Permission management method and electronic device

Abstract

The present application relates to the technical field of terminals. Provided are a permission management method and an electronic device. The present application differentiates service execution permissions of different users on the basis of the functions of a function lock, so as to improve device security. The method comprises: when detecting a sensitive operation of a user, on the basis of the functions of a function lock that are enabled by an electronic device, the electronic device determining whether a first permission of the identity of the current user comprises allowing the execution of a first service indicated by the sensitive operation, wherein the functions of the function lock are used for limiting the execution permission for the first service, and the functions of the function lock comprise one or more of the following: a space lock function, a privacy lock function, a configuration lock function and a data lock function, the space lock function being used for limiting the permission to switch spaces, the privacy lock function being used for limiting the permission to access sensitive data, the configuration lock function being used for limiting the permission to trigger a setting function, and the data lock function being used for limiting the permission to display information on a user-defined interface; and when the first permission comprises allowing the execution of the first service, executing the first service.

Description

Rights management method and electronic device

[0001] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office on March 21, 2024, with application number 202410332628.5 and application name “Authorization Management Method and Electronic Device,” the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of terminal technology, and in particular to a rights management method and electronic device. Background Art

[0003] With the development of whole-home smart technology, the number of smart devices installed in users' homes is increasing to meet their diverse needs. These devices include audio and video equipment, lighting equipment, environmental control equipment, security system equipment, etc. Users can control different smart devices through the whole-home central control screen.

[0004] Due to the particularity of home scenarios, different people (such as family members, guests, etc.) can directly operate the central control screen of the whole house, creating safety risks. Summary of the Invention

[0005] To solve the above technical problems, the present application provides a rights management method and electronic device. The technical solution provided by the present application, based on the function lock function, realizes the distinction between the scope of authority of different users to perform services, thereby improving the security of the device.

[0006] In order to achieve the above technical objectives, this application provides the following technical solutions:

[0007] In a first aspect, a permission management method is provided for use in an electronic device. The method comprises: detecting a first sensitive operation by a user, and determining, based on a function lock function enabled on the electronic device, whether a first permission of the current user's identity includes permission to execute a first service indicated by the first sensitive operation; the function lock function is used to restrict permission to execute the first service; the function lock function includes one or more of the following: a space lock function, a privacy lock function, a configuration lock function, and a data lock function; wherein the space lock function is used to restrict permission to switch spaces, the privacy lock function is used to restrict permission to access sensitive data, the configuration lock function is used to restrict permission to trigger a setting function, and the data lock function is used to restrict permission to display information on a user-defined interface. If the first permission includes permission to execute the first service, executing the first service.

[0008] In this way, when an electronic device detects a sensitive user operation, it can trigger the acquisition of the current operator's user identity. Therefore, the service will only be executed if the corresponding permissions of the user identity include permission to execute the service indicated by the sensitive operation. This improves the security of device operation by increasing the confirmation of the scope of the operator's permissions.

[0009] In some examples, the interface display information includes interface display effects, interface display content, etc.

[0010] In some examples, executing the first business includes at least one of switching spaces, accessing sensitive data, triggering a setting function, and switching to a customized interface display information corresponding to the user identity.

[0011] Optionally, sensitive data includes, for example, data corresponding to sensitive devices, data corresponding to sensitive subsystems, etc. For example, sensitive data includes data collected by a camera. Another example is sensitive data including user data collected by a health care subsystem.

[0012] According to the first aspect, before detecting the first sensitive operation of the user, the method further includes: configuring a first permission, where the first permission is used to limit the execution permission of the user's identity to execute the first business.

[0013] For example, when an electronic device detects an operation to add a user, it can configure the first permission for the currently added user based on the user's operation. Subsequently, when a sensitive operation is detected, the electronic device can determine whether the current user has permission to perform the corresponding service based on the determined user identity, thereby ensuring device security.

[0014] According to the first aspect, or any implementation of the first aspect above, before detecting the user's first sensitive operation, the method also includes: detecting the user's approach, triggering the user's identity authentication, and obtaining the first permission corresponding to the user's identity.

[0015] In some examples, the authentication methods for authenticating the user's identity include one or more of the following: face recognition, account verification, voiceprint verification, and fingerprint recognition.

[0016] In this way, the electronic device can trigger the authentication of the identity of the user currently approaching in response to the user approaching, so as to facilitate the subsequent confirmation of whether the sensitive operation performed by the user is allowed.

[0017] According to the first aspect, or any implementation of the first aspect above, determining whether a first permission of the current user's identity includes permission to execute a first service indicated by a first sensitive operation includes: authenticating the user in response to the first sensitive operation. Obtaining a first permission corresponding to the user's identity, and determining whether the first permission of the user's identity includes permission to execute the first service indicated by the first sensitive operation.

[0018] In this way, when a user triggers a sensitive operation, the electronic device authenticates the user's identity to confirm whether the user has the authority to perform the business corresponding to the current sensitive operation, thereby ensuring the security of the device.

[0019] According to the first aspect, or any implementation of the first aspect above, the method further includes: triggering secondary identity authentication when it is determined that the first permission of the user's identity does not include permission to execute the first service indicated by the first sensitive operation. Identity information input by the user is received, and determining whether the second permission corresponding to the identity information includes permission to execute the first service indicated by the first sensitive operation.

[0020] Optionally, the identity information input by the user is, for example, administrator account information, or other account information with higher authority.

[0021] In this way, even if it is determined that the user does not have the authority to perform the business corresponding to the current sensitive operation, a method for entering administrator information can be provided to meet the user's needs for high-authority business. While ensuring device security, it also improves the flexibility of authority authentication.

[0022] According to the first aspect, or any implementation of the first aspect above, the method also includes: detecting a second sensitive operation of the user, determining that the current time point is within the authentication validity period, and when the first permission includes allowing execution of a second business indicated by the second sensitive operation, executing the second business.

[0023] For example, in response to a user approaching, the electronic device obtains the user's identity and the first permission corresponding to the user's identity. Subsequently, when the electronic device detects a second sensitive operation and determines that the current time point is within the authentication validity period and the first permission includes permission to perform a second service indicated by the second sensitive operation, it may determine that it is not necessary to authenticate the current user's identity and that the second service can be performed directly.

[0024] In this way, by setting the authentication validity period, the number of times users perform identity authentication is reduced and user operations are simplified.

[0025] According to the first aspect, or any implementation of the first aspect above, before detecting the first sensitive operation of the user, the method further includes: displaying a function lock function selection interface, and determining the function lock function that the user indicates to enable based on the first user operation.

[0026] Optionally, the electronic device determines one or more function lock functions that the user indicates to enable based on the user's operation on the function lock function selection interface. For example, the user can choose to enable one or more function lock functions among the space lock function, privacy lock function, configuration lock function, and data lock function as needed.

[0027] In this way, the electronic device can flexibly select the scope of permissions that need to be controlled by the electronic device through the function lock function according to user needs.

[0028] According to the first aspect, or any implementation of the first aspect above, before detecting the user's first sensitive operation, the method further includes: displaying the user's function lock function selection interface; and determining the function lock function enabled by the user according to the user's second operation.

[0029] In this way, the electronic device can flexibly configure the permission range of different users through the function lock function according to user needs.

[0030] According to the first aspect, or any implementation of the first aspect above, the user is a first user, and the function lock function is used to limit the execution authority of the first service, including: the first function lock function is used to limit the first user's execution authority on the first service.

[0031] For example, different user accounts may be configured with different function locks to limit the scope of permissions for different user identities to perform different services. For example, an electronic device may be configured with multiple user-level function locks, each of which is used to limit the permissions corresponding to the corresponding user identity. For example, a second user may be configured with a second function lock to limit the second user's permission to perform services.

[0032] According to the first aspect, or any implementation of the first aspect above, the user is a first user, and the function lock function is used to limit the execution authority of the first service, including: the function lock function is used to limit the execution authority of multiple users including the first user to the first service.

[0033] For example, an electronic device is configured with a device-level function lock, which is used to limit the authority of multiple users managed by the electronic device to perform services.

[0034] In this way, the authority control of electronic devices can be achieved through the flexible function lock function.

[0035] According to the first aspect, or any implementation method of the first aspect above, the first sensitive operation is an operation indicating switching space, and when the first permission includes allowing execution of the first business, executing the first business includes: when the first permission includes allowing switching space, switching the first interface of the space indicating the first sensitive operation.

[0036] In this way, the electronic device allows the user to switch spaces only when the operator has the authority to switch spaces. By increasing the space switching control capability, the trouble caused to the user by arbitrary space switching can be avoided.

[0037] According to the first aspect, or any implementation method of the first aspect above, the first sensitive operation is an operation indicating viewing sensitive data, and when the first permission includes allowing execution of the first business, executing the first business, including: when the first permission includes allowing access to the preset system indicated by the first sensitive operation, switching to display the second interface, the second interface displays sensitive data in the preset system indicated by the first sensitive operation, and the preset system includes a security subsystem or a health care subsystem.

[0038] Optionally, sensitive data may also include data from sensitive devices, such as data collected by security equipment.

[0039] In this way, the electronic device can only switch to display the interface including sensitive data when the operator has the authority to access sensitive data. By increasing the sensitive data management and control capabilities, the risk of privacy leakage caused by arbitrary sensitive data access can be avoided.

[0040] According to the first aspect, or any implementation method of the first aspect above, the first sensitive operation is an operation that triggers a setting function, and when the first permission includes allowing the execution of the first business, the first business is executed, including: when the first permission includes allowing the setting function to trigger the first sensitive operation indication, switching to display the third interface corresponding to the setting function indicated by the first sensitive operation, the third interface includes at least one of a setting interface, a user management interface, a security and privacy interface, and a factory configuration restore interface.

[0041] In this way, the electronic device can only switch to display the corresponding setting interface when the operator has the authority to trigger the device function. By increasing the setting operation control capability, the device safety hazards caused by random users performing setting operations can be avoided.

[0042] According to the first aspect, or any implementation of the first aspect above, the first sensitive operation is an operation approaching the electronic device, and when the first permission includes permission to execute the first business, the first business is executed, including: when the first permission includes permission to display information of the user-defined interface, the display information of the current display interface is switched, and the switched display information corresponds to the user's customized data.

[0043] In this way, when the operator has the authority to trigger the user-defined interface display information, the electronic device can switch to display the user-defined interface display information, and provide the user with a personalized display experience by increasing the ability to update user preference settings.

[0044] According to the first aspect, or any implementation of the first aspect above, before detecting the first sensitive operation of the user, the method further includes: displaying an administrator settings interface, receiving a third operation of the user adding a user identity in the administrator settings interface, and setting permissions for the user identity.

[0045] In this way, the electronic device can flexibly configure the personalized permission ranges of different users according to user needs.

[0046] According to the first aspect, or any implementation of the first aspect above, receiving a third operation of adding a user identity in an administrator setting interface, and setting permissions for the user identity includes: receiving a user role input by the user, and obtaining first permission information matching the user role.

[0047] In this way, the difficulty of permission configuration is reduced through role matching.

[0048] According to the first aspect, or any implementation of the first aspect above, the method further includes: displaying the first permission information, receiving a fourth operation of the user on the first permission information, and obtaining second permission information confirmed by the user, where the second permission information is used to indicate the first permission.

[0049] In this way, after matching the permissions corresponding to the role, users can also customize the specific permission range according to their needs to meet the user's personalized needs.

[0050] According to the first aspect, or any implementation of the first aspect above, the electronic device is a whole-house central control screen.

[0051] In a second aspect, an electronic device is provided. The electronic device includes: a processor and a memory, the memory being coupled to the processor, the memory being configured to store computer program code, the computer program code including computer instructions. When the processor reads the computer instructions from the memory, the electronic device executes the following: detecting a first sensitive operation by a user, and determining, based on a function lock function enabled on the electronic device, whether a first permission of the current user's identity includes permission to execute a first service indicated by the first sensitive operation; the function lock function is configured to restrict permission to execute the first service; the function lock function includes one or more of the following: a space lock function, a privacy lock function, a configuration lock function, and a data lock function; wherein the space lock function is configured to restrict permission to switch spaces, the privacy lock function is configured to restrict permission to access sensitive data, the configuration lock function is configured to restrict permission to trigger a setting function, and the data lock function is configured to restrict permission to display information on a user-defined interface. If the first permission includes permission to execute the first service, the first service is executed.

[0052] According to the second aspect, before detecting the user's first sensitive operation, when the processor reads the computer instructions from the memory, it also enables the electronic device to execute: configure the first permission, and the first permission is used to limit the user's identity to execute the first business.

[0053] According to the second aspect, or any implementation of the above second aspect, when the processor reads computer instructions from the memory, it also enables the electronic device to execute: detect the user's approach, trigger the user's identity authentication, and obtain the first permission corresponding to the user's identity.

[0054] According to the second aspect, or any implementation of the second aspect above, determining whether a first permission of the current user's identity includes permission to execute a first service indicated by a first sensitive operation includes: authenticating the user in response to the first sensitive operation. Obtaining a first permission corresponding to the user's identity, and determining whether the first permission of the user's identity includes permission to execute the first service indicated by the first sensitive operation.

