A rights management system for debugging functions, comprising a client, an authorization management terminal and a target terminal, wherein the client comprises a first memory, a first processor and a first computer program stored in the first memory and running on the first processor; the authorization management terminal comprises a second memory, a second processor and a second computer program stored in the second memory and running on the second processor; the target terminal comprises a third memory, a third processor and a third computer program stored in the third memory and running on the third processor; characterized in that: The first processor implements the steps performed by the client of the method for managing rights for debugging functions as described in any one of claims 1 to 9 when executing the first computer program; The second processor implements the steps performed by the authorization management end of the method for managing rights for debugging functions as described in any one of claims 1 to 9 when executing the second computer program; When the third processor executes the third computer program, the steps performed by the target terminal of the method for managing rights for debugging functions described in any one of claims 1 to 9 are implemented.