Authority control method, device and equipment of intelligent automobile operating system and medium

Abstract

The invention provides a permission control method and device for an intelligent automobile operating system, equipment and a medium, and the method comprises the steps: obtaining the capability data of a target application, the capability data being used for indicating the permission information of the target application; when the target application is loaded and runs, obtaining a process capability table corresponding to the target application according to the capability data; when the target application executes a target operation, permission verification operation is carried out on the target operation according to the process capability table, and the target operation is calling a heap memory application interface, calling a mapping physical address interface or calling a communication interface. According to the method, the problems that other applications cannot provide services due to the fact that malicious applications consume a system memory and the system is maliciously damaged by mapping irrelevant physical memory addresses are effectively avoided, and meanwhile, the problem that sensitive information is leaked due to the fact that the malicious applications snoop is prevented. And the reliability and the safety of the operating system are effectively improved.

Description

Technical Field

[0001] The present application relates to the field of smart car technology, and in particular to a permission control method, device, equipment and medium for a smart car operating system. Background Art

[0002] As the core functions of the intelligent automobile operating system using the macro kernel continue to grow, the complexity of the system continues to increase. Therefore, the microkernel architecture is generated. The microkernel is to decouple the operating system of the macro kernel architecture, separate a single function or module from the kernel, and deploy it as an independent service in an independent operating environment. The kernel only retains a few functions and provides basic capabilities such as communication for the service, so that it can cooperate with each other to complete the functions required by the operating system.

[0003] As the corresponding kernel functions and complexity continue to increase, the macro kernel has caused more problems in terms of reliability and security. This is because under the macro kernel architecture, all kernel modules run in privileged space, and a single point of error may cause the entire system to crash or be hacked. Even kernel systems written by operating system kernel programmers with strong programming skills are difficult to avoid bugs.

[0004] However, the following problems still exist in existing operating systems: there is no limit on the use of application memory, and malicious applications may request to consume all memory, causing the normal functions of the system to be unable to be used normally; applications can map memory physical addresses, but there is no limit on the physical address range, and malicious applications may map irrelevant physical addresses to carry out destructive activities; malicious applications can easily establish communication channels with normal applications to obtain sensitive information, leading to information leakage. Summary of the invention

[0005] Based on the above problems, the present application provides a permission control method, device, equipment and medium for an intelligent automobile operating system.

[0006] In a first aspect, the present application provides a permission control method for an intelligent automobile operating system, which is applied to the kernel of the intelligent automobile operating system, and the method includes:

[0007] Acquire capability data of a target application, where the capability data is used to indicate permission information of the target application;

[0008] When the target application is loaded and run, obtaining a process capability table corresponding to the target application according to the capability data;

[0009] When the target application executes a target operation, a permission verification operation is performed on the target operation according to the process capability table, and the target operation is calling a heap memory application interface, calling a mapping physical address interface, or calling a communication interface.

[0010] In a possible implementation, if the target operation is the calling of the heap memory application interface, performing a permission verification operation on the target operation according to the process capability table includes:

[0011] Acquire first call information when the target application calls a heap memory application interface, wherein the first call information indicates a required heap memory size currently applied for by the target application;

[0012] Obtaining the sum of the required heap memory size and the historically allocated heap memory size, and determining whether the sum exceeds an upper limit of the available heap memory;

[0013] If yes, a first error code is returned to the target application; if no, a heap memory application is made so that the target application uses the required heap memory with a first access permission, where the first access permission is the permission for the target application to access available heap memory.

[0014] In a possible implementation manner, before performing the permission verification operation on the target operation according to the process capability table, the method further includes:

[0015] Acquire a first preset permission of the target application according to the process capability table, where the first preset permission is used to indicate the available heap memory size corresponding to the target application and the first access permission;

[0016] An upper limit value of the available heap memory of the target application is configured according to the available heap memory size, and the first access permission is configured in a memory management unit.

[0017] In a possible implementation, if the target operation is the call mapping physical address interface, performing a permission verification operation on the target operation according to the process capability table includes:

[0018] Acquire second call information when the target application calls the mapped physical address interface, the second call information indicating a required address range currently mapped by the target application;

[0019] According to the process capability table, obtaining a second preset permission of the target application, where the second preset permission includes an available physical memory address range of the target application and a second access permission, where the second access permission is a permission for the target application to access the available physical memory;

[0020] Perform an authority verification operation according to the second calling information and the second preset authority.

