Data access method and electronic equipment

Abstract

The invention discloses a data access method and electronic equipment, relates to the technical field of terminals, and can improve the security and privacy in an information interaction process between application programs. According to the application, based on a refined authority management mechanism during access between the applications, for example, access accounts corresponding to different applications are created by taking the applications as granularity, so that the isolation degree between different third-party applications (for example, between the second application and the third application) when the different third-party applications access the first application is improved; the security and privacy of application data are improved when a third-party application accesses a first application.

Description

Technical Field

[0001] The present application relates to the field of terminal technology, and in particular to a data access method and electronic device. Background Art

[0002] With the rapid development of terminal application technology, more and more different applications can provide convenience for users in various aspects such as work, life, financial management, shopping, travel, etc., and the information interaction between applications has also brought great convenience to users. For example, the conference application, email application, memo application and other applications installed in electronic devices can provide users with better schedule management and reminder services by linking the schedule data in the calendar application.

[0003] However, the information interaction between existing applications has certain security and privacy issues. Figure 1 As shown, when the application programming interface (API) of other applications (such as third-party applications) successfully calls the application system permission verification interface of a certain application (such as the first application), it can freely read and write data in the database of the first application. Taking the third-party application linking to the calendar application as an example, when the API of the third-party application successfully calls the system permission verification interface of the calendar application, it can not only read all the schedule information in the calendar application database, but even tamper with the schedule information in the calendar application database, where the schedule information may be the user's private schedule or the schedule information written by other applications. Therefore, the information interaction process between existing applications may cause the user's privacy to be leaked and there are great security risks. Summary of the invention

[0004] The present application provides a data access method and an electronic device, which can provide a more refined permission management mechanism for inter-application access to improve the security and privacy of information interaction between application programs.

[0005] In order to achieve the above objectives, this application adopts the following technical solutions:

[0006] In a first aspect, a data access method is provided, which can be applied to a first electronic device, wherein a first application is installed in the first electronic device, and the method comprises: the first electronic device receives a request from a second application to access the first application; the first electronic device obtains account information of a second account, wherein the second account corresponds to the second application, the second account is different from the first account, and the first account is a system account; the first electronic device provides a service for the second application to access data within the first application based on the account information of the second account.

[0007] As an example, the second application's request to access the first application may include one or more of the following: a request for the second application to read data within the first application, a request for the second application to write data to the first application, and a request for the second application to modify data within the first application.

[0008] As an example, the first electronic device may store and maintain an application account association table, which includes an association relationship between applications and account information, and the account information may include but is not limited to one or more of an account identifier, a package name corresponding to the account, and an account name. The second account is an access account corresponding to the second application when accessing the first application, and the first application may control the permission of the second application to access the first application based on the second account.

[0009] Taking the example that the request of the second application to access the first application includes the request of the second application to read the data in the first application, the first electronic device can provide the second application with a service of reading the data in the first application based on the account information of the second account. Taking the example that the request of the second application to access the first application includes the request of the second application to write data in the first application, the first electronic device can provide the second application with a service of writing data in the first application based on the account information of the second account. Taking the example that the request of the second application to access the first application includes the request of the second application to modify the data in the first application, the first electronic device can provide the second application with a service of modifying the data in the first application based on the account information of the second account.

[0010] As an example, the first application is a calendar application, and the second application and the third application are third-party applications.

[0011] According to the solution provided in the first aspect above, the first electronic device can provide cross-application access services for third-party applications based on a refined permission management mechanism for inter-application access, such as providing cross-application access services for third-party applications based on the application granularity and according to the access accounts corresponding to different third-party applications, so as to improve the isolation between applications when different third-party applications access the first application, such as between different third-party applications and between a third-party application and the first application, and improve the security and privacy of application data when a third-party application accesses the first application.

[0012] As a possible implementation method, the above-mentioned second application is not accessing the first application for the first time. In this case, the first electronic device has already saved and maintained the association relationship between application information and account information of one or more applications (including the second application). In this way, the first electronic device can obtain the account information corresponding to the second application, that is, the account information of the second account, by searching the application account association table to see whether the account information corresponding to the second application is included.

[0013] As a possible implementation, the second application accesses the first application for the first time. In this case, the first electronic device obtains the account information of the second account, including: the first electronic device creates a second account and records the association between the application information of the second application and the account information of the second account; the second electronic device obtains the account information of the second account corresponding to the second application based on the association between the application information and the account information of one or more applications in the first electronic device, and the one or more applications include the second application. Based on this, the first electronic device can create a corresponding access account when a third-party application accesses the first application for the first time, so as to support the subsequent permission management of the third-party application when accessing the first application, so as to improve the security and privacy of application data when the third-party application accesses the first application.

[0014] As a possible implementation, after the first electronic device receives a request from the second application to access the first application, the method further includes: the first electronic device obtains the permission level of the second application; the first electronic device obtains the account information of the second account, including: the first electronic device obtains the account information of the second account when the permission level is a predefined level. Based on this, the first electronic device can not only provide customized permissions for different third-party applications to access the first application, but also improve the security and privacy of application data during the application information interaction process based on the permission management mechanism for access between multiple dimensions of applications.

[0015] As an example, the permission level of the second application may include any one of the following: high permission, low permission, and no permission, wherein the predefined level is low permission.

[0016] As a possible implementation, the method further includes: the first electronic device sets a first permission range for the second application; the first electronic device provides the second application with a service of accessing data in the first application based on the account information of the second account, including: the first electronic device obtains the first permission range corresponding to the second account; the first electronic device provides the second application with a service of accessing data in the first application based on the first permission range. In this way, the first electronic device can provide more flexible access rights management in the process of application information interaction based on more fine-grained permission range management for the account, and improve the security and privacy of application data in the process of application information interaction while meeting various personalized needs of users.

[0017] As an example, the first permission scope may include a permission scope under the read / write / modify dimension, such as the first permission scope may include one or more of the following permissions: read permission, write permission, modify permission, and permission level.

[0018] As an example, the first permission scope may include a permission scope under the permission level dimension, such as the first permission scope may include a high-level permission scope, a low-level permission scope, and the like.

[0019] As a possible implementation, the first electronic device sets permissions for the second application, including: the first electronic device sets a first permission range for the second application according to the permission setting operation of the user on the permission setting interface. Based on this, the user can apply for a specific permission for the application separately to achieve refined management and control of access rights, thereby improving the security and privacy of application data during application information interaction.

[0020] As a possible implementation, the method further includes: the first electronic device obtains the second permission range of the second application; the first electronic device provides the second application with a service of accessing the data in the first application according to one or more account information corresponding to the second permission range. In this way, the first electronic device can provide more flexible access rights management in the process of application information interaction based on more fine-grained permission range management across applications, thereby improving the security and privacy of application data in the process of application information interaction while meeting various personalized needs of users.

[0021] As an example, the second permission scope may include a permission scope under the access area dimension. For example, the second permission scope of the second application may include data corresponding to one or more accounts that the second application can access.

[0022] As a possible implementation, the first permission range corresponds to multiple accounts, including the second account and the third account, wherein the third account corresponds to the third application. Based on this, the first electronic device can provide more flexible cross-account access services according to various personalized needs of users, thereby improving user experience.

[0023] As a possible implementation, the second application is installed in the first electronic device. Based on this, the first electronic device can provide a service for a third-party application in the first electronic device to access the first application.

