Permission management method, electronic device, readable medium and computer program product

Abstract

Provided in the present disclosure is a permission management method, comprising: when an identity recognition condition is satisfied, acquiring identity feature information of the current user of a terminal device; when the identity feature information of the current user is not matched with pre-stored identity feature information of an authorized user, acquiring user authorization information of the current user; and, on the basis of the user authorization information of the current user, updating device permission information of the terminal device, the initial state of the device permission information of the terminal device being configured on the basis of the user authorization information of the authorized user. Further provided in the present disclosure are an electronic device, a computer-readable storage medium, and a computer program product.

Description

Access control methods, electronic devices, readable media, and computer program products

[0001] Cross-reference to related applications

[0002] This disclosure claims priority to Chinese Patent Application No. 202410799186.5, filed on June 19, 2024, the contents of which are incorporated herein by reference in their entirety. Technical Field

[0003] This disclosure relates to the field of data processing technology, and in particular to access control methods, electronic devices, computer-readable storage media, and computer program products. Background Technology

[0004] With the widespread adoption of various smart terminals such as mobile phones, tablets, wearable devices, and in-vehicle computers, the types of applications and business functions supported by these terminals are becoming increasingly diverse. Some applications require access to data or interfaces within the terminal device during operation. For example, some applications need to access data such as contacts and SMS messages, or they need to call the terminal device's location, camera, and recording function interfaces. Therefore, to ensure the security of user data, these applications must obtain user authorization before calling authorized data or interfaces.

[0005] In related technologies, authorized users (such as the device owner) can pre-configure user authorization information to determine the permissions of various applications based on this information. However, the above-mentioned permission management method has poor flexibility; once the user authorization information is configured, it cannot be changed adaptively.

[0006] Public content

[0007] This disclosure provides a permission management method, an electronic device, a computer-readable storage medium, and a computer program product.

[0008] In a first aspect, embodiments of this disclosure provide a permission management method, comprising: obtaining the identity feature information of the current user of a terminal device when the identity recognition conditions are met; obtaining the user authorization information of the current user when the identity feature information of the current user does not match the identity feature information of a pre-stored authorized user; updating the device permission information of the terminal device according to the user authorization information of the current user; and configuring the initial state of the device permission information of the terminal device according to the user authorization information of the authorized user.

[0009] Secondly, embodiments of this disclosure provide an electronic device, including a memory and a processor; the memory stores a computer program that can be executed by the processor, and the computer program is executed by the processor to enable the processor to implement the above-described permission management method.

[0010] Thirdly, embodiments of this disclosure provide a computer-readable storage medium having a computer program stored thereon, the computer program being executed by a processor to enable the processor to implement the aforementioned permission management method.

[0011] Fourthly, embodiments of this disclosure provide a computer program product, including a computer program, which is executed by a processor to enable the processor to implement the aforementioned permission management method. Attached Figure Description

[0012] In the accompanying drawings of the embodiments disclosed herein:

[0013] Figure 1 is a flowchart illustrating a permission management method provided in an embodiment of this disclosure;

[0014] Figure 2 shows a flowchart of an example of the permission management method in this disclosure;

[0015] Figure 3 shows a schematic diagram of the structure of a terminal device in one example of this disclosure;

[0016] Figure 4 illustrates a flowchart of an example of the permission management method in this disclosure, combining the various modules contained in the terminal device.

[0017] Figure 5 is a block diagram of an electronic device provided in an embodiment of this disclosure. Detailed Implementation

[0018] To enable those skilled in the art to better understand the technical solutions of this disclosure, the embodiments of this disclosure will be described in detail below with reference to the accompanying drawings.

[0019] The present disclosure will be described more fully below with reference to the accompanying drawings; however, the embodiments shown may be embodied in different forms, and the present disclosure should not be construed as limited to the embodiments set forth below. These embodiments are provided so that this disclosure will be thorough and complete, and that those skilled in the art will fully understand the scope of the disclosure.

