Device authorization method, apparatus, equipment, medium and product

Abstract

The embodiment of the present application provides a device authorization method, apparatus, device, medium and product, the device authorization method is applied to a first device, a debugging bridge is deployed in the first device, the method comprises: obtaining access information of a second device to access the first device through the debugging bridge; determining the communication mode between the second device and the first device based on the access information through the debugging bridge; granting the second device access to the first device through the debugging bridge when the access information is verified based on a preset verification strategy, the preset verification strategy is associated with the communication mode. The embodiment of the present application effectively solves the problem that the Android device has unauthorized access or potential attacks, resulting in low security of the Android device.

Description

Technical Field

[0001] The present application belongs to the technical field of vehicle-mounted terminals and operating systems, and in particular, relates to a device authorization method, apparatus, equipment, medium and product. Background Art

[0002] Android Debug Bridge (ADB) is a command-line tool used to communicate and debug between computers and Android devices. Since ADB allows computers to debug Android devices through command lines, it is possible to access any data on Android devices and perform malicious operations through ADB, which leads to low security of Android devices. Summary of the invention

[0003] The embodiments of the present application provide a device authorization method, apparatus, device, medium and product, which solve the problem of low security of Android devices caused by the ability to access any data on the Android device or perform malicious operations through ADB in the prior art.

[0004] In a first aspect, an embodiment of the present application provides a device authorization method, which is applied to a first device, in which a debug bridge is deployed, and the device authorization method includes:

[0005] Acquire access information of the second device accessing the first device through the debugging bridge;

[0006] Determining, by the debug bridge, a communication mode between the second device and the first device based on the access information;

[0007] When it is determined that the access information verification is passed based on a preset verification policy, the second device is granted permission to access the first device through the debug bridge, and the preset verification policy is associated with the communication method.

[0008] In a second aspect, a device authorization apparatus is provided. The device authorization apparatus is applied to a first device, a debugging bridge is deployed in the first device, and the device authorization apparatus includes:

[0009] An acquisition module, used for acquiring access information of the second device accessing the first device through the debug bridge;

[0010] A determination module, configured to determine a communication mode between the second device and the first device based on the access information through the debug bridge;

[0011] The granting module is used to grant the second device access to the first device through the debugging bridge when it is determined that the access information verification is passed based on a preset verification policy, and the preset verification policy is associated with the communication method.

[0012] In a third aspect, an electronic device is provided, comprising: a memory for storing computer program instructions; and a processor for reading and running the computer program instructions stored in the memory to execute the device authorization method provided in any optional implementation manner in the first aspect.

[0013] In a fourth aspect, a computer storage medium is provided, on which computer program instructions are stored, and when the computer program instructions are executed by a processor, a device authorization method provided by any optional implementation in the first aspect is implemented.

[0014] In a fifth aspect, a computer program product is provided. The computer program product includes a computer program. When the computer program is executed by a processor, the device authorization method provided by any optional implementation method in the first aspect is implemented.

[0015] In an embodiment of the present application, a first device with a debug bridge deployed thereon can be used to obtain access information of the second device accessing the first device through the debug bridge, and the debug bridge can be used to determine the communication method between the second device and the first device based on the access information, and then the debug bridge can be used to grant the second device access to the first device when the access information is verified based on a preset verification policy associated with the communication method. In this way, the access information of the second device accessing the first device can be verified through the verification policy associated with the communication method between the second device and the first device, and when the verification is passed, the second device is granted access rights for the second device to access the first device, thereby avoiding unauthorized access or potential attacks, thereby improving the security of Android devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solution of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0017] Figure 1 It is a flowchart of a device authorization method provided in an embodiment of the present application;

[0018] Figure 2 It is a flowchart of a method for determining whether access information verification is passed in a device authorization method provided in an embodiment of the present application;

[0019] Figure 3 It is a flowchart of another method for determining whether access information verification is passed in a device authorization method provided in an embodiment of the present application;

[0020] Figure 4It is a flowchart of a method for obtaining a first rule chain after association in a device authorization method provided in an embodiment of the present application;

[0021] Figure 5 It is a flowchart of a specific implementation method of a device authorization method provided in an embodiment of the present application;

[0022] Figure 6 This is an example diagram of a device authorization method provided in an embodiment of the present application;

[0023] Figure 7 It is a scenario diagram of a device authorization method provided in an embodiment of the present application;

[0024] Figure 8 It is a structural diagram of a device authorization apparatus provided in an embodiment of the present application;

[0025] Fig. 9 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0026] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present application, rather than to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is only to provide a better understanding of the present application by illustrating the examples of the present application.

