Small program permission control method and device based on swan gap system

Abstract

The invention discloses an applet permission control method and device based on a swan gap system. The method comprises the following steps: acquiring current running scene information of the applet, wherein the running scene information comprises a program running state and a function calling scene; according to the running scene information and preset permission hierarchical configuration, determining permission level requirements of the applet, the preset permission hierarchical configuration comprising a plurality of permission levels, and one permission level corresponding to one privacy sensitivity; under the condition that the permission level demand belongs to a first level range in the preset permission level configuration, directly executing authorization operation according to the permission level demand; and under the condition that the permission level demand belongs to a second level range in the preset permission level configuration, displaying permission prompt information, and executing an authorization operation or an unauthorized operation based on a user operation instruction.

Description

Technical Field

[0001] This application relates to the field of privacy protection technology, and more specifically, to a method and apparatus for controlling the permissions of mini-programs based on the HarmonyOS system. Background Technology

[0002] In the HarmonyOS ecosystem, mini programs, as lightweight applications, are widely used in various scenarios. During their operation, they often need to access privacy permissions of varying sensitivity, such as network access, location, and device information. It is necessary to ensure that the functions can be implemented normally while preventing the risk of privacy data leakage. Therefore, the fine-grained control of permissions has become a core requirement.

[0003] In existing technologies, the permission control of HarmonyOS and third-party mini-programs mostly adopts a static authorization mode, that is, all requested permissions are obtained at once during installation or first launch, and the authorization is valid for a long time; some solutions divide permission levels, but they are not related to the use case.

[0004] However, this type of solution has significant drawbacks: First, static authorization lacks flexibility, and the mini-program still holds highly sensitive permissions when running in the background or in unnecessary scenarios, which can easily lead to the abuse of privacy data; second, the permission level division is out of touch with the actual scenario, resulting in over-authorization or insufficient permissions, which cannot meet the compliance requirements for privacy protection. Summary of the Invention

[0005] The main purpose of this application is to provide a method and device for controlling the permissions of mini programs based on the HarmonyOS system, in order to solve the problems of rigid static authorization of permissions in HarmonyOS mini programs, the disconnect between hierarchical classification and scenarios, and to achieve fine-grained permission classification and dynamic adaptation of authorization according to scenarios. This can effectively prevent privacy leakage and ensure compliance.

[0006] To achieve the above objectives, a first aspect of this application proposes a method for controlling the permissions of a mini-program based on the HarmonyOS system, comprising: obtaining the current running scenario information of the mini-program, the running scenario information including the program's running state and function call scenarios; determining the permission level requirements of the mini-program based on the running scenario information and a preset permission level configuration, the preset permission level configuration including multiple permission levels, each permission level corresponding to a privacy sensitivity; when the permission level requirement falls within the first level range of the preset permission level configuration, directly performing an authorization operation according to the permission level requirement; when the permission level requirement falls within the second level range of the preset permission level configuration, displaying permission prompt information, and performing an authorization operation or a non-authorization operation based on user operation instructions; wherein, the permission prompt information is used to indicate the permission level, usage scenario, and data purpose corresponding to the permission level requirement, and the privacy sensitivity of the permission levels in the second level range is higher than that of the permission levels in the first level range.

[0007] According to the method for controlling the permissions of a mini-program based on the HarmonyOS system provided in this application, before obtaining the current running scenario information of the mini-program, the method further includes: dividing the permissions of the mini-program into multiple permission levels according to the data privacy sensitivity and the importance of the functional scenario; adding permission level identifiers to the permission declaration field of the basic configuration file of the mini-program, with one permission level corresponding to one permission level identifier; and determining the preset permission level configuration by loading the basic configuration file when the mini-program starts.

[0008] According to the mini-program permission control method based on HarmonyOS provided in this application, after performing the authorization operation, the method further includes: updating the permission status of the mini-program according to a preset rule base when preset adjustment conditions are met; wherein, the preset rule base includes scenario adaptation rules, risk assessment rules, and user preference rules, and the preset adjustment conditions include changes in the functional scenarios of the mini-program and / or the discovery of preset high-risk behaviors.

[0009] According to the method for controlling the permission of a mini-program based on the HarmonyOS system provided in this application, the step of updating the permission status of the mini-program according to a preset rule base includes: updating the permission status of the mini-program through the application permission management dedicated interface set of the HarmonyOS system according to the preset rule base.

[0010] According to the mini-program permission control method based on HarmonyOS provided in this application, after obtaining the current running scenario information of the mini-program, the method further includes: outputting permission warning information when preset risk warning conditions are met; wherein, the preset risk warning conditions include the call frequency of permission levels in the second level range being higher than the warning frequency value, unauthorized permissions being illegally called, and abnormal cross-terminal transmission of data obtained through permission levels in the second level range, and the permission warning information is used to remind the user that the mini-program has a risk of abnormal use of privacy permissions.

