Application authority management method, electronic device, and computer-readable storage medium

Abstract

The present application provides an application authority management method, an electronic device, and a computer-readable storage medium, which includes: determining whether an application has misused access authority for privacy data; and, if the application has misused access authority for privacy data, revoking the access authority for the privacy data from the application.

Description

[Technical Field]

[0001] [CROSS-REFERENCE TO RELATED APPLICATIONS] This application claims priority from Chinese Patent Application No. 202211263500.5 filed on October 10, 2022, the entire contents of which are incorporated herein by reference. [Technical field] TECHNICAL FIELD The present application relates to the field of terminal technology, and in particular to an application authority management method, an electronic device, and a computer-readable storage medium. [Background technology]

[0002] The Android system divides permissions into two types: normal permissions, which do not hide issues that threaten users' privacy and safety, such as permissions to access the network and wireless connections (WiFi, Wireless Fidelity), and dangerous permissions, which threaten users' privacy and safety, such as permissions to access address books, albums, location information, etc.

[0003] For security reasons, the Android system introduced a permission request mechanism starting with Android 6.0. This means that applications can dynamically request relevant dangerous permissions before using certain functions. Each time an application uses a function with a dangerous permission, it checks whether it has the permission. If it does not have the permission, it must request the permission before it can use the function. For example, if an application needs to use a photo function, it must first determine whether it has permission to use the camera. If the application does not have permission to use the camera, it can obtain permission to use the camera after the user grants permission; if the user denies permission, it cannot use the camera. However, privacy data leakage still remains an issue. Summary of the Invention

[0004] In a first aspect, an embodiment of the present application provides an application privilege management method, including a step of determining whether an application has misused its access privileges to privacy data, and if the application has misused its access privileges to privacy data, a step of revoking the application's access privileges to privacy data.

[0005] In a second aspect, an embodiment of the present application provides an electronic device including at least one processor and a memory having stored therein at least one computer program, the at least one computer program being configured to implement the above-described application privilege management method when executed by the at least one processor.

[0006] In a third aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, the computer program implementing the above application rights management method when executed by a processor. [Brief explanation of the drawings]

[0007] [Figure 1] 1 is a flowchart of an application privilege management method according to an embodiment of the present application; [Figure 2] 1 is a flowchart of an exemplary application rights management method according to an embodiment of the present application; [Figure 3] 1 is a block diagram of an application right management device according to an embodiment of the present application; DETAILED DESCRIPTION OF THE INVENTION

[0008] In order to help those skilled in the art better understand the technical solution of the present application, the application privilege management method, electronic device, and computer-readable storage medium provided by the present application will be described in detail below in combination with the accompanying drawings.

[0009] The following description of exemplary embodiments will be given in more detail with reference to the drawings. However, these exemplary embodiments may be embodied in different ways and should not be construed as limiting the present application to the embodiments described herein. Rather, the purpose of providing these examples is to make the present application thorough and complete, and to allow those skilled in the art to fully appreciate the scope of the present application.

[0010] Unless contradictory, each embodiment and each feature in each embodiment of the present application can be combined with each other.

[0011] As used herein, the term "and / or" includes any and all combinations of one or more of the associated listed items.

[0012] The terms used herein are for the purpose of describing particular embodiments only and are not intended to limit the present application. As used herein, the singular forms "a," "an," and "the" are intended to include the plural, unless the context clearly dictates otherwise. Furthermore, when used herein, the terms "comprising" and / or "consisting of" indicate the presence of certain features, wholes, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components, and / or groups thereof.

[0013] Unless otherwise specified, all terms used herein (including technical and scientific terms) have the same meaning as commonly understood by those skilled in the art. Furthermore, terms defined in commonly used dictionaries should be understood to have the same meaning as in the relevant art and the context of this application, and should not be construed as having an idealized meaning or an overly formal meaning unless expressly limited in this specification.

[0014] In the current application privilege management method, dangerous privileges are granted by users, and users cannot control the behavior of the application after granting the privileges, so there is still a risk that users' privacy data will be leaked.