[0055] According to the second aspect, or any implementation of the second aspect above, when the processor reads computer instructions from the memory, the electronic device is further caused to execute: triggering secondary identity authentication when the first permission determined based on the user's identity does not include permission to execute the first service indicated by the first sensitive operation. Receive identity information input by the user, and determine whether the second permission corresponding to the identity information includes permission to execute the first service indicated by the first sensitive operation.

[0056] According to the second aspect, or any implementation of the second aspect above, when the processor reads computer instructions from the memory, it also enables the electronic device to execute: when a second sensitive operation of the user is detected, it is determined that the current time point is within the authentication validity period, and the first permission includes allowing the execution of the second business indicated by the second sensitive operation, then the second business is executed.

[0057] According to the second aspect, or any implementation of the second aspect above, when the processor reads the computer instructions from the memory, the electronic device is further caused to execute: displaying a function lock function selection interface; and determining, based on the user's first operation, a function lock function that the user indicates to enable.

[0058] According to the second aspect, or any implementation of the second aspect above, when the processor reads the computer instructions from the memory, the electronic device is further caused to execute: displaying a function lock function selection interface for the user; and determining, based on the user's second operation, a function lock function that the user has enabled.

[0059] According to the second aspect, or any implementation of the second aspect above, the user is a first user, and the function lock function is used to limit the execution authority of the first service, including: the first function lock function is used to limit the first user's execution authority on the first service.

[0060] According to the second aspect, or any implementation of the second aspect above, the user is a first user, and the function lock function is used to limit the execution authority of the first service, including: the function lock function is used to limit the execution authority of multiple users including the first user to the first service.

[0061] According to the second aspect, or any implementation method of the above second aspect, the first sensitive operation is an operation indicating switching space, and when the first permission includes allowing execution of the first business, executing the first business includes: when the first permission includes allowing switching space, switching the first interface of the space indicating the first sensitive operation.

[0062] According to the second aspect, or any implementation method of the second aspect above, the first sensitive operation is an operation indicating viewing sensitive data, and when the first permission includes allowing execution of the first business, executing the first business, including: when the first permission includes allowing access to the preset system indicated by the first sensitive operation, switching to display the second interface, the second interface displays sensitive data in the preset system indicated by the first sensitive operation, and the preset system includes a security subsystem or a health care subsystem.

[0063] According to the second aspect, or any implementation method of the above second aspect, the first sensitive operation is an operation that triggers a setting function, and when the first permission includes allowing the execution of the first business, the first business is executed, including: when the first permission includes allowing the setting function to trigger the first sensitive operation indication, switching to display the third interface corresponding to the setting function of the first sensitive operation indication, the third interface includes at least one of a setting interface, a user management interface, a security and privacy interface, and a factory configuration restore interface.

[0064] According to the second aspect, or any implementation of the second aspect above, the first sensitive operation is an operation approaching the electronic device, and when the first permission includes permission to execute the first business, the first business is executed, including: when the first permission includes permission to display information of the user-defined interface, the display information of the current display interface is switched, and the switched display information corresponds to the user's customized data.

[0065] According to the second aspect, or any implementation of the second aspect above, when the processor reads the computer instructions from the memory, the electronic device is further caused to: display an administrator settings interface; receive a third operation of the user adding a user identity in the administrator settings interface; and set permissions for the user identity.

[0066] According to the second aspect, or any implementation of the second aspect above, receiving a third operation of adding a user identity in the administrator setting interface, and setting permissions for the user identity includes: receiving a user role input by the user, and obtaining first permission information matching the user role.

[0067] According to the second aspect, or any implementation of the second aspect above, when the processor reads the computer instructions from the memory, the electronic device is further caused to: display the first permission information; receive a fourth operation of the user on the first permission information; and obtain second permission information confirmed by the user, where the second permission information is used to indicate the first permission.

[0068] According to the second aspect, or any implementation of the second aspect above, the electronic device is a whole-house central control screen.

[0069] In a third aspect, an electronic device is provided, which has the function of implementing the rights management method described in the first aspect and any possible implementation thereof. This function can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above-mentioned functions.

[0070] In a fourth aspect, a computer-readable storage medium is provided. The computer-readable storage medium stores a computer program (also referred to as instructions or code), which, when executed by an electronic device, causes the electronic device to perform the method of the first aspect or any one of the embodiments of the first aspect.

[0071] In a fifth aspect, a computer program product is provided. When the computer program product is run on an electronic device, the electronic device executes the method of the first aspect or any one of the embodiments of the first aspect.

[0072] In a sixth aspect, a circuit system is provided, the circuit system including a processing circuit, the processing circuit being configured to execute the method of the first aspect or any one of the embodiments of the first aspect.

[0073] In the seventh aspect, a chip system is provided, comprising at least one processor and at least one interface circuit, wherein the at least one interface circuit is used to perform transceiver functions and send instructions to the at least one processor. When the at least one processor executes the instructions, the at least one processor executes the method of the first aspect or any one of the embodiments of the first aspect.

[0074] The technical effects of the aforementioned aspects can be referenced with each other and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] FIG1 is a first schematic diagram of an interface provided in an embodiment of the present application;

[0076] FIG2 is a second schematic diagram of an interface provided in an embodiment of the present application;

[0077] FIG3 is a third schematic diagram of an interface provided in an embodiment of the present application;

[0078] FIG4 is a fourth schematic diagram of an interface provided in an embodiment of the present application;

[0079] FIG5 is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application;

[0080] FIG6 is a schematic diagram of a first account adding scenario provided in an embodiment of the present application;

[0081] FIG7 is a second schematic diagram of an account adding scenario provided in an embodiment of the present application;

[0082] FIG8 is a logic diagram of a function lock configuration according to an embodiment of the present application;

[0083] FIG9 is a schematic diagram of an account role setting scenario provided in an embodiment of the present application;

[0084] FIG10A is a schematic diagram of a first scenario for setting account permissions according to an embodiment of the present application;

[0085] FIG10B is a second schematic diagram of an account authority setting scenario provided in an embodiment of the present application;

[0086] FIG11 is a flowchart of a rights management method according to an embodiment of the present application;

[0087] FIG12 is a schematic diagram of an interface for opening or closing a space lock according to an embodiment of the present application;

[0088] FIG13 is a schematic diagram of a space lock application scenario provided by an embodiment of the present application;

[0089] FIG14 is a schematic diagram of an application scenario of a privacy lock provided in an embodiment of the present application;

[0090] FIG15 is a schematic diagram of an application scenario of a configuration lock provided in an embodiment of the present application;

[0091] FIG16 is a schematic diagram of a data lock application scenario provided by an embodiment of the present application;

[0092] FIG17 is a second flowchart of the rights management method provided in an embodiment of the present application;

[0093] FIG18 is a third flowchart of the rights management method provided in an embodiment of the present application;

[0094] FIG19 is a fourth flowchart of the rights management method provided in an embodiment of the present application;

[0095] FIG20 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0096] The technical solutions in the embodiments of the present application are described below in conjunction with the drawings in the embodiments of the present application. Among them, in the description of the embodiments of the present application, the terms used in the following embodiments are only for the purpose of describing specific embodiments, and are not intended to be used as limitations on the present application. As used in the specification and appended claims of the present application, the singular expressions "one", "a kind of", "said", "above", "the" and "this" are intended to include expressions such as "one or more", unless there is a clear indication to the contrary in the context. It should also be understood that in the following embodiments of the present application, "at least one", "one or more" refer to one or more (including two).

[0097] References to "one embodiment" or "some embodiments" etc. described in this specification mean that the specific features, structures or characteristics described in conjunction with the embodiment are included in one or more embodiments of the present application. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. appearing in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in another way. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in another way. The term "connected" includes direct and indirect connections, unless otherwise stated. "First" and "second" are used for descriptive purposes only and are not to be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated.

[0098] In the embodiments of this application, words such as "exemplarily" or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design described as "exemplarily" or "for example" in the embodiments of this application should not be interpreted as being preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplarily" or "for example" is intended to present the relevant concepts in a concrete manner.

[0099] In some embodiments, various electronic devices have entered people's lives, and the concept of a smart home system is proposed for the home use of electronic devices. Among them, the electronic devices in the smart home system are, for example, smart home devices. Smart home devices are smart devices, such as audio and video devices (such as smart screens, Bluetooth speakers, etc.), lighting equipment (such as ceiling lights, table lamps, spotlights, etc.), environmental control equipment (such as air conditioners, air purifiers, etc.), anti-theft alarm equipment (such as human body sensors, cameras, etc.), etc.

[0100] In some examples, a smart home system is configured with a control device that can control other smart home devices in the smart home system. Optionally, the control device is, for example, a whole-house central control screen (which can also be described as a smart home device control panel, etc.). For example, after logging into an administrator account, the whole-house central control screen can obtain information about other smart home devices logged in and authorized by the account. If these smart home devices are nearby, communication connections can be established with these smart home devices, thereby achieving management and control of these smart home devices.

[0101] In some examples, during the process of connecting a smart home device to a smart central control screen (or during the pre-installation process of a smart home device), the user can configure the location information of the smart home device, which indicates the installation location of the smart home device. This can simplify the user's operation when operating the smart home device later.

[0102] In some examples, due to the unique characteristics of home environments, different people (such as family members and guests) can enter the home and may need to operate the whole-home central control screen to control other smart home devices. Currently, the whole-home central control screen does not verify the user's identity to ensure the user interaction experience, but allows users to operate directly, which affects the security of the whole house's smart home devices.

[0103] For example, the whole-house central control screen does not have the ability to control space switching, allowing all operators to arbitrarily instruct the whole-house central control screen to switch spaces and control all equipment in the space, which may cause trouble to managers.

[0104] Exemplarily, as shown in Figure 1, after the whole-house central control screen is started, the default interface is displayed, such as the living room interface shown by reference numeral 11. In the living room interface, the user can control the smart home devices with location information of the living room as needed. For example, in response to the user's operation of the light-on control 12, the whole-house central control screen controls all the lights in the living room to turn on. Optionally, the whole-house central control screen can also switch different rooms according to user operations to facilitate the control of smart home devices located in other rooms. For example, in response to the user's operation of the switching control 13, the whole-house central control screen can switch to display the control interfaces corresponding to other rooms. For example, if you switch to the master bedroom interface, the user can control the smart home devices in the master bedroom through the master bedroom interface.

[0105] For example, the whole-house central control screen does not have the ability to control sensitive equipment and sensitive data, allowing all operators to arbitrarily instruct the whole-house central control screen to control sensitive equipment (such as cameras, etc.) and display sensitive data (such as camera data, user health data, etc.), exposing user privacy.

[0106] For example, as shown in Figure 2, the central control screen of the entire house displays a security interface in response to user operations. The security interface displays the camera image captured by the camera, such as the living room image 21. The security interface also displays camera data 22 generated based on the camera image.

[0107] For example, the whole-house central control screen does not have the ability to control sensitive operations. The whole-house central control screen will respond to any sensitive operations of any operator, affecting the safety of the equipment.

[0108] Exemplarily, as shown in (a) in FIG3 , the whole-house central control screen displays a pop-up window for restoring the factory configuration according to the user's operation. In response to the user's operation on the factory configuration restore control 31, the whole-house central control screen restores the factory configuration. Any user can perform the sensitive operation of instructing the whole-house central control screen to restore the factory configuration, affecting the data security of the whole-house central control screen. Another exemplary embodiment, as shown in (b) in FIG3 , the whole-house central control screen displays a privacy statement page in response to the user's operation, and the privacy statement page can directly access the external network. Users who are restricted from accessing the Internet, such as children, can also perform this sensitive operation, thereby browsing the external network content through the privacy statement page.

[0109] For example, the whole-house central control screen does not have the ability to adaptively update configurations based on user preferences.

[0110] For example, as shown in Figure 4, the entire home central control screen displays the default control interface. However, in reality, different users may have different preferences for themes, backgrounds, and interaction styles, and the same interface display cannot provide a personalized experience for different users. For example, children may prefer cartoon-style themes with more streamlined operation and interaction. Elderly people may prefer themes with larger fonts, etc.

[0111] Based on this, an embodiment of the present application provides a permission management method, which uses a function lock function to distinguish the permission scopes of different users to perform business, thereby improving device security.

[0112] Optionally, the rights management method provided in the embodiment of the present application is applied to the electronic device 100. Optionally, the electronic device 100 can be, for example, a whole-house central control screen, a tablet computer, a mobile phone, a computer, a laptop computer, an ultra-mobile personal computer (UMPC), a netbook, a personal digital assistant (PDA), a wearable device, an artificial intelligence (AI) device, or other terminal device. In some examples, the electronic device 100 is an intelligent electronic device. The operating system installed on the electronic device 100 includes but is not limited to This application does not limit the specific type of the electronic device 100 or the installed operating system.

[0113] Optionally, the electronic device 100 may be a dedicated device for controlling smart home devices, or a device that includes the function of controlling smart home devices. For example, the electronic device 100 may be a terminal device such as a whole-home central control screen, a mobile phone, a tablet, or a smart speaker. The whole-home central control screen is a dedicated device for controlling smart home devices in a smart home system. In some embodiments, the electronic device 100 may be a fixed device or a portable device. This application does not impose any particular restrictions on the specific form of the electronic device 100.

