Method and system for dynamically managing and controlling privacy authority of application program of mobile equipment
By generating user digital signatures using biometrics and password information, and combining this with dynamic permission adjustments using compliance data, the problem of insufficient static authorization in mobile device applications is solved, achieving fine-grained and secure permission management.
Patent Information
- Application Number
- CN202511720063.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-21
- Publication Date
- 2026-01-23
AI Technical Summary
Existing mobile application management backends use static authorization mechanisms for permission control, lacking dynamic adjustment and fine-grained control, leading to permission abuse and insufficient security.
By collecting users' biometric information and verification password information, generating users' digital signatures, and matching them with verification digital signatures, and combining this with compliance data to dynamically adjust permission levels, fine-grained control over user operations can be achieved.
It enables fine-grained and secure privacy permission management for mobile device applications, effectively preventing permission abuse and improving system security and usability.
Smart Images
Figure CN121389095A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The application belongs to the technical field of authority management, and particularly relates to a privacy authority dynamic management and control method and system for mobile device application programs. BACKGROUND
[0002] With the popularity of mobile devices and the explosive growth of the number of users, some mobile device application programs with specific functional and security requirements (such as external service application programs or internal application programs of units or enterprises) need to effectively manage and control the use authority of users to prevent authority abuse, protect user privacy, ensure background data security, reduce resource occupation and interference. However, the existing mobile device application program management background adopts a static authorization mechanism when performing authority management and control, that is, the corresponding authority of the user is granted at one time when the user installs and registers, and the authority is verified only through a static password in the subsequent use process of the user. There are still deficiencies in the security aspect, which need to be improved, and there is a lack of dynamic adjustment and fine control of the authority. SUMMARY
[0003] The purpose of the application is to provide a privacy authority dynamic management and control method and system for mobile device application programs to solve the above problems existing in the prior art.
[0004] In order to achieve the above purpose, the application adopts the following technical solutions: In the first aspect, a privacy authority dynamic management and control method for mobile device application programs is provided, comprising: When a user enables a target application program through a mobile device, biological feature information and verification password information entered by the user are collected; A biological feature vector is extracted based on the biological feature information, and verification data sequence is calculated based on the verification password information; A user digital signature is generated by fusing the biological feature vector and the verification data sequence; The verification digital signature and the configuration authority level associated with the verification digital signature are matched and called from the authority library by using the verification data sequence; The user digital signature and the verification digital signature are verified and matched to obtain a corresponding matching result; When it is determined that the user digital signature and the verification digital signature are successfully matched according to the matching result, use compliance data of the user is obtained, and the configuration authority level is dynamically adjusted based on the use compliance data to obtain a dynamic authority level; It is determined whether the operation of the user on the target application program is out of authority according to the dynamic authority level, and the operation response of the target application program is interrupted when it is determined that the corresponding operation is out of authority.
[0005] In a possible design, the biometric feature information includes a fingerprint image, and the extracting the biometric feature vector based on the biometric feature information includes: performing binarization processing on the fingerprint image to obtain a fingerprint binary image, and performing image filtering processing on the fingerprint binary image to obtain a filtered fingerprint binary image; performing detail feature point extraction on the filtered fingerprint binary image by using a CrossNumber method to obtain a set of detail feature points; performing feature vector coding on the set of detail feature points to obtain the biometric feature vector.
[0006] In a possible design, the calculating the verification data sequence based on the verification password information includes: calculating the verification password information by using a secure hash algorithm to obtain the verification data sequence.
[0007] In a possible design, the generating the user digital signature by fusing the biometric feature vector and the verification data sequence includes: splicing and fusing the biometric feature vector and the verification data sequence to obtain fused feature data, and performing digital signature calculation on the fused feature data to obtain the user digital signature.