[0024] As a possible implementation, the second application is installed in the second electronic device. Based on this, the first electronic device can provide a service for third-party applications in other electronic devices to access the first application in the first electronic device across devices, so as to meet more diverse application information interaction needs.

[0025] As a possible implementation, the second application is installed in the second electronic device, and the method further includes: the first electronic device obtains the first information from the second electronic device, wherein the first information includes one or more of the following: device information of the second electronic device, capability information of the second electronic device, application information of the second application in the first electronic device, and version information of the second application in the first electronic device; the first electronic device records the association between the first information and the account information of the second account. Based on this, the first electronic device can further improve the security and privacy of application data during the application information interaction process based on more fine-grained permission range management, such as device granularity, application granularity, device capability (such as whether it supports the ability to write / modify) granularity, and application version granularity.

[0026] In a second aspect, an electronic device is provided, comprising: a memory for storing computer program instructions; and a processor for executing the computer program instructions to support the electronic device to implement a method in any possible implementation manner of the first aspect.

[0027] According to a third aspect, a communication system is provided. The communication system includes a first electronic device and a second electronic device. The method described in any one of the first aspects can be implemented through interaction between the first electronic device and the second electronic device.

[0028] According to a fourth aspect, a computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the method in any possible implementation of the first aspect is implemented.

[0029] According to a fifth aspect, a computer program product comprising instructions is provided. When the computer program product is run on a computer, the computer implements the method in any possible implementation of the first aspect.

[0030] In a sixth aspect, a chip system is provided, the chip system comprising a processing circuit and a storage medium, wherein the storage medium stores computer program instructions; when the computer program instructions are executed by the processor, the method in any possible implementation of the first aspect is implemented. The chip system may be composed of a chip, or may include a chip and other discrete devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 It is a schematic diagram of the information interaction process between conventional applications;

[0032] Figure 2 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application;

[0033] Figure 3A schematic diagram of the software structure of an electronic device provided in an embodiment of the present application;

[0034] Figure 4A Data access method flow provided for the embodiment of the present application Figure 1 ;

[0035] Figure 4B A schematic diagram for comparing data access effects provided in an embodiment of the present application;

[0036] Figure 5 Data access method flow provided for the embodiment of the present application Figure 2 ;

[0037] Figure 6 Data access method flow provided for the embodiment of the present application Figure 3 ;

[0038] Figure 7 Flow chart 4 of the data access method provided in the embodiment of the present application;

[0039] Figure 8 A schematic diagram of a multi-dimensional access rights management combination provided in an embodiment of the present application;

[0040] Fig. 9 A schematic diagram of a permission setting interface provided in an embodiment of the present application;

[0041] Fig.10 A schematic diagram of a data access effect provided in an embodiment of the present application;

[0042] Fig.11 A schematic diagram of another permission setting interface provided in an embodiment of the present application;

[0043] Fig.12 Another data access effect diagram provided in an embodiment of the present application. DETAILED DESCRIPTION

[0044] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application. In the description of the embodiments of the present application, unless otherwise specified, " / " means or, for example, A / B can mean A or B; "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, "multiple" means two or more than two.

[0045] In the following, the terms "first", "second", etc. are only used to distinguish different description objects, and have no limiting effect on the position, order, priority, quantity or content of the described objects. For example, if the described object is a "field", the ordinal number before the "field" in the "first field" and the "second field" does not limit the position or order between the "fields", and the "first" and "second" do not limit whether the "fields" they modify are in the same message, nor do they limit the order of the "first field" and the "second field". For another example, if the described object is a "level", the ordinal number before the "level" in the "first level" and the "second level" does not limit the priority between the "levels". For another example, the number of described objects is not limited by the ordinal number, and can be one or more. Taking the "first device" as an example, the number of "devices" can be one or more. In addition, the objects modified by different prefixes can be the same or different. For example, if the described object is a "device", the "first device" and the "second device" can be the same type of device or different types of devices. For another example, if the described object is "information", the "first information" and the "second information" can be information of the same content or information of different contents. In summary, the use of prefixes such as ordinal numbers to distinguish the described objects in the embodiments of the present application does not constitute a limitation on the described objects. For the statement of the described objects, please refer to the description in the context of the claims or embodiments, and no unnecessary limitation should be constituted due to the use of such prefixes.

[0046] Furthermore, in the embodiments of the present application, "connection" may be a direct connection or an indirect connection; in addition, it may refer to an electrical connection or a communication connection; for example, the connection between two electrical components A and B may refer to a direct connection between A and B, or may refer to an indirect connection between A and B through other electrical components or connecting media, or may refer to an indirect connection between A and B through other communication devices or communication media, as long as communication between A and B can be achieved.

[0047] As mentioned above, the information interaction between existing applications (hereinafter referred to as "applications") has certain security and privacy issues. After analysis, the reason is that the permission management during access between applications is relatively rough. For example, in the existing application information interaction process, no matter which third-party application accesses the first application, it accesses all data corresponding to the first application system account, such as being able to read data corresponding to the system account, write data to the data storage address corresponding to the system account, and modify data corresponding to the system account, which will lead to security and privacy issues. For example, the lack of specific isolation of data between the third-party application and the first application leads to the third-party application being able to arbitrarily read / write / modify the data of the first application, including some highly private data; for another example, the lack of specific isolation between third-party applications, such as the data written by the second application and the third application into the first application, leads to the third-party applications being able to arbitrarily read / write / modify each other's data written into the first application.

[0048] In order to solve the above-mentioned problems existing in the existing application information interaction process, an embodiment of the present application provides a data access method, which can improve the security and privacy of application data in the application information interaction process based on a refined permission management mechanism for access between applications.

[0049] In some embodiments of the present application, the electronic device may use application as the granularity to improve the isolation between applications when a third-party application accesses a first application.

[0050] As an example, the electronic device may use application granularity to improve the degree of isolation between a third-party application and the first application when the third-party application accesses the first application.

[0051] For example, the electronic device can create different access accounts for different third-party applications based on the application granularity, such as creating a first account corresponding to the first application and a second account corresponding to the second application. Based on this, when receiving an access request from the second application, the electronic device can allow the second application to access the data corresponding to the second account and prohibit the second application from accessing the data corresponding to the first account. Among them, the second application accesses the data corresponding to the second account, such as the second application reads the data previously written to the data storage address corresponding to the second account, writes data to the data storage address corresponding to the second account, and modifies the data at the data storage address corresponding to the second account. For example, if the first application is a calendar application and the second application is a conference application, the first account can be a system account corresponding to the system calendar, and the conference application can only access the data corresponding to the second account but cannot access the data corresponding to the system account.

[0052] As an example, the electronic device may use application as a granularity to improve the isolation between different third-party applications (such as between the second application and the third application) when different third-party applications access the first application.

[0053] For example, the electronic device can create different access accounts for different third-party applications based on the application granularity, such as creating a second account corresponding to the second application and creating a third account corresponding to the third application. Based on this, when receiving the access request of the second application, the electronic device can allow the second application to access the data corresponding to the second account and prohibit the second application from accessing the data corresponding to the third account. When receiving the access request of the third application, the electronic device can allow the third application to access the data corresponding to the third account and prohibit the third application from accessing the data corresponding to the second account. Among them, the third application accesses the data corresponding to the third account, such as the third application reads the data previously written to the data storage address corresponding to the third account, writes data to the data storage address corresponding to the third account, and modifies the data at the data storage address corresponding to the third account. For example, the first application is a calendar application, the second application is a conference application, and the third application is a memo application. The conference application can only access the data corresponding to the second account created by the calendar application for it, but cannot access the data written by the memo application under the second account created by the calendar application for it. Similarly, the memo application can only access the data corresponding to the third account but cannot access the data corresponding to the third account.