[0027] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "include..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0028] The term "and / or" in this article is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone.

[0029] As described in the background technology, in real life, there may be situations where the ADB is used to access any data on an Android device or to perform malicious operations, for example, the ADB is started through the network, physical serial port, or built-in applications of the Android device to obtain any data on the Android device or to execute malicious programs. This results in a low security of the Android device.

[0030] In response to the above problems, physical serial ports such as Universal Serial Bus (USB) are generally prohibited from connecting to other operating systems as slave devices from the driver side, thereby preventing the acquisition of information in Android devices through USB operation debug bridge. Although this method can prevent external devices from connecting to the Android platform debug bridge in the system through USB at the physical level, it cannot prevent malicious applications in the car computer from using built-in ADB clients to connect to the Android platform debug bridge in the system through sockets. This solution still has security risks.

[0031] Alternatively, the prior art will choose to remove the services related to the Android platform debug bridge from the Android system, and use a "one-size-fits-all" approach to solve the security issues of the Android platform debug bridge. This can prevent both the connection to the Android platform debug bridge via USB and the connection to the Android platform debug bridge via the network. However, if a "one-size-fits-all strategy" is adopted to completely remove the Android platform debug bridge, although the security issue is solved, many technical solutions that rely on the Android platform debug bridge cannot be implemented. At the same time, system suppliers and OEMs cannot diagnose and debug the system through the Android platform debug bridge after the vehicle is mass-produced, which is a "throwing the baby out with the bathwater". This solution is still not perfect.

[0032] In order to solve the above problems, the embodiments of the present application provide a device authorization method, apparatus, device, medium and product. The device authorization method provided by the embodiments of the present application can use a first device with a debug bridge deployed to obtain the access information of the second device accessing the first device through the debug bridge, and determine the communication mode between the second device and the first device based on the access information through the debug bridge, and then grant the second device access to the first device through the debug bridge when the access information is verified based on a preset verification policy associated with the communication mode. In this way, the access information of the second device accessing the first device can be verified through the verification policy associated with the communication mode between the second device and the first device, and when the verification is passed, the second device is granted access rights for the second device to access the first device, thereby avoiding unauthorized access or potential attacks, thereby improving the security of Android devices.

[0033] The device authorization method provided in the embodiment of the present application is described in detail below with reference to the accompanying drawings.

[0034] Figure 1 It is a flow chart of a device authorization method provided in an embodiment of the present application.

[0035] like Figure 1 As shown, the execution subject of the method may be a first device, in which a debugging bridge is deployed. Based on this, the device authorization method may specifically include the following steps:

[0036] S110: Obtain access information of the second device accessing the first device through the debug bridge.

[0037] The access information may be the relevant information sent by the second device when accessing the first device, which is not limited here. In addition, the first device may be an Android device, and accordingly, the debug bridge may be a debug bridge for the Android platform, and the second device may be an electronic device that needs to access the Android device to obtain relevant information or perform operations, which is not limited here.

[0038] S120, determining, through the debug bridge, a communication mode between the second device and the first device based on the access information.

[0039] The communication method between the second device and the first device may be a wired communication method or a wireless communication method, which is not specifically limited here.

[0040] S130: When it is determined based on a preset verification policy that the access information verification is successful, granting the second device access to the first device through a debug bridge.

[0041] The preset verification strategy may be a verification strategy pre-set based on actual experience or circumstances, which is not specifically limited here. In addition, the preset verification strategy may be associated with the communication method, that is, different communication methods have different corresponding preset verification strategies.