[0008] In a possible design, the performing verification matching on the user digital signature and the verification digital signature to obtain a corresponding matching result includes: respectively performing homomorphic encryption processing on the user digital signature and the verification digital signature to obtain a user encrypted signature and a verification encrypted signature, and respectively performing vectorization processing on the user encrypted signature and the verification encrypted signature to obtain a user encrypted signature vector and a verification encrypted signature vector; calculating the Euclidean distance between the user encrypted signature vector and the verification encrypted signature vector, and determining that the user digital signature and the verification digital signature are successfully matched when the Euclidean distance is less than a set threshold, or determining that the user digital signature and the verification digital signature are not successfully matched.
[0009] In a possible design, the obtaining the use compliance data of the user and dynamically adjusting the configuration permission level based on the use compliance data to obtain a dynamic permission level includes: obtaining real-time use location, real-time use time, and historical use behavior records of the user; determining whether the user uses the location in compliance with the real-time use location, determining whether the user uses the time in compliance with the real-time use time, and determining whether the user has historical use risk behaviors according to the historical use behavior records; when it is determined that the user uses the location in compliance, the user uses the time in compliance, and / or the user does not have historical use risk behaviors, performing downgrading processing on the configuration permission level to obtain the dynamic permission level.
[0010] In a possible design, the determining whether the operation of the user on the target application program is unauthorized according to the dynamic permission level includes: determining a set of allowed operation types corresponding to the dynamic permission level, and a real-time operation type when the user performs the operation on the target application program; if the real-time operation type is not in the set of allowed operation types, determining that the operation of the user is unauthorized, or otherwise, determining that the operation of the user is not unauthorized.
[0011] In a possible design, after obtaining the dynamic permission level, the method further includes: determining whether the dynamic permission level is lower than the configuration permission level, and issuing a permission adjustment prompt information to the user based on the target application program when it is determined that the dynamic permission level is lower than the configuration permission level.
[0012] In a second aspect, a privacy permission dynamic management system of a mobile device application program is provided, including an information collection unit, a feature extraction unit, a signature generation unit, a data retrieval unit, a verification matching unit, a dynamic adjustment unit, and a permission management unit, where: The information collection unit is configured to collect biological feature information and verification password information entered by a user when the user enables a target application program through a mobile device. The feature extraction unit is configured to extract a biological feature vector based on the biological feature information, and calculate a verification data sequence based on the verification password information. The signature generation unit is configured to generate a user digital signature by fusing the biological feature vector and the verification data sequence. The data retrieval unit is configured to match and retrieve a verification digital signature and a configuration permission level associated with the verification digital signature from a permission library by using the verification data sequence. The verification matching unit is configured to verify and match the user digital signature and the verification digital signature to obtain a corresponding matching result. The dynamic adjustment unit is configured to, when it is determined that the user digital signature and the verification digital signature are successfully matched according to the matching result, obtain usage compliance data of the user, and dynamically adjust the configuration permission level based on the usage compliance data to obtain a dynamic permission level. The permission management unit is configured to determine whether an operation of the user on the target application program is unauthorized according to the dynamic permission level, and interrupt an operation response of the target application program when it is determined that the operation is unauthorized.
[0013] In a third aspect, a privacy permission dynamic management system of a mobile device application program is provided, including: a memory configured to store instructions; and A processor is configured to read instructions stored in the memory and execute the method for dynamically controlling privacy permissions of a mobile device application according to the instructions.
[0014] In a fourth aspect, a computer readable storage medium is provided, and the computer readable storage medium stores instructions, and when the instructions are executed on a computer, the computer is caused to execute the method for dynamically controlling privacy permissions of a mobile device application according to the first aspect. Meanwhile, a computer program product is also provided, and when the computer program product is executed on a computer, the method for dynamically controlling privacy permissions of a mobile device application according to the first aspect is executed.