[0114] In some embodiments, one or more electronic devices 100 may be configured in the whole house scenario. For example, one electronic device 100 is configured in the whole house, and the electronic device is used to control all smart home devices in the whole house. For example, the electronic device 100 is a movable device, and the electronic device 100 controls the smart home devices in the current space by locating the current spatial position. For another example, one electronic device 100 is configured in each room in the whole house, and the electronic device 100 is used to control the smart home devices in the current space (room). For example, the electronic device 100 is a fixed device, and the spatial properties of the electronic device 100 can be configured during the pre-installation process of the electronic device 100.

[0115] FIG5 is a schematic diagram of the hardware structure of an electronic device 100 provided in an embodiment of the present application.

[0116] As shown in Figure 5, the electronic device 100 may include a processor 110, an external memory interface 120, an internal memory 121, a universal serial bus (USB) interface 130, a charging management module 140, a power management module 141, a battery 142, an antenna 1, an antenna 2, a mobile communication module 150, a wireless communication module 160, an audio module 170, a sensor module 180, a button 190, a motor 191, an indicator 192, a camera 193, a display screen 194, and a subscriber identification module (SIM) card interface 195, etc.

[0117] It should be understood that the structures illustrated in the embodiments of the present application do not constitute a specific limitation on the electronic device 100. In other embodiments of the present application, the electronic device 100 may include more or fewer components than shown, or may combine or separate certain components, or arrange the components differently. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0118] The processor 110 may include one or more processing units. For example, the processor 110 may include an application processor (AP), a modem processor, a graphics processing unit (GPU), an image signal processor (ISP), a controller, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU). The different processing units may be independent devices or integrated into one or more processors.

[0119] The controller can generate operation control signals according to the instruction operation code and timing signal to complete the control of instruction fetching and execution.

[0120] Processor 110 may also include a memory for storing instructions and data. In some embodiments, the memory in processor 110 is a cache memory. This memory can store instructions or data that have just been used or are being recycled by processor 110. If processor 110 needs to use the same instruction or data again, it can directly access the memory. This avoids duplicate accesses, reduces processor 110 latency, and thus improves system efficiency.

[0121] In some embodiments, the processor 110 may include one or more interfaces. The interfaces may include an inter-integrated circuit (I2C) interface, an inter-integrated circuit sound (I2S) interface, a pulse code modulation (PCM) interface, a universal asynchronous receiver / transmitter (UART) interface, a mobile industry processor interface (MIPI), a general-purpose input / output (GPIO) interface, a subscriber identity module (SIM) interface, and / or a universal serial bus (USB) interface.

[0122] The I2C interface is a bidirectional synchronous serial bus that includes a serial data line (SDA) and a serial clock line (SCL). In some embodiments, the processor 110 may include multiple I2C bus lines. The processor 110 may be coupled to a touch sensor, a charger, a flash, a camera 193, and the like via different I2C bus interfaces. For example, the processor 110 may be coupled to a touch sensor via an I2C interface, enabling communication between the processor 110 and the touch sensor via the I2C bus interface, thereby enabling touch functionality of the electronic device 100.

[0123] The MIPI interface can be used to connect the processor 110 to peripheral devices such as the display 194 and the camera 193. MIPI interfaces include the camera serial interface (CSI) and the display serial interface (DSI). In some embodiments, the processor 110 and the camera 193 communicate via the CSI interface to implement the camera function of the electronic device 100. The processor 110 and the display 194 communicate via the DSI interface to implement the display function of the electronic device 100.

[0124] The USB interface 130 is an interface that complies with USB standards and may be a Mini USB interface, a Micro USB interface, a USB Type-C interface, or the like. The USB interface 130 can be used to connect a charger to charge the electronic device 100, or to transfer data between the electronic device 100 and peripheral devices. It can also be used to connect headphones to play audio. This interface can also be used to connect other electronic devices, such as augmented reality devices.

[0125] It is understood that the interface connection relationship between the modules illustrated in the embodiments of the present application is merely an illustrative illustration and does not constitute a structural limitation on the electronic device 100. In other embodiments of the present application, the electronic device 100 may also adopt different interface connection methods from the above embodiments, or a combination of multiple interface connection methods.

[0126] The charging management module 140 is configured to receive charging input from a charger. The charger can be either a wireless charger or a wired charger. In some wired charging embodiments, the charging management module 140 can receive charging input from the wired charger via the USB interface 130. In some wireless charging embodiments, the charging management module 140 can receive wireless charging input via the wireless charging coil of the electronic device 100. While charging the battery 142, the charging management module 140 can also provide power to the electronic device via the power management module 141.

[0127] The power management module 141 is used to connect the battery 142, the charging management module 140, and the processor 110. The power management module 141 receives input from the battery 142 and / or the charging management module 140, and provides power to the processor 110, the internal memory 121, the display 194, the camera 193, and the wireless communication module 160. The power management module 141 can also be used to monitor parameters such as battery capacity, battery cycle count, and battery health status (leakage, impedance). In some other embodiments, the power management module 141 can also be set in the processor 110. In other embodiments, the power management module 141 and the charging management module 140 can also be set in the same device.

[0128] The wireless communication function of the electronic device 100 can be implemented through the antenna 1, the antenna 2, the mobile communication module 150, the wireless communication module 160, the modem processor and the baseband processor.

[0129] Antenna 1 and Antenna 2 are used to transmit and receive electromagnetic wave signals. Each antenna in electronic device 100 can be used to cover a single or multiple communication frequency bands. Different antennas can also be reused to improve antenna utilization. For example, antenna 1 can be reused as a diversity antenna for a wireless local area network. In other embodiments, the antennas can be used in conjunction with a tuning switch.

[0130] The mobile communication module 150 can provide solutions for wireless communications including 2G / 3G / 4G / 5G applied to the electronic device 100. The mobile communication module 150 may include at least one filter, a switch, a power amplifier, a low noise amplifier (LNA), etc. The mobile communication module 150 can receive electromagnetic waves from the antenna 1, and filter, amplify, and process the received electromagnetic waves, and transmit them to the modulation and demodulation processor for demodulation. The mobile communication module 150 can also amplify the signal modulated by the modulation and demodulation processor, and convert it into electromagnetic waves for radiation through the antenna 1. In some embodiments, at least some of the functional modules of the mobile communication module 150 can be set in the processor 110. In some embodiments, at least some of the functional modules of the mobile communication module 150 can be set in the same device as at least some of the modules of the processor 110.

[0131] The modem processor may include a modulator and a demodulator. The modulator is used to modulate the low-frequency baseband signal to be transmitted into a medium-high frequency signal. The demodulator is used to demodulate the received electromagnetic wave signal into a low-frequency baseband signal. The demodulator then transmits the demodulated low-frequency baseband signal to the baseband processor for processing. After being processed by the baseband processor, the low-frequency baseband signal is passed to the application processor. The application processor outputs the sound signal through the audio device or displays an image or video through the display screen 194. In some embodiments, the modem processor may be an independent device. In other embodiments, the modem processor may be independent of the processor 110 and be provided in the same device as the mobile communication module 150 or other functional modules.

[0132] The wireless communication module 160 can provide wireless communication solutions including wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) networks), Bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), infrared (IR), etc., which are applied to the electronic device 100. The wireless communication module 160 can be one or more devices that integrate at least one communication processing module. The wireless communication module 160 receives electromagnetic waves via the antenna 2, frequency modulates and filters the electromagnetic wave signals, and sends the processed signals to the processor 110. The wireless communication module 160 can also receive the signal to be sent from the processor 110, frequency modulate it, amplify it, and convert it into electromagnetic waves for radiation through the antenna 2.

[0133] In some embodiments, the antenna 1 of the electronic device 100 is coupled to the mobile communication module 150, and the antenna 2 is coupled to the wireless communication module 160, so that the electronic device 100 can communicate with a network and other devices through wireless communication technologies. The wireless communication technologies may include global system for mobile communications (GSM), general packet radio service (GPRS), code division multiple access (CDMA), wideband code division multiple access (WCDMA), time-division code division multiple access (TD-SCDMA), long term evolution (LTE), BT, GNSS, WLAN, NFC, FM, and / or IR technology. The GNSS may include a global positioning system (GPS), a global navigation satellite system (GLONASS), a Beidou navigation satellite system (BDS), a quasi-zenith satellite system (QZSS) and / or a satellite based augmentation system (SBAS).

[0134] Electronic device 100 implements display functionality through a GPU, display screen 194, and an application processor. A GPU is a microprocessor for image processing that connects display screen 194 and the application processor. The GPU is used to perform mathematical and geometric calculations for graphics rendering. Processor 110 may include one or more GPUs that execute program instructions to generate or modify display information.

[0135] Display screen 194 is used to display images, videos, etc. Display screen 194 includes a display panel. The display panel can be manufactured using a liquid crystal display (LCD), for example, an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode or an active-matrix organic light-emitting diode (AMOLED), a flexible light-emitting diode (FLED), a Mini-LED, a Micro-LED, a Micro-OLED, or a quantum dot light-emitting diode (QLED). In some embodiments, electronic device 100 can include one or N display screens 194, where N is a positive integer greater than one.

[0136] The camera 193 is used to capture still images or videos. The object generates an optical image through the lens and projects it onto the photosensitive element. The photosensitive element can be a charge coupled device (CCD) or a complementary metal-oxide-semiconductor (CMOS) phototransistor. The photosensitive element converts the light signal into an electrical signal, and then passes the electrical signal to the ISP for conversion into a digital image signal. The ISP outputs the digital image signal to the DSP for processing. The DSP converts the digital image signal into an image signal in a standard RGB, YUV or other format. In some embodiments, the electronic device 100 may include 1 or N cameras 193, where N is a positive integer greater than 1.

[0137] The external memory interface 120 can be used to connect an external memory card, such as a Micro SD card, to expand the storage capacity of the electronic device 100. The external memory card communicates with the processor 110 via the external memory interface 120 to implement data storage functions. For example, files such as music and videos can be stored on the external memory card.

[0138] The internal memory 121 can be used to store computer executable program codes, which include instructions. The internal memory 121 may include a program storage area and a data storage area. Among them, the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc. The data storage area may store data created during the use of the electronic device 100 (such as audio data, a phone book, etc.), etc. In addition, the internal memory 121 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, a universal flash storage (UFS), etc. The processor 110 executes various functional applications and data processing of the electronic device 100 by running instructions stored in the internal memory 121 and / or instructions stored in a memory provided in the processor.

[0139] The audio module 170 is used to convert digital audio information into analog audio signal output, and is also used to convert analog audio input into digital audio signals. The audio module 170 can also be used to encode and decode audio signals. In some embodiments, the audio module 170 can be set in the processor 110, or some functional modules of the audio module 170 can be set in the processor 110. The electronic device 100 can use the audio module 170, such as music playback and recording. The audio module 170 may include a speaker, a receiver, a microphone, a headphone jack, and an application processor to implement audio functions.

[0140] The sensor module 180 may include a pressure sensor, a gyro sensor, an air pressure sensor, a magnetic sensor, an acceleration sensor, a distance sensor, a proximity light sensor, a fingerprint sensor, a temperature sensor, a touch sensor, an ambient light sensor, a bone conduction sensor, and the like.

[0141] The buttons 190 include a power button, a volume button, and the like. The buttons 190 may be mechanical buttons or touch buttons. The electronic device 100 may receive key inputs and generate key signal inputs related to user settings and function control of the electronic device 100.

[0142] Motor 191 can generate vibration alerts. This can be used for incoming call vibration alerts or touch vibration feedback. Depending on the touch operation applied to different areas of the display 194, motor 191 can also generate different vibration feedback effects. Different application scenarios (e.g., time reminders, receiving messages, alarm clocks, gaming, etc.) can also correspond to different vibration feedback effects.

[0143] The indicator 192 may be an indicator light, which may be used to indicate the charging status, power level changes, messages, missed calls, notifications, etc.

[0144] The SIM card interface 195 is used to connect a SIM card. The SIM card can be connected to and disconnected from the electronic device 100 by inserting or removing the SIM card into or from the SIM card interface 195. The electronic device 100 may support one or N SIM card interfaces, where N is a positive integer greater than one.

[0145] In some embodiments, the electronic device 100 can be applied to different scenarios, such as smart home scenarios, smart office scenarios, smart factories, etc., and the embodiments of the present application do not limit this. The following uses the electronic device 100 applied to the smart home scenario and the electronic device 100 as a whole-house central control screen as an example to describe in detail the permission management method provided in the embodiments of the present application.

[0146] In some embodiments, the whole-house central control screen responds to user operations and completes account login. The whole-house central control screen can set the currently logged-in account as the main account according to the user operation. Subsequently, the whole-house central control screen can add other slave accounts when it is in the logged-in state of the main account. Optionally, different accounts are configured with different permissions, and the security of the whole-house central control screen is guaranteed through permission management. For example, in the subsequent use of the whole-house central control screen, the whole-house central control screen can determine the permissions of the current user by authenticating the current user identity and matching the corresponding account, thereby improving the security of the device. Optionally, if the account is not added, the whole-house central control screen may not be able to identify the current user identity in the subsequent use of the whole-house central control screen, then the whole-house central control screen can match a lower permission range for the user, thereby improving the security of the device.

[0147] Optionally, the account of the whole-house central control screen is, for example, a system account or an application account. For example, the account of the whole-house central control screen is a smart life application account. The user can complete the registration of the smart life application account on the whole-house central control screen or other devices. Afterwards, log in to the account on the whole-house central control screen.