[0021] In a possible implementation, performing the permission verification operation according to the second calling information and the second preset permission includes:

[0022] Determine whether the required address range belongs to the available physical memory address range;

[0023] If yes, mapping the physical address corresponding to the required address range into a virtual address, and configuring a second access permission in the memory management unit so that the target application accesses the virtual address with the second access permission;

[0024] If not, a second error code is returned to the target application.

[0025] In a possible implementation, if the target operation is to call a communication interface, performing a permission verification operation on the target operation according to the process capability table includes:

[0026] According to the process capability table, third calling information when the target application calls the communication interface is obtained, wherein the third calling information includes a preset matching value of the target application and a required access right to the current communication mode, wherein the matching value is file path information or a key value;

[0027] According to the third calling information, determining whether capability information of a candidate application matches the third calling information;

[0028] If yes, allowing the target application to communicate with the candidate application corresponding to the target matching value in the current communication mode;

[0029] If not, a third error code is returned to the target application to reject the communication request of the target application.

[0030] In a possible implementation, the capability data is determined by a description of a capability script; and the first access right / the second access right / the required access right includes at least one of read, write or execute.

[0031] In a second aspect, the present application provides a permission control device for an intelligent automobile operating system, the device comprising:

[0032] An acquisition module, used to acquire capability data of a target application, wherein the capability data is used to indicate permission information of the target application;

[0033] The acquisition module is also used to acquire a process capability table corresponding to the target application according to the capability data when the target application is loaded and running;

[0034] The processing module is used to perform permission verification operation on the target operation according to the process capability table when the target application executes the target operation, and the target operation is calling a heap memory application interface, calling a mapping physical address interface or calling a communication interface.

[0035] In a third aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, they are used to implement the method according to any one of claims 1 to 7.

[0036] In a fourth aspect, the present application provides an electronic device, comprising: at least one processor and a memory; wherein:

[0037] The memory stores computer-executable instructions;

[0038] The at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor performs the method as described in any one of the first aspects.

[0039] The present application provides a permission control method, device, equipment and medium for an intelligent automobile operating system. By obtaining capability data containing permission information of a target application, when the target application is loaded, the process capability table corresponding to the target application is obtained according to the capability data. When the target application executes the target operation, such as calling a heap memory application interface, calling a mapping physical address interface or calling a communication interface, the target operation is subjected to permission verification according to the process capability table. This method effectively avoids the problem of malicious applications consuming system memory, thereby causing other applications to be unable to provide services, and mapping irrelevant physical memory addresses to maliciously damage the system, while preventing malicious applications from snooping and causing sensitive information to be leaked. The reliability and security of the operating system are effectively improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0041] Figure 1 The permission control method process of the intelligent automobile operating system provided in the embodiment of the present application Figure 1 ;

[0042] Figure 2 The permission control method process of the intelligent automobile operating system provided in the embodiment of the present application Figure 2 ;

[0043] Figure 3A A schematic diagram of a process for pre-configuring heap memory permissions provided in an embodiment of the present application;

[0044] Figure 3B A schematic diagram of the permission verification operation flow when calling the heap memory application interface provided in an embodiment of the present application;

[0045] Figure 4Flowchart 3 of the permission control method for the intelligent automobile operating system provided in the embodiment of the present application;

[0046] Figure 5A A schematic diagram of a process for pre-configuring physical memory address permissions provided in an embodiment of the present application;

[0047] Figure 5B A schematic diagram of the permission verification operation flow when calling the mapped physical address interface provided in an embodiment of the present application;

[0048] Figure 6 The permission control method process of the intelligent automobile operating system provided in the embodiment of the present application Figure 4 ;

[0049] Fig. 7A A schematic diagram of the communication authority control process provided in an embodiment of the present application;

[0050] Figure 7B A schematic diagram of the permission verification operation flow when calling a communication interface provided in an embodiment of the present application;

[0051] Figure 8 A diagram of a permission control device for an intelligent automobile operating system provided by an embodiment of the present invention;

[0052] Fig. 9 A hardware schematic diagram of an electronic device provided by an embodiment of the present invention.