[0015] FIG. 1 is a flowchart of an application privilege management method according to an embodiment of the present application. In a first aspect, referring to FIG. 1, an embodiment of the present application provides an application privilege management method, including steps 100 and 101.

[0016] Step 100: Determine whether the application has misused the access permission of the privacy data.

[0017] In some embodiments, the privacy data includes, but is not limited to, at least one of a mobile phone number, an address book, short messages, call records, albums, emails, schedules, internet access records, consumption records, social media accounts, installed application lists, location information, clipboard, personal biometric information, International Mobile Equipment Identity (IMEI), International Mobile Subscriber Identification Number (IMSI), Media Access Control (MAC) address, camera, microphone, and sensor.

[0018] In some embodiments, the permission for an application to call privacy data includes, but is not limited to, at least one of: allow only for the duration of use, allow only this time, allow always, and never allow.

[0019] In some embodiments, Always Allowed has the highest level of authority, Duration Allowed has the next highest level of authority, followed by Just This Time Allowed and Never Allowed has the lowest level of authority.

[0020] In the embodiment of the present application, the timing of determining whether an application is misusing the access authority of the private data is not limited. For example, when the application accesses the private data, it may determine whether the application is misusing the access authority of the private data. Alternatively, for example, it may periodically or periodically determine whether the application is misusing the access authority of the private data.

[0021] In order to later determine whether an application has misused its access authority to the privacy data based on the call record information, it is necessary to record the call record information for the application's privacy data each time the application calls the privacy data, regardless of when it is determined whether the application has misused its access authority to the privacy data.

[0022] In some embodiments, the call record information includes at least one of application information, information on the type of privacy data called, information on the time of the call, information on the statistical number of calls, and information indicating whether the application has permission to call the privacy data.

[0023] In some embodiments, when an application calls privacy data, if it is determined whether the application has misused the calling authority of the privacy data, the application authority management method further includes: determining the application's calling authority to the privacy data when the application calls the privacy data; and determining whether the application has misused the calling authority of the privacy data based on the application's calling authority to the privacy data.

[0024] In some embodiments, determining whether the application is abusing the permission to call privacy data based on the permission to call privacy data by the application includes at least one of: if the permission to call privacy data by the application is not permitted, determining whether the application is abusing the permission to call privacy data based on other information; if the permission to call privacy data by the application is not permitted, directly determining that the application is abusing the permission to call privacy data because the application has called privacy data that is not permitted by the user, blocking the application's attempt to call privacy data, and terminating this flow.

[0025] In the embodiment of the present application, the state of the application when determining whether the application has misused the access permission of the privacy data is not limited. For example, when the application is launched, terminated, or running in the background, it can be determined whether the application has the access permission to misuse the privacy data.

[0026] In some embodiments, the step of determining whether the application is misusing the access authority for the privacy data includes: The time when the application calls the privacy data, The number of times the application calls privacy data, and How often the application calls privacy data, and Where the application stores privacy data; The application transmits privacy data in plaintext; and With whom the application shares privacy data, and Application privacy data call permissions and and determining whether the application is misusing the permission to call privacy data based on at least one of the above.

[0027] For example, if an application accesses privacy data during the time period from 23:00 to 5:00, and the duration is greater than a first threshold, it is determined that the application is abusing the access authority of privacy data.

[0028] In addition, if the number of times the Ctrip mobile app accesses the device's private data within one minute from 19:16 to 19:17 is greater than the second threshold, it is determined that the Ctrip mobile app is abusing the access authority for private data.

[0029] In addition, if an application stores private data in a public data area, it is determined that the application is abusing the access authority for the private data.

[0030] Furthermore, if an application shares privacy data with applications that are not listed in the privacy policy list, it is determined that the application is abusing the access authority for privacy data.

[0031] In addition, if an application accesses the device's location information in the background, but the user's access permission for the privacy data is set to "only allow during the usage period," it is determined that the application is abusing the access permission for the privacy data.