[0011] According to the method for controlling the permissions of a mini-program based on the HarmonyOS system provided in this application, the method further includes: collecting the permission call log of the mini-program; and displaying historical permission call information according to the permission call log when a user's query instruction is received.

[0012] This application also provides a mini-program permission control device based on the HarmonyOS system, comprising the following modules: an acquisition module, a processing module, and an execution module; the acquisition module is used to acquire the current running scenario information of the mini-program, the running scenario information including the program running status and function call scenario; the processing module is used to determine the permission level requirements of the mini-program according to the running scenario information and a preset permission level configuration, the preset permission level configuration including multiple permission levels, each permission level corresponding to a privacy sensitivity; the execution module is used to directly execute the authorization operation according to the permission level requirements when the permission level requirements fall within the first level range of the preset permission level configuration; when the permission level requirements fall within the second level range of the preset permission level configuration, display permission prompt information and execute the authorization operation or non-authorization operation based on the user's operation command; wherein, the permission prompt information is used to indicate the permission level, usage scenario, and data purpose corresponding to the permission level requirements, and the privacy sensitivity of the permission levels in the second level range is higher than that of the permission levels in the first level range.

[0013] According to the mini-program permission control device based on HarmonyOS provided in this application, before obtaining the current running scenario information of the mini-program, the processing module is used to divide the permissions of the mini-program into multiple permission levels according to the data privacy sensitivity and functional scenario importance; add permission level identifiers to the permission declaration field of the basic configuration file of the mini-program, with one permission level corresponding to one permission level identifier; and determine the preset permission level configuration by loading the basic configuration file when the mini-program starts.

[0014] According to the mini-program permission control device based on HarmonyOS provided in this application, after the authorization operation is performed, the execution module is used to update the permission status of the mini-program according to the preset rule base when the preset adjustment conditions are met; wherein, the preset rule base includes scenario adaptation rules, risk assessment rules and user preference rules, and the preset adjustment conditions include changes in the functional scenario of the mini-program and / or the discovery of preset high-risk behaviors.

[0015] According to the mini-program permission control device based on HarmonyOS provided in this application, the step of updating the permission status of the mini-program according to the preset rule base includes: updating the permission status of the mini-program through the application permission management dedicated interface set of HarmonyOS according to the preset rule base.

[0016] According to the mini-program permission control device based on the HarmonyOS system provided in this application, after obtaining the current running scenario information of the mini-program, the execution module is used to output permission warning information when preset risk warning conditions are met; wherein, the preset risk warning conditions include the call frequency of permission levels in the second level range being higher than the warning frequency value, unauthorized permissions being illegally called, and abnormal cross-terminal transmission of data obtained through permission levels in the second level range, and the permission warning information is used to remind the user that there is a risk of abnormal use of privacy permissions in the mini-program.

[0017] According to the mini-program permission control device based on HarmonyOS provided in this application, the execution module is used to collect the permission call log of the mini-program; when receiving a user's query command, it displays historical permission call information according to the permission call log.

[0018] This application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the mini-program permission control method based on HarmonyOS as described above.

[0019] This application also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the applet permission control method based on HarmonyOS as described above.

[0020] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the mini-program permission control method based on HarmonyOS as described above.

[0021] The technical solutions provided by the embodiments of this application may include the following beneficial effects: In this application, since the preset permission level configuration divides permissions into multiple levels according to privacy sensitivity, and determines the permission level requirements in combination with the current running scenario information of the mini program, it can achieve accurate matching between permissions and scenarios, and solve the problem of over-authorization or insufficient permissions caused by the disconnect between permission level division and scenario in the prior art. Because the first level of permissions with low sensitivity is directly granted to ensure basic operation, while the second level of permissions with high sensitivity are granted by displaying prompts that include the permission level, usage scenario and data purpose and are based on user instructions, it takes into account both ease of use and allows users to clearly understand the purpose of the permissions and make their own decisions, thereby reducing the risk of misuse of privacy data. By abandoning the static authorization model and granting only the necessary permissions in the corresponding scenarios, it avoids situations where highly sensitive permissions are still held when the mini-program is running in the background or in unnecessary scenarios, thereby improving the fineness of privacy protection and meeting privacy protection compliance requirements. Attached Figure Description

[0022] The accompanying drawings, which form part of this application, are used to provide a further understanding of the application and to make other features, objects, and advantages of the application more apparent. The illustrative embodiments and descriptions of this application are used to explain the application and do not constitute an undue limitation of the application. In the drawings: Figure 1 One of the flowcharts illustrating the WeChat Mini Program permission control method based on the HarmonyOS system provided in this application; Figure 2 The second flowchart illustrating the method for controlling the permissions of mini-programs based on the HarmonyOS system provided in this application; Figure 3 A schematic diagram of the permission level processing flow provided for this application; Figure 4 This is a schematic diagram of the structure of the mini-program permission control device based on the HarmonyOS system provided by the present invention; Figure 5 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0023] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present application.