[0015] Beneficial effects: The application obtains a user digital signature by deeply fusing biological feature information and verification password information of the user, and then verifies and matches the user digital signature with a verification digital signature to determine a configuration permission level, and then dynamically adjusts the configuration permission level based on usage compliance data of the user to obtain a dynamic permission level, and finally controls the permission of the user to a subsequent operation target application according to the dynamic permission level, so that more fine and safe application privacy permission control can be realized. The application can effectively solve the problems of insufficient static authorization and permission abuse in the prior art by means of two-factor fusion authentication and dynamic permission adjustment, and realize fine-grained permission control in a mobile device application, and has good applicability and promotion prospect. BRIEF DESCRIPTION OF DRAWINGS
[0016] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description only constitute some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor.
[0017] Figure 1 It is a flowchart of the method in the embodiment 1 of the present application. Figure 2 It is a schematic diagram of the system in the embodiment 2 of the present application. Figure 3 It is a schematic diagram of the system in the embodiment 3 of the present application. DETAILED DESCRIPTION
[0018] It should be noted that the description of these embodiments is used to help understand the present application, but does not constitute a limitation of the present application. The specific structures and functional details disclosed herein are only used to describe the example embodiments of the present application. However, the present application can be embodied in many alternative forms, and should not be understood as being limited in the embodiments set forth herein.
[0019] It should be understood that, unless otherwise explicitly specified and limited, the corresponding terms should be understood in a broad sense, for example, "connection" can be fixed connection, or detachable connection, or integrally connected; can be directly connected, or indirectly connected through an intermediate medium, can be internal communication of two elements. For those of ordinary skill in the art, the specific meaning of the above terms in the embodiments can be understood according to the specific circumstances.
[0020] In the following description, specific details are provided to facilitate a full understanding of the example embodiments. However, one of ordinary skill in the art will understand that the example embodiments can be implemented without these specific details. For example, devices can be shown in block diagrams to avoid obscuring the examples with unnecessary detail. In other embodiments, well-known processes, structures, and techniques can not be shown in unnecessary detail in order to avoid obscuring the embodiments.
[0021] Embodiment 1: The embodiment provides a privacy permission dynamic management method of a mobile device application program, which can be applied to a permission management background of a mobile device application program, such as Figure 1 As shown in the figure, the method comprises the following steps: S1. Collecting biological feature information and verification password information entered by a user when the user enables a target application program through a mobile device.
[0022] In specific implementation, when the user logs in to enable the target application program through the mobile device, the biological feature information (including a fingerprint image) and the verification password information (i.e. a verification code) are first entered through the mobile device, and the target application program uploads the biological feature information and the verification password information entered by the user to the management background, and at the same time, uploads the use compliance data (including real-time use location, real-time use time and historical use behavior record of the user) of the user to the management background, so as to make corresponding permission determination by the management background.
[0023] S2. Extracting a biological feature vector based on the biological feature information, and calculating a verification data sequence based on the verification password information.
[0024] In specific implementation, the management background performs binaryzation processing on the fingerprint image to obtain a fingerprint binary image, and performs image filtering processing on the fingerprint binary image to obtain a filtered fingerprint binary image; adopts a CrossNumber method to extract detail feature points from the filtered fingerprint binary image to obtain a detail feature point set; and encodes the detail feature point set to obtain a biological feature vector. At the same time, a secure hash algorithm (such as SHA-256) is used to calculate the verification password information to obtain a verification data sequence.
[0025] S3. Fuse the biometric feature vector and the verification data sequence to generate a user digital signature.
[0026] In specific implementation, the management background splices and fuses the biometric feature vector and the verification data sequence to obtain fused feature data, and performs digital signature calculation on the fused feature data to obtain the user digital signature.
[0027] S4. Match and call the verification digital signature and the configuration permission level associated with the verification digital signature from the permission library using the verification data sequence.
[0028] In specific implementation, the management background can traverse and search the verification data sequence matching verification digital signature and the configuration permission level associated with the verification digital signature from the permission library. The permission library is preconfigured with verification digital signatures corresponding to a plurality of verification data sequences and the configuration permission levels associated with the verification digital signatures. Illustratively, if the configuration permission level is three, it corresponds to full access permission, and has all permissions such as read, write, execute, and delete. If the configuration permission level is two, it corresponds to limited access permission, and has read and write permissions but restricts sensitive operation permissions. If the configuration permission level is two, it corresponds to read-only permission, which only reads and has no modification permission.