[0032] In an embodiment of the present application, when determining whether an application is misusing the terminal's privacy data access permission, the application may determine one type of privacy data, or may determine two or more types of privacy data.

[0033] When making a judgment about two or more types of privacy data, the number of times an application calls the privacy data refers to the sum of the number of times the application calls two or more types of privacy data, the location where the application stores the privacy data refers to the union of the locations where the application stores two or more types of privacy data, the objects with which the application shares privacy data refers to the union of the objects with which the application shares two or more types of privacy data, and the application's permission to call privacy data refers to an AND operation performed on the application's permission to call two or more types of privacy data.

[0034] Step 101: If an application misuses the access authority for the privacy data, the access authority for the application is revoked.

[0035] In some embodiments, revoking the call permissions for the application's privacy data includes popping up a setting dialog for the call permissions for the application's privacy data to allow the user to modify the call permissions for the application's privacy data, i.e., a "user confirms the revocation" method.

[0036] The user can arbitrarily set the access authority of the application to the private data in the setting dialog.

[0037] In some embodiments, reclaiming the application's access permission to the privacy data includes at least one of modifying the application's access permission to the privacy data to an access permission with a lower authority level than the current authority level, or modifying the application's access permission to the privacy data to an access permission corresponding to the lowest authority level, i.e., in a "smart reclaim" manner.

[0038] For example, a "gradual retrieval" method can be adopted to retrieve the application's access permission to the private data. That is, each time the permission level of the application's access permission to the private data is lowered by one level, if the current access permission is always allowed, the access permission will be adjusted to only allowed during the usage period. If the application's access permission to the private data needs to be retrieved later, it will be sequentially adjusted to "only allowed this time" and "not allowed."

[0039] In addition, the application's access permission to the privacy data can be retrieved in a "one-time retrieval" manner, that is, the application's access permission to the privacy data can be directly adjusted to the access permission corresponding to the lowest permission level, i.e., "not allowed."

[0040] In some embodiments, when an application accesses privacy data, if it is determined whether the application is abusing the permission to access the privacy data, the application permission management method further includes blocking the application from accessing the privacy data if the application is abusing the permission to access the privacy data.

[0041] In some embodiments, the application privilege management method further includes, when an application misuses the access privileges to the privacy data, determining the severity of the application's misuse of the access privileges to the privacy data, and revoking the application's access privileges to the privacy data based on the severity.

[0042] In some embodiments, the severity of an application's misuse of privacy data access privileges can be determined based on at least one of the number of times the application is determined to have misused privacy data access privileges, the degree to which the application violates access privileges to the same privacy data, or whether the application violates access privileges to multiple privacy data.

[0043] For example, if the number of times the application accesses privacy data in the background is greater than the third threshold, it is determined that the application has misused the permission to access privacy data, and the severity of the application's misuse of the permission to access privacy data is medium.

[0044] After a certain period of time, if the number of times the application calls the private data is greater than the fourth threshold, and the fourth threshold is greater than the third threshold, it is again determined that the application has misused the permission to call the private data, and the severity of the application's misuse of the permission to call the private data is determined to be serious.

[0045] In some embodiments, revoking the call permission for the application's privacy data based on the severity includes at least one of modifying the call permission for the application's privacy data to a call permission having a lower authority level than the current authority level if the severity is normal, or modifying the call permission for the application's privacy data to a call permission corresponding to the lowest authority level if the severity is severe.

[0046] In some embodiments, when an application misuses the permission to call privacy data, the application permission management method further includes determining whether a smart collection application permission switch is turned on, and if the smart collection application permission switch is turned on, allowing the collection application to continue executing the permission to call privacy data.

[0047] In some embodiments, the application authority management method further includes, if the application is engaging in an act of abusing the authority to call privacy data, displaying presentation information to notify the user that the application is engaging in an act of abusing the authority to call privacy data.

[0048] In some embodiments, if the smart collection application permission is switched off, the flow ends.