[0024] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this application described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0025] In this application, the terms "upper," "lower," "left," "right," "front," "rear," "top," "bottom," "inner," "outer," "middle," "vertical," "horizontal," "lateral," and "longitudinal" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. These terms are primarily for the purpose of better describing this application and its embodiments, and are not intended to limit the indicated device, element, or component to having a specific orientation, or to be constructed and operated in a specific orientation.

[0026] Furthermore, in addition to indicating location or positional relationship, some of the aforementioned terms may also have other meanings. For example, the term "above" may also be used in some cases to indicate a certain dependency or connection relationship. Those skilled in the art can understand the specific meaning of these terms in this application based on the specific circumstances.

[0027] Furthermore, the terms "installation," "setup," "equipped with," "connection," "linked," and "socketing" should be interpreted broadly. For example, "connection" can be a fixed connection, a detachable connection, or an integral structure; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, or an internal connection between two devices, components, or parts. Those skilled in the art can understand the specific meaning of the above terms in this application according to the specific circumstances.

[0028] This application describes some exemplary embodiments for illustrative purposes. It should be understood that this application may be implemented in other ways not specifically shown in the accompanying drawings.

[0029] like Figure 1 and Figure 2 As shown, this application provides a method for controlling the permissions of mini-programs based on the HarmonyOS system. This method can be applied to a device for controlling the permissions of mini-programs based on the HarmonyOS system. The method may include steps S101-S104: S101. The mini-program permission control device based on the HarmonyOS system obtains the current running scenario information of the mini-program.

[0030] The aforementioned runtime scenario information includes program runtime status and function call scenarios.

[0031] Specifically, after a mini-program in the HarmonyOS system is launched and initialized, the mini-program permission control device can monitor the lifecycle status of the mini-program through the lifecycle management component of the HarmonyOS system, capture the switching of program running status and function call scenarios in real time, and obtain the running scenario information. This lifecycle management component can be the AbilityStage component.

[0032] It should be noted that the above program running states refer to the lifecycle stages of the mini program in the HarmonyOS system, including startup initialization, active running in the foreground, background suspension, and destruction. For example, when a user opens the mini program to perform a function operation, it is in the foreground active running state; when the user switches the mini program to the desktop but does not close it, it is in the background suspension state.

[0033] It should be noted that the above-mentioned function call scenarios refer to the specific functional requirements triggered by the mini program, such as calling location permission for map navigation, calling device information permission for device adaptation, and calling network permission for data loading.

[0034] S102. The mini-program permission control device based on the HarmonyOS system determines the permission level requirements of the mini-program according to the running scenario information and the preset permission level configuration.

[0035] The preset permission level configuration includes multiple permission levels, with each permission level corresponding to a privacy sensitivity level.

[0036] Optionally, before obtaining the current running scenario information of the mini program, the mini program permission control device may first divide the permissions of the mini program into multiple permission levels according to the data privacy sensitivity and the importance of the functional scenario; add permission level identifiers to the permission declaration field of the basic configuration file of the mini program, with one permission level corresponding to one permission level identifier; and determine the preset permission level configuration by loading the basic configuration file when the mini program starts.

[0037] Specifically, such as Figure 3As shown, mini-program developers can submit permission requests for their mini-programs in the HarmonyOS system's operation and management backend. These permission requests can include the privacy sensitivity and functional scenario importance of each permission. Privacy sensitivity can be divided into several different levels, such as normal, sensitive, and highly sensitive, while functional scenario importance can be divided into several different levels, such as core, secondary, and auxiliary. The mini-program permission control device can obtain the permission request through the management backend and review it. The review includes checking whether information such as privacy sensitivity and functional scenario importance is complete. If the review fails, the mini-program developer is prompted to resubmit the permission request. If the review succeeds, the mini-program permission control device can divide the mini-program's permissions into multiple permission levels based on the two dimensions of data privacy sensitivity and functional scenario importance, and prompt the mini-program developer to continue to supplement the permission description, applicable scenarios, and other information. Then, all information is packaged to generate a preset permission level configuration. After that, the mini-program permission control device can add permission level identifiers to the permission declaration field of the mini-program's basic configuration file module.json5, and supplement the description of the corresponding functional scenario and data purpose. The basic configuration file module.json5 is then packaged and deployed together with the mini-program package to ensure that the level rules can be correctly identified. When the mini-program starts, the basic configuration file is loaded through the configuration loading interface of the MCloud SDK, and the permission name, level identifier, functional scenario description, and other information in it are parsed to determine the preset permission level configuration.