[0020] The accompanying drawings of the embodiments disclosed herein are provided to further illustrate the embodiments of this disclosure and form part of the specification. They are used together with the detailed description of the embodiments to explain this disclosure and do not constitute a limitation thereof. The above and other features and advantages will become more apparent to those skilled in the art from the description of the detailed embodiments with reference to the accompanying drawings.

[0021] This disclosure may be described with reference to plan and / or cross-sectional views using the ideal schematic diagrams of this disclosure. Therefore, the example illustrations may be modified according to manufacturing techniques and / or tolerances.

[0022] Where there is no conflict, the various embodiments of this disclosure and the features thereof in the embodiments may be combined with each other.

[0023] The terminology used in this disclosure is for describing particular embodiments only and is not intended to limit the disclosure. The term "and / or" as used in this disclosure includes any and all combinations of one or more of the associated enumerated entries. The singular forms "a" and "the" as used in this disclosure also include the plural forms, unless the context clearly indicates otherwise. The terms "comprising," "made of," etc., as used in this disclosure specify the presence of a particular feature, integral, step, operation, element, and / or component, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components, and / or groups thereof.

[0024] Unless otherwise specified, all terms used in this disclosure (including technical and scientific terms) have the same meaning as commonly understood by one of ordinary skill in the art. It will also be understood that terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning in the context of the relevant art and this disclosure, and will not be interpreted as having an idealized or overly formal meaning, unless expressly so specified in this disclosure.

[0025] This disclosure is not limited to the embodiments and implementations shown in the accompanying drawings, but includes modifications to the configuration based on the manufacturing process. Therefore, the areas illustrated in the drawings are schematic, and the shapes of the areas shown in the drawings illustrate the specific shapes of the areas of the element, but are not limiting.

[0026] In some related technologies, authorized users (such as the account holder) can pre-configure user authorization information to determine the permissions of various applications based on this information. However, the above-mentioned permission management methods are inflexible, and user authorization information cannot be easily changed once configured. To solve the above problems, this application provides a permission management method, an electronic device, a computer-readable storage medium, and a computer program product.

[0027] In a first aspect, embodiments of this disclosure provide a permission management method. Figure 1 is a schematic flowchart of a permission management method provided by an embodiment of this disclosure. As shown in Figure 1, the method includes the following steps S110 to S130.

[0028] Step S110: If the identity recognition conditions are met, obtain the current user's identity feature information on the terminal device.

[0029] Identity verification conditions are pre-configured conditions used to trigger subsequent identity verification operations. These conditions can be flexibly configured by those skilled in the art. For example, an identity verification condition could be: determining that the identity verification condition is met when a change in the user is detected. Another example is: determining that the identity verification condition is met whenever the interval between the current time and the time of the last identity verification operation reaches a preset period.

[0030] In one implementation, the identity recognition conditions include at least one of the following conditions (1) to (3).

[0031] Condition (1) The current user’s operation behavior is detected to be inconsistent with the pre-stored historical operation behavior of authorized users.

[0032] User actions are used to represent various operation-related information such as user habits and geographical location. Any behavior associated with user actions can be considered a user action, and this application does not limit the specific meaning of user actions. When a mismatch is detected between the current user's actions and the pre-stored historical actions of authorized users, it is generally assumed that the current user is a different user from the authorized users, that is, the user using the terminal device has changed. Therefore, an identity verification operation needs to be triggered to confirm the current user's identity.

[0033] For example, artificial intelligence technology can be used to analyze users' usage habits, including but not limited to physical activities, frequently used functions, usage time periods, and location. If the usage habits of an authorized user (such as the device owner) are not met, the current user is considered to be an unauthorized user (such as a non-device owner).

[0034] Therefore, user actions can include actions related to physical activity, such as movement speed, movement trajectory, heart rate, blood pressure, and other physical activity information generated during runtime. Correspondingly, if a user's physical activity information changes significantly compared to previously recorded data, it can be considered that the current user's actions do not match the pre-stored historical actions of authorized users.