[0054] Of course, the electronic device can also provide cross-account data access between applications based on the user's authorization. This embodiment of the present application does not make specific limitations and will be introduced in detail below.

[0055] In some embodiments of the present application, the electronic device may provide customized permission levels for different third-party applications when accessing the first application based on the granularity of the third-party application.

[0056] As an example, the electronic device may provide the second application with the first level, second level, or third level of permission when accessing the first application, and provide the third application with the first level, second level, or third level of permission when accessing the first application. The first level is higher than the second level, and the second level is higher than the third level. Exemplarily, the first level of permission is high permission, the second level of permission is low permission, and the third level of permission is no permission.

[0057] For example, the electronic device can provide the second application with high permissions when accessing the first application, and provide the third application with low permissions when accessing the first application. Based on this, the second application can access the data corresponding to the second account of the second application and the data corresponding to the first account of the first application, and the third application can access the data corresponding to the third account of the third application but cannot access the data corresponding to the first account of the first application. Of course, the first level of permissions, the second level of permissions, and the permission range indicated by the third level in this example are only examples, and the embodiments of this application do not make specific limitations, and can be determined according to the capabilities and usage scenarios of the device during actual application.

[0058] In some embodiments of the present application, the electronic device may provide different third-party applications with a customized first permission range when accessing the first application, based on the granularity of the third-party application.

[0059] As an example, the electronic device may provide the second application with one or more of the read, write, modify, etc. permissions when accessing the first application, and provide the third application with one or more of the read, write, etc. permissions when accessing the first application.

[0060] Taking the first application as a sports health management application and the second application as a motion detection application as an example, the electronic device can only provide the motion detection application with write permission when accessing the sports health management application, and not provide it with permission to write and modify application data in the sports health management application, so as to protect the security and privacy of user health data and other data. Of course, the second application and the first permission range corresponding to the second application in this example are only used as examples, and the embodiments of this application are not specifically limited, and can be determined according to the capabilities and usage scenarios of the device during actual application.

[0061] In some embodiments of the present application, the electronic device may include but is not limited to a smart phone, a netbook, a tablet computer, a smart drawing board, a handwriting board, a smart watch, a smart bracelet, a phone watch, smart glasses, a smart camera, a PDA, a car computer, a personal computer (PC), a personal digital assistant (PDA), a portable multimedia player (PMP), an augmented reality (AR) / virtual reality (VR) device, a smart TV, a projection device, or a somatosensory game console in a human-computer interaction scene, etc. Alternatively, the electronic device may also be an electronic device of other types or structures, which is not limited in the present application.

[0062] As an example, see Figure 2 , Figure 2A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application is shown.

[0063] like Figure 2 As shown, the electronic device may include a processor 210, a memory (including an external memory interface 220 and an internal memory 221), a universal serial bus (USB) interface 230, a charging management module 240, a power management module 241, a battery 242, an antenna 1, an antenna 2, a mobile communication module 250, a wireless communication module 260, an audio module 270, a speaker 270A, a receiver 270B, a microphone 270C, an earphone interface 270D, a sensor module 280, a button 290, a motor 291, an indicator 292, a camera 293, a display screen 294, etc. Among them, the sensor module 280 may include a touch sensor and a pressure sensor. Optionally, the sensor module 280 may also include a gyroscope sensor, an air pressure sensor, a magnetic sensor, an acceleration sensor, a distance sensor, a proximity light sensor, a fingerprint sensor, a temperature sensor, an ambient light sensor, a bone conduction sensor, etc.

[0064] It is to be understood that the structure illustrated in the embodiment of the present invention does not constitute a specific limitation on the electronic device. In other embodiments of the present application, the electronic device may include more or fewer components than shown in the figure, or combine certain components, or split certain components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0065] The processor 210 may include one or more processing units. For example, the processor 210 may include an application processor (AP), a modem processor, a graphics processor (GPU), an image signal processor (ISP), a flight controller, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU). Different processing units may be independent devices or integrated into one or more processors.

[0066] The processor 210 may also be provided with a memory for storing instructions and data. In some embodiments, the memory in the processor 210 is a cache memory. The memory may store instructions or data that the processor 210 has just used or cyclically used. If the processor 210 needs to use the instruction or data again, it may be directly called from the memory. This avoids repeated access, reduces the waiting time of the processor 210, and thus improves the efficiency of the system.

[0067] In some embodiments, the processor 210 may include one or more interfaces. The interface may include an inter-integrated circuit (I2C) interface, an inter-integrated circuit sound (I2S) interface, a pulse code modulation (PCM) interface, a universal asynchronous receiver / transmitter (UART) interface, a mobile industry processor interface (MIPI), a general-purpose input / output (GPIO) interface, a subscriber identity module (SIM) interface, and / or a universal serial bus (USB) interface, etc.

[0068] The charging management module 240 is used to receive charging input from the charger. The power management module 241 is used to connect the battery 242, the charging management module 240 and the processor 210. The power management module 241 receives input from the battery 242 and / or the charging management module 240 to power the processor 210, the internal memory 221, the display screen 294, the camera 293 and the wireless communication module 260.

[0069] The wireless communication function of the electronic device can be implemented through antenna 1, antenna 2, mobile communication module 250, wireless communication module 260, modem processor and baseband processor.

[0070] Antenna 1 and antenna 2 are used to transmit and receive electromagnetic wave signals. Each antenna in the electronic device can be used to cover a single or multiple communication frequency bands. Different antennas can also be reused to improve the utilization of the antennas. For example, antenna 1 can be reused as a diversity antenna for a wireless local area network. In some other embodiments, the antenna can be used in combination with a tuning switch.

[0071] The mobile communication module 250 can provide solutions for wireless communications including 2G / 3G / 4G / 5G applied to electronic devices. The mobile communication module 250 may include at least one filter, switch, power amplifier, low noise amplifier (LNA), etc. The mobile communication module 250 may receive electromagnetic waves from the antenna 1, filter, amplify, and process the received electromagnetic waves, and transmit them to the modulation and demodulation processor for demodulation. The mobile communication module 250 may also amplify the signal modulated by the modulation and demodulation processor, and convert it into electromagnetic waves for radiation through the antenna 1. The modulation and demodulation processor may include a modulator and a demodulator. Among them, the modulator is used to modulate the low-frequency baseband signal to be sent into a medium-high frequency signal. The demodulator is used to demodulate the received electromagnetic wave signal into a low-frequency baseband signal. The demodulator then transmits the demodulated low-frequency baseband signal to the baseband processor for processing. After the low-frequency baseband signal is processed by the baseband processor, it is transmitted to the application processor. The application processor outputs sound signals through an audio device (not limited to the speaker 270A, the receiver 270B, etc.), or displays images or videos through the display screen 294.

[0072] The wireless communication module 260 can provide wireless communication solutions for electronic devices, including wireless local area networks (WLAN) (such as WiFi networks), Bluetooth BT, global navigation satellite system (GNSS), frequency modulation (FM), near field communication technology (NFC), infrared technology (IR), etc.