[0029] S5. Verify and match the user digital signature and the verification digital signature to obtain a corresponding matching result.
[0030] In specific implementation, the management background can perform homomorphic encryption processing on the user digital signature and the verification digital signature respectively to obtain user encrypted signature and verification encrypted signature, and perform vectorization processing on the user encrypted signature and the verification encrypted signature respectively to obtain user encrypted signature vector and verification encrypted signature vector. Then, the Euclidean distance between the user encrypted signature vector and the verification encrypted signature vector is calculated, and when the Euclidean distance is less than a set threshold, it is determined that the user digital signature and the verification digital signature match successfully, otherwise, it is determined that the user digital signature and the verification digital signature do not match successfully.
[0031] S6. When it is determined that the user digital signature and the verification digital signature match successfully according to the matching result, obtain the use compliance data of the user, and dynamically adjust the configuration permission level based on the use compliance data to obtain a dynamic permission level.
[0032] In specific implementation, when the management background determines that the user digital signature matches the verification digital signature according to the matching result, the management background acquires the user's use compliance data, including the user's real-time use location, real-time use time and historical use behavior record, and then determines whether the user's use location is compliant according to the real-time use location, whether the user's use time is compliant according to the real-time use time, and whether the user has historical use risk behavior according to the historical use behavior record. When it is determined that the user's use location is not compliant, the user's use time is not compliant and / or the user has historical use risk behavior (such as high-frequency login access behavior at different use locations in a certain historical time period), the configuration permission level is downgraded to obtain a dynamic permission level. When the management background determines that the dynamic permission level is lower than the configuration permission level, the management background can send a permission adjustment prompt information to the user based on the target application program, so that the user pays attention to the user's permission range or performs corresponding permission appeal processing, etc.
[0033] S7. Determine whether the user's subsequent operation on the target application program is out of authority according to the dynamic permission level, and interrupt the operation response of the target application program when it is determined that the corresponding operation is out of authority.
[0034] In specific implementation, the management background determines the set of allowed operation types corresponding to the dynamic permission level (such as read, write, execute and delete for three levels, read and write for two levels, and only read for one level), and determines the real-time operation type of the user when the user subsequently operates the target application program. If the real-time operation type is not in the set of allowed operation types, it is determined that the user's operation is out of authority, otherwise, it is determined that the user's operation is not out of authority. When it is determined that the user's corresponding operation is out of authority, the operation response of the target application program to the user is directly interrupted.
[0035] The method can achieve more fine and secure application program privacy permission control by collecting the user's biometric information and verification password information for deep fusion to obtain a user digital signature, verifying and matching the user digital signature with a verification digital signature to determine a configuration permission level, dynamically adjusting the configuration permission level based on the user's use compliance data to obtain a dynamic permission level, and finally controlling the user's subsequent operation on the target application program according to the dynamic permission level.
[0036] Embodiment 2 The embodiment provides a mobile device application program privacy permission dynamic control system, as shown in Figure 2 The system includes an information collection unit, a feature extraction unit, a signature generation unit, a data retrieval unit, a verification and matching unit, a dynamic adjustment unit and a permission control unit, wherein: The information collection unit is configured to collect biometric information and verification password information entered by a user when the user enables a target application program through a mobile device. The feature extraction unit is used to extract biometric vectors based on biometric information and to calculate the verification data sequence based on the verification password information. The signature generation unit is used to generate a user's digital signature by fusing biometric vectors and verification data sequences. The data retrieval unit is used to retrieve the verification digital signature and the configuration permission level associated with the verification digital signature from the permission database by matching the verification data sequence. The verification and matching unit is used to verify and match the user's digital signature with the verification digital signature to obtain the corresponding matching result. The dynamic adjustment unit is used to obtain the user's usage compliance data when the user's digital signature and the verified digital signature are successfully matched according to the matching result, and to dynamically adjust the configured permission level based on the usage compliance data to obtain the dynamic permission level. The access control unit is used to determine whether a user's subsequent operation on the target application is unauthorized based on the dynamic access level, and to interrupt the operation response of the target application when the corresponding operation is determined to be unauthorized.