[0042] Specifically, the first device can obtain the access information of the second device to the first device through the debugging bridge, and determine the communication method between the second device and the first device based on the access information through the debugging bridge, and then use the preset verification strategy associated with the above communication method to determine whether the access information is an authorized access. If the access information is determined to be an authorized access, that is, when the preset verification strategy determines that the access information is verified, the second device can be granted permission to access the first device through the debugging bridge, so that the second device can subsequently access the first device to obtain relevant data or perform certain operations.

[0043] In an embodiment of the present application, a first device with a debug bridge deployed thereon can be used to obtain access information of the second device accessing the first device through the debug bridge, and the debug bridge can be used to determine the communication method between the second device and the first device based on the access information, and then the debug bridge can be used to grant the second device access to the first device when the access information is verified based on a preset verification policy associated with the communication method. In this way, the access information of the second device accessing the first device can be verified through the verification policy associated with the communication method between the second device and the first device, and when the verification is passed, the second device is granted access rights for the second device to access the first device, thereby avoiding unauthorized access or potential attacks, thereby improving the security of Android devices.

[0044] In order to accurately determine the communication mode between the second device and the first device, and further determine a preset verification strategy associated with the communication mode, so as to accurately verify the access information, in one embodiment, the access information may include an information type. Based on this, the S120 specifically includes:

[0045] The debugging bridge matches the information type of the access information based on the correspondence between the preset information type and the communication mode to obtain the communication mode between the second device and the first device.

[0046] The correspondence between the above-mentioned preset information types and communication methods may be preset based on actual experience or circumstances, and is not specifically limited here.

[0047] Specifically, since the access information of the second device accessing the first device may include information type, the first device can match the information type of the access information based on the correspondence between the preset information type and the communication method through the debugging bridge to obtain the communication method between the second device and the first device.

[0048] In one example, if the communication mode can include a wireless communication mode and a wired communication mode, based on this, if the information type in the above access information is a network type, then based on the correspondence between the preset information type and the communication mode, it can be determined that the communication mode corresponding to the network type is a wireless communication mode.

[0049] In another example, if the information type in the access information is an electrical signal type, it can be determined that the communication mode corresponding to the electrical signal type is a wired communication mode based on the correspondence between the preset information type and the communication mode.

[0050] In this embodiment, the debugging bridge can match the information type in the access information based on the correspondence between the preset information type and the communication method, so as to accurately determine the communication method between the second device and the first device, and then facilitate the subsequent determination of the preset verification strategy associated with the communication method for accurately verifying the access information.

[0051] Based on this, in one embodiment, if the above communication mode is a wired communication mode, before the above S130, if Figure 2 As shown, the device authorization method provided in the embodiment of the present application may specifically include:

[0052] S210: Read access attribute information from the first device through the debug bridge.

[0053] S220: When the access attribute information is the target attribute information, determine through the debug bridge whether the access information verification is successful.

[0054] The access attribute information is used to determine whether the second device can access the first device via wired communication to obtain relevant data or perform operations. Based on this, the target attribute information can be used to indicate that the second device is allowed to access the first device via the wired communication.

[0055] Specifically, in the case where the communication method can be a wired communication method, after the first device receives the access information of the second device accessing the first device through the debugging bridge, the first device can read the access attribute information from the first device through the debugging bridge, and then determine whether the access attribute information is the target attribute information. If the access attribute information is the target attribute information, it indicates that the second device can access the first device, and the access information verification is determined to be successful through the debugging bridge.

[0056] It should be noted that, when the access attribute information is not the target attribute information, it indicates that the second device is not allowed to access the first device. In this case, the first device can perform subsequent operations, for example, start the initialization of the Socket Server.

[0057] In this embodiment, when the communication mode is a wired communication mode, access attribute information can be read from the first device, and the access information can be accurately verified using the access attribute information, so that access rights can be granted to the second device when the verification is passed, so that the second device can access the first device, thereby avoiding unauthorized access or potential attacks, thereby improving the security of the Android device.

[0058] In another embodiment, when the communication mode may include a wireless communication mode, the access information may include an access identifier. Based on this, before the above S130, Figure 3 As shown, the device authorization method provided in the embodiment of the present application may also include the following steps:

[0059] S310: Verify the access identifier based on a preset accessible identifier through a debug bridge.

[0060] S320: When the preset accessible identifier includes an access identifier, determine through the debug bridge whether the access information verification is successful.