[0073] In some embodiments, the antenna 1 of the electronic device is coupled to the mobile communication module 250, and the antenna 2 is coupled to the wireless communication module 260, so that the electronic device can communicate with the network and other devices through wireless communication technology. The wireless communication technology may include global system for mobile communications (GSM), general packet radio service (GPRS), code division multiple access (CDMA), wideband code division multiple access (WCDMA), time division code division multiple access (TD-SCDMA), long term evolution (LTE), BT, GNSS, WLAN, NFC, FM, and / or IR technology, etc. The GNSS may include global positioning system (GPS), global navigation satellite system (GLONASS), Beidou navigation satellite system (BDS), quasi-zenith satellite system (QZSS) and / or satellite based augmentation system (SBAS).

[0074] In some embodiments of the present application, the coupling of antenna 1 and mobile communication module 250 and the coupling of antenna 2 and wireless communication module 260 can be used to support electronic devices to communicate with other electronic devices or network devices, such as receiving and sending one or more data such as device information, device capability information, user data, application data, application version information, etc. with other electronic devices.

[0075] The electronic device implements the display function through a GPU, a display screen 294, and an application processor. The GPU is a microprocessor for image processing, connecting the display screen 294 and the application processor. The GPU is used to perform mathematical and geometric calculations for graphics rendering. The processor 210 may include one or more GPUs that execute program instructions to generate or change display information.

[0076] The display screen 294 is used to display images, videos, etc. The display screen 294 includes a display panel.

[0077] The external memory interface 220 can be used to connect an external memory card, such as a Micro SD card, to expand the storage capacity of the electronic device. The external memory card communicates with the processor 210 through the external memory interface 220 to implement a data storage function.

[0078] The internal memory 221 can be used to store computer executable program codes. Exemplarily, the computer program may include an operating system program and an application program. Among them, the executable program code includes instructions. The processor 210 executes various functional applications and data processing of the electronic device by running the instructions stored in the internal memory 221. The internal memory 221 may include a program storage area and a data storage area. Among them, the program storage area may store an operating system, an application program required for at least one function, etc. The data storage area may store data created during the use of the electronic device, etc. In addition, the internal memory 221 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, a universal flash storage (UFS), etc. The processor 210 executes various functional applications and data processing of the electronic device by running the instructions stored in the internal memory 221, and / or the instructions stored in the memory provided in the processor.

[0079] In some embodiments of the present application, the internal memory 221 and / or the external memory card connected to the external memory interface 220 can be used to store application-related data, user data, etc. Application-related data such as application information and account information are not specifically limited in the embodiments of the present application, but depend on the specific device functions and application configurations, etc.

[0080] The electronic device can implement audio functions such as music playing and recording through the audio module 270, the speaker 270A, the receiver 270B, the microphone 270C and the application processor.

[0081] For the introduction of hardware such as the button 290 , the motor 291 , and the indicator 292 , reference may be made to conventional technologies, and the embodiments of the present application will not be described in detail.

[0082] It is understandable that this application Figure 2 The illustrated structure does not constitute a specific limitation on the electronic device. In other embodiments of the present application, the electronic device may include more or fewer components than shown in the figure, or combine some components, or split some components, or arrange the components differently. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0083] As a possible example, see Figure 3 , Figure 3 FIG. 1 shows a schematic diagram of the software structure of an electronic device provided in an embodiment of the present application. Figure 3 As shown, the operating system of the electronic device may include an application layer, a framework layer (framework, FWK) and a kernel layer.

[0084] The application layer can include a series of applications, such as Figure 3 The first application, the second application, the third application, ... shown in the figure, for example, the application may include but is not limited to mailbox, camera, gallery, calendar, call, map, navigation, Bluetooth, music, video, short message and other native applications (such as applications integrated in the operating system) or third-party applications (such as applications downloaded and installed by users through the application store), which are not limited in the embodiments of the present application.

[0085] The framework layer is used to provide application programming interface (API) and programming framework for applications in the application layer. Figure 3 As shown, the framework layer can provide window management service (WindowManagerService, WMS), activity management service (activity management service, AMS), input synthesis (InputFlinger) service and surface synthesis (SurfaceFlinger) service.

[0086] The window management service is used to provide window management, such as window creation, window activation, window deletion, window movement, window position / size / style management, etc. In some embodiments, the window management service can also be used to manage window information. The window information may include, but is not limited to, window identification, window level, identification of the interface displayed in the window, virtual screen object corresponding to the window, and other information. Exemplarily, the virtual screen object corresponding to the window is the displayId of the virtual screen where the window is located, for example, displayId can be a parameter of type int.

[0087] The activity management service is responsible for managing activities, starting, switching, and scheduling various components in the system, as well as managing and scheduling applications. Specifically, AMS defines data classes for saving processes, activities, and tasks. Among them, the data class corresponding to the process can include process file information, process memory status information, and the activities and services contained in the process. Activity information can be saved in the task stack (ActivityStack). Among them, ActivityStack is used to uniformly schedule application activities. ActivityStack can specifically save information about all running activities. ActivityStack can also save information about historically run activities.

[0088] The input synthesis service is used to collect, process user touch information and distribute input events. The input synthesis service can include the following two classes: InputReader and InputDispatcher. Among them, InputReader is used to determine the predicted points based on the touch information, and use the predicted points that belong to the effects of touch auxiliary tools such as user fingers, styluses, touch pens or touch balls as touch points, and then determine the touch operation based on one or more touch points and convert it into specific input events. InputDispatcher is used for subsequent input event distribution. For example, InputDispatcher can send input events to WMS through a dedicated channel between WMS and it. After receiving the input event, WMS can distribute the input event to the activity (Activity) corresponding to the target window in AMS. After that, the Activity can respond to the input event.

[0089] The surface synthesis service is used to synthesize graphic display data from multiple sources. For example, suppose the application layer corresponding to the content interface includes four layers: status bar, navigation bar, wallpaper and launcher icon layer. The drawing and rendering of the above status bar, navigation bar, wallpaper and launcher icon layer are all performed separately. The surface synthesis service mainly synthesizes the status bar, navigation bar, wallpaper and launcher icon layer and sends them for display.

[0090] Of course, the framework layer can also be used to provide other management services, such as package management services, content provision services, phone management services, resource management services, notification management services, location management services, and view system services. Among them, the package management service is responsible for program management within the system. The content provision service is used to support an application to access the data of another application (such as a contact database), or to share its own data with other applications, where the data may include video, images, audio, dialed and received calls, browsing history and bookmarks, phone books, etc. The phone management service is used to provide a method for accessing the status and information related to terminal device communication; and to provide communication functions of terminal devices, such as call status management (including connection, hang up, etc.). The resource management service is used to provide access to non-code resources, such as local strings, icons, pictures, graphics, video files or layout files. The notification management service is used to provide the function of displaying customized prompt information in the status bar. The prompt information can be used to convey notification-type messages and can disappear automatically after a short stay without user interaction. The location management service is used to provide services related to processing geographic location. The view system can be used to build the display interface of the application. The view system includes visual controls such as text box controls, list controls, grid controls, button controls, and embeddable web browser controls.

[0091] The kernel layer is the layer between hardware and software. The kernel layer can include camera driver, display driver, microphone driver, sensor driver, etc. Hardware such as camera, display (touch screen), microphone, etc.

[0092] It should be noted that Figure 3 This is only an example of a software structure diagram of an electronic device, in which only the layers and software modules related to the solution of the present application are simply listed. In practical applications, the operating system of the electronic device may also include other layers, and each layer may also include other software modules for implementing one or more functions or services. This embodiment of the present application does not specifically limit this.