[0038] For example, mini-program permissions can be divided into five levels, L1 to L5, with each level corresponding to a unique level of privacy sensitivity and an increasing degree of strictness in permission control. Specifically: Level L1 is a basic permission, corresponding to permissions with low privacy sensitivity and essential for functional scenarios, such as reading basic device information and connecting to the network. For example, the network access permission of the HarmonyOS system is only used for loading basic data of the mini program. Level L2 is a general permission, covering medium privacy-sensitive permissions such as device identification and network status query. It is suitable for assisting in the implementation of functional scenarios, such as device information access permissions in device compatibility adaptation scenarios. Level L3 is a sensitive permission, involving highly privacy-sensitive permissions such as location information and frequently used account information. It corresponds to core functional scenarios, such as location permissions for food delivery address location and map navigation. Level L4 is a highly sensitive permission, including permissions that are directly related to the user's core privacy data, such as contacts, photo album, and SMS messages. It is suitable for special functional scenarios, such as contact access permissions in friend invitation scenarios. Level L5 is an extremely sensitive permission, covering highly sensitive permissions such as payment information and biometric data. It can only be used for critical functional scenarios such as payment and identity verification, and must meet the highest security control requirements of the HarmonyOS system.

[0039] The mini-program permission control device determines the permission level requirements of the mini-program based on the running scenario information and the preset permission level configuration, including: first, retrieving the preset permission level configuration loaded and parsed by the MCloud SDK to clarify the control rules and calling prerequisites for each level of permission; then, performing multi-dimensional matching in conjunction with the collected running scenario information to clarify the permission level requirements of the mini-program.

[0040] For example, if the app is actively running in the foreground and the current function call scenario is a core business scenario, then higher-level permissions will be prioritized; if it is suspended in the background, then only lower-level permissions required to maintain basic operation will be matched. Alternatively, based on the specific function currently triggered by the mini-program, the corresponding permission level can be found in the preset permission hierarchy configuration. For example, when location-related functions are triggered, L3 sensitive permissions will be matched; when contact access is triggered, L4 highly sensitive permissions will be matched; and when basic data loading is triggered, L1 basic permissions will be matched. Simultaneously, the privacy sensitivity threshold corresponding to the permission level will be used to verify whether the current running scenario meets the calling conditions for that level of permission. For example, L5 extremely sensitive permissions are only allowed to be triggered in critical scenarios such as payment and identity verification, and when the app is actively running in the foreground.

[0041] Optionally, during the determination process, if the running scenario information completely matches the adaptation range of a certain permission level, then that level is directly determined as the current permission level requirement; if there are cross-level function call scenarios, such as triggering basic functions and sensitive functions in the same running state, then the requirement is determined according to the highest sensitivity level permission, and the associated lower level permissions are marked as auxiliary requirements simultaneously; if the scenario information does not have a direct match with the preset configuration, then the adaptation is downgraded based on the importance of the functional scenario, prioritizing the minimum permission level requirement required by the core function, ensuring accurate adaptation between permission level requirements and running scenarios, which can both meet the normal operation of the mini program functions and avoid the risk of over-authorization.

[0042] S103. If the permission level requirement falls within the first level range of the preset permission level configuration, the authorization operation is performed directly according to the permission level requirement.

[0043] It should be noted that the first level range refers to the set of permissions with low privacy sensitivity in the preset permission hierarchy configuration, which are only used to support the basic operation of the mini program. For example, the first level range may include L1 level permissions and L2 level permissions.

[0044] For example, when the permission level requirement of a mini program is determined to be L1, the mini program permission control device can directly initiate an authorization command through the FinAppClient API, the dedicated interface set for application permission management of the HarmonyOS system. The underlying system will automatically grant the mini program the right to use this level of permission.

[0045] Optionally, during the authorization process, the MCloud SDK can synchronously record permission authorization logs, including authorization time, corresponding function call scenarios, permission names and levels, and other information.

[0046] S104. If the permission level requirement falls within the second level range of the preset permission level configuration, display permission prompt information and perform an authorization operation or a non-authorization operation based on the user's operation command.

[0047] The permission prompt information is used to indicate the permission level, usage scenario, and data purpose corresponding to the permission level requirement. The privacy sensitivity of the permission levels in the second level range is higher than that of the permission levels in the first level range.

[0048] It should be noted that the second level range refers to the set of permissions with high privacy sensitivity in the preset permission level configuration, which are associated with the core functions or core privacy data of the mini program. For example, the second level range may include L3 permissions, L4 permissions, and L5 permissions.