[0061] Among them, the preset accessible identifier may be pre-set based on actual experience or circumstances, and the preset accessible identifier may include multiple identifiers, which are not specifically limited here.

[0062] Specifically, if the communication method between the second device and the first device is a wireless communication method, the access information of the second device accessing the first device may include an access identifier. Based on this, after the first device obtains the access information of the second device accessing the first device through the debugging bridge, the access identifier can be verified through the debugging bridge based on a preset accessible identifier. If the preset accessible identifier can include the access identifier, the access information verification information can be determined through the debugging bridge.

[0063] It should be noted that if the above-mentioned second device is a server applied in the first device, the above-mentioned access identifier is a user identifier (User Identifier, UID); if the above-mentioned second device is other devices independent of the first device, the above-mentioned access identifier can be the Internet Protocol (Internet Protocol, IP) address of the second device.

[0064] In this embodiment, when the communication mode is a wireless communication mode, the access identifier in the access information can be accurately verified through a preset accessible identifier, so that when the verification is passed, access rights can be granted to the second device for the second device to access the first device, thereby avoiding unauthorized access or potential attacks, thereby improving the security of the Android device.

[0065] Based on this, in the above embodiment, when the communication mode is a wireless communication mode, it is necessary to use a preset accessible identifier to verify the access identifier in the access information. Thus, in one embodiment, Figure 4 As shown, before verifying the access identifier based on the preset accessible identifier, the device authorization method provided in the embodiment of the present application may further include:

[0066] S410: Determine, through the debugging bridge, a first rule chain in the firewall tool for processing access information.

[0067] S420: Create a second rule chain for carrying a preset accessible identifier through a debugging bridge.

[0068] S430: Associating the second rule chain with the first rule chain through the debugging bridge to obtain the associated first rule chain.

[0069] Among them, the above-mentioned firewall tool can be deployed in the first device, which is not specifically limited here. It should be noted that the above-mentioned first rule chain can be a built-in chain in the firewall tool, which is used to process the received access information, and the first rule chain can be an INPUT chain in the firewall tool. The above-mentioned second rule chain can be a rule chain set based on user needs. For example, the second rule chain can be an OEM-in chain. Both the first rule chain and the second rule chain can include multiple rules, which are not specifically limited here. It should also be noted that the above-mentioned second rule chain can be a child chain of the first rule chain, that is, there is a parent-child relationship between the first rule chain and the second rule chain, or it can be understood that the process of associating the second rule chain to the first rule chain is the process of creating a parent-child relationship between the first rule chain and the second rule chain.

[0070] In addition, the associated first rule chain may include a preset accessible identifier.

[0071] Specifically, the first device can determine the first rule chain for processing access information in the firewall tool through the debugging bridge, and create a second rule chain for carrying the above-mentioned preset accessible identifier through the debugging bridge, and then associate the second rule chain with the first rule chain through the debugging bridge to obtain the associated first rule chain.

[0072] It should be noted that since the firewall tool also includes other built-in chains, and the above-mentioned first rule chain can also include chains created by other users, such as the fw-INPUT chain and the bw-INPUT chain, the firewall tool can only be started to verify the access information after the rules are written to all rule chains.

[0073] Furthermore, it should be noted that network communication in Android is managed by the Network Daemon (Network Daemon, netd). In the initialization process, the Android platform debug bridge will wait for the completion of netd initialization. In the summary of the netd initialization process, the Android firewall program (Iptables) will be called to configure the firewall rules. In this way, the device authorization method provided in the embodiment of the present application can create a firewall INPUT subchain through netd in this process, and write the accessible identifier of the Android device into the oem-in subchain through the Android platform debug bridge using the sh script, and then the oem-in subchain can be added to the INPUT chain through the Android platform debug bridge to obtain the associated INPUT chain. In addition, after completing the above operations, the Android platform debug bridge can be notified to allow the Android platform debug bridge to continue to complete the initialization operation.