[0148] For example, as shown in (a) in Figure 6, the account of user A is currently logged in to the whole-house central control screen. The whole-house central control screen detects the user's operation on the add account control 61, and determines that the user instructs to add a new account. In some examples, in order to ensure the security of account addition, the account addition process can also be verified to prevent unauthorized users from adding accounts at will. For example, as shown in (b) in Figure 6, the whole-house central control screen can display a QR code 62, prompting the user to add an account by scanning the code. Among them, the code scanning device needs to have completed the account login and the whole-house central control screen has been added as a trusted device. Afterwards, the code scanning device can display a prompt message in response to the code scanning operation to prompt the user whether to authorize the whole-house central control screen to perform user management. In response to the user's operation on the consent control 63, the code scanning device can send an instruction message to the whole-house central control screen to complete the authorization.

[0149] After obtaining authorization, the whole-house central control screen can start adding accounts. Optionally, the permissions configured for the current login account of the whole-house central control screen include adding accounts. Then, during the process of the whole-house central control screen logging into the account, if it is determined that the user who instructs to add the account has passed the authentication, the account addition process can also be directly triggered without having to scan the code for authentication. Among them, the whole-house central control screen can perform user identity authentication through face recognition, password verification, etc. For the user identity authentication process, please see the relevant description below for details.

[0150] Exemplarily, the whole house central control screen triggers the account adding process and displays the interface shown in Figure 7 (a), where the user can enter the name of the currently added account on this interface, such as user C. Afterwards, after completing the account creation, the whole house central control screen can then enter the authentication credentials, such as facial image, account password, voiceprint, fingerprint, etc. Among them, the authentication credentials are used to authenticate the user's identity, so as to ensure that the correct authority range is matched during the subsequent use of the whole house central control screen and provide personalized services. For example, in response to the user's operation on the next step control 71, the whole house central control screen displays the interface shown in Figure 7 (b), on which the whole house central control screen can enter the user's facial image according to the user's operation, and then the whole house central control screen displays the interface shown in Figure 7 (c), prompting the user that the facial image has been successfully entered.

[0151] In this way, by creating different accounts in the whole-house central control screen, the user's identity authentication can be increased and security risks can be reduced in the subsequent use of the whole-house central control screen.

[0152] It should be understood that the above text uses different accounts to distinguish different user identities as an example to introduce the process of adding users to the whole-house central control screen. In some examples, the whole-house central control screen does not distinguish different users by account number, but can directly identify the user identity. After obtaining the user identity, the permissions that match the user identity can be obtained. In other words, after the whole-house central control screen identifies the user identity, it does not have to match the corresponding account number to obtain the corresponding permissions, but can directly obtain the corresponding permissions based on the user identity. In this way, it is also possible to reduce the security risks of the whole-house equipment by increasing the authentication of the user identity by the whole-house central control screen. This will not be elaborated below.

[0153] For example, in the scenario shown in Figure 6, the whole-house central control screen logs in to the administrator account (such as the main account). It should be understood that the whole-house central control screen logs in to at least one account to achieve the management and control of the device. Subsequently, after detecting the user's operation of adding a user, the whole-house central control screen can obtain the new user identity information, such as authentication credentials such as facial images, user names and other information. In this way, after authenticating the user's identity, the whole-house central control screen can match the corresponding user identity and then match different permissions.

[0154] In some embodiments, the whole-house central control screen obtains user identity information through account (or user) creation. Afterwards, the whole-house central control screen can configure different permission ranges for different user identities.

[0155] In some examples, the whole-house central control screen is configured with a function lock function, and a correspondence is established between the function lock function and different user identities, thereby limiting the user's authority range through different function lock functions. Optionally, the function lock function includes, for example, a space lock function, a privacy lock function, a configuration lock function, a data lock function, and the like. Different function lock functions are used to define different function locks. For example, function locks include space locks, privacy locks, configuration locks, data locks, and the like. To simplify the description, the function lock function is referred to as the function lock function below. Optionally, the function lock is turned on by default for the whole-house central control screen. If the function lock is not turned on, the corresponding permissions are not allowed to be obtained by default.

[0156] Among them, the space lock is used to limit the permission to switch spaces, such as supporting the space capabilities of the whole-house central control screen. For example, when the space lock is turned on, the whole-house central control screen allows authenticated users to switch spaces, such as switching between different rooms, to control the smart home devices in the corresponding room.

[0157] Privacy locks are used to restrict access to sensitive data, such as security and healthcare subsystems, which contain user-sensitive data. For example, with the privacy lock enabled, the central control panel allows authenticated users to access pre-defined systems containing user-sensitive data. These pre-defined systems containing user-sensitive data are optionally pre-configured in the operating system and can be customized by the user.

[0158] Configuration locks are used to restrict permissions for triggering setup functions, such as accessing system settings on the whole-home central control screen. For example, with the privacy lock enabled, the whole-home central control screen allows authenticated users to launch the setup app and modify related settings.

[0159] The data lock is used to limit the user's ability to customize the interface display information, such as supporting the isolation of user data such as theme style, page layout, font size, etc. For example, when the data lock is turned on, the user can customize the display information to meet their own needs, and the display information may include display effects, display content, etc. In this way, after the user's identity authentication is passed, the whole house central control screen can match the user data corresponding to the current user (such as user-defined display information), such as modifying the current display interface to the corresponding theme style, page layout, font size, etc., to achieve a personalized display effect.

[0160] In some examples, embodiments of the present application use the concept of a function lock to define different permission scopes, with different function locks supporting different permission scopes. It should be understood that a function lock is merely a design logic for the permission scope within a design logic and does not constitute a limitation on the permission scope. For example, a function lock can also be described as a function key, a function lock, or permission support, which will not be further described below.

[0161] In some examples, the whole-house central control screen can set the user role corresponding to the current account (or user) according to user operations. Different user roles can match different function locks, thereby reducing the difficulty of users setting function locks one by one.

[0162] For example, as shown in Figure 8, the whole-home central control screen uses the smart life application in the aforementioned example code scanning device to add a user and enter the user's authentication information, such as password, face, and fingerprint, to obtain the user's identity information. The whole-home central control screen then defines the role corresponding to the current user account based on the user's operation, such as head of household, elder, child, nanny, visitor, or other customized roles. Predefined function locks are configured for different roles. For example, the head of household has greater authority and supports management of space locks, privacy locks, configuration locks, and data locks, while the nanny has less authority and only supports management of data locks. Optionally, after the whole-home central control screen determines the role corresponding to the user account based on the user's operation, it can bind different function locks to the user account based on that role. Alternatively, the whole-home central control screen can also determine the role corresponding to the user's identity based on the user's operation and bind different function locks to the user identity based on that role. This way, after the whole-home central control screen recognizes the user identity, it can determine different function locks to determine the different permissions for the current user identity.

[0163] Before a user account (or user) is created, the current operator's identity is authenticated to ensure the security of account creation. Therefore, creating roles and configuring function locks for new user accounts can also ensure the security of the central control screen throughout the house.

[0164] Optionally, the whole-house central control screen supports users to modify the bound function locks after selecting a role, thereby meeting the user's personalized needs.

[0165] Optionally, the whole-home central control screen can directly prompt the user to configure the corresponding function lock after the user creates an account, without having to configure the user role first. Alternatively, the whole-home central control screen can also prompt the user to configure the corresponding function lock after the user role is configured. In other words, the user role configuration process and the function lock configuration process can be decoupled.

[0166] For example, as shown in (a) in Figure 9, after the user account is created, a pop-up window for adding a user is displayed to enrich the acquired user identity information. Such as collecting user avatars, nicknames, family roles, birthdays, etc. For example, the whole-house central control screen detects the user's operation of clicking on control 91 and determines that the user instructs to configure the role of the current user account. Then, the whole-house central control screen can display an interface as shown in (b) in Figure 9, which displays a pop-up window for selecting a family role. The whole-house central control screen can determine the role of the currently created user account based on the user's selection operation.

[0167] As another example, as shown in Figure 10A, the central control screen displays a function lock configuration interface, where users can select different function locks according to their needs. For example, based on the user's selection, the central control screen configures the privacy lock, configuration lock, and data lock for the account corresponding to the current user C, but does not configure the space lock. Therefore, the account corresponding to the current user C does not have permission to switch spaces.

[0168] In this way, the permission ranges of different user identities are configured through function locks, so that after the central control screen of the whole house completes the user identity identification, different permission ranges can be matched to different user identities to ensure the security of the central control screen of the whole house.

[0169] Optionally, the whole-house central control screen can also configure some or all permissions for different function locks based on user operations. For example, as shown in Figure 10A, the whole-house central control screen configures the access to the security subsystem in the privacy lock based on user operations. Then, if the privacy lock is turned on on the whole-house central control screen, user C will only be able to access the security subsystem after completing identity authentication.

[0170] In this way, a more flexible function lock configuration is achieved.

[0171] In other embodiments, the whole-house central control screen can also configure accounts (or users) applicable to different function locks according to user operations.

[0172] Exemplarily, as shown in FIG10B , the accounts currently saved on the whole-house central control screen include user A, user B, and user C. Among them, the whole-house central control screen displays the function lock setting interface according to the user operation. In this interface, the different function locks and saved accounts of the whole-house central control screen are displayed, and the user can select the account applicable to the different function locks according to needs. For example, as shown in FIG10B , the whole-house central control screen determines that the user applicable to the space lock is user A based on the user operation, and then the whole-house central control screen sets the space lock for the account corresponding to user A. Subsequently, when the space lock is turned on, the account of user A can instruct the whole-house central control screen to switch spaces after authentication is passed, while the accounts of user B and user C do not have the authority to switch spaces.

[0173] Optionally, an account with function lock configuration permission can display the function lock settings interface and configure the accounts applicable to different function locks. For example, after logging in to the administrator account, the whole-house central control screen allows the administrator to configure the accounts applicable to different function locks. Alternatively, the administrator can authorize the account to configure the accounts applicable to different function locks.

[0174] The following describes the user account creation and permission configuration process provided by the embodiment of the present application through the process shown in Figure 11. As shown in Figure 11, the process includes the following steps.

[0175] S1101: The family member management module in the security center receives a user instruction to add a family member.

[0176] S1102. The family member management module performs security authentication.

[0177] The operation of indicating adding a family member includes, for example, an operation of adding a control to a family member, a voice operation, a gesture operation, and the like.

[0178] In some embodiments, in response to a user's instruction to add a family member, the family member management module instructs the display to display a QR code, which can be scanned by other electronic devices logged into the smart life application account to verify the safety of the current family member addition operation. After the code is scanned, the family member management module determines that the current operation is safe and the family member can be added.

[0179] In other embodiments, in response to a user's instruction to add a family member, the family member management module determines that the current login account is an administrator account with permission to add family members, and that the current operator has passed the security authentication corresponding to the administrator account (e.g., passing facial recognition, passing the account and password verification, etc.). The family member management module can then directly determine that the current operation to add a family member is secure and complete the security authentication.

[0180] Among them, each module in the whole house central control screen is divided according to its function, such as the family member management module, role management module, permission management module, and password management module located in the security center. It should be understood that other module division methods may exist, and this embodiment of the application does not limit this.

[0181] S1103. The family member management module interacts with the user identity management module in the panel assistant to add new family members.

[0182] In some embodiments, after completing security authentication, the family member management module may determine that adding family members is currently permitted. The family member management module may then send a new family member addition instruction to the user identity management module in the panel assistant. After passing security authentication, the family member management module may obtain user-entered information such as the name, surname, and profile picture of the new family member. The family member management module may include this information in the new family member addition instruction. Accordingly, after receiving the new family member addition instruction, the user identity management module may complete the addition of the current family member. Thereafter, the user identity management module may send a new family member addition response to the family member management module to indicate to the family member management module that the user addition process for the current family member has been completed.

[0183] S1104. The family member management module instructs the password management module in the security center to obtain the password.

[0184] S1105. The family member management module instructs the face recognition module to obtain a face image.

[0185] S1106. The family member management module saves the user identity information.

[0186] In some embodiments, after adding a new family member, the family member management module can add the corresponding user identity information of the family member. This user identity information is used to subsequently authenticate the operator's identity. For example, during the subsequent use of the whole-house central control screen, the whole-house central control screen can authenticate the current operator's identity based on this user identity information and, after successful authentication, match the pre-configured function lock.

[0187] Optionally, the user identity information includes, for example, a face image, a password, a fingerprint, a voiceprint, etc.

[0188] For example, as shown in S1104 and S1105, the embodiment of the present application takes the addition of facial image authentication method and password authentication method as examples to introduce the process of adding user identity information. For example, the family member management module sends an instruction to the password management module of the security center to instruct the password management module to display the password addition interface, collect the password entered by the user, and save the password. Afterwards, the password management module can send a password addition success response to the family member management module to complete the password addition process in the user identity information. For another example, in the facial image collection scenario shown in Figure 7, the family member management module sends an instruction to the facial recognition module to instruct the facial recognition module to collect the user's facial image and save the facial image. Afterwards, the facial recognition module can send a facial image addition success response to the family member management module to complete the facial image addition process in the user identity information.