[0049] The application authority management method provided by the embodiment of the present application monitors whether an application misuses the access authority of private data, thereby improving the security of private data on the terminal.

[0050] In order to more completely illustrate the application privilege management method of the embodiment of the present application, an example is given below, and the example given does not limit the scope of the claims of the embodiment of the present application.

[0051] example As shown in FIG. 2, the application authority management method includes steps 200 to 205.

[0052] Step 200: Monitor whether the application calls privacy data, if so, then execute step 201, otherwise, end this flow.

[0053] In step 201, the access authority for the privacy data of the application is determined. If the access authority is not denied, step 202 is subsequently executed; if the access authority is not denied, step 203 is executed.

[0054] Step 202: Based on the time and number of times the application calls the private data, determine whether the application has misused the access authority to the private data. If such an action has occurred, then execute step 203; if not, terminate this flow.

[0055] Step 203: Determine whether the smart collection application authority switch is turned on. If it is turned on, then execute step 204; if it is not turned off, end this flow.

[0056] Step 204: Block the application from accessing the privacy data, and withdraw the application's access authority to the privacy data.

[0057] Step 205: Displaying presentation information to notify the user that the application is misusing the access authority for privacy data.

[0058] In a second aspect, an embodiment of the present application provides an electronic device including at least one processor and a memory having stored therein at least one computer program, the at least one computer program, when executed by the at least one processor, realizing the above-described application privilege management method.

[0059] A processor is a device having data processing capabilities, including, but not limited to, a central processing unit (CPU), etc. A memory is a device having data storage capabilities, including, but not limited to, random access memory (RAM, more specifically SDRAM, DDR, etc.), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), and flash memory (FLASH).

[0060] In some embodiments, the processor and memory are coupled to each other and to other components of the computing device by a bus.

[0061] In a third aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, the computer program implementing the above application privilege management method when executed by a processor.

[0062] FIG. 3 is a block diagram of the configuration of an application right management device according to an embodiment of the present invention. In a fourth aspect, referring to FIG. 3, an embodiment of the present application provides an application privilege management device, including: a determination module 301 configured to determine whether an application has engaged in an activity of abusing the access privileges of privacy data; and a processing module 302 configured to retrieve the application's access privileges to the privacy data if the application has engaged in an activity of abusing the access privileges of privacy data.

[0063] In some embodiments, the determination module 301 is specifically configured to determine whether the application is misusing the permission to call the privacy data when the application calls the privacy data, and the processing module 302 is further configured to block the application from calling the privacy data if the application is misusing the permission to call the privacy data.

[0064] In some embodiments, the determination module 301 is further configured to determine an application's access authority to the privacy data, and determine whether the application has misused the access authority to the privacy data based on the application's access authority to the privacy data.

[0065] In some embodiments, the processing module 302 is further configured to determine the severity of the calling privileges that the application misuses the privacy data, and revoke the calling privileges of the application to the privacy data based on the severity.

[0066] In some embodiments, the processing module 302 is further configured to determine whether a smart recovery application permission is switched on when an application misuses the access permission for privacy data, and if the smart recovery application permission is switched on, subsequently perform the step of recovering the application's access permission for privacy data.

[0067] In some embodiments, the determining module 301 is specifically configured to determine whether an application misuses the access authority of privacy data by the following method: The time when the application calls the privacy data, The number of times the application called privacy data, How often the application calls privacy data, and Where the application stores privacy data; The application transmits the privacy data in a clear text manner; With whom the application shares privacy data, and Permission for applications to call privacy data; and determining whether the application is misusing the access authority of the privacy data based on at least one of the information above.

[0068] In some embodiments, the processing module 302 is specifically configured to realize the retrieval of the application's permission to call privacy data by popping up a setting dialog for the application's permission to call privacy data, for the user to modify the application's permission to call privacy data.