[0074] In this embodiment, the first rule chain for processing access information in the firewall tool can be determined through the debugging bridge, and the second rule chain for carrying the preset accessible identifier can be created through the debugging bridge, and then the second rule chain can be associated with the first rule chain through the debugging bridge, and the associated first rule chain includes the preset accessible identifier. In this way, when receiving access information, the first rule chain in the firewall tool can be called to accurately verify the access information.

[0075] In addition, in order to accurately create a second rule chain for carrying a preset accessible identifier through the debug bridge, in one embodiment, Figure 5 As shown, the step of creating a second rule chain for carrying a preset accessible identifier through the debug bridge includes:

[0076] S510: Create a second rule chain through the debugging bridge.

[0077] S520: Clear the rules in the second rule chain through the debugging bridge.

[0078] S530: Write the preset accessible identifier into the second rule chain through the debugging bridge.

[0079] Specifically, the first device can create a second rule chain through the debugging bridge, and clear the rules in the second rule chain through the debugging bridge, and then write a preset accessible identifier into the second rule chain through the debugging bridge, so that a second rule chain carrying the preset accessible identifier can be obtained.

[0080] In this embodiment, a second rule chain can be created through the debug bridge, and all rules in the second rule chain are cleared first, and then a preset accessible identifier is written. In this way, the accuracy of the rules contained in the second rule chain is ensured, so that when access information is received later, the first rule chain in the firewall tool can be called to accurately verify the access information.

[0081] In order to accurately and in detail describe the device authorization method provided in the embodiment of the present application, in one embodiment, the device authorization method provided in the embodiment of the present application may further include the following steps:

[0082] Send a download request to the cloud device through the debug bridge;

[0083] Receive download information sent by the cloud device through the debug bridge;

[0084] Update the information corresponding to the download information through the debug bridge.

[0085] The information may include at least one of the execution program information to be updated and the accessible identifier to be updated.

[0086] Specifically, the first device may send a download request to the cloud device through the debugging bridge, and then receive the download information sent by the cloud device through the debugging bridge, and update the information corresponding to the download information through the debugging bridge.

[0087] It should be noted that before sending a download request to the cloud device through the debug bridge, the cloud device can use the application dedicated to system software upgrades in the first device. The application will pop up an upgrade prompt. After the user agrees, the relevant files can be downloaded from the cloud through the debug bridge and replaced in the vehicle system.

[0088] In this embodiment, a download request can be sent to a cloud device through the debug bridge, and download information sent by the cloud device can be received, and then the information corresponding to the download information can be updated, and the information includes at least one of the executable program information to be updated and the accessible identifier to be updated. In this way, only the system files related to the Android platform debug bridge can be modified. This upgrade method does not need to rely on the upgrade of the entire vehicle, which is fast and safe for end users.

[0089] In another embodiment, the device authorization method provided in the embodiment of the present application may also include the following steps:

[0090] Get the operation information of the debug bridge;

[0091] Stores debug bridge operation information.

[0092] Among them, the above-mentioned operation information can be the operation information of the debugging bridge within a preset time. The preset time can be determined according to actual conditions and is not specifically limited here.

[0093] Specifically, the first device can obtain the operation information of the debug bridge and can store the operation information of the debug bridge. Specifically, the first device can store the operation information of the debug bridge in a local log partition, or upload the operation information of the debug bridge to a cloud device for storage through a remote data collection module in the first device.

[0094] In this embodiment, the operation information of the debug bridge can be acquired and stored, thereby backing up the operation information so that subsequent users can analyze the operation information.

[0095] In order to fully describe the device authorization method provided in the embodiment of the present application, in one embodiment, Figure 6 As shown, the device authorization method provided in the embodiment of the present application may include the following steps:

[0096] S601: Obtain access information of a second device accessing a first device through a debugging bridge.

[0097] S602: Match the information type of the access information based on the correspondence between the preset information type and the communication mode through the debugging bridge to obtain the communication mode between the second device and the first device.

[0098] S603: When the communication mode is a wired communication mode, read access attribute information from the first device through the debug bridge.

[0099] S604: When the access attribute information is the target attribute information, determine through the debug bridge whether the access information verification is successful.

[0100] S605: When the communication mode is a wireless communication mode, verify the access identifier based on a preset accessible identifier through the debug bridge.