[0093] A data access method provided in an embodiment of the present application will be specifically introduced below in conjunction with specific drawings.

[0094] In some embodiments of the present application, the electronic device can improve the isolation between applications when a third-party application accesses a first application based on application granularity. For example, the electronic device can improve the isolation between a third-party application and the first application, or between multiple third-party applications, when a third-party application accesses a first application based on application granularity.

[0095] Please refer to Figure 4A , Figure 4A Taking the first electronic device having the first application and the second application installed as an example, a flow chart of a data access method provided by an embodiment of the present application is shown. Figure 4A As shown, a data access method provided in an embodiment of the present application may include S401-S404:

[0096] S401: The first electronic device receives a request from a second application to access a first application.

[0097] In some embodiments, the second application's request to access the first application may include but is not limited to the second application's request to read the first application's data, the second application's request to write data to the first application, the second application's request to modify the first application's data, etc.

[0098] Taking the first application as a calendar application as an example, the second application's request to access the first application includes the second application's request to read schedule information in the calendar application, the second application's request to write schedule information to the calendar application, and the second application's request to modify schedule information in the calendar application.

[0099] In some embodiments, the second application may request access to the first application by way of an API call.

[0100] S402: The first electronic device determines whether the second application accesses the first application for the first time.

[0101] In some embodiments, the first electronic device can determine whether there is account information corresponding to the second application by querying the account information of the second application, and based on this, determine whether the second application is accessing the first application for the first time.

[0102] For example, an application account association table may be stored and maintained in the first electronic device, where the application account association table includes an association between the application and the account information. The account information may include, but is not limited to, one or more of an account identifier, a package name corresponding to the account, an account name, etc. The first electronic device may determine whether there is account information corresponding to the second application by searching the application account association table to see whether the account information corresponding to the second application is included.

[0103] As an example, if the application account association table does not include the account information corresponding to the second application, the first electronic device believes that the second application is accessing the first application for the first time; if the application account association table includes the account information corresponding to the second application, the first electronic device believes that the second application is not accessing the first application for the first time.

[0104] As a possible situation, the first electronic device determines that the second application is accessing the first application for the first time. The first electronic device executes S403A and then executes S404:

[0105] S403A: The first electronic device creates a second account corresponding to the second application.

[0106] In some embodiments, the first electronic device creates a second account corresponding to the second application, including the first electronic device creating account information corresponding to the second application, and associating the second application with the account information (such as updating the association relationship between the second application and the account information to the application account association table).

[0107] Taking the first application as a calendar application as an example, the first electronic device can save and maintain an application account association table that allows access to the calendar application. By searching the application account association table, if the application account association table does not include the account information corresponding to the second application, the first electronic device believes that the second application is accessing the calendar application for the first time. In this case, the first electronic device can create an access account corresponding to the second application, such as a second account.

[0108] As a possible situation, the first electronic device determines that the second application is not accessing the first application for the first time. In this situation, the first electronic device executes S403B and then executes S404:

[0109] S403B: The first electronic device obtains account information of a second account corresponding to the second application.

[0110] In some embodiments, an application account association table may be stored and maintained in the first electronic device, where the application account association table includes an association between the application and the account information. The account information may include but is not limited to one or more of an account identifier, a package name corresponding to the account, an account name, etc. The first electronic device may obtain the account information corresponding to the second application, such as the account information of the second account, by searching in the application account association table.

[0111] Taking the first application as a calendar application as an example, the first electronic device can save and maintain an application account association table that allows access to the calendar application. By searching the application account association table, if the application account association table includes account information corresponding to the second application, the first electronic device believes that it is not the first time that the second application has accessed the calendar application. In this case, the first electronic device can obtain the access account when the second application accesses the first application from the application account association table, such as the second account.

[0112] S404: The first electronic device provides a service for the second application to access data of the first application according to the account information of the second account.

[0113] In some embodiments, the request of the second application to access the first application is a request to read the data of the first application. In this case, the first electronic device can search for the data that the second application wants to read at the corresponding data storage address according to the account information of the second account and provide it to the second application. Taking the first application as a calendar application as an example, the first electronic device can search for the data that the second application wants to read (such as schedule information) at the data storage address corresponding to the calendar application according to the account information of the second account and provide it to the second application.

[0114] In some embodiments, the request of the second application to access the first application is a request to write data to the first application. In this case, the first electronic device can write the data that the second application wants to write to the data storage address corresponding to the second account according to the account information of the second account. Taking the first application as a calendar application as an example, the first electronic device can write the data that the second application wants to write (such as schedule information) to the data storage address corresponding to the second account in the calendar application according to the account information of the second account.

[0115] In some embodiments, the request of the second application to access the first application is a request to modify the data of the first application. In this case, the first electronic device can allow the second application to modify the data at the data storage address corresponding to the second account based on the account information of the second account. Taking the first application as a calendar application as an example, the first electronic device can allow the second application to modify the data at the data storage address corresponding to the second account in the calendar application based on the account information of the second account.

[0116] based on Figure 4A In the data access method shown, an electronic device (such as the first electronic device) can create access accounts corresponding to different third-party applications at the application level, and the third-party application (such as the second application) can intelligently access the data corresponding to the access account. Based on this, the isolation between applications can be improved through a fine-grained permission management mechanism when the third-party application accesses the first application, and the security and privacy of application data during application information interaction can be improved. For example, Figure 4B As shown, compared to Figure 4B In (a), application 2, application 3, and application 4 can all access all schedule information in "My Calendar" in the calendar application. Figure 4B As shown in (b), the security and privacy of the solution in which application 2, application 3 and application 4 only access the schedule information under their respective accounts are greatly improved.

[0117] Need to know, Figure 4A Only the second application accessing the first application is taken as an example. For other third-party applications (such as the third application) accessing the first application, you can also refer to Figure 4AThe data access method for the second application to access the first application is shown. For example, after receiving a request from a third application to access the first application, the first electronic device can determine whether the third application is accessing the first application for the first time. If so, the first electronic device can create a third account corresponding to the third application, and provide the third application with access to the data of the first application based on the account information of the third account; if not, the first electronic device can obtain the account information of the third account of the third application, and then provide the third application with access to the data of the first application based on the account information of the third account. For the specific process, please refer to the above about Figure 4A The description of each step in the process is not repeated here.

[0118] In some embodiments of the present application, the electronic device can also provide customized permission levels for different third-party applications when accessing the first application, based on the granularity of the third-party application. For example, the electronic device can provide the second application with a first level of permission when accessing the first application, and provide the third application with a second level of permission when accessing the first application, wherein the first level of permission is any one of high permission and low permission, and the second level of permission is any one of high permission and low permission.

[0119] Please refer to Figure 5 , Figure 5 Taking the first electronic device having the first application and the second application installed as an example, a flow chart of a data access method provided by an embodiment of the present application is shown. Figure 5 As shown, a data access method provided in an embodiment of the present application may include S501-S503A / S503B / S503C:

[0120] S501: The first electronic device receives a request from a second application to access a first application.

[0121] For the introduction of S501, please refer to the above description of S401, which will not be repeated here.

[0122] S502: The first electronic device obtains the permission level of the second application.

[0123] In some embodiments, the permission level of the second application may include, but is not limited to, one or more of high permission, low permission, no permission, etc.