[0189] S1107. The family member management module interacts with the role management module in the security center to complete role binding.

[0190] In some embodiments, after saving the user's identity information, the Family Member Management Module may send a role binding instruction to the Role Management Module in the Security Center to add a role to the current account. Accordingly, in response to the role binding instruction, the Role Management Module may display the interface shown in FIG9(b) and, based on the user's operation, determine the user-defined role corresponding to the current account. The Role Management Module may then send a role binding response to the Family Member Management Module, indicating that the current account has completed role binding and including details of the role binding.

[0191] S1108. The family member management module interacts with the rights management module in the security center to complete rights binding.

[0192] In some embodiments, after determining the role corresponding to the account, the family member management module may trigger the permission binding process for the current account. Optionally, the family member management module may automatically match the permission range based on the determined role and send an instruction to the permission management module to establish a mapping relationship between the current account and the permissions. Optionally, the family member management module may further instruct the permission management module to display the interface shown in Figure 10A and determine the permissions corresponding to the current account based on user operations. The permission management module may then send a permission binding response to the family member management module to indicate that the current account has completed permission binding, i.e., the account has been configured with the corresponding permission range, such as the corresponding function lock.

[0193] In this way, when creating a user, the permission range is added. This facilitates the subsequent authentication of the operator's identity and matches the permission range corresponding to the current operator, thereby preventing the operator from arbitrarily operating the whole house central control screen and affecting the security of the whole house central control screen.

[0194] The above describes the process of creating a function lock, and the following describes the specific process of using a function lock.

[0195] In some embodiments, the whole-house central control screen has the function lock enabled by default. If the function lock is not enabled, the corresponding permissions are not allowed by default. Optionally, the whole-house central control screen can enable or disable the function lock based on user operations. Optionally, the whole-house central control screen can also enable or disable some or all of the function locks based on user operations. For example, as shown in Figure 12, the user can choose to enable or disable the space lock, privacy lock, configuration lock, and data lock separately.

[0196] Optionally, different roles are configured with permissions to manage different function locks. For example, as shown in Figure 8, the household owner is supported by default to manage space locks, privacy locks, configuration locks, and data locks.

[0197] For example, the whole-house central control screen has the space lock turned on by default. Then, when the user instructs to switch spaces, the whole-house central control screen triggers the authentication of the current user identity. After the user identity authentication is passed, the corresponding space switching event is executed.

[0198] Among them, the whole house central control screen determines that the currently collected authentication information (such as user face and password) matches the pre-saved user identity information 1. Then, the whole house central control screen determines that the user identity authentication is passed, otherwise it determines that the user identity authentication is failed.

[0199] Optionally, during the user identity creation process, the user can choose whether to bind a corresponding function lock. During the user identity authentication process, the central control screen determines that the currently collected authentication information (such as the user's face and password) matches the pre-saved user identity information 1, and that the user identity information 1 includes information about the bound space lock. Only then does the central control screen determine that the user identity authentication has passed; otherwise, it determines that the user identity authentication has failed.

[0200] The following describes the usage of different function locks.

[0201] In some embodiments, a space lock is added to the whole-house central control screen to isolate devices in different spaces and reduce the risk of users switching spaces at will.

[0202] For example, as shown in (a) in Figure 13, the whole-house central control screen detects the user's operation on the switching control 131 during the display of the living room interface, and determines that the user instructs to switch spaces. If the current space lock is turned on, then the whole-house central control screen displays the interface shown in (b) in Figure 13, prompting the user to perform face authentication to confirm the identity of the current operator. The current operator may not have entered a face image during the account creation process, or the current environment may not be convenient for collecting face images. Then, the user can choose to complete identity authentication through other methods. For example, the whole-house central control screen detects the user's operation on the password verification control 132, and may display the interface shown in (c) in Figure 13 to collect the password entered by the user. The whole-house central control screen determines that the face recognition is successful or the password is correct, and may determine that the user's identity authentication is successful. Afterwards, the whole-house central control screen may display the interface shown in (d) in Figure 13, allowing the user to switch spaces.

[0203] It should be understood that the authentication process in Figure 13 is only an example. The whole-house central control screen can authenticate the user through face recognition, password authentication, or other authentication methods. The user identity authentication process below will still use face recognition as an example to illustrate, and other authentication methods will not be repeated one by one.

[0204] Optionally, after the user identity authentication is passed, within the validity period of the user identity authentication, the whole house central control screen may not need to authenticate the user identity again, but allow the user to directly perform operations within the authority.

[0205] For example, in the scenario shown in Figure 13, the user identity authentication is valid for 30 minutes. After the whole-house central control screen determines that the user identity authentication is passed at 8:00 in the morning, it detects the user's instruction to switch spaces at 8:15 in the morning of the same day. The whole-house central control screen determines that the current operation time point is within the user identity authentication validity period and can directly execute the corresponding space switching event without having to authenticate the user identity again. Afterwards, the whole-house central control screen detects the user's instruction to switch spaces again at 8:45 in the morning of the same day. The whole-house central control screen determines that the current operation time point has exceeded the user identity authentication validity period, then the whole-house central control screen can trigger the user identity authentication process.

[0206] In this way, the validity period of user identity authentication is reduced, the number of user authentication times is reduced, and the difficulty of user operation is reduced.

[0207] Optionally, after the user identity authentication validity period expires, if the whole-house central control screen detects the user's sensitive operation (such as an operation indicating switching spaces), it can trigger the authentication of the user's identity again, thereby improving the security of the device.

[0208] Optionally, when a user approaches the central control screen, the screen can detect their presence and trigger the camera to capture the user's facial image for authentication through facial recognition. If facial recognition is successful, the central control screen can then directly respond to the user's action. In other words, the user authentication process can be triggered by either user action or proximity.

[0209] For example, in the scenario shown in Figure 13, the whole-house central control screen responds to the user approaching and confirms that the user's identity authentication is successful. Then, as shown in Figure 13 (a), the whole-house central control screen detects the user's operation of the switch space control 131 and can directly display the interface shown in Figure 13 (d) to switch spaces.

[0210] Optionally, as shown in the user function lock configuration scenario in Figure 10A, the user has configured different function locks for different user identities as needed. For example, the function lock of the current user C does not have the space lock permission enabled. Then, in the scenario shown in Figure 13, in response to the user's operation of the switch space control 131 shown in Figure 13 (a), the whole-house central control screen displays the interface shown in Figure 13 (b), and performs face recognition authentication on the current user. The whole-house central control screen determines that the current operator is user C based on the currently collected facial image, and user C has not enabled the space lock permission. Then, the whole-house central control screen can determine that the face recognition has failed, and the current user does not have the permission to switch spaces.

[0211] Optionally, when the whole-house central control screen determines that the user does not have the operation authority, it can display a prompt message to inform the user that the identity authentication failed and the corresponding operation cannot be performed. Optionally, when the whole-house central control screen determines that the user does not have the operation authority, it can trigger a secondary identity authentication. For example, the whole-house central control screen can prompt the user to enter the administrator account to obtain the required operation authority.

[0212] In this way, the space lock function is used to isolate devices in different spaces (such as rooms). Space switching is allowed only after authentication is passed to control the devices in the corresponding space, thereby preventing the central control screen from accessing any device in the house and avoiding safety hazards.

[0213] In some embodiments, the above uses space locks to implement isolated control of different devices. Optionally, the whole-house central control screen can also perform device isolation control at other granularities.

[0214] For example, the whole-house central control screen supports scene configuration, and a single scene (such as a home scene, etc.) includes at least one device. Then, a scene lock can be configured in the whole-house central control screen. When the user instructs to trigger or edit a scene, the user's identity can be authenticated to confirm whether the user has the corresponding authority, thereby realizing device isolation in the scene. For another example, the whole-house central control screen supports subsystem configuration, and a single subsystem (such as a lighting subsystem) includes at least one device. Then, a subsystem lock can be configured in the whole-house central control screen. When the user instructs to trigger or edit a subsystem, the user's identity can be authenticated to confirm whether the user has the corresponding authority, thereby realizing device isolation in the subsystem. For another example, the whole-house central control screen is equipped with a device lock. When the user instructs to control a device, the whole-house central control screen can authenticate the user's identity to confirm whether the user has the corresponding authority.

[0215] In this way, more flexible device isolation control can be achieved through locking functions of different granularities.

[0216] In some examples, space locks can also be used to isolate devices in certain spaces. For example, users can pre-configure sensitive spaces, such as a study or bedroom. When the central control panel detects the user's request to switch to a sensitive space, it authenticates the user. However, when the user requests to switch to a non-sensitive space, the central control panel does not authenticate the user. This allows for flexible device isolation within a space.

[0217] It should be understood that the permission management method provided in the embodiment of the present application can also be applied to other scenarios. For example, in the smart office scenario, the whole-house central control screen can also be configured with a space lock to achieve device isolation in some spaces. For example, the whole-house central control screen creates the identity of user A based on user operations, and configures the permissions corresponding to the identity of user A, including switching sensitive spaces, such as the pre-configured general manager's office. In this way, in the subsequent use of the whole-house central control screen, the operation of switching the space to the general manager's office is performed according to the user's instructions, and the user identity of the current operator is determined to be user A, and the permissions corresponding to the identity of user A are obtained, including switching the space to the general manager's office. Then, the whole-house central control screen can switch spaces and switch to display the operation interface corresponding to the general manager's office.

[0218] In some embodiments, a privacy lock is added to the central control screen to enhance the central control screen's ability to control access to sensitive devices and sensitive data, reducing the risk of privacy leaks. Optionally, sensitive devices include cameras, and sensitive data includes camera data and health care data.

[0219] For example, as shown in (a) in Figure 14, the whole-house central control screen detects the user's operation on the security control 141 and determines that the user instructs to access the security subsystem. The current privacy lock is turned on, then the whole-house central control screen determines that the user's identity needs to be authenticated. As shown in (b) in Figure 14, the whole-house central control screen displays the face image acquisition interface and authenticates the user's identity through face image recognition. After the user identity authentication is passed, the whole-house central control screen displays the camera interface shown in (c) in Figure 14. Among them, as shown in the figure mark 142, the current interface displays the living room camera screen.

[0220] In this way, the privacy lock function can be used to protect sensitive devices and sensitive data, preventing any user from accessing these contents in the central control screen throughout the house, thereby improving security.

[0221] Optionally, in the user function lock configuration scenario shown in FIG10A , during the account creation process, the user has configured unused function locks as needed. For example, the account corresponding to the current user C turns on the privacy lock permission, and limits the scope of the privacy lock permission to support access to the security subsystem. Then, in the scenario shown in FIG14 , in response to the user's operation of the security control 141 shown in FIG14 (a), the whole-house central control screen displays the interface shown in FIG14 (b), and performs face recognition authentication on the current user. The whole-house central control screen determines that the current operator is user C based on the currently collected facial image, and the account corresponding to user C turns on the permission to access the security subsystem in the privacy lock. Then, the whole-house central control screen can determine that the facial image recognition is successful and allow the current user to access the security subsystem.

[0222] In some scenarios, during the validity period of the current user identity authentication, it is detected that the user instructs to access the health care subsystem, such as the permission configuration range shown in Figure 10A. The whole-house central control screen confirms that the identity of the current user C (or the account corresponding to user C) does not have the permission to access the health care subsystem, then the whole-house central control screen can determine that the user is not allowed to access the health care subsystem. Optionally, the whole-house central control screen can also trigger the identity recognition of the current user again, such as collecting the user's facial image, and confirm whether to switch the operator to avoid abnormal permission management. If the whole-house central control screen confirms that the user corresponding to the currently collected facial image is still user C and does not have the permission to access the health care subsystem, it can determine that the facial image recognition has failed and the current user is not allowed to access the security subsystem.

[0223] In some embodiments, a configuration lock is added to the central control screen of the whole house to control the setting entrance. Only authenticated users can modify the setting content, thereby improving device security.

[0224] Optionally, the configuration lock is used to support the modification of corresponding configuration data, such as user management configuration, factory reset, theme modification configuration, etc. For example, the settings include adding an account, deleting an account, restoring the factory reset, and operating the privacy statement page.

[0225] For example, as shown in (a) in Figure 15, the whole-house central control screen detects the user's operation on the settings application icon 151 and determines that the user instructs to access the settings application. The current configuration lock is turned on, then the whole-house central control screen determines that the user identity needs to be authenticated. As shown in (b) in Figure 15, the whole-house central control screen displays the face image acquisition interface and authenticates the user identity through face recognition. After the user identity authentication is passed, the whole-house central control screen displays the settings application interface shown in (c) in Figure 15. In this interface, the whole-house central control screen can receive the user's setting operations.

[0226] In some examples, the whole-house central control screen can also set up entrances for some of the settings entrances and add configuration locks. For example, add configuration locks for account (or user) management, system settings, security and privacy settings. For example, in the user function lock configuration scenario shown in Figure 10A, during the user creation process, the configuration lock for user C identity is set to support factory configuration restoration and theme modification configuration. Then, user C identity has the authority to restore factory configuration and theme modification, but does not have user management authority.

[0227] For example, as shown in (a) of Figure 15, in response to the user's operation on the setting application icon, the whole-house central control screen can directly display the setting interface as shown in (c) of Figure 15. Some setting contents in the setting interface (such as the setting contents in the dotted box) are pre-configured with corresponding operation permissions. When the configuration lock is turned on, the operation of these configuration contents requires authentication of the operator's identity.