[0053] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solutions and advantages of this application clearer, the technical solutions in this application will be clearly and completely described below in conjunction with the drawings in this application. Obviously, the described embodiments are part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0055] The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in sequences other than those illustrated or described herein, for example.

[0056] In the embodiments of the present application, the words "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0057] The smart car operating system is the underlying operating system of the smart car, which is used to control and manage the hardware and software resources of the entire smart car, and provide an interface and environment for users and other software. In existing operating systems, the use of application memory is unlimited, and malicious applications may request to consume all memory, resulting in the inability to use normal system functions; and when applications map physical addresses of memory, there is no restriction on the physical address range, and malicious applications may map irrelevant physical addresses to carry out destructive activities; communication between application processes can establish a communication channel through path information or key value matching. When malicious applications learn the matching value, they can establish inter-process communication with normal applications to obtain sensitive information, resulting in information leakage.

[0058] In some microkernel architectures, a capability allows the capability owner to access entities (such as device USB flash drives, cameras, etc.) or objects (such as files, directories, network ports, and memory, etc.) in the device.

[0059] Therefore, based on the above background and problems, this application proposes a permission control method for an intelligent automobile operating system. Based on Capability, the available heap memory and physical memory of the application are restricted, and permission control is performed for various communication methods between application processes, such as shared memory, message queues, sockets, etc. Specifically, the capability data containing the permission information of the target application is obtained, and when the target application is loaded, the process capability table corresponding to the target application is obtained according to the capability data. When the target application performs the target operation, such as calling the heap memory application interface, calling the mapping physical address interface, or calling the communication interface, the target operation is subjected to permission verification according to the process capability table. This method effectively avoids the problem that malicious applications consume system memory, thereby causing other applications to be unable to provide services, and map irrelevant physical memory addresses to maliciously damage the system. At the same time, limiting communication between application processes can prevent malicious applications from snooping and causing sensitive information to be leaked. The reliability and security of the operating system are effectively improved.

[0060] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0061] Figure 1 The permission control method process of the intelligent automobile operating system provided in the embodiment of the present application Figure 1 .like Figure 1 As shown, the method is applied to the kernel of the intelligent automobile operating system, and includes:

[0062] S101. Acquire capability data of a target application, where the capability data is used to indicate permission information of the target application.

[0063] Exemplarily, the capability data is determined by a description of a capability script.

[0064] It should be noted that the user can define and describe the capabilities that the current application or all applications of the entire system need to use through the capability description script language defined by the operating system, generate a corresponding capability script file, compile the capability script corresponding to the application, and import it into the application for use. One application can correspond to a capability script, which contains all capability data of the application. Specifically, the capability script may include autonomous capability data describing the application, output capability data, and external data representations that represent the association relationship between the application and other applications. Obtain the capability data required by the target application according to the capability script.

[0065] In this embodiment, the capability data of the target application may include the available heap memory size and the permission to access the heap memory, the available physical memory address range and the permission to access the physical memory, and the matching value information and access permission information for communicating with other applications. Any of the access permissions mentioned above may include at least one of read, write, and execute.

[0066] S102: When the target application is loaded and run, obtain a process capability table corresponding to the target application according to the capability data.

[0067] In this step, when the application loader loads the application, it can first read the capability data corresponding to the target application, parse the capability data, and then write it into the process capability table in the kernel through the interface provided by the operating system for storage. Correspondingly, one application can correspond to one process capability table.

[0068] S103: When the target application executes a target operation, a permission verification operation is performed on the target operation according to the process capability table, where the target operation is calling a heap memory application interface, calling a mapping physical address interface, or calling a communication interface.

[0069] In this step, when the application performs some operations, it is implemented by calling the corresponding interface. Specifically, when the target application applies for heap memory, it can apply through heap memory allocation interfaces such as malloc; when the target application applies for physical memory, it can use interfaces such as ioremap that can map physical addresses to map physical addresses; when the target application needs to communicate, it calls the inter-process communication interface.

[0070] According to the target operation performed by the target application, the corresponding permission verification operation is triggered. Specifically, when the target application applies for heap memory or physical memory, the call information when calling the corresponding interface can be compared with the process capability table to confirm whether the call information of the target application meets the permission range required in the process capability table, including the size of memory that can be applied and the permission to access memory. When the target application communicates between processes, it can be confirmed whether there are other corresponding matching applications based on the matching value of the target application in the process capability table and the access rights to communication, so as to communicate with other applications.