[0101] S606: When the preset accessible identifier includes an access identifier, determine through the debug bridge whether the access information verification is successful.

[0102] S607: Grant the second device permission to access the first device through the debug bridge.

[0103] Specifically, the first device can obtain the access information of the second device to access the first device through the debugging bridge, and match the information type of the access information based on the correspondence between the preset information type and the communication mode through the debugging bridge to obtain the communication mode between the second device and the first device. Based on this, if the communication mode is a wireless communication mode, the access attribute information is read from the first device through the debugging bridge, and it is determined whether the access attribute information is the target access attribute. If so, the access information verification is determined to be passed through the debugging bridge, and then the second device can be granted the right to access the first device through the debugging bridge.

[0104] If the above communication method is a wireless communication method, the access identifier is verified based on the preset accessible identifier through the debugging bridge. If the preset accessible identifier includes the access identifier, the debugging bridge determines that the access information verification is successful, and then the debugging bridge grants the second device permission to access the first device.

[0105] In one example, if Figure 7 As shown, device 1 is connected to the vehicle system through the wireless communication method of WebSocket. In this way, if device 1 needs to complete the screen projection through the debugging bridge of the vehicle system, the screen projection application in device 1 can establish communication with the WebSocket Server in the screen projection application of the vehicle system through the WebSocke Client. In this way, the debugging bridge can obtain the access information of device 1 to the vehicle device through the Adb Client in the screen projection application in the vehicle system. The access information includes the application identifier (i.e., access identifier) ​​of the screen projection application of the vehicle system. If the application identifier of the screen projection application of the vehicle system is in the preset accessible identifier in the debugging bridge, the screen projection application of the vehicle system can interact with the debugging bridge through Socket. If the application identifier (i.e., access identifier) ​​of the screen projection application of the vehicle system is not in the preset accessible identifier in the debugging bridge, the screen projection application of the vehicle system cannot interact with the debugging bridge through Socket.

[0106] Continue as Figure 7 As shown, device 2 is connected to the vehicle system via a wired method of Universal Serial Bus (USB). When device 2 is connected to the vehicle system via USB, the vehicle system can obtain the access information of device 2 to the vehicle system through the debug bridge via the USB driver, and then read the access attribute information of the vehicle system through the debug bridge to determine whether the access attribute information of the vehicle system allows device 2 to access the vehicle system. If it is determined that the access attribute information of the vehicle system allows device 2 to access the vehicle system, the debug bridge can grant device 2 access to the vehicle system. If it is determined that the access attribute information of the vehicle system does not allow device 2 to access the vehicle system, the debug bridge can deny device 2 access.

[0107] In this embodiment, the access information of the second device accessing the first device can be verified through a verification policy associated with the communication method between the second device and the first device, and if the verification passes, the second device is granted access rights for accessing the first device, thereby avoiding unauthorized access or potential attacks, thereby improving the security of the Android device.

[0108] Based on the same inventive concept, the embodiment of the present application also provides a device authorization device, which can be applied to a first device, the first device is deployed with a debugging bridge, specifically in combination with Figure 8 The device authorization apparatus provided in the embodiment of the present application is described in detail.

[0109] Figure 8 It is a structural diagram of a device authorization apparatus provided in an embodiment of the present application.

[0110] like Figure 8 As shown, the device authorization apparatus 800 may include:

[0111] An acquisition module 810 is used to acquire access information of the second device accessing the first device through the debug bridge;

[0112] A determination module 820, configured to determine a communication mode between the second device and the first device based on the access information through the debug bridge;

[0113] The granting module 830 is used to grant the second device access to the first device through the debug bridge when it is determined that the access information verification is passed based on a preset verification policy, and the preset verification policy is associated with the communication method.

[0114] In one embodiment, the access information may include an access type. Based on this, the determination module is specifically configured to:

[0115] The debugging bridge matches the information type of the access information based on the correspondence between the preset information type and the communication mode to obtain the communication mode between the second device and the first device.

[0116] In one embodiment, the above communication mode may be a wired communication mode. Based on this, the device authorization apparatus provided in the embodiment of the present application may further include:

[0117] A reading module, used for reading access attribute information from the first device through the debugging bridge;

[0118] The determination module is also used to determine whether the access information verification is passed through the debugging bridge when the access attribute information is the target attribute information.