[0049] Specifically, when the permission request is determined to fall within the second level, the mini-program permission control device can trigger the display of permission prompt information through the HarmonyOS native pop-up component. The pop-up content can include the permission name, corresponding permission level, function usage scenario, and data purpose. For example, the pop-up content could be "Requesting L3 level location permission for accurate location of food delivery addresses. This permission will only be used when the mini-program is active in the foreground and will not leak historical location data." It also provides three operation options for the user: "Allow," "Deny," and "Allow only this time." If the user selects "Allow," persistent authorization is granted, and no further prompts are needed in the same scenario. If "Allow only this time" is selected, temporary authorization is granted, and the permission will be automatically revoked when the mini-program exits or switches to the background. If "Deny" is selected, authorization is denied, and a denial log is recorded. If the permission request is triggered again, the user must manually enable the permission in the system settings.

[0050] Optionally, if the mini-program is actively running in the foreground and triggers a core function call, a pop-up window will appear in real time; if the mini-program is in a background suspended state and triggers the permission requirement, the pop-up window will not appear temporarily, and the authorization prompt will be displayed after the mini-program switches back to the foreground.

[0051] Optionally, after performing the authorization operation, the method further includes: updating the permission status of the mini-program according to a preset rule base when preset adjustment conditions are met, otherwise maintaining the current permission status; wherein, the preset rule base includes scenario adaptation rules, risk assessment rules, and user preference rules, and the preset adjustment conditions include changes in the functional scenarios of the mini-program and / or the discovery of preset high-risk behaviors.

[0052] Specifically, the preset rule base is a dynamically adjusted rule engine built into the mini-program permission control device, covering at least three categories of rules: scenario adaptation rules, risk assessment rules, and user preference rules. After the mini-program completes authorization and enters the permission usage stage, the mini-program permission control device can continuously monitor changes in functional scenarios through the HarmonyOS AbilityStage component, and at the same time rely on the MCloud SDK to monitor permission call behavior and data interaction status, and detect in real time whether the preset adjustment conditions are met. For example, if the mini-program switches from a core function (such as food delivery location) to an auxiliary function (such as message notification), it is determined that the functional scenario has changed; if the mini-program is detected to frequently call second-level range permissions, the data transmission path is abnormal, or the code execution status deviates from the normal logic, it is determined that preset high-risk behaviors have been discovered.

[0053] Optionally, when the functional scenario changes, the execution of scenario adaptation rules can be triggered. For example, when a mini-program switches from a private environment to a public environment, or from a Wi-Fi environment to a mobile network environment, the authorization threshold for location information permissions is automatically raised, and the original continuous authorization of L3-level location permissions is adjusted to temporary authorization; if the mini-program switches from core functions to auxiliary functions, the corresponding permission level is reduced from the second level range to the first level range, and only the basic permissions required for auxiliary functions are retained.

[0054] Optionally, when a pre-defined high-risk behavior is detected, risk assessment rules can be triggered. For example, the risk level can be assessed in real time by analyzing information such as network request frequency, data transmission destination, and code execution chain. If it is determined to be high-risk, the permission level will be automatically downgraded, such as temporarily making L3-level location permissions in the second level range unavailable, or restricting the frequency of calling the corresponding permissions.

[0055] Optionally, the mini-program permission control device can also record the user's authorization history and generate appropriate authorization suggestions based on user preference rules. For example, if a user repeatedly refuses location permission requests in public environments, the "Allow only this time" option will be displayed first when location permission requests are triggered in public environments in subsequent instances, reducing repetitive user actions. Optionally, all permission status updates can be synchronized to the FinAppClient API and permission usage logs to ensure that the permission status is consistent with the current scenario, risk level, and user preferences.

[0056] Optionally, updating the permission status of the mini-program according to a preset rule base includes: updating the permission status of the mini-program through the application permission management dedicated interface set of the HarmonyOS system according to the preset rule base.

[0057] Optionally, after obtaining the current running scenario information of the mini-program, the method further includes: outputting permission warning information when preset risk warning conditions are met; wherein, the preset risk warning conditions include the call frequency of permission levels in the second level range being higher than the warning frequency value, unauthorized permissions being illegally called, and abnormal cross-terminal transmission of data obtained through permission levels in the second level range, and the permission warning information is used to remind the user that the mini-program has a risk of abnormal use of privacy permissions.

[0058] Specifically, when a permission request triggers a preset risk warning condition, the mini-program permission control device can immediately trigger a risk warning mechanism. This triggering can manifest as follows: pushing permission warning information to the user through the cloud drive application's message center. The information clearly indicates the risk type, the relevant permission level, and the corresponding functional scenario, alerting the user to the risk of abnormal use of privacy permissions in the current mini-program.