[0124] In some embodiments, high permission means having the permission to access all data of the first application, low permission means having the permission to access part of the data of the first application (such as user-authorized data, data of non-system accounts (such as the first account), non-private data, etc.), and no permission means not having the permission to access the data of the first application.

[0125] In some embodiments, high authority refers to having authority to access data within a first range in the first application, low authority refers to having authority to access data within a second range in the first application, and no authority refers to not having authority to access data in the first application. The second range is smaller than the first range. In some embodiments, the second range may also belong to the first range.

[0126] Taking the first application as a calendar application as an example, high permissions include permissions to access all schedule information of the calendar application, low permissions include permissions to access part of the schedule information of the calendar application (such as user-authorized data, data of non-system accounts, etc.), and no permissions include no permissions to access any data in the calendar application.

[0127] The embodiment of the present application does not specifically limit the setting of the permission level of the second application and the permission scope corresponding to each permission level, and it can be determined according to the capabilities and usage scenarios of the device during the actual application process.

[0128] As a possible implementation manner, the first electronic device may obtain the permission level of the second application by calling a system permission verification interface.

[0129] After acquiring the permission level of the second application, the first electronic device executes the following S503A, S503B or S503C:

[0130] S503A: When the permission level of the second application to access the first application is the first level, the first electronic device provides the second application with a service of accessing the data of the first application according to the first level.

[0131] In some embodiments, the first level of permission is high permission. In this case, the first electronic device provides a service for the second application to access data of the first application within a corresponding permission range according to the high permission level.

[0132] For example, assuming that high authority means having the authority to access all data of the first application, the first electronic device can provide the second application with the authority to access all data of the first application. For another example, assuming that high authority means having the authority to access data within a first range in the first application, the first electronic device can provide the second application with access to data within the first range in the first application, and the data within the first range can be other data other than the user's private data.

[0133] Taking the first application as a calendar application as an example, assuming that high authority means the authority to access all data of the first application, the first electronic device can provide the second application with the authority to access all schedule information of the calendar application; or assuming that high authority means the authority to access data within a first range in the first application, the first electronic device can provide the second application with the authority to access data within the first range in the calendar application, such as the authority to access user-authorized data in the calendar application, data of non-system accounts, etc.

[0134] The specific scope of authority of the first level may depend on the capabilities and usage scenarios of the device during actual application, and is not limited in the embodiments of the present application.

[0135] S503B: When the permission of the second application to access the first application is at the second level, the first electronic device provides the second application with a service of accessing the data of the first application according to the second level.

[0136] In some embodiments, the first level of permission is low permission. In this case, the first electronic device provides a service for the second application to access data of the first application within a corresponding permission range according to the low permission level.

[0137] For example, assuming that low permissions refer to permissions to access part of the data of the first application (such as data within the second scope), the first electronic device can provide the second application with permissions to access the data within the second scope of the first application, such as user-authorized data, data of non-system accounts, etc.

[0138] Taking the first application being a calendar application as an example, the first electronic device may provide the second application with permission to access user-authorized data in the calendar application, data of non-system accounts, and the like.

[0139] The specific scope of authority of the second level may depend on the capabilities and usage scenarios of the device during actual application, and is not limited in the embodiments of the present application.

[0140] S503C: When the permission level of the second application to access the first application is the third level, the first electronic device denies the second application to access the first application.

[0141] In some embodiments, the first level of permission is such as no permission. In this case, the first electronic device denies the second application from accessing the first application.

[0142] based on Figure 5 In the data access method shown, the electronic device (such as the first electronic device) can authorize the same or different levels of permissions for different applications based on the application granularity. Based on this, a fine-grained permission management mechanism can be used to provide customized permissions for different third-party applications when accessing the first application, thereby improving the security and privacy of application data during application information interaction.

[0143] In some embodiments of the present application, the first electronic device may also execute when the permission level of the second application to access the first application is the second level (such as low permission). Figure 4A As shown in S402-S404. For example, Figure 6As shown, after the first electronic device executes S501-S502, if the permission level of the second application to access the first application is the first level, the first electronic device executes S503A; if the permission level of the second application to access the first application is the third level, the first electronic device executes S503C; if the permission level of the second application to access the first application is the second level, the first electronic device executes S402-S404.

[0144] based on Figure 6 In the data access method shown, an electronic device (such as a first electronic device) can authorize the same or different levels of permissions for different applications based on the application granularity, and create access accounts corresponding to different applications. Based on this, not only can customized permissions be provided for different third-party applications when accessing the first application, but also the isolation between applications can be improved when the third-party application accesses the first application. The security and privacy of application data during application information interaction can be greatly improved through a fine-grained and multi-dimensional permission management mechanism.

[0145] In some embodiments of the present application, the first electronic device may also provide different customized permission ranges for different access accounts at the access account level, wherein the permission range includes the first permission range and / or the second permission range.

[0146] In some embodiments of the present application, the first electronic device may obtain the permission range of the second application after obtaining the account information of the second account corresponding to the second application, and then provide the second application with a service of accessing the data of the first application according to the account information of the second account and the permission range of the second application. Figure 7 As shown, after executing S401-S403B, the first electronic device may further execute S701 and S703.

[0147] Among them, S701 and S703 are as follows:

[0148] S701: The first electronic device obtains the permission scope of the second application.

[0149] In some embodiments, the permission scope of the second application may include a first permission scope. For example, the first permission scope of the second application may be a permission scope under the read / write / modify dimension, such as the first permission scope of the second application may include one or more of the permissions of read, write, modify, etc.; for another example, the first permission scope of the second application may be a permission scope under the permission level dimension, such as including a high-level permission scope, a low-level permission scope, etc.

[0150] In some embodiments, the permission scope of the second application may include a second permission scope, and the second permission scope of the second application may be a permission scope under the access area dimension. For example, the second permission scope of the second application may include accounts that the second application can access, such as one or more accounts.

[0151] In some embodiments, the permission scope of the second application may be a permission scope under multiple combined dimensions, for example, the permission scope of the second application may be a permission scope under multiple dimensions of read / write / modify dimension, access area dimension, and permission level dimension. For example, the permission scope of the second application may include readable accounts, writable accounts, modifiable accounts, high-authority read range, low-authority read range, high-authority write range, low-authority write range, high-authority modification range, low-authority modification range, accounts accessible by high-authority, accounts accessible by low-authority, accounts readable by high-authority, accounts readable by low-authority, accounts writable by high-authority, accounts writable by low-authority, accounts modifiable by high-authority, accounts modifiable by low-authority, etc.

[0152] S703: The first electronic device provides a service of the data of the first application to the second application according to the account information of the second account and the permission scope of the second application.

[0153] In some embodiments of the present application, the first electronic device may also create a second account corresponding to the second application, set a permission range for the second application, and then provide the second application with a service of accessing data under the second account that meets the permission range of the second application based on the account information of the second account and the permission range of the second application (such as the first permission range and / or the second permission range). Figure 7 As shown, after the first electronic device has executed S401-S403A, it may further execute S702 and S703. Among them, S702 is specifically as follows:

[0154] S702: The first electronic device sets a permission scope for the second application.

[0155] In some embodiments, the permission scope of the permissions set by the first electronic device for the second application may include a first permission scope. For example, the first permission scope may be a permission scope under the read / write / modify dimension, such as the first permission scope of the second application may include one or more of the permissions of read, write, modify, etc.; for example, the first permission scope may include a permission scope under the permission level dimension, such as a high-level permission scope, a low-level permission scope, etc.