[0037] Example 3: This embodiment provides a dynamic privacy permission management system for mobile device applications, such as... Figure 3 As shown, at the hardware level, it includes: The data interface is used to establish data communication between the processor and external data terminals; Memory, used to store instructions; The processor is configured to read instructions stored in the memory and execute the method for dynamic management of privacy permissions of mobile device applications in Embodiment 1 according to the instructions.
[0038] Optionally, the system further comprises an internal bus, the processor and the memory and the data interface can be connected with each other through the internal bus, the internal bus can be a PCIe (Peripheral Component Interconnect Eexpress) bus, the bus can be divided into an address bus, a data bus, a control bus and the like. The memory can include, but is not limited to, a random access memory (Random Access Memory, RAM), a read-only memory (Read Only Memory, ROM), a flash memory (Flash Memory), a first-in first-out memory (First Input First Output, FIFO) and / or a first-in last-out memory (First In Last Out, FILO) and the like. The processor can be a general-purpose processor, including a central processing unit (Central Processing Unit, CPU), a network processor (Network Processor, NP) and the like; can also be a digital signal processor (Digital Signal Processor, DSP), an application specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.
[0039] Embodiment 4: The embodiment provides a computer readable storage medium, and instructions are stored on the computer readable storage medium, and when the instructions are run on a computer, the computer executes the privacy permission dynamic management method of the mobile device application program in the embodiment 1. Wherein, the computer readable storage medium refers to a carrier for storing data, and can include, but is not limited to, a floppy disk, an optical disc, a hard disk, a flash memory, a USB flash disk and / or a memory stick and the like, and the computer can be a general-purpose computer, a special-purpose computer, a computer network or other programmable devices.
[0040] The embodiment further provides a computer program product, and when the computer program product is run on a computer, the privacy permission dynamic management method of the mobile device application program in the embodiment 1 is executed. Wherein, the computer can be a general-purpose computer, a special-purpose computer, a computer network or other programmable devices.
[0041] Finally, it should be noted that the above description is only the preferred embodiment of the present application, and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.
Claims
1. A method for dynamically managing privacy permissions of mobile device applications, characterized in that, include: When a user activates the target application via a mobile device, the system collects the user's biometric information and verification password information. Biometric vectors are extracted based on biometric information, and verification data sequences are calculated based on verification password information. A user's digital signature is generated by fusing biometric vectors and verification data sequences. The verification data sequence is used to match and retrieve the verification digital signature and the configuration permission level associated with the verification digital signature from the permission database; The user's digital signature is verified and matched with the verification digital signature to obtain the corresponding matching result; When the matching result determines that the user's digital signature and the verified digital signature are successfully matched, the user's usage compliance data is obtained, and the configured permission level is dynamically adjusted based on the usage compliance data to obtain the dynamic permission level; The system determines whether a user's subsequent actions on the target application are unauthorized based on the dynamic permission level, and interrupts the target application's operation response when the corresponding action is determined to be unauthorized.
2. The method for dynamic management of privacy permissions in a mobile device application according to claim 1, characterized in that, The biometric information includes fingerprint images, and the extraction of biometric feature vectors based on the biometric information includes: The fingerprint image is binarized to obtain a binary fingerprint image, and then the binary fingerprint image is filtered to obtain a filtered binary fingerprint image. The CrossNumber method is used to extract minutiae from the filtered binary fingerprint image to obtain a set of minutiae. Feature vector encoding is performed on the set of detailed feature points to obtain biological feature vectors.
3. The method for dynamic control of privacy permissions in a mobile device application according to claim 1, characterized in that, The calculation of the verification data sequence based on the verification password information includes: A secure hash algorithm is used to calculate the verification password information to obtain a verification data sequence.