[0059] For example, the preset risk warning conditions can be: if the call frequency of the permission level in the second level range exceeds the preset warning frequency value within 1 minute, or if the unauthorized second level range permission is illegally called by the mini program, or if the data obtained through the permission level is abnormally transmitted across terminals.

[0060] Optionally, the method further includes: collecting the permission call log of the mini-program; and displaying historical permission call information according to the permission call log when a user's query instruction is received.

[0061] Specifically, the mini-program permission control device can rely on the logging function of the MCloud SDK to collect permission call logs in real time during the mini-program's operation. The log content can include information such as permission call time, corresponding function call scenario, and data transmission volume. After collection, the log data is encrypted using the SM3 encryption algorithm to ensure data security before being stored in a local log file, preventing the log content from being illegally tampered with or leaked. When a user initiates a query command, they can submit a request through the mini-program management backend or the privacy management page of the cloud drive application. The mini-program permission control device can extract the corresponding data from the encrypted permission call logs according to the user-specified filtering conditions (such as time range, permission level, and behavior type), and display the historical permission call information in a structured list format after decryption. The historical permission call information can include the specific content of each call behavior, the triggering scenario, and the permission status, thereby realizing traceable query of the entire permission usage chain, making it easy for users to clearly understand the permission usage of the mini-program.

[0062] In this embodiment, because the preset permission hierarchy configuration divides permissions into multiple levels according to privacy sensitivity, and determines the permission level requirements based on the current running scenario information of the mini-program, it can achieve precise matching between permissions and scenarios, solving the problem of over-authorization or insufficient permissions caused by the disconnect between permission level division and scenario in the prior art. Since the first level of permissions with low sensitivity is directly authorized to ensure basic operation, and the second level of permissions with high sensitivity are authorized based on user instructions by displaying prompts containing permission level, usage scenario and data purpose, it takes into account both ease of use and allows users to clearly understand the purpose of permissions and make independent decisions, reducing the risk of privacy data abuse. Since the static authorization mode is abandoned and the required permissions are granted only in the corresponding scenario, it avoids the situation where the mini-program still holds high-sensitivity permissions when running in the background or in unnecessary scenarios, improving the fineness of privacy protection and meeting privacy protection compliance requirements.

[0063] The foregoing mainly describes the solutions provided by the embodiments of this application from a methodological perspective. To achieve the above functions, it includes corresponding hardware structures and / or software modules for executing each function. Those skilled in the art should readily recognize that, in conjunction with the units and algorithm steps of the various examples described in the embodiments disclosed herein, the embodiments of this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0064] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0065] It should be noted that the device in the embodiments of this application includes a virtual device and a physical device. The virtual device can be a mini-program permission control device based on the HarmonyOS system, and the physical device can include electronic devices, computer storage media, and computer program products.

[0066] The mini-program permission control method based on the HarmonyOS system provided in this application embodiment can be executed by a mini-program permission control device based on the HarmonyOS system, or a control module for mini-program permission control based on the HarmonyOS system within that device. This application embodiment uses the execution of the mini-program permission control method based on the HarmonyOS system by a mini-program permission control device as an example to illustrate the mini-program permission control device based on the HarmonyOS system provided in this application embodiment.

[0067] It should be noted that, according to the above method examples, the functional modules of the mini-program permission control device based on the HarmonyOS system can be divided. For example, each function can be divided into its own functional modules, or two or more functions can be integrated into one processing module. The integrated modules can be implemented in hardware or as software functional modules. Optionally, the module division in this embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0068] like Figure 4 As shown, this application embodiment provides a mini-program permission control device 400 based on the HarmonyOS system. The HarmonyOS-based mini-program permission control device 400 includes: an acquisition module 401, a processing module 402, and an execution module 403; The acquisition module 401 is used to acquire the current running scenario information of the mini-program, the running scenario information including the program running status and function call scenario; The processing module 402 is used to determine the permission level requirements of the mini-program based on the running scenario information and the preset permission level configuration. The preset permission level configuration includes multiple permission levels, and each permission level corresponds to a privacy sensitivity. The execution module 403 is configured to directly perform an authorization operation according to the permission level requirement when the permission level requirement falls within the first level range of the preset permission level configuration; and to display permission prompt information and perform an authorization operation or a non-authorization operation based on the user's operation command when the permission level requirement falls within the second level range of the preset permission level configuration; wherein, the permission prompt information is used to indicate the permission level, usage scenario, and data purpose corresponding to the permission level requirement, and the privacy sensitivity of the permission level in the second level range is higher than that of the permission level in the first level range.