[0071] The permission control method of the intelligent automobile operating system provided in this embodiment obtains capability data containing permission information of the target application, and obtains the process capability table corresponding to the target application according to the capability data when the target application is loaded. When the target application executes the target operation, such as calling the heap memory application interface, calling the mapping physical address interface, or calling the communication interface, the target operation is subjected to permission verification according to the process capability table. This method effectively avoids the problem of malicious applications consuming system memory, thereby causing other applications to be unable to provide services, and mapping irrelevant physical memory addresses to maliciously damage the system, while preventing malicious applications from snooping and causing sensitive information to be leaked. The reliability and security of the operating system are effectively improved.

[0072] Figure 2 The permission control method process of the intelligent automobile operating system provided in the embodiment of the present application Figure 2 .like Figure 2 As shown, in Figure 1 Based on the embodiment, the permission verification operation and pre-configuration process of calling the heap memory application interface are described in detail. The method includes:

[0073] S201. Obtain a first preset permission of the target application according to the process capability table, where the first preset permission is used to indicate an available heap memory size corresponding to the target application and the first access permission.

[0074] S202: Configure an upper limit of the available heap memory of the target application according to the available heap memory size, and configure the first access permission in a memory management unit.

[0075] It should be noted that before the target application executes the target operation, the corresponding capabilities can be pre-configured. For the relevant capabilities of the heap memory, that is, the first preset permission, after being obtained through the process capability table, the first preset permission information is notified to the memory manager in the kernel. The upper limit of the available heap memory of the target application and the permission to access the heap memory are pre-configured through the memory manager. Optionally, the access rights to the available heap memory can be set in the MMU (Memory Management Unit) to limit the target application's access rights to the available heap memory. Among them, MMU is a memory management unit, which is computer hardware responsible for processing memory access requests of the central processing unit (CPU). Its functions include conversion of virtual addresses to physical addresses (i.e. virtual memory management), memory protection, and control of the central processing unit cache.

[0076] S203: When the target application calls a heap memory application interface, first calling information when the target application calls the heap memory application interface is obtained, where the first calling information indicates a required heap memory size currently applied for by the target application.

[0077] In this step, when the target application calls the heap memory application interface, the target application will simultaneously input relevant requirement parameters, ie, first calling information, to apply for heap memory based on the calling information.

[0078] S204: Obtain the sum of the required heap memory size and the historically allocated heap memory size, and determine whether the sum exceeds an upper limit of the available heap memory.

[0079] S205: If yes, return the first error code to the target application.

[0080] S206 : If not, apply for heap memory so that the target application uses the required heap memory with a first access permission, where the first access permission is permission for the target application to access available heap memory.

[0081] It should be noted that when the first call information is obtained, the total heap memory allocation amount of the current target application can be compared with the preset upper limit of the available heap memory. If the maximum limit is exceeded, the first error code is returned to indicate that the target application's application for the required heap memory size has exceeded the upper limit of the available heap memory. It should be understood that the total heap memory allocation amount includes the required heap memory size of the current application and the heap memory size that has been allocated historically. Optionally, the above operation can be implemented by a memory manager in the kernel.

[0082] Figure 3A A schematic diagram of a process for pre-configuring heap memory permissions provided in an embodiment of the present application. Figure 3AAs shown, based on the description of the available heap memory size of the target application and the first access right in the capability script, the first preset permission corresponding to the target application is generated. When the target application is loaded and run, the kernel obtains the process capability table corresponding to the target application, and the first preset permission is written into the process capability table. The memory manager in the kernel sets the upper limit of the available heap memory according to the available heap memory size, and sets the first access right to the MMU to limit the target application's access rights to this section of available heap memory.

[0083] Figure 3B This is a schematic diagram of the permission verification operation flow when calling the heap memory application interface provided in the embodiment of the present application. Figure 3B As shown, the target application applies for heap memory by calling a heap memory application interface, such as a malloc interface. The memory manager records the total memory allocation size of the current target application and compares it with the upper limit of the available heap memory. If the upper limit is exceeded, the first error code is returned. If not, the current heap memory application is approved.