[0119] In one embodiment, the communication method may be a wireless communication method, and the access information may be an access identifier. Based on this, the device authorization apparatus provided in the embodiment of the present application may further include:

[0120] A verification module, used to verify the access identifier based on a preset accessible identifier through a debugging bridge;

[0121] The determination module is further used to determine whether the access information verification is passed through the debugging bridge when the preset accessible identifier includes the access identifier.

[0122] In one embodiment, the device authorization apparatus provided by the embodiment of the present application may further include: a determination module, further used to determine a first rule chain for processing access information in a firewall tool through a debugging bridge;

[0123] A creation module, used for creating a second rule chain for carrying a preset accessible identifier through a debugging bridge;

[0124] The association module is used to associate the second rule chain with the first rule chain through the debugging bridge to obtain the associated first rule chain, wherein the associated first rule chain includes a preset accessible identifier.

[0125] In one embodiment, the device authorization apparatus provided in the embodiment of the present application further includes:

[0126] A sending module, used to send a download request to a cloud device via a debug bridge;

[0127] A receiving module, used for receiving download information sent by a cloud device through a debugging bridge;

[0128] The update module is used to update the information corresponding to the download information through the debug bridge, wherein the information includes at least one of the execution program information to be updated and the accessible identifier to be updated.

[0129] In one embodiment, the device authorization apparatus provided in the embodiment of the present application may further include:

[0130] An acquisition module is used to obtain the operation information of the debug bridge;

[0131] The storage module is used to store the operation information of the debug bridge.

[0132] In an embodiment of the present application, a first device with a debug bridge deployed thereon can be used to obtain access information of the second device accessing the first device through the debug bridge, and the debug bridge can be used to determine the communication method between the second device and the first device based on the access information, and then the debug bridge can be used to grant the second device access to the first device when the access information is verified based on a preset verification policy associated with the communication method. In this way, the access information of the second device accessing the first device can be verified through the verification policy associated with the communication method between the second device and the first device, and when the verification is passed, the second device is granted access rights for the second device to access the first device, thereby avoiding unauthorized access or potential attacks, thereby improving the security of Android devices.

[0133] Each module in the device authorization device provided in the embodiment of the present application can be implemented Figures 1 to 6 The method steps of any of the embodiments shown in the figure can achieve the corresponding technical effects, which will not be repeated here for the sake of brevity.

[0134] Fig. 9 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application is shown.

[0135] The electronic device may include a processor 901 and a memory 902 storing computer program instructions.

[0136] Specifically, the processor 901 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0137] The memory 902 may include a large capacity memory for data or instructions. By way of example and not limitation, the memory 902 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive or a combination of two or more of these. In appropriate cases, the memory 902 may include a removable or non-removable (or fixed) medium. In appropriate cases, the memory 902 may be inside or outside the electronic device. In a particular embodiment, the memory 902 is a non-volatile solid-state memory.

[0138] The memory may include read-only memory (ROM), random access memory (RAM), magnetic disk storage media devices, optical storage media devices, flash memory devices, electrical, optical or other physical / tangible memory storage devices. Thus, typically, the memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to an aspect of the present disclosure.

[0139] The processor 901 implements any one of the layout file conversion methods in the above embodiments by reading and executing the computer program instructions stored in the memory 902 .

[0140] In one example, the electronic device may further include a communication interface 903 and a bus 910. Fig. 9 As shown, the processor 901, the memory 902, and the communication interface 903 are connected via a bus 910 and communicate with each other.

[0141] The communication interface 903 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiments of the present application.

[0142] Bus 910 includes hardware, software or both, and the parts of electronic equipment are coupled to each other.For example, but not limitation, bus may include accelerated graphics port (AGP) or other graphics bus, enhanced industrial standard architecture (EISA) bus, front side bus (FSB), hypertransport (HT) interconnection, industrial standard architecture (ISA) bus, infinite bandwidth interconnection, low pin count (LPC) bus, memory bus, micro channel architecture (MCA) bus, peripheral component interconnection (PCI) bus, PCI-Express (PCI-X) bus, serial advanced technology attachment (SATA) bus, video electronics standard association local (VLB) bus or other suitable bus or two or more of these combinations. In appropriate cases, bus 910 may include one or more buses. Although the present application embodiment describes and shows a specific bus, the application considers any suitable bus or interconnection.