[0069] In some embodiments, the processing module 302 is specifically configured to realize the retrieval of the application's access permission to the privacy data by adopting at least one of modifying the application's access permission to the privacy data to an access permission with an access level lower than the current access level, and modifying the application's access permission to the privacy data to an access permission corresponding to the lowest access level.

[0070] The specific implementation process of the application right management device is the same as the specific implementation process of the application right management method, and will not be described again here.

[0071] Those skilled in the art will understand that all or part of the steps in the methods and functional modules / units in the apparatuses disclosed above can be implemented as software, firmware, hardware, or any suitable combination thereof. In hardware embodiments, the division between functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, one physical component may have multiple functions, or one function or step may be performed by several physical components in cooperation. Some or all of the physical components may be implemented as software executed by a processing unit (e.g., a central processing unit, digital signal processor, or microprocessor), as hardware, or as an integrated circuit, such as a dedicated integrated circuit. Such software may be located on a computer-readable medium, which may include computer storage media (or non-transitory media) and communication media (or transitory media). As is well known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information, such as computer-readable commands, data structures, program modules, or other data. Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and that can be accessed by a computer. Additionally, those skilled in the art will know that communication media typically include computer-readable commands, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism and can include any information delivery media.

[0072] Although illustrative examples are disclosed and specific terms are used herein, they are used for general descriptive purposes only and should be construed as such and not for purposes of limitation. It will be apparent to those skilled in the art that, unless expressly indicated otherwise, features, characteristics, and / or elements described in connection with a particular embodiment can be used alone or in combination with features, characteristics, and / or elements described in connection with other embodiments. Accordingly, those skilled in the art will recognize that changes in form and detail may be made without departing from the scope of the present application, as defined by the appended claims.

Claims

1. determining whether the application is misusing the permission to call privacy data; If the application misuses the access authority of the privacy data, revoking the access authority of the privacy data by the application. Application privilege management methods.

2. When the application accesses the privacy data, determine whether the application misuses the access authority of the privacy data; The application authority management method includes: If the application misuses the access authority of the privacy data, the application is further blocked from accessing the privacy data. The application rights management method of claim 1 .

3. When the application accesses the privacy data, the access authority of the application to the privacy data is determined; and determining whether the application has misused the access right of the privacy data according to the access right of the privacy data by the application. The application rights management method according to claim 2 .

4. If the application misuses the access authority of the privacy data, determining the severity of the application misusing the access authority of the privacy data; and revoking the application's right to access the privacy data based on the severity. The application rights management method of claim 1 .

5. When the application misuses the access permission of the privacy data, determining whether the switch of the smart collection application permission is turned on; When the smart collection application authority is switched on, then execute the call authority of the collection application for the privacy data; The application rights management method of claim 1 .

6. The step of determining whether the application has misused the access authority of the privacy data includes: The time at which the application accesses the privacy data; the number of times the application calls the privacy data; and The frequency with which the application accesses the privacy data; and a location where the application stores the privacy data; The application transmits the privacy data in plaintext; and a subject with whom the application shares the privacy data; The application's access rights to the privacy data; determining whether the application is misusing the access authority of the privacy data based on at least one of the following: The application right management method according to any one of claims 1 to 5.

7. The step of withdrawing the application's access authority to the privacy data includes: popping up a setting dialog for setting the access permission of the application to the privacy data so that the user can change the access permission of the application to the privacy data; The application right management method according to any one of claims 1 to 5.

8. The step of withdrawing the application's access authority to the privacy data includes: Changing the access authority of the application to the privacy data to an access authority with an authority level lower than the current authority level; or changing the access permission of the application to the privacy data to an access permission corresponding to a lowest access level; The application right management method according to any one of claims 1 to 5.

9. at least one processor; a memory for storing at least one computer program, the at least one computer program being adapted to implement the application rights management method according to any one of claims 1 to 8 when executed by the at least one processor; electronic equipment.

10. A computer program is stored in the computer, and when the computer program is executed by a processor, the computer program implements the application right management method according to any one of claims 1 to 8. A computer-readable storage medium.

Images