[0069] Optionally, before obtaining the current running scenario information of the mini-program, the processing module 402 is used to divide the permissions of the mini-program into multiple permission levels according to the data privacy sensitivity and functional scenario importance; add permission level identifiers to the permission declaration field of the basic configuration file of the mini-program, with one permission level corresponding to one permission level identifier; and determine the preset permission level configuration by loading the basic configuration file when the mini-program starts.

[0070] Optionally, after performing the authorization operation, the execution module 403 is used to update the permission status of the mini-program according to a preset rule base when preset adjustment conditions are met; wherein, the preset rule base includes scenario adaptation rules, risk assessment rules and user preference rules, and the preset adjustment conditions include changes in the functional scenarios of the mini-program and / or the discovery of preset high-risk behaviors.

[0071] Optionally, updating the permission status of the mini-program according to a preset rule base includes: updating the permission status of the mini-program through the application permission management dedicated interface set of the HarmonyOS system according to the preset rule base.

[0072] Optionally, after obtaining the current running scenario information of the mini-program, the execution module 403 is used to output permission warning information when the preset risk warning conditions are met; wherein, the preset risk warning conditions include the call frequency of the permission level in the second level range being higher than the warning frequency value, unauthorized permissions being illegally called, and abnormal cross-terminal transmission of data obtained through the permission level in the second level range, and the permission warning information is used to remind the user that the mini-program has a risk of abnormal use of privacy permissions.

[0073] Optionally, the execution module 403 is used to collect the permission call log of the mini-program; when a user's query instruction is received, the historical permission call information is displayed according to the permission call log.

[0074] In this embodiment, because the preset permission hierarchy configuration divides permissions into multiple levels according to privacy sensitivity, and determines the permission level requirements based on the current running scenario information of the mini-program, it can achieve precise matching between permissions and scenarios, solving the problem of over-authorization or insufficient permissions caused by the disconnect between permission level division and scenario in the prior art. Since the first level of permissions with low sensitivity is directly authorized to ensure basic operation, and the second level of permissions with high sensitivity are authorized based on user instructions by displaying prompts containing permission level, usage scenario and data purpose, it takes into account both ease of use and allows users to clearly understand the purpose of permissions and make independent decisions, reducing the risk of privacy data abuse. Since the static authorization mode is abandoned and the required permissions are granted only in the corresponding scenario, it avoids the situation where the mini-program still holds high-sensitivity permissions when running in the background or in unnecessary scenarios, improving the fineness of privacy protection and meeting privacy protection compliance requirements.

[0075] Figure 5 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 5As shown, the electronic device may include: a processor 510, a communications interface 520, a memory 530, and a communications bus 540, wherein the processor 510, the communications interface 520, and the memory 530 communicate with each other through the communications bus 540. The processor 510 can call logical instructions in the memory 530 to execute a mini-program permission control method based on the HarmonyOS system. This method includes: obtaining the current running scenario information of the mini-program, the running scenario information including the program's running state and function call scenarios; determining the permission level requirements of the mini-program based on the running scenario information and a preset permission level configuration, the preset permission level configuration including multiple permission levels, each permission level corresponding to a privacy sensitivity; if the permission level requirement falls within the first level range of the preset permission level configuration, directly performing an authorization operation according to the permission level requirement; if the permission level requirement falls within the second level range of the preset permission level configuration, displaying permission prompt information and performing an authorization operation or a non-authorization operation based on user operation instructions; wherein the permission prompt information is used to indicate the permission level, usage scenario, and data purpose corresponding to the permission level requirement, and the privacy sensitivity of permission levels in the second level range is higher than that of permission levels in the first level range.

[0076] Furthermore, the logical instructions in the aforementioned memory 530 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0077] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the mini-program permission control method based on the HarmonyOS system provided by the above methods. The method includes: obtaining the current running scenario information of the mini-program, the running scenario information including the program running status and function call scenario; determining the permission level requirements of the mini-program according to the running scenario information and a preset permission level configuration, the preset permission level configuration including multiple permission levels, one permission level corresponding to one privacy sensitivity; when the permission level requirement belongs to the first level range in the preset permission level configuration, directly performing an authorization operation according to the permission level requirement; when the permission level requirement belongs to the second level range in the preset permission level configuration, displaying permission prompt information and performing an authorization operation or a non-authorization operation based on the user operation instruction; wherein, the permission prompt information is used to prompt the permission level, usage scenario and data purpose corresponding to the permission level requirement, and the privacy sensitivity of the permission level in the second level range is higher than that of the permission level in the first level range.