[0143] In addition, in combination with the layout file conversion method in the above embodiment, the present application embodiment can provide a computer storage medium to implement. The computer storage medium stores computer program instructions; when the computer program instructions are executed by the processor, the layout file conversion method provided in the present application embodiment is implemented.

[0144] The embodiment of the present application also provides a computer program product, which includes a computer program, and the computer program is executed by a processor to implement the method for layout file conversion provided in the embodiment of the present application.

[0145] It should be clear that the present application is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present application.

[0146] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiment, or in a different order from the embodiment, or several steps can be performed simultaneously.

[0147] The above are only specific implementation methods of the present application. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the protection scope of the present application is not limited to this. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in this application, and these modifications or replacements should be included in the protection scope of this application.

Claims

1. A device authorization method, characterized in that: Applied to a first device, wherein a debugging bridge is deployed in the first device, the method includes: Acquire access information of the second device accessing the first device through the debugging bridge; Determining, by the debug bridge, a communication mode between the second device and the first device based on the access information; In the case where it is determined based on a preset verification policy that the access information verification is passed, the second device is granted permission to access the first device through the debug bridge, and the preset verification policy is associated with the communication mode.

2. The method according to claim 1, characterized in that The access information includes information type; The determining, by the debug bridge based on the access information, a communication mode between the second device and the first device includes: The debugging bridge matches the information type of the access information based on the correspondence between the preset information type and the communication mode to obtain the communication mode between the second device and the first device.

3. The method according to claim 1 or 2, characterized in that: The communication mode is a wired communication mode; and before granting the second device access to the first device through the debug bridge when it is determined based on the preset verification strategy that the access information verification is passed, the method further includes: reading access attribute information from the first device through the debug bridge; In a case where the access attribute information is target attribute information, it is determined through the debug bridge that the access information verification is successful.

4. The method according to claim 1 or 2, characterized in that: The communication mode includes a wireless communication mode; the access information includes an access identifier; In the case where it is determined based on the preset verification policy that the access information verification passes, before granting the second device permission to access the first device through the debug bridge, the method further includes: Verifying the access identifier based on a preset accessible identifier by the debug bridge; In a case where the preset accessible identifier includes the access identifier, it is determined through the debug bridge that the access information verification is successful.

5. The method according to claim 4, characterized in that Before verifying the access identifier based on the preset accessible identifier, the method further includes: Determining, by the debugging bridge, a first rule chain in a firewall tool for processing the access information; Creating, by means of the debugging bridge, a second rule chain for carrying the preset accessible identifier; The second rule chain is associated with the first rule chain through the debugging bridge to obtain an associated first rule chain, wherein the associated first rule chain includes the preset accessible identifier.

6. The method according to claim 1, characterized in that The method further comprises: Sending a download request to a cloud device via the debug bridge; Receiving download information sent by the cloud device through the debugging bridge; Information corresponding to the download information is updated through the debug bridge, and the information includes at least one of executable program information to be updated and accessible identification to be updated.

7. A device authorization apparatus, characterized in that: Applied to a first device, in which a debugging bridge is deployed, the apparatus comprises: An acquisition module, configured to acquire access information of a second device accessing the first device through the debug bridge; a determination module, configured to determine, through the debug bridge, a communication mode between the second device and the first device based on the access information; A granting module is used to grant the second device access to the first device through the debug bridge when it is determined that the access information is authenticated based on a preset authentication policy, and the preset authentication policy is associated with the communication mode.

8. An electronic device, characterized in that: The device comprises: a processor and a memory storing computer program instructions; The processor reads and executes the computer program instructions to implement the device authorization method as described in any one of claims 1-6.

9. A computer storage medium, characterized in that The computer storage medium stores computer program instructions, and when the computer program instructions are executed by a processor, the device authorization method according to any one of claims 1 to 6 is implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the device authorization method according to any one of claims 1 to 6 is implemented.

Images