[0084] The permission control method of the intelligent automobile operating system provided in this embodiment pre-configures the relevant permissions for the target application to apply for heap memory through the first preset permission in the process capability table, and when the target application calls the heap memory application interface, determines whether the required heap memory size currently applied meets the requirements. If it does, the target application is allowed to use the required heap memory with the first access permission. This method effectively controls the use of heap memory by applications and avoids the problem of disorderly memory use by malicious applications.

[0085] Figure 4 Flowchart 3 of the permission control method for the intelligent automobile operating system provided in the embodiment of the present application. Figure 4 As shown, in Figure 2 Based on the embodiment, the permission verification process when the target application calls the mapped physical interface is described in detail. The method includes:

[0086] S401. When the target application calls a mapped physical address interface, second call information when the target application calls the mapped physical address interface is obtained, where the second call information indicates a required address range currently mapped by the target application.

[0087] S402. Obtain a second preset permission of the target application according to the process capability table, where the second preset permission includes an available physical memory address range of the target application and a second access permission, where the second access permission is permission for the target application to access available physical memory.

[0088] It should be noted that the memory physical address usually mapped by the application is the space address in the register of the device, or it can be the memory physical address of DDR (Double Data Rate) or SRAM (Static Random Access Memory). The range of the physical address can be described by the start address and the end address; or the end address can be determined by knowing the start address and the size of the physical memory (such as the size described by bytes, binary capacity units or decimal capacity units), so as to obtain the range of the physical address.

[0089] S403: Perform an authority verification operation according to the second calling information and the second preset authority.

[0090] Exemplarily, the permission verification operation may include the following steps:

[0091] Determine whether the required address range belongs to the available physical memory address range;

[0092] If yes, mapping the physical address corresponding to the required address range into a virtual address, and configuring a second access permission in the memory management unit so that the target application accesses the virtual address with the second access permission;

[0093] If not, a second error code is returned to the target application.

[0094] It should be noted that for the permission verification operation, it is necessary to first search and verify according to the second preset permission and the second call information to determine whether the physical memory required by the target application meets the requirements. Furthermore, if the required physical memory meets the requirements, the physical address corresponding to the required address range can be mapped to a virtual address, and the second access permission can be configured in the memory management unit (such as MMU) so that the target application can access the corresponding virtual address with the second access permission. If the required physical address does not meet the requirements, a second error code is returned to indicate that the required address range of the target application does not match the available physical address range.

[0095] It should be understood that mapping physical memory addresses to virtual addresses can achieve memory management and address isolation. By mapping physical addresses to virtual addresses, different applications can have their own independent address spaces, thereby ensuring that each application can only access its own address space, improving the security and stability of the system. At the same time, the operating system can dynamically allocate and recycle virtual addresses without having to worry about the actual situation of the physical address, so that multiple applications can share the physical address. In addition, the operating system can therefore perform fine-grained control over the access rights of each application.

[0096] Based on the method of this embodiment, an application can map a specified range of memory physical addresses, while an application that has not been authorized through Capability cannot perform mapping operations on physical memory addresses.

[0097] Figure 5A A schematic diagram of a process for pre-configuring physical memory address permissions provided in an embodiment of the present application. Figure 5A As shown, based on the description of the available physical memory address range and the second access right of the target application by the capability script, the second preset permission corresponding to the target application is generated. When the target application is loaded and run, the kernel obtains the process capability table corresponding to the target application, and the second preset permission is written into the process capability table.

[0098] Figure 5B This is a schematic diagram of the permission verification operation flow when calling the mapped physical address interface provided in the embodiment of the present application. Figure 5B As shown, the target application performs a mapping operation by calling a mapping physical address interface, such as an ioremap interface. The kernel performs capability verification on the second preset permission of the target application. If the required address range of this mapping operation does not match the second preset permission, a second error code is returned to the application; if they match, the memory manager maps the required address to a virtual address and sets the second access permission in the MMU to limit the target application's access rights to the mapped virtual address.

[0099] The permission control method of the intelligent automobile operating system provided in this embodiment verifies the permission through the second call information when the target application calls the mapped physical address interface and the second preset permission in the process capability table, maps the required address that meets the conditions to a virtual address, and configures the corresponding access rights. This method can effectively control the physical memory address range mapped by the application, avoiding the problem of malicious applications mapping irrelevant physical addresses to carry out malicious damage.