[0228] For example, the whole-house central control screen detects the user's operation on the add account control 152 and determines that the user instructs to add a new account. The whole-house central control screen triggers the user identity authentication process, such as collecting the user's facial image and, through facial image recognition, determining that the current user is user C. As shown in FIG10A , user C does not have user management permissions. Then, the whole-house central control screen determines that the current user is not allowed to add a new account. Optionally, the whole-house central control screen can display a prompt message to inform the user that the identity authentication failed and the new account cannot be added.

[0229] For another example, the whole-house central control screen detects the user's operation on the security and privacy control 153, and determines that the user instructs to restore the factory configuration. The whole-house central control screen triggers the user identity authentication process, such as collecting the user's face image, and through face image recognition, determines that the current user is user C. The identity of user C shown in Figure 10A has the authority to restore the factory configuration. Then, as shown in (d) in Figure 15, the whole-house central control screen can display a prompt message to prompt the user to perform the operation of restoring the factory configuration. It should be understood that the whole-house central control screen can also trigger the user identity authentication process after detecting the user's operation on the restore factory configuration control 154 to confirm whether the user has the authority to restore the factory configuration.

[0230] In this way, the configuration lock function can be used to control sensitive operations (such as restoring factory settings, accessing the external network, etc.), preventing any user from performing sensitive operations and improving device security.

[0231] In some embodiments, a data lock is added to the central control screen of the whole house to isolate user data and provide personalized services for different users.

[0232] For example, the whole-home central control screen provides users with personalized display effects. For example, the whole-home central control screen can set different themes based on user operations, with different page layouts, font sizes, interactive styles, and other content. Alternatively, the whole-home central control screen can also be individually set according to user operations. Among them, the theme styles include Elder Mode, Child Mode, Lady Mode, Business Meeting Mode, and Leisure Mode.

[0233] In some examples, the user identity is not configured with a data lock. Then, after identifying the user identity, the whole-house central control screen receives the user's editing operation on the interface display information, such as modifying the display effect. Afterwards, the whole-house central control screen can obtain the display information set by the user based on the user's editing operation and save the display information. Subsequently, the whole-house central control screen can display the interface according to the display information. That is, when the user identity is configured with a data lock, if the user has the permission to edit the display information, the default display information of the whole-house central control screen can be edited, but the user does not have the permission to edit the display information that meets the personalized needs of different users. For example, the identities of user A and user B are not configured with a data lock. After user A edits the display information that meets his own needs according to his needs, the whole-house central control screen displays according to the display information of user A. Subsequently, user B edits the display information that meets the needs of user B according to his own needs, and the whole-house central control screen displays according to the display information of user B. Obviously, the display information of user B does not meet the needs of user A. In some examples, if a user identity is configured with a data lock, the entire house central control screen can be instructed to save customized display information specific to that user identity, so that after the user identity is authenticated, the customized display information can be automatically switched to display, thereby matching personalized display information for different user identities.

[0234] In other examples, as shown in FIG16 (a), if the user has not set the display effect, the whole house central control screen will display the default display effect interface 1601 after being awakened. Obviously, the default display effect cannot provide users with a personalized service experience. Then, after the whole house central control screen switches to different display effects in response to user operations, it can save the display effect finally set by the user to the current corresponding account, so that after the user identity authentication is completed later, the interface display effect corresponding to the corresponding account is provided to the user who has passed the identity authentication.

[0235] For example, user A is an elderly person. After the whole-house central control screen switches to user A's account, it sets the theme style to elder mode according to the user's operation. Then, after the whole-house central control screen is awakened again, it determines that the current operator is user A through face recognition (or other authentication methods), and obtains the theme style saved under the account corresponding to user A. Afterwards, as shown in (b) in Figure 16, the whole-house central control screen can display interface 1602 according to the display effect of the elder mode. It can be seen that compared with the default display effect of interface 1601, interface 1602 has a larger font, a more stable background theme, and clear indoor and outdoor environment information, which can better meet the usage needs of user A.

[0236] For another example, user B is a child. After switching to user B's account, the whole-house central control screen sets the theme style to child mode according to the user's operation. Then, after the whole-house central control screen is awakened again, it determines that the current operator is user B through face recognition (or other authentication methods), and obtains the theme style saved under the account corresponding to user B. Afterwards, as shown in (c) in Figure 16, the whole-house central control screen can display interface 1603 according to the display effect of child mode. It can be seen that compared with the default display effect of interface 1601, interface 1603 has a display effect that meets the cartoon background requirements of user B.

[0237] In some examples, when the data lock is on, the whole-house central control screen can confirm the current user's identity through facial image recognition, match the corresponding user data, and switch to the corresponding display effect for interface display after detecting the user approaching. In other examples, when the whole-house central control screen displays the interface according to the default display effect, it detects user operation, and then performs user identity authentication to confirm whether the display effect needs to be switched. For example, the whole-house central control screen confirms that the authenticated user identity is pre-configured with a theme style, and can be displayed according to the theme style. For another example, the whole-house central control screen confirms that the authenticated user identity does not have a pre-configured theme style, and can continue to display according to the default theme style.

[0238] In some examples, different user identities can be set to different roles. The whole house central control screen can match different display effects (such as theme styles) according to the different roles of the currently authenticated user identity.

[0239] In this way, through the data lock function, the whole-house central control screen provides different interface display effects for different users based on user identity recognition, realizing personalized services and meeting the user's demand for customized interface display effects. Moreover, this personalized service does not require users to repeat the settings every time they use the whole-house central control screen, reducing user operation difficulty.

[0240] The following describes the process of using the function lock provided by the embodiment of the present application through the process shown in Figure 17. As shown in Figure 17, the process includes the following steps.

[0241] S1701: The proximity interaction module detects that a user is approaching.

[0242] S1702: The proximity interaction module sends a user proximity notification to the whole-house manager.

[0243] In some embodiments, the whole-house central control screen is equipped with a proximity interaction module for detecting whether a person is approaching the whole-house central control screen. Optionally, the whole-house central control screen automatically lights up when the proximity interaction module detects the user approaching.

[0244] In some examples, after the proximity interaction module detects the approach of a user, it sends a user approach notification to the whole-house housekeeper to trigger facial recognition of the approaching user.

[0245] S1703. The whole-house manager sends a face recognition instruction to the face recognition module.

[0246] S1704. The face recognition module sends a face recognition response to the security center.

[0247] In some embodiments, after receiving the notification that the user is approaching, the whole-house butler determines that facial recognition of the approaching user is required to confirm the user's identity. Then, the whole-house butler can send a facial recognition instruction to the facial recognition module. Correspondingly, after receiving the facial recognition instruction, the facial recognition module can call the camera to collect the user's facial image and identify the collected facial image. If it is determined that the facial image matches a pre-saved facial image of a certain person, it can be determined that the facial recognition is passed, and a facial recognition response indicating that the facial recognition is passed is sent to the security center. If it is determined that the facial image does not match any of the pre-saved facial images, it can be determined that the facial recognition has failed, and a facial recognition response indicating that the facial recognition has failed is sent to the security center.

[0248] Optionally, the family member management in the security center receives the face recognition response sent by the face recognition module.

[0249] S1705. The face recognition module sends a password verification request to the password management module.

[0250] S1706. The password management module sends a password verification response to the face recognition module.

[0251] In some embodiments, if the facial recognition module determines that facial recognition has failed, it may prompt the user to authenticate using another method. For example, the facial recognition module may prompt the user to authenticate using a password. For example, as shown in FIG13(b), after facial recognition fails, the central control panel detects the user's operation of the password verification control 132 and determines that the user has indicated that the user's identity should be authenticated using a password verification method.

[0252] In some examples, the facial recognition module sends a password verification request to the password management module, triggering the password verification process. The password management module receives the password entered by the user and compares it with its stored passwords to determine whether a password identical to the entered password exists. If so, the password management module may provide the facial recognition module with a password verification response indicating that the password verification passed. If not, the password management module may provide the facial recognition module with a password verification response indicating that the password verification failed.

[0253] It should be understood that steps S1705 and S1706 are optional. If facial recognition is successful, the whole-house central control screen does not need to authenticate the user's identity through password verification. In addition, the current embodiment uses facial recognition and password verification as examples to illustrate the user identity authentication process. The whole-house central control screen can also authenticate the user's identity through other methods, which will not be illustrated one by one.

[0254] S1707: The security center determines the user's identity.

[0255] S1708: The security center starts recording the validity period of the identity authentication.

[0256] In some embodiments, after receiving the face recognition response, the security center can determine whether the user identity is authenticated. Optionally, if the user identity is authenticated, the face recognition response may carry a face image identifier (such as an ID) that has been authenticated. Then, after receiving the face recognition response, the security center can determine the corresponding user identity (or account) based on the face image identifier carried therein. For example, in the process of creating a user identity, the central control screen of the whole house collects a face image and establishes a corresponding relationship between the identifier of the face image and the user identity. In this way, subsequently, during the user identity authentication process, the security center can determine the corresponding user identity based on the face image identifier.

[0257] In some examples, if a user's identity is authenticated through password verification and the user's identity authentication is successful, the security center can also obtain the password (or password identifier) ​​that passed the authentication. In this way, the security center can also match the obtained password (or password identifier) ​​to the corresponding user identity.

[0258] In some embodiments, the whole house central control screen is configured with a user identity authentication validity period, for example, 30 minutes. In some examples, after the user identity authentication is passed, the security center begins to record the identity authentication validity period. During the user identity authentication validity period, the whole house central control screen allows the user to perform operations within the authority corresponding to the currently authenticated user identity without having to repeatedly authenticate the user identity, reducing power consumption and reducing the difficulty of user operation (see steps S1801-S1803 below for details). Alternatively, after the user identity authentication validity period is exceeded, the whole house central control screen will trigger the user identity authentication again to ensure operational safety (see steps S1901-S1909 below for details).

[0259] In some embodiments, after the user identity authentication is passed, the whole-house central control screen determines that the scope of authority corresponding to the currently authenticated user identity includes user management authority. Then, during the validity period of the user identity authentication, after the whole-house central control screen detects the user's instruction to add a user (or account), it can directly respond to the operation and execute the user creation process without having to verify the security of the current user addition through other devices. For example, the whole-house central control screen no longer needs to perform security verification through a QR code as shown in the scenario (b) in Figure 6, but can directly collect the user name (or account name of the new account), face image, etc. entered by the user.

[0260] In this way, through the validity period of user identity authentication, the user operation difficulty is reduced while ensuring the effectiveness of permission management and avoiding security issues.

[0261] In some embodiments, the whole-home central control screen has a data lock enabled. Once the user identity is authenticated, the whole-home central control screen can retrieve the corresponding user data, such as the theme style, based on the authenticated user identity, and then display the interface according to that theme style. For example, the whole-home central control screen updates the desktop display and switches to the interaction style corresponding to the current user identity to meet the user's personalized display needs.

[0262] Optionally, during the validity period of the user identity authentication, the whole house central control screen maintains the display effect corresponding to the current user identity. After the user identity validity period is exceeded, the whole house central control screen automatically switches to the default display effect, or it can also maintain the current display effect.

[0263] In this way, by automatically identifying the user's identity, the display effect that matches the user's identity can be automatically switched, thereby improving the user experience.

[0264] The following describes the process of using the function lock during the validity period of user identity authentication through steps S1801 to S1803 as shown in FIG. 18 .

[0265] S1801. The sensitive business module sends an authentication request to the security center.

[0266] In some embodiments, different function locks are used to limit the scope of different sensitive operations. For example, the space lock is used to limit the operation of switching spaces (or scenes, subsystems, etc.), the privacy lock is used to limit access to security subsystems, health care subsystems and other operations involving sensitive data, and the configuration lock is used to limit configuration operations (such as user management configuration, factory configuration restoration, etc.). When the function lock of the whole-house central control screen is turned on, if it detects the user's sensitive operations (such as operations indicating switching spaces, accessing security subsystems, configuration operations, etc.), it can be determined that sensitive services are triggered. Then, the sensitive business module can send an authentication request to the security center to request authentication of the identity of the user currently operating to prevent any user from triggering the execution of sensitive services and affecting the security of the device.

[0267] S1802: The security center determines that the identity authentication is within the validity period.

[0268] S1803. The security center sends an authentication response to the sensitive business module.

[0269] In some embodiments, after receiving the authentication request sent by the sensitive business module, the security center can confirm whether the user identity authentication is currently valid. As described in step S1708 above, after confirming that the user identity authentication is passed, the security center starts counting down to the user identity authentication validity period. Then, within the user identity authentication validity period, the security of the operating user can generally be guaranteed. Therefore, the security center can send an authentication response to the sensitive business module to indicate that the user identity authentication is passed. Accordingly, the sensitive business module can execute sensitive business within the scope of authority corresponding to the current user identity based on the authentication response, such as the switching space indicated by the sensitive operation.

[0270] In this way, during the validity period of user identity authentication, the whole-house central control screen can allow users to perform sensitive operations. While realizing user identity-based permission management, it reduces the number of user identity authentications and improves the user experience.

[0271] The following describes the process of using the function lock after the user identity authentication validity period has expired through steps S1901 to S1909 as shown in FIG. 18 .