[0156] In some embodiments, the permission scope of the permissions set by the first electronic device for the second application may include a second permission scope. For example, the second permission scope may be a permission scope under the access area dimension. For example, the second permission scope of the second application may include data corresponding to accounts (such as one or more accounts) that the second application can access.

[0157] In some embodiments, the permission range of the permission set by the first electronic device for the second application may be a permission range under multiple combined dimensions, for example, Figure 8 The permission scope of the second application shown may be a permission scope under a combination of multiple dimensions in the read / write / modify dimension, the access area dimension, and the permission level dimension. The permission scope of the second application may include readable accounts, writable accounts, modifiable accounts, high-authority read range, low-authority read range, high-authority write range, low-authority write range, high-authority modification range, low-authority modification range, accounts accessible by high-authority, accounts accessible by low-authority, accounts readable by high-authority, accounts readable by low-authority, accounts writable by high-authority, accounts writable by low-authority, accounts modifiable by high-authority, accounts modifiable by low-authority, etc.

[0158] In some embodiments, the first electronic device may set a permission range for the second application based on the user's authorization, or the first electronic device may also set a permission range for the second application based on information related to the first electronic device and / or information related to the second application, which is not specifically limited in the embodiments of the present application.

[0159] For example, the first electronic device sets the permission range for the second application according to the user's authorization. Fig. 9 , Fig. 9 Taking the first application being a calendar application as an example, a schematic diagram of a permission setting interface provided by an embodiment of the present application is shown. Fig. 9 As shown, the calendar application maintains four accounts, namely account 1, account 2, account 3 and account 4, where account 1 is the system account of the calendar application, account 2 is the access account corresponding to the second application, account 3 is the access account corresponding to the third application, and account 4 is the access account corresponding to the fourth application. Fig. 9 As shown, users can customize the read, write, modify and other permissions under multiple access accounts (such as account 2, account 3, account 4) through the permission setting interface. Based on this, users can apply for a specific permission for a separate device and / or application to achieve refined management and control of access rights, and improve the security and privacy of application data during application information interaction.

[0160] For example, the access account of application 2 in the calendar application is account 2, the access account of application 3 in the calendar application is account 3, the access account of application 4 in the calendar application is account 4, the permissions of account 2 are read / write / modify permissions, the permissions of account 3 are read / write permissions, and the permissions of account 4 are read permissions. Fig.10 As shown, through a fine-grained and multi-dimensional permission management mechanism, it can be ensured that application 2 corresponding to account 2 can access the calendar application normally, while preventing application 3 corresponding to account 3 and application 4 corresponding to account 4 from maliciously tampering with or being maliciously exploited to tamper with the schedule information in the calendar application. It can also prevent application 4 corresponding to account 4 from arbitrarily writing schedule information into the calendar application, thereby greatly improving the security and privacy of application data during application information interaction.

[0161] As another example, see Fig.11 , Fig.11 Taking the first application being a calendar application as an example, another schematic diagram of a permission setting interface provided by an embodiment of the present application is shown. Fig.11 As shown, the calendar application maintains four accounts, namely account 1, account 2, account 3 and account 4, where account 1 is the system account of the calendar application, account 2 is the access account corresponding to the second application, account 3 is the access account corresponding to the third application, and account 4 is the access account corresponding to the fourth application. Fig.11 As shown, users can customize the permissions of privacy accounts, cross-account access, and other related permissions under multiple access accounts (such as account 2, account 3, and account 4) through the permission setting interface. In some embodiments, the data corresponding to the account set as a privacy account can be prohibited from being accessed by third-party applications corresponding to other accounts. For example, the database corresponding to the account set as a privacy account can be set with a privacy flag to prohibit third-party applications corresponding to other accounts from accessing the data stored in the database at the data storage address corresponding to the privacy account. Based on this, users can apply for a specific permission for a single device and / or application to achieve refined management and control of access rights, thereby improving the security and privacy of application data during application information interaction.

[0162] For example, the access account of application 2 in the calendar application is account 2, the access account of application 3 in the calendar application is account 3, the access account of application 4 in the calendar application is account 4, the permissions of account 2 are read / write / modify permissions, the permissions of account 3 are read / write permissions, and the permissions of account 4 are read permissions. Fig.12As shown, through the fine-grained and multi-dimensional permission management mechanism, application 2 can access the data corresponding to account 2 and access the data corresponding to account 3 across accounts, application 3 can only access the data corresponding to account 3, and application 4 can access the data corresponding to account 4 and access the data corresponding to account 3 across accounts. Based on this, permissions can be flexibly customized according to actual needs and application situations, greatly improving the security and privacy of application data during application information interaction.

[0163] It should be noted that this application Fig. 9 and Fig.11 As two examples of permission setting interfaces, the embodiments of the present application do not limit the specific content and layout of the interface; in addition, for permission setting interfaces of permission ranges under other dimensions and permission ranges under various combined dimensions, please refer to Fig. 9 and Fig.11 Examples are not listed here one by one.

[0164] Based on more fine-grained permission scope management for accounts, including permission scope management in the read / write / modify dimension, access area dimension or permission level dimension under the account, or permission scope management in the combination of multiple dimensions among the read / write / modify dimension, access area dimension and permission level dimension under the account, more flexible access permission management can be provided during the application information interaction process, thereby improving the security and privacy of application data during the application information interaction process while meeting various personalized needs of users.

[0165] It should be noted that the above embodiments only take an electronic device (such as a first electronic device) accessing a first application installed in the first electronic device using a third-party application (such as a first application or a second application) installed in the first electronic device as an example. In some embodiments, assuming that the first electronic device receives a request from a third-party application in a second electronic device to access the first application installed in the first electronic device, the first electronic device may also adopt a data access method similar to the above-mentioned third-party application accessing the first application.

[0166] In some embodiments, assuming that the first electronic device receives a request from a third-party application in a second electronic device to access a first application installed in the first electronic device, the first electronic device can also save and maintain the access account of the third-party application to access the first application based on a similar permission management mechanism.

[0167] As an example, when a third-party application (such as a fourth application) in the second electronic device first accesses the first application, the first electronic device can obtain the device information of the second electronic device, create a corresponding access account (such as a fourth account), and associate the combined information of the device information of the second electronic device and the application information of the fourth application with the account information of the fourth account. Based on this, whenever the fourth application in the second electronic device requests access to the first application, the first electronic device can only allow it to access the data corresponding to the fourth account.

[0168] As an example, when a third-party application (such as a fourth application) from a second electronic device accesses the first application for the first time, the first electronic device can obtain the version information of the fourth application, create a corresponding access account (such as a fourth account), and associate the combination of the application information of the fourth application and the version information of the fourth application with the account information of the fourth account. Based on this, whenever the same version of the fourth application in other devices accesses the first application, the first electronic device can only allow it to access the data corresponding to the fourth account.

[0169] As an example, when a third-party application (such as a fourth application) from the second electronic device first accesses the first application, the first electronic device can obtain the login account information of the fourth application, create a corresponding access account (such as the fourth account), and associate the combined information of the fourth application information and the login account information of the fourth application with the account information of the fourth account. Based on this, whenever the fourth application logged in to the same login account requests to access the first application, the first electronic device can only allow it to access the data corresponding to the fourth account.