[0100] Figure 6 The permission control method process of the intelligent automobile operating system provided in the embodiment of the present application Figure 4 .like Figure 6 As shown, in Figure 4 Based on the embodiment, the permission verification process when the target application calls the communication interface is described in detail. The method includes:

[0101] S601. When the target application calls a communication interface, third calling information when the target application calls the communication interface is obtained according to the process capability table.

[0102] The third call information includes a preset matching value of the target application and a required access permission for the current communication method, and the matching value is file path information or a key value.

[0103] In this step, the communication methods between applications generally include pipes, semaphores, signals, message queues, shared memory or sockets, etc. In this application, the communication of the target application is restricted by setting the matching value and access permission information at the same time through the process capability table. According to the process capability table of the target application, the call information when calling the communication interface is obtained, and the communication process is further matched. Before executing the method of this embodiment, the preset matching value and the required access permission for the current mode have been pre-configured in the process capability table of the target application.

[0104] S602: Determine, according to the third calling information, whether capability information of a candidate application matches the third calling information.

[0105] S603: If yes, allow the target application to communicate with the candidate application corresponding to the target matching value in the current communication mode.

[0106] S604: If not, return a third error code to the target application to reject the communication request of the target application.

[0107] It should be noted that communication between application processes may include communication between two or more applications. Correspondingly, when matching between communications, it is necessary to confirm whether the capability information corresponding to the candidate application matches the call information of the target application, including the target matching value and access permission information. Therefore, the capability information of the successfully matched candidate application also includes the permission to allow applications with the same target matching value to access their own data.

[0108] Exemplarily, the first access permission / the second access permission / the required access permission include at least one of read, write or execute.

[0109] Fig. 7A The following is a schematic diagram of the communication authority control process provided by the embodiment of the present application. Fig. 7A As shown, the access permission control process of shared memory is used as an illustration, and the communication methods between other applications are similar. The target matching value and access permission information are preset in the process capability table corresponding to application 1. The access permission information includes the access permission to other application data and the access permission of other application data to itself. The target matching value and access permission information are also preset in the process capability table corresponding to application 2. At this point, application 1 and application 2 have the ability to perform inter-process communication of the specified method. When application 3 appears, if its corresponding matching value is different from the target matching value or no relevant information is actually configured, it cannot communicate with application 1 and application 2.

[0110] Figure 7B This is a schematic diagram of the authority verification operation flow when calling the communication interface provided in the embodiment of the present application. Figure 7BAs shown, when the target application calls the communication interface, the kernel verifies the capability of the target application and checks the process capability table corresponding to the target application to confirm whether the capability information of the candidate application matches it. If yes, a successful match result is returned to the target application; if no, a third error code is returned to the target application to refuse the target application to communicate using the specified method.

[0111] The permission control method of the intelligent automobile operating system provided in this embodiment verifies the permission of the communication request of the target application through the capability table of the target application. The permission control based on capability limits the scope of users of communication between applications, avoiding the problem of malicious applications snooping and causing sensitive information leakage.

[0112] Figure 8 A diagram of a permission control device for an intelligent automobile operating system provided by an embodiment of the present invention, such as Figure 8 As shown, the control device 80 includes: an acquisition module 801 and a processing module 802 .

[0113] An acquisition module 801 is used to acquire capability data of a target application, where the capability data is used to indicate permission information of the target application;

[0114] The acquisition module 801 is also used to acquire the process capability table corresponding to the target application according to the capability data when the target application is loaded and running;

[0115] The processing module 802 is used to perform permission verification operation on the target operation according to the process capability table when the target application executes the target operation, and the target operation is calling a heap memory application interface, calling a mapping physical address interface or calling a communication interface.

[0116] Fig. 9 Schematic diagram of the hardware of the electronic device provided by the embodiment of the present invention. Fig. 9 As shown, the electronic device 90 provided in this embodiment includes: at least one processor 901 and a memory 902. The device 90 also includes a communication component 903. The processor 901, the memory 902 and the communication component 903 are connected via a bus 904.

[0117] In a specific implementation process, at least one processor 901 executes the computer-executable instructions stored in the memory 902, so that at least one processor 901 executes the above method.

[0118] The specific implementation process of the processor 901 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0119] In the above Fig. 9In the illustrated embodiment, it should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the invention may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0120] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (Non-volatile Memory, NVM), such as at least one disk memory.