[0035] In addition, user behavior can also include actions performed on frequently used applications, specifically including the types of frequently used applications, the usage time of frequently used applications, and the location information when frequently used applications are used. In short, by recording users' historical behavior, it is possible to determine whether to trigger identity verification detection based on abnormal behavior.

[0036] Condition (2) The terminal device is detected to switch from a black screen state to a bright screen state.

[0037] When a terminal device switches from a black screen to a bright screen, it indicates that the user has just started using the terminal. At this time, the possibility of a user switch is relatively high. Therefore, identity verification can be automatically triggered every time the terminal device switches from a black screen to a bright screen to avoid permission issues caused by user changes.

[0038] Condition (3) The face contour information of the current user does not match the face contour information of the authorized user.

[0039] It can continuously identify the facial contour information of the current user, initially determining whether the user has changed through fuzzy recognition. If a mismatch is detected between the current user's facial contour information and that of an authorized user, it triggers the collection of identity feature information. Fuzzy recognition focuses on recognizing the user's facial contour without considering detailed facial information, thus offering advantages such as low power consumption, simple computation, and fast processing speed.

[0040] The current user of the terminal device refers to the user who is currently operating the terminal device. Identity feature information is used to identify the user's identity and may specifically include facial feature information, fingerprint feature information, iris feature information, voiceprint feature information, etc. This application does not limit the specific types of identity feature information.

[0041] Step S120: If the current user's identity feature information does not match the pre-stored identity feature information of authorized users, obtain the current user's user authorization information.

[0042] The pre-stored identity information of authorized users typically refers to the identity information of the account holder. If the current user's identity information does not match the pre-stored identity information of authorized users, it means that the current user is a different user from the account holder.

[0043] Considering that different users have different security requirements for different data, in order to meet user needs, different user authorization information can be configured for different users in this embodiment of the disclosure. The user authorization information is used to characterize the application access permissions configured by the corresponding user for various applications in the terminal device.

[0044] Accordingly, this step requires obtaining the current user's authorization information. This authorization information can be configured by the current user. Alternatively, fixed authorization information can be pre-configured for the current user; this fixed authorization information typically differs from the authorization information of authorized users.

[0045] Step S130: Update the device permission information of the terminal device according to the user authorization information of the current user; the initial state of the device permission information of the terminal device is configured according to the user authorization information of the authorized user.

[0046] Device permission information for a terminal device is used to characterize the application access permissions of various applications on the terminal device. These applications include system applications, user applications, and other types. Application access permissions characterize whether an application can access various data or interfaces on the terminal device during operation.

[0047] Therefore, it is evident that device permission information will change based on different users' authorization information. For example, if an authorized user's authorization information contains more types of permissions, the application can access a wider range of data and interfaces on the terminal device during operation; conversely, if an unauthorized user's authorization information contains fewer types of permissions, the application can access fewer types of data and interfaces on the terminal device during operation. This differentiated setting helps protect the personal privacy data of unauthorized users and prevents its leakage.

[0048] In the permission management method provided in this disclosure, when the identity recognition conditions are met, the identity feature information of the current user of the terminal device is obtained; when the identity feature information of the current user does not match the identity feature information of the pre-stored authorized user, the device permission information of the terminal device can be updated according to the user authorization information of the current user. Normally, the initial state of the device permission information of the terminal device can be configured according to the user authorization information of the authorized user. The permission management method provided in this disclosure can automatically update the device permission information of the terminal device according to the user authorization information when it is determined that the current user is different from the authorized user based on the user's identity feature information. Therefore, this method can automatically update the device permission information of the terminal device in a timely manner according to the authorization status of different users when the user changes, thereby ensuring the security of user data, improving the flexibility of the permission management method, and enabling flexible modification of user authorization information and device permission information.

[0049] In addition, those skilled in the art can make various modifications and variations to the above embodiments.