[0078] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements the mini-program permission control method based on the HarmonyOS system provided by the above methods. The method includes: obtaining the current running scenario information of the mini-program, the running scenario information including the program running state and function call scenario; determining the permission level requirements of the mini-program according to the running scenario information and a preset permission level configuration, the preset permission level configuration including multiple permission levels, each permission level corresponding to a privacy sensitivity; when the permission level requirement falls within the first level range of the preset permission level configuration, directly performing an authorization operation according to the permission level requirement; when the permission level requirement falls within the second level range of the preset permission level configuration, displaying permission prompt information and performing an authorization operation or a non-authorization operation based on user operation instructions; wherein, the permission prompt information is used to indicate the permission level, usage scenario, and data purpose corresponding to the permission level requirement, and the privacy sensitivity of the permission level in the second level range is higher than that of the permission level in the first level range.

[0079] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0080] Obviously, those skilled in the art should understand that the various units or steps of this application described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. Optionally, they can be implemented using computer-executable program code, thereby storing them in a storage device for execution by a computing device, or fabricating them separately as individual integrated circuit modules, or fabricating multiple modules or steps into a single integrated circuit module. Thus, this application is not limited to any particular combination of hardware and software.

[0081] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A method for applet permission control based on a Hongmeng system, characterized in that, The method comprises the following steps: obtaining the current running scene information of the applet, wherein the running scene information comprises program running state and function calling scene; determining the permission level requirement of the applet according to the running scene information and preset permission hierarchical configuration, wherein the preset permission hierarchical configuration comprises a plurality of permission levels, and one permission level corresponds to one privacy sensitivity; in the case that the permission level requirement belongs to the first level range in the preset permission hierarchical configuration, directly performing authorization operation according to the permission level requirement; in the case that the permission level requirement belongs to the second level range in the preset permission hierarchical configuration, displaying permission prompt information, and performing authorization operation or non-authorization operation based on user operation instruction; wherein the permission prompt information is used to prompt the permission level corresponding to the permission level requirement, use scene and data use, and the privacy sensitivity of the permission level in the second level range is higher than that in the first level range. 2.The method of claim 1, wherein, Before the step of obtaining the current running scene information of the applet, the method further comprises: dividing the permissions of the applet into a plurality of permission levels according to data privacy sensitivity and function scene importance; adding permission level identifiers in the permission declaration field of the basic configuration file of the applet, and one permission level corresponds to one permission level identifier; when the applet is started, the preset permission hierarchical configuration is determined by loading the basic configuration file. 3.The method of claim 1, wherein, After the step of performing authorization operation, the method further comprises: when the preset adjustment condition is met, updating the permission state of the applet according to the preset rule base; wherein the preset rule base comprises scene adaptation rule, risk assessment rule and user preference rule, and the preset adjustment condition comprises change of function scene of the applet and / or discovery of preset high-risk behavior.

4. The method of claim 3, wherein the method further comprises: The step of updating the permission state of the applet according to the preset rule base comprises: updating the permission state of the applet through the application permission management exclusive interface set of the Hongmeng system according to the preset rule base.

5. The method of claim 3, wherein the method further comprises: After the step of obtaining the current running scene information of the applet, the method further comprises: when the preset risk warning condition is met, outputting permission warning information; wherein the preset risk warning condition comprises that the calling frequency of the permission level in the second level range is higher than the warning frequency value, the un-authorized permission is illegally called, the data obtained through the permission level in the second level range is abnormally transmitted across terminals, and the permission warning information is used to prompt the user that the applet has privacy permission abnormal use risk.

6. The method according to any one of claims 1-4, wherein, The method further comprises: collecting the permission calling log of the applet; when receiving the query instruction of the user, displaying the historical permission calling information according to the permission calling log.

7. A device for controlling the authority of an applet based on a Hongmeng system, characterized in that, The method comprises the following steps: acquiring module, processing module and execution module; the acquiring module is used to acquire the current running scene information of the applet, wherein the running scene information comprises program running state and function calling scene; The processing module is configured to determine a permission level requirement of the applet according to the operation scenario information and a preset permission level configuration, the preset permission level configuration including a plurality of permission levels, one permission level corresponding to one privacy sensitivity; The execution module is configured to, in a case where the permission level requirement belongs to a first level range in the preset permission level configuration, directly perform an authorization operation according to the permission level requirement; In a case where the permission level requirement belongs to a second level range in the preset permission level configuration, display permission prompt information, and perform an authorization operation or no authorization operation based on a user operation instruction; The permission prompt information is used to prompt a permission level corresponding to the permission level requirement, a use scenario, and a data use purpose, and the privacy sensitivity of the permission level in the second level range is higher than the privacy sensitivity of the permission level in the first level range.

8. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the computer program to implement the applet permission control method based on the Hongmeng system according to any one of claims 1 to 6. 9.A non-transitory computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the applet permission control method based on the Hongmeng system according to any one of claims 1 to 6.

10. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the applet permission control method based on the Hongmeng system according to any one of claims 1 to 6.

Images