[0121] The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0122] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the method described above is implemented.

[0123] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0124] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (Application Specific Integrated Circuits, referred to as: ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0125] The division of the units is only a logical function division, and there may be other divisions in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, which may be electrical, mechanical or other forms.

[0126] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0127] Each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0128] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program codes.

[0129] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0130] Finally, it should be noted that those skilled in the art will readily conceive of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art not disclosed by the present invention, are not limited to the precise structure described above and shown in the drawings, and may be modified and changed in various ways without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A permission control method for an intelligent automobile operating system, characterized in that: Applied to the kernel of the intelligent automobile operating system, the method comprises: Acquire capability data of a target application, where the capability data is used to indicate permission information of the target application; When the target application is loaded and run, obtaining a process capability table corresponding to the target application according to the capability data; When the target application executes a target operation, a permission verification operation is performed on the target operation according to the process capability table, and the target operation is calling a heap memory application interface, calling a mapping physical address interface, or calling a communication interface.

2. The method according to claim 1, characterized in that If the target operation is the calling of the heap memory application interface, performing permission verification operation on the target operation according to the process capability table includes: Acquire first call information when the target application calls a heap memory application interface, wherein the first call information indicates a required heap memory size currently applied for by the target application; Obtaining the sum of the required heap memory size and the historically allocated heap memory size, and determining whether the sum exceeds an upper limit of the available heap memory; If yes, a first error code is returned to the target application; if no, a heap memory application is made so that the target application uses the required heap memory with a first access permission, where the first access permission is the permission for the target application to access available heap memory.

3. The method according to claim 2, characterized in that Before performing the permission verification operation on the target operation according to the process capability table, the method further includes: Acquire a first preset permission of the target application according to the process capability table, where the first preset permission is used to indicate the available heap memory size corresponding to the target application and the first access permission; An upper limit value of the available heap memory of the target application is configured according to the available heap memory size, and the first access permission is configured in a memory management unit.

4. The method according to claim 1, characterized in that: If the target operation is the call mapping physical address interface, performing permission verification operation on the target operation according to the process capability table includes: Acquire second call information when the target application calls the mapped physical address interface, the second call information indicating a required address range currently mapped by the target application; According to the process capability table, obtaining a second preset permission of the target application, where the second preset permission includes an available physical memory address range of the target application and a second access permission, where the second access permission is a permission for the target application to access the available physical memory; Perform an authority verification operation according to the second calling information and the second preset authority.

5. The method according to claim 4, characterized in that The performing of the permission verification operation according to the second calling information and the second preset permission includes: Determine whether the required address range belongs to the available physical memory address range; If yes, mapping the physical address corresponding to the required address range into a virtual address, and configuring a second access permission in the memory management unit so that the target application accesses the virtual address with the second access permission; If not, a second error code is returned to the target application.

6. The method according to claim 1, characterized in that If the target operation is to call a communication interface, performing a permission verification operation on the target operation according to the process capability table includes: According to the process capability table, third calling information when the target application calls the communication interface is obtained, wherein the third calling information includes a preset matching value of the target application and a required access right to the current communication mode, wherein the matching value is file path information or a key value; According to the third calling information, determining whether capability information of a candidate application matches the third calling information; If yes, allowing the target application to communicate with the candidate application corresponding to the target matching value in the current communication mode; If not, a third error code is returned to the target application to reject the communication request of the target application.

7. The method according to any one of claims 1 to 6, characterized in that: The capability data is determined by the description of the capability script; the first access right / the second access right / the required access right includes at least one of read, write or execute.

8. A permission control device for an intelligent automobile operating system, characterized in that: The device comprises: An acquisition module, used to acquire capability data of a target application, wherein the capability data is used to indicate permission information of the target application; The acquisition module is also used to acquire a process capability table corresponding to the target application according to the capability data when the target application is loaded and running; The processing module is used to perform permission verification operation on the target operation according to the process capability table when the target application executes the target operation, and the target operation is calling a heap memory application interface, calling a mapping physical address interface or calling a communication interface.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, they are used to implement the method according to any one of claims 1 to 7.

10. An electronic device, characterized in that: include: at least one processor and memory; wherein, The memory stores computer-executable instructions; The at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor performs the method according to any one of claims 1 to 7.

Images