[0272] S1901. The sensitive business module sends an authentication request to the security center.

[0273] Optionally, the content of step S1901 may refer to the relevant content of the above-mentioned step S1801 and will not be repeated here.

[0274] S1902: The security center determines that the identity authentication validity period has expired.

[0275] S1903. The security center sends a face recognition instruction to the face recognition module.

[0276] S1904. The face recognition module sends a face recognition response to the security center.

[0277] S1905. The face recognition module sends a password verification request to the password management module.

[0278] S1906. The password management module sends a password verification response to the face recognition module.

[0279] S1907: The security center determines the user's identity.

[0280] S1908. The security center starts recording the validity period of identity authentication.

[0281] S1909. The security center sends an authentication response to the sensitive business module.

[0282] In some embodiments, after receiving an authentication request from a sensitive business module, the security center can confirm whether the user is currently within the validity period of the user identity authentication. If the security center confirms that the user's identity has expired, it can automatically trigger the user identity authentication process, such as through various methods such as facial recognition, password verification, and voiceprint recognition. The user identity authentication process of steps S1903-S1908 can refer to the relevant content of steps S1703-S1708 above and will not be repeated here.

[0283] If the security center confirms that the user's identity authentication has passed, the timer restarts and the user's identity authentication validity period is entered. An authentication response is sent to the sensitive business, indicating that the user's identity authentication has passed. Based on the authentication response, the sensitive business module can then execute sensitive services within the scope of the permissions of the account corresponding to the current user, such as accessing the health care subsystem as indicated by sensitive operations.

[0284] In this way, if the user identity authentication validity period is exceeded, the whole-house central control screen can also automatically trigger the user identity authentication process, thereby realizing user identity-based permission management and ensuring device security. In addition, after the user identity authentication is passed, the whole-house central control screen can also automatically start recording the user identity authentication validity period to simplify the subsequent user identity authentication process.

[0285] In some embodiments, the whole-home central control screen configures different function locks for different user identities (or accounts) to implement permission management for different user identities. However, in some special cases, low-privilege users may need to perform highly sensitive business operations, but due to insufficient permissions, they may not be able to perform these operations, which may have an impact.

[0286] For example, during the user identity creation process, the whole-house central control screen creates a child role for the user identity, and the matching permissions are narrower, such as not being allowed to switch spaces on the whole-house central control screen or operate the gas stove. However, if a sudden malfunction of the gas stove at home causes a fire, and the child is the only one at home, the child will be in danger because he or she does not have permission to control the gas stove through the whole-house central control screen.

[0287] In some examples, the central control panel allows users to obtain temporary permissions to deal with emergencies. This temporary permission can be granted remotely, or automatically granted when a pre-set scenario is met during the user creation process. Temporary permissions are configured with a specific expiration date to ensure security.

[0288] For example, in the above-mentioned fire scenario, the whole-house central control screen triggers the temporary authorization process based on the user's (such as the child's) operation. For example, the whole-house central control screen sends a text message to the remote administrator device (such as the homeowner's mobile phone) based on the user's operation, prompting whether temporary authorization is allowed. The whole-house central control screen confirms whether to authorize the current user identity (such as the child) based on the instructions received from the administrator device. For another example, the whole-house central control screen displays a QR code (or verification code), and the user sends the QR code to the administrator device. The administrator device scans the code through the smart life application to complete the temporary authorization. For another example, after the user contacts the homeowner, the homeowner directly performs a temporary authorization operation in the smart life application on the device that has logged in to the administrator account, and the device can instruct the whole-house central control screen to perform temporary authorization. In this way, after the whole-house central control screen authorizes the temporary authority to the user identity, the user can instruct the whole-house central control screen to control the gas stove to avoid danger.

[0289] For example, in the fire scenario described above, the central control screen can determine the fire situation based on the data fed back by the indoor sensors and automatically trigger the temporary authorization process. Through the various methods described in the examples above, temporary authorization for the user identity corresponding to the child can be obtained, thus avoiding the danger.

[0290] In this way, while ensuring device security through different permission scopes, more flexible permission management can be achieved through temporary authorization.

[0291] Figure 19 is a flow chart of another method for rights management provided by an embodiment of the present application. It should be noted that the method is not limited to the specific sequence shown in Figure 19 and described below. It should be understood that in other embodiments, the order of some steps in the method can be interchanged according to actual needs, or some steps can be omitted or deleted. The method includes the following steps:

[0292] S2001. The electronic device detects a first sensitive operation of the user and, based on a function lock function enabled on the electronic device, determines whether the first permission of the current user's identity includes permission to execute a first service indicated by the first sensitive operation.

[0293] Function locks include one or more of the following: space lock, privacy lock, configuration lock, and data lock. The space lock restricts access to spaces, the privacy lock restricts access to sensitive data, the configuration lock restricts access to trigger settings, and the data lock restricts access to information displayed on user-defined interfaces.

[0294] Optionally, sensitive operations include, for example, switching spaces, accessing private data, triggering setting functions, and customizing interface display information.

[0295] Optionally, the function lock function is used to limit the execution authority of the first service.

[0296] In some examples, the user is a first user, and the function lock function is used to limit the execution authority of the first service, including: a first function lock function is used to limit the first user's execution authority on the first service.

[0297] For example, different user accounts may be configured with different function locks to limit the scope of permissions for different user identities to perform different services. For example, an electronic device may be configured with multiple user-level function locks, each of which is used to limit the permissions corresponding to the corresponding user identity. For example, a second user may be configured with a second function lock to limit the second user's permission to perform services.

[0298] In some other examples, the user is a first user, and the function lock function is used to limit the execution authority of the first service, including: the function lock function is used to limit the execution authority of multiple users including the first user to the first service.

[0299] For example, an electronic device is configured with a device-level function lock, which is used to limit the authority of multiple users managed by the electronic device to perform services.

[0300] In this way, the authority control of electronic devices can be achieved through the flexible function lock function.

[0301] In some embodiments, upon detecting a user's proximity, the electronic device triggers identity authentication of the user and obtains a first permission corresponding to the user's identity. Optionally, the authentication method for authenticating the user's identity includes one or more of the following: facial recognition, account verification, voiceprint verification, and fingerprint recognition.

[0302] In this way, the electronic device can trigger the authentication of the identity of the user currently approaching in response to the user approaching, so as to facilitate the subsequent confirmation of whether the sensitive operation performed by the user is allowed.

[0303] In other embodiments, in response to the first sensitive operation, the electronic device authenticates the user, obtains a first permission corresponding to the user's identity, and determines whether the first permission of the user's identity includes permission to execute the first service indicated by the first sensitive operation.

[0304] In some examples, the electronic device triggers secondary identity authentication when it determines that the first permission of the user's identity does not include permission to perform the first service indicated by the first sensitive operation. The electronic device receives the identity information entered by the user and determines whether the second permission corresponding to the identity information includes permission to perform the first service indicated by the first sensitive operation. Optionally, the identity information entered by the user may be, for example, administrator account information or other account information with higher permissions.

[0305] In this way, when a user triggers a sensitive operation, the electronic device authenticates the user's identity to confirm whether the user has the authority to perform the corresponding service, thereby ensuring device security. Furthermore, if it is determined that the user does not have the authority to perform the corresponding service, a method for entering administrator information can be provided to meet the user's need to perform high-privilege services. This improves the flexibility of permission authentication while ensuring device security.

[0306] In some embodiments, the electronic device detects a second sensitive operation of the user, determines that the current time point is within the authentication validity period, and that the first permission includes permission to execute the second business indicated by the second sensitive operation, and executes the second business.

[0307] For example, in response to a user approaching, the electronic device obtains the user's identity and the first permission corresponding to the user's identity. Subsequently, when the electronic device detects a second sensitive operation and determines that the current time point is within the authentication validity period and the first permission includes permission to perform a second service indicated by the second sensitive operation, it may determine that it is not necessary to authenticate the current user's identity and that the second service can be performed directly.

[0308] In this way, by setting the authentication validity period, the number of times users perform identity authentication is reduced and user operations are simplified.

[0309] S2002: When the first permission includes permission to execute a first service, the electronic device executes the first service.

[0310] In some embodiments, executing the first service includes at least one of switching spaces, accessing sensitive data, triggering a setting function, and switching to a customized interface display information corresponding to the user identity.

[0311] In this way, when an electronic device detects a sensitive user operation, it can trigger the acquisition of the current operator's user identity. Therefore, the service will only be executed if the corresponding permissions of the user identity include permission to execute the service indicated by the sensitive operation. This improves the security of device operation by increasing the confirmation of the scope of the operator's permissions.

[0312] In some examples, the first sensitive operation is an operation indicating switching spaces. When the first permission includes permission to execute a first service, executing the first service includes: when the first permission includes permission to switch spaces, the electronic device switches to displaying a first interface of the space indicated by the first sensitive operation.

[0313] For example, as shown in Figure 13 (a), while displaying the living room interface, the electronic device detects a user's operation on the switch control 131 and determines that the user has instructed to switch spaces. If the current space lock is on, the electronic device displays the interface shown in Figure 13 (b), prompting the user to perform facial recognition to confirm the identity of the current operator. If the electronic device determines that facial recognition is successful, it can determine that the user's identity authentication has passed. The electronic device can then display the interface shown in Figure 13 (d), allowing the user to switch spaces.

[0314] In this way, the electronic device allows the user to switch spaces only when the operator has the authority to switch spaces. By increasing the space switching control capability, the trouble caused to the user by arbitrary space switching can be avoided.

[0315] In other examples, the first sensitive operation is an operation instructing to view sensitive data. When the first permission includes permission to execute the first service, executing the first service includes: when the first permission includes permission to access a preset system indicated by the first sensitive operation, the electronic device switches to displaying a second interface. The second interface displays sensitive data in the preset system indicated by the first sensitive operation, where the preset system includes a security subsystem or a health care subsystem.

[0316] Optionally, sensitive data may also include data from sensitive devices, such as data collected by security equipment.

[0317] For example, as shown in FIG14(a), the electronic device detects the user's operation on the security control 141 and determines that the user has instructed to access the security subsystem. If the privacy lock is currently on, the electronic device determines that the user's identity needs to be authenticated. As shown in FIG14(b), the electronic device displays a face image acquisition interface and authenticates the user's identity through face image recognition. After the user's identity authentication is passed, the electronic device displays a camera interface as shown in FIG14(c). As shown in FIG14(c), the current interface displays the living room camera image (i.e., sensitive data).

[0318] In this way, the electronic device can only switch to display the interface including sensitive data when the operator has the authority to access sensitive data. By increasing the sensitive data management and control capabilities, the risk of privacy leakage caused by arbitrary sensitive data access can be avoided.

[0319] In other examples, the first sensitive operation is an operation that triggers a setting function. When the first permission includes permission to execute the first service, executing the first service includes: when the first permission includes permission to trigger the setting function indicated by the first sensitive operation, the electronic device switches to displaying a third interface corresponding to the setting function indicated by the first sensitive operation. The third interface includes at least one of a settings interface, a user management interface, a security and privacy interface, and a factory reset interface.

[0320] For example, as shown in Figure 15 (a), the electronic device detects a user's operation on the settings application icon and determines that the user has instructed to access the settings application. If the current configuration lock is on, the electronic device determines that the user's identity needs to be authenticated. As shown in Figure 15 (b), the electronic device displays a face image acquisition interface and authenticates the user's identity through face recognition. After the user's identity is authenticated, the electronic device displays the settings application interface shown in Figure 15 (c). On this interface, the electronic device can receive the user's settings operation.

[0321] In this way, the electronic device can only switch to display the corresponding setting interface when the operator has the authority to trigger the device function. By increasing the setting operation control capability, the device safety hazards caused by random users performing setting operations can be avoided.

[0322] In some further examples, the first sensitive operation is an operation of approaching the electronic device. When the first permission includes permission to execute the first service, executing the first service includes: when the first permission includes permission for the user to customize interface display information, the electronic device switches the display information of the current display interface, and the switched display information corresponds to the user's customized data.

[0323] For example, user A is an elderly person. After the electronic device switches to user A's account, it sets the theme style to elder mode according to the user's operation. In addition, the electronic device determines that user A has the authority to customize the interface display information. Then, the electronic device can save the display style of the elder mode set by user A. Then, after the electronic device is awakened again, it determines that the current operator is user A through face recognition (or other authentication methods) and obtains the theme style corresponding to user A's identity. Afterwards, as shown in Figure 16 (b), the electronic device can display interface 1602 according to the display effect of the elder mode.

[0324] In this way, when the operator has the authority to trigger the user-defined interface display information, the electronic device can switch to display the user-defined interface display information, and provide the user with a personalized display experience by increasing the ability to update user preference settings.

[0325] In some embodiments, before detecting a first sensitive operation of a user, the electronic device configures a first permission, where the first permission is used to limit the execution permission of the user's identity to execute the first business.

[0326] For example, when an electronic device detects an operation to add a user, it can configure the first permission for the currently added user based on the user's operation. Subsequently, when a sensitive operation is detected, the electronic device can determine whether the current user has permission to perform the corresponding service based on the determined user identity, thereby ensuring device security.

[0327] In some embodiments, the electronic device displays a function lock function selection interface and determines, based on the user's first operation, the function lock function that the user indicates to enable.