4. The method for dynamic control of privacy permissions in a mobile device application according to claim 1, characterized in that, The process of generating a user's digital signature by fusing biometric feature vectors and verification data sequences includes: The biometric vector and the verification data sequence are spliced and fused to obtain fused feature data, and the fused feature data is used to calculate the digital signature to obtain the user's digital signature.
5. The method for dynamic management of privacy permissions in a mobile device application according to claim 1, characterized in that, The process of verifying and matching the user's digital signature with the verification digital signature to obtain the corresponding matching result includes: Homomorphic encryption is applied to the user's digital signature and the verification digital signature respectively to obtain the user's encrypted signature and the verification encrypted signature. The user's encrypted signature and the verification encrypted signature are then vectorized to obtain the user's encrypted signature vector and the verification encrypted signature vector respectively. Calculate the Euclidean distance between the user's encrypted signature vector and the verification encrypted signature vector. If the Euclidean distance is less than a set threshold, the user's digital signature and the verification digital signature are considered to match successfully. Otherwise, the user's digital signature and the verification digital signature are considered to match unsuccessfully.
6. The method for dynamic control of privacy permissions in a mobile device application according to claim 1, characterized in that, The process of obtaining user compliance data and dynamically adjusting the configured permission level based on the compliance data to obtain a dynamic permission level includes: Obtain the user's real-time location, real-time usage time, and historical usage behavior records; The system determines whether a user's location usage is compliant based on real-time location, whether a user's time usage is compliant based on real-time usage time, and whether a user has a history of risky usage behavior based on historical usage records. When a user is found to have non-compliant location usage, non-compliant usage time, and / or has a history of risky usage behavior, the configured permission level is downgraded to obtain a dynamic permission level.
7. The method for dynamic control of privacy permissions in a mobile device application according to claim 1, characterized in that, The step of determining whether a user's subsequent operations on the target application are unauthorized based on dynamic permission levels includes: Determine the set of allowed operation types corresponding to the dynamic permission level, as well as the real-time operation types when the user subsequently performs operations on the target application; If the real-time operation type is not within the set of allowed operation types, the user's operation is deemed to be unauthorized; otherwise, the user's operation is deemed not to be unauthorized.
8. The method for dynamic control of privacy permissions for mobile device applications according to claim 1, characterized in that, After obtaining the dynamic permission level, the method further includes: Determine if the dynamic permission level is lower than the configured permission level, and if so, send a permission adjustment prompt to the user based on the target application.
9. A dynamic privacy permission management system for mobile device applications, characterized in that, It includes an information collection unit, a feature extraction unit, a signature generation unit, a data retrieval unit, a verification and matching unit, a dynamic adjustment unit, and an access control unit, among which: The information collection unit is used to collect the biometric information and verification password information entered by the user when the user enables the target application through a mobile device. The feature extraction unit is used to extract biometric vectors based on biometric information and to calculate the verification data sequence based on the verification password information. The signature generation unit is used to generate a user's digital signature by fusing biometric vectors and verification data sequences. The data retrieval unit is used to retrieve the verification digital signature and the configuration permission level associated with the verification digital signature from the permission database by matching the verification data sequence. The verification and matching unit is used to verify and match the user's digital signature with the verification digital signature to obtain the corresponding matching result. The dynamic adjustment unit is used to obtain the user's usage compliance data when the user's digital signature and the verified digital signature are successfully matched according to the matching result, and to dynamically adjust the configured permission level based on the usage compliance data to obtain the dynamic permission level. The access control unit is used to determine whether a user's subsequent operation on the target application is unauthorized based on the dynamic access level, and to interrupt the operation response of the target application when the corresponding operation is determined to be unauthorized.
10. A dynamic privacy permission management system for mobile device applications, characterized in that, include: Memory, used to store instructions; A processor is configured to read instructions stored in the memory and execute, according to any one of claims 1-8, a method for dynamic management of privacy permissions for a mobile device application.