[0170] As an example, when a third-party application (such as a fourth application) from a second electronic device accesses the first application for the first time, the first electronic device can obtain the device capability information of the second electronic device (such as whether the ability to write / modify is supported), create a corresponding access account (such as a fourth account), and associate the combined information of the device capability information of the second electronic device and the information of the fourth application with the account information of the fourth account. Based on this, whenever a fourth application with the same device capability requests access to the first application, the first electronic device can only allow it to access the data corresponding to the fourth account.

[0171] As an example, when a third-party application (such as a fourth application) in a second electronic device first accesses the first application, the first electronic device can obtain the device information of the second electronic device and the login account information of the fourth application, create a corresponding access account (such as the fourth account), and associate the combined information of the device information of the second electronic device, the information of the fourth application, and the login account information of the fourth application with the account information of the fourth account. Based on this, whenever a fourth application in the second electronic device that is logged in with the same login account requests to access the first application, the first electronic device can only allow it to access the data corresponding to the fourth account.

[0172] As an example, when a third-party application (such as a fourth application) in the second electronic device first accesses the first application, the first electronic device can obtain the device information of the second electronic device and the version information of the fourth application, create a corresponding access account (such as the fourth account), and associate the combined information of the device information of the second electronic device, the version information of the fourth application, and the information of the fourth application with the account information of the fourth account. Based on this, whenever the fourth application of the same version in the second electronic device requests access to the first application, the first electronic device can only allow it to access the data corresponding to the fourth account.

[0173] Of course, the first electronic device may also associate a combination of multiple pieces of information, including application information of the application that initiates the access request, version information of the application, device information where the application is located, and capability information of the device where the application is located, with its corresponding account to provide more fine-grained permission scope management, thereby improving the security and privacy of application data during application information interaction while meeting various personalized needs of users.

[0174] For example, assuming that the second electronic device has the ability to read but not the ability to write and modify schedule information, the second electronic device can be only authorized to read the schedule information of the calendar application in the first electronic device, but not to write and modify the schedule information. Based on this, not only can the user's private schedule be effectively protected, but also the security issues caused by some malicious devices using the second electronic device's permission to write / modify the schedule information in the first electronic device to maliciously write or tamper with the user's schedule information can be avoided.

[0175] In some embodiments, assuming that the first electronic device receives a request from a third-party application in the second electronic device to access the first application installed in the first electronic device, the first electronic device can also save and maintain the access account of the third-party application to access the first application based on multi-dimensional and more fine-grained permission range management. For example, the first electronic device can also provide permission range management including read / write / modify dimension, access area dimension or permission level dimension for the access account corresponding to the fourth application in the second electronic device (such as the fourth account), or permission range management of multiple dimensions under the account read / write / modify dimension, access area dimension and permission level dimension, so as to provide more flexible access permission management in the process of application information interaction, and improve the security and privacy of application data in the process of application information interaction while meeting various personalized needs of users.

[0176] It should be understood that the various schemes of the embodiments of the present application can be used in reasonable combination, and the explanations or descriptions of the various terms appearing in the embodiments can be mutually referenced or explained in the various embodiments, without limitation.

[0177] It should also be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0178] It is understandable that, in order to implement the functions of any of the above-mentioned embodiments, the electronic device includes a hardware structure and / or software module corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0179] The embodiments of the present application can divide the electronic device into functional modules. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated modules can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0180] It should also be understood that each module in the electronic device can be implemented in software and / or hardware form, without specific limitation. In other words, the electronic device is presented in the form of functional modules. The "module" here can refer to a specific application integrated circuit ASIC, a circuit, a processor and a memory that executes one or more software or firmware programs, an integrated logic circuit, and / or other devices that can provide the above functions.

[0181] In an optional manner, when data transmission is implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is implemented in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a digital video disk (DVD)), or a semiconductor medium (e.g., a solid state disk (SSD)), etc.

[0182] The steps of the method or algorithm described in conjunction with the embodiments of the present application can be implemented in a hardware manner or by a processor executing software instructions. The software instructions can be composed of corresponding software modules, and the software modules can be stored in random access memory (RAM), flash memory, read-only memory (ROM), erasable programmable read-only memory (EPROM), electrically erasable read-only memory (EEPROM) memory, register, hard disk, mobile hard disk, compact disc read-only memory (CD-ROM) or any other form of storage medium known in the art. An exemplary storage medium is coupled to a processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an application specific integrated circuit (ASIC). In addition, the ASIC can be located in an electronic device. Of course, the processor and the storage medium can also exist as discrete components.

[0183] Through the description of the above implementation methods, technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

Claims

1. A data access method, characterized in that: Applied to a first electronic device, in which a first application is installed, the method includes: receiving a request from a second application to access the first application; Acquire account information of a second account, where the second account corresponds to the second application, the second account is different from the first account, and the first account is a system account; A service of accessing data within the first application is provided to the second application according to the account information of the second account.

2. The method according to claim 1, characterized in that This is not the first time that the second application accesses the first application.

3. The method according to claim 1, characterized in that The second application accesses the first application for the first time, and the acquiring the account information of the second account includes: Creating the second account and recording the association relationship between the application information of the second application and the account information of the second account; Obtain account information of the second account.

4. The method according to any one of claims 1 to 3, characterized in that The obtaining the account information of the second account includes: According to the association relationship between application information and account information of one or more applications in the first electronic device, account information of the second account corresponding to the second application is obtained, and the one or more applications include the second application.

5. The method according to any one of claims 1 to 4, characterized in that After receiving a request from the second application to access the first application, the method further includes: Obtaining the permission level of the second application; The obtaining the account information of the second account includes: When the authority level is a predefined level, account information of the second account is obtained.

6. The method according to claim 5, characterized in that The permission level includes any one of the following: high permission, low permission, and no permission, and the predefined level is the low permission.

7. The method according to any one of claims 1 to 6, characterized in that The method further comprises: Setting a first permission scope for the second application; The providing the second application with a service of accessing data in the first application according to the account information of the second account includes: Obtaining a first permission scope corresponding to the second account; Provide the second application with a service of accessing data within the first application according to the first permission scope.

8. The method according to claim 7, characterized in that The first permission range includes one or more of the following permissions: read permission, write permission, modify permission, and permission level.

9. The method according to any one of claims 1 to 7, characterized in that: The method further comprises: Obtaining a second permission scope of the second application; Provide the second application with a service for accessing the data within the first application based on one or more account information corresponding to the second permission scope.

10. The method according to claim 9, characterized in that The second permission range corresponds to multiple accounts, the multiple accounts include the second account and a third account, and the third account corresponds to a third application.

11. The method according to claim 10, characterized in that The first application is a calendar application, and the second application and the third application are third-party applications.

12. The method according to any one of claims 1 to 11, characterized in that The second application is installed in the first electronic device or the second electronic device.

13. An electronic device, characterized in that: The electronic device comprises: a memory for storing computer program instructions; A processor, configured to execute the computer program instructions to support the electronic device to implement the method as described in any one of claims 1-12.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, and when the computer program instructions are executed by a processing circuit, the method according to any one of claims 1 to 12 is implemented.

15. A computer program product comprising instructions, characterized in that When the computer program product is run on a computer, the computer is caused to execute the method according to any one of claims 1 to 12.

16. A chip system, characterized in that: The chip system includes a processing circuit and a storage medium, wherein the storage medium stores computer program instructions; when the computer program instructions are executed by the processing circuit, the method as described in any one of claims 1 to 12 is implemented.

Images