[0328] Optionally, the electronic device determines one or more function lock functions that the user indicates to enable based on the user's operation on the function lock function selection interface. For example, the user can choose to enable one or more function lock functions among the space lock function, privacy lock function, configuration lock function, and data lock function as needed.

[0329] In this way, the electronic device can flexibly select the scope of permissions that need to be controlled by the electronic device through the function lock function according to user needs.

[0330] In some embodiments, the electronic device displays a function lock function selection interface of the user and determines the function lock function that the user has enabled according to the second operation of the user.

[0331] In this way, the electronic device can flexibly configure the permission range of different users through the function lock function according to user needs.

[0332] In some embodiments, the electronic device displays an administrator setting interface, receives a third operation of adding a user identity in the administrator setting interface, and sets permissions for the user identity.

[0333] In some examples, the electronic device receives a user role input by a user and obtains first permission information that matches the user role.

[0334] In some examples, the electronic device displays the first permission information. Thereafter, the electronic device receives a fourth operation of the user on the first permission information and obtains second permission information confirmed by the user, where the second permission information is used to indicate the first permission.

[0335] In this way, electronic devices can flexibly configure personalized permission ranges for different users based on their needs. Furthermore, through role matching, the difficulty of permission configuration is reduced.

[0336] In some embodiments, the electronic device can select whether to enable a function lock function based on user operation. Optionally, upon detecting a sensitive operation, the electronic device determines whether a function lock function corresponding to the sensitive operation is currently enabled, and then obtains the permissions corresponding to the user's identity. In some examples, the electronic device enables the function lock function by default. Optionally, the electronic device does not provide a user with an entry to enable or disable the function lock function.

[0337] Optionally, the electronic device can also execute the steps and functions performed by the whole-house central control screen in the above embodiments, thereby realizing the permission management method provided by the above embodiments.

[0338] It should be noted that the personal information (such as facial image data, etc.) used in the embodiments of this application is limited to information for which the individual's separate consent has been obtained, including but not limited to notifying and reminding the user to read the relevant user agreement (notification) before the user uses the function, and signing the agreement (authorization) including authorization of relevant user information.

[0339] The above describes in detail the rights management method provided by the embodiment of the present application in conjunction with Figures 6 to 19. The following describes in detail the electronic device provided by the embodiment of the present application in conjunction with Figure 20.

[0340] In one possible design, Figure 20 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. As shown in Figure 20, electronic device 2000 may include: a transceiver unit 2001 and a processing unit 2002. Electronic device 2000 can be used to implement the functions of the whole-home central control screen involved in the above method embodiment.

[0341] Optionally, the transceiver unit 2001 is used to support the electronic device 2000 to execute S1101, S1104 and S1105 in Figure 11; and / or to support the electronic device 2000 to execute S1701, S1703 and S1705 in Figure 17; and / or to support the electronic device 2000 to execute S1903 and S1905 in Figure 18; and / or to support the electronic device 2000 to execute S2001 in Figure 19.

[0342] Optionally, the processing unit 2002 is used to support the electronic device 2000 to execute S1102-S1108 in Figure 11; and / or to support the electronic device 2000 to execute S1702-S1708 in Figure 17; and / or to support the electronic device 2000 to execute S1801-S1803, and S1901-S1909 in Figure 18; and / or to support the electronic device 2000 to execute S2001 and S2002 in Figure 19.

[0343] The transceiver unit may include a receiving unit and a transmitting unit, and may be implemented by a transceiver or a transceiver-related circuit component, and may be a transceiver or a transceiver module. The operations and / or functions of each unit in the electronic device 2000 are respectively for implementing the corresponding processes of the rights management method described in the above method embodiment. All relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional unit. For the sake of brevity, they are not repeated here.

[0344] Optionally, the electronic device 2000 shown in Figure 20 may further include a storage unit (not shown in Figure 20) in which a program or instruction is stored. When the transceiver unit 2001 and the processing unit 2002 execute the program or instruction, the electronic device 2000 shown in Figure 20 may execute the rights management method described in the above method embodiment.

[0345] The technical effects of the electronic device 2000 shown in Figure 20 can refer to the technical effects of the rights management method described in the above method embodiment, and will not be repeated here. In addition to the form of electronic device 2000, the technical solution provided by this application can also be a functional unit or chip in an electronic device, or a device used in conjunction with an electronic device.

[0346] An embodiment of the present application also provides a chip system, including: a processor, the processor is coupled to a memory, the memory is used to store programs or instructions, when the program or instructions are executed by the processor, the chip system implements the method in any of the above method embodiments.

[0347] Optionally, there may be one or more processors in the chip system. The processor may be implemented in hardware or software. When implemented in hardware, the processor may be a logic circuit, an integrated circuit, etc. When implemented in software, the processor may be a general-purpose processor implemented by reading software code stored in a memory.

[0348] Optionally, the memory in the chip system may be one or more. The memory may be integrated with the processor or may be provided separately from the processor, which is not limited in the embodiments of the present application. For example, the memory may be a non-transient processor, such as a read-only memory (ROM), which may be integrated with the processor on the same chip or provided on different chips. The embodiments of the present application do not specifically limit the type of memory or the configuration of the memory and the processor.

[0349] Exemplarily, the chip system may be a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on chip (SoC), a central processor unit (CPU), a network processor (NP), a digital signal processor (DSP), a microcontroller unit (MCU), a programmable logic device (PLD) or other integrated chips.

[0350] It should be understood that each step in the above method embodiment can be completed by hardware integrated logic circuits in a processor or by software instructions. The method steps disclosed in the embodiments of the present application can be directly embodied as being executed by a hardware processor, or by a combination of hardware and software modules in a processor.

[0351] An embodiment of the present application also provides a computer-readable storage medium, which stores a computer program. When the computer program runs on a computer, the computer executes the above-mentioned related steps to implement the rights management method in the above-mentioned embodiment.

[0352] The embodiment of the present application also provides a computer program product. When the computer program product is run on a computer, it enables the computer to execute the above-mentioned related steps to implement the rights management method in the above-mentioned embodiment.

[0353] In addition, embodiments of the present application further provide a device. The device may be a component or module, and may include one or more processors and a memory connected to each other. The memory is used to store a computer program. When the computer program is executed by one or more processors, the device performs the rights management method described in each of the above method embodiments.

[0354] The apparatus, computer-readable storage medium, computer program product, or chip provided in the embodiments of the present application are all used to execute the corresponding methods provided above. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects of the corresponding methods provided above, and will not be repeated here.

[0355] The steps of the method or algorithm described in conjunction with the disclosure of the embodiments of the present application can be implemented in a hardware manner or can be implemented by a processor executing software instructions. The software instructions can be composed of corresponding software modules, and the software modules can be stored in a random access memory (RAM), a flash memory, a read-only memory (ROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a register, a hard disk, a mobile hard disk, a read-only compact disc (CD-ROM) or any other form of storage medium known in the art. An exemplary storage medium is coupled to a processor so that the processor can read information from the storage medium and can write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an application specific integrated circuit (ASIC).

[0356] Through the description of the above embodiments, those skilled in the art will clearly understand that for the sake of convenience and brevity, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed; that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. The specific working processes of the above-mentioned systems, devices, and units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0357] In the several embodiments provided in this application, it should be understood that the disclosed methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of the modules or units is only a logical function division, and there may be other division methods in actual implementation; for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of modules or units, which can be electrical, mechanical or other forms.

[0358] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0359] Computer-readable storage media include, but are not limited to, any of the following: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and other media that can store program code.

[0360] The above is only a specific embodiment of the present application, but the scope of protection of this application is not limited to this. Any changes or substitutions within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A rights management method, characterized in that: Applied to electronic equipment, the method includes: Detecting a first sensitive operation of a user, and determining, based on a function lock function enabled on the electronic device, whether a first permission of the current user's identity includes permission to execute a first service indicated by the first sensitive operation; the function lock function is used to limit the execution permission of the first service; the function lock function includes one or more of the following: a space lock function, a privacy lock function, a configuration lock function, and a data lock function; wherein the space lock function is used to limit the permission to switch spaces, the privacy lock function is used to limit the permission to access sensitive data, the configuration lock function is used to limit the permission to trigger a setting function, and the data lock function is used to limit the user's permission to display information on a custom interface; When the first authority includes permission to execute the first service, the first service is executed.

2. The method according to claim 1, characterized in that Before detecting the first sensitive operation of the user, the method further includes: The first permission is configured, where the first permission is used to limit the execution permission of the user identity to execute the first service.

3. The method according to claim 1 or 2, characterized in that Before detecting the first sensitive operation of the user, the method further includes: Detecting the user's approach triggers identity authentication of the user and obtains the first permission corresponding to the user's identity.

4. The method according to claim 1 or 2, characterized in that The step of determining whether the first permission of the current user's identity includes permission to execute the first service indicated by the first sensitive operation comprises: In response to the first sensitive operation, authenticating the user; Obtain the first permission corresponding to the user's identity, and determine whether the first permission of the user's identity includes allowing execution of the first service indicated by the first sensitive operation.

5. The method according to claim 4, characterized in that The method further comprises: triggering secondary identity authentication when it is determined that the first permission of the user's identity does not include permission to execute the first service indicated by the first sensitive operation; Receive identity information input by the user, and determine whether the second permission corresponding to the identity information includes permission to execute the first service indicated by the first sensitive operation.

6. The method according to claim 3 or 4, characterized in that The method further comprises: When a second sensitive operation of the user is detected and it is determined that the current time point is within the authentication validity period, and the first permission includes permission to execute the second business indicated by the second sensitive operation, the second business is executed.

7. The method according to any one of claims 1 to 6, characterized in that Before detecting the first sensitive operation of the user, the method further includes: Display the function lock function selection interface; According to a first operation of the user, a function lock function indicated by the user to be turned on is determined.

8. The method according to any one of claims 1 to 7, characterized in that Before detecting the first sensitive operation of the user, the method further includes: Displaying a function lock function selection interface for the user; According to the second operation of the user, the function lock function corresponding to the user is determined.

9. The method according to any one of claims 1 to 8, characterized in that The user is a first user, and the function lock function is used to limit the execution authority of the first service, including: a first function lock function is used to limit the first user's execution authority for the first service.

10. The method according to any one of claims 1 to 8, characterized in that: The user is a first user, and the function lock function is used to limit the execution authority of the first service, including: the function lock function is used to limit the execution authority of multiple users including the first user to the first service.

11. The method according to any one of claims 1 to 10, characterized in that: The first sensitive operation is an operation indicating switching spaces, and when the first permission includes permission to execute the first service, executing the first service includes: When the first permission includes allowing switching spaces, switch the first interface of the space displaying the first sensitive operation indication.

12. The method according to any one of claims 1 to 10, characterized in that The first sensitive operation is an operation of instructing to view sensitive data, and when the first permission includes permission to execute the first service, executing the first service includes: When the first permission includes allowing access to the preset system accessed by the first sensitive operation instruction, the second interface is switched to display, and the second interface displays sensitive data in the preset system accessed by the first sensitive operation instruction, and the preset system includes a security subsystem or a health care subsystem.

13. The method according to any one of claims 1 to 10, characterized in that: The first sensitive operation is an operation that triggers a setting function, and when the first permission includes permission to execute the first service, executing the first service includes: When the first permission includes a setting function that allows triggering the first sensitive operation indication, the third interface corresponding to the setting function of the first sensitive operation indication is switched to display, and the third interface includes at least one of a setting interface, a user management interface, a security and privacy interface, and a factory configuration restore interface.

14. The method according to any one of claims 1 to 10, characterized in that The first sensitive operation is an operation of approaching the electronic device, and when the first permission includes permission to execute the first service, executing the first service includes: When the first permission includes permission for the user to customize interface display information, the display information of the current display interface is switched, and the switched display information corresponds to the user's customized data.

15. The method according to any one of claims 1 to 14, characterized in that: Before detecting the first sensitive operation of the user, the method further includes: Display the administrator settings interface; A third operation of adding a user identity in the administrator setting interface is received, and permissions of the user identity are set.

16. The method according to claim 15, characterized in that The receiving a third operation of the user adding a user identity in the administrator setting interface, and setting permissions for the user identity, includes: Receive user input of user role; Acquire first permission information that matches the user role.

17. The method according to claim 16, characterized in that The method further comprises: displaying the first permission information; A fourth operation of the user on the first permission information is received, and second permission information confirmed by the user is obtained, where the second permission information is used to indicate the first permission.

18. The method according to any one of claims 1 to 17, characterized in that: The electronic device is a whole-house central control screen.

19. An electronic device, characterized in that: include: A processor and a memory, the memory being coupled to the processor, the memory being used to store computer program code, the computer program code comprising computer instructions, and when the processor reads the computer instructions from the memory, the electronic device executes the method according to any one of claims 1 to 18.

20. The electronic device according to claim 19, wherein The electronic device is a whole-house central control screen.

21. A computer-readable storage medium, characterized in that The computer-readable storage medium includes a computer program, and when the computer program is run on an electronic device, the electronic device is caused to perform the method according to any one of claims 1 to 18.

22. A computer program product, characterized in that When the computer program product is run on a computer, the computer is caused to perform the method according to any one of claims 1 to 18.

Images