[0050] In one implementation, the current user's authorization information is obtained as follows: if the current user's authorization information is not found in the pre-stored authorization data, a permission configuration prompt is displayed; in response to the permission configuration command triggered by the permission configuration prompt, the current user's authorization information is obtained and updated in the authorization data. The pre-stored authorization data stores authorization information for authorized users (e.g., the device owner) or unauthorized users (e.g., the device owner), and can be stored in various ways such as an authorization database or authorization data table. If the current user's authorization information is not found in the pre-stored authorization data, it indicates that the current user is using the terminal device for the first time and has not yet configured the terminal device's permission information; therefore, a permission configuration prompt is displayed. Correspondingly, the current user can trigger a permission configuration command through the permission configuration prompt, which allows for flexible configuration of access permissions for various applications on the terminal. Therefore, the current user's authorization information can be determined based on the user's configuration, and for ease of subsequent querying, the current user's authorization information can be stored in the authorization data.

[0051] In one implementation, permission configuration prompts can be displayed as follows: The system retrieves various data permissions from the data permission set supported by the terminal device; it then displays a permission configuration interface containing permission configuration entry points; these entry points correspond to the data permissions. The data permission set stores various data access permissions supported by the terminal device, such as microphone, camera, and location access. Additionally, the data permission set can store the mapping between these permissions and applications. For example, for microphone permissions, it allows flexible configuration of which applications can and cannot use the microphone. Correspondingly, the permission configuration entry points configure the mapping between applications and permissions. Multiple permission configuration entry points can be configured, and each entry point can correspond to a different data permission.

[0052] In one implementation, before displaying the permission configuration prompt, the following operations are further performed: In response to the received level setting instruction, the various data permissions contained in the data permission set are divided into at least two permission levels; correspondingly, the permission configuration entry includes at least two types of permission configuration entry corresponding to the at least two permission levels. By classifying data permissions into levels, it is convenient to configure different authorization management methods for different levels of permissions, thereby facilitating flexible management of permission information.

[0053] For example, in one implementation, at least two types of permission configuration entry points may include: a first type of configuration entry point for triggering permission configuration instructions upon detecting a triggering operation by the current user; and a second type of configuration entry point for triggering permission configuration instructions upon detecting an authorization operation by an authorized user. Thus, the first type of configuration entry point corresponds to data permissions at the first permission level. These data permissions typically do not involve user privacy data; therefore, the first type of configuration entry point can directly trigger permission configuration instructions based on the current user's triggering operation, without requiring additional authorization from the authorized user. The second type of configuration entry point corresponds to data permissions at the second permission level. These data permissions may involve some privacy data; therefore, to improve data security, the second type of configuration entry point can only trigger permission configuration instructions upon detecting an authorization operation by an authorized user. The authorization operation by the authorized user can be various identity verification operations such as facial verification or fingerprint verification. Therefore, because the data permissions at the second permission level have higher security, additional authorization from the device owner is required to ensure the device owner's control over the smart terminal and effectively protect user privacy.

[0054] In one implementation, before displaying the permission configuration prompt, the following operations are further performed: In response to the received type setting instruction, the various data permissions included in the data permission set are divided into at least two permission types; the at least two permission types include: a first type of data permission corresponding to authorized users, and a second type of data permission corresponding to unauthorized users; and the permission configuration entry corresponds to the second type of data permission. The first type of data permission typically refers to permissions that can only be enabled when an authorized user (i.e., the device owner) uses the terminal device; the second type of data permission typically refers to permissions that can be enabled when an unauthorized user (i.e., a non-device owner) uses the terminal device. Therefore, by dividing data permissions into at least two permission types, it can be ensured that some data permissions are only enabled when the device owner uses the device, avoiding data security issues caused by enabling such permissions for non-device owners. Thus, the permissions that can be configured through the permission configuration entry are limited to the second type of data permissions, excluding the first type of data permissions. Accordingly, the aforementioned first and second type configuration entries are for the second type of data permissions. In other words, the second type of data permissions can be further divided into two categories: one corresponding to the first type of configuration entry and the other corresponding to the second type of configuration entry.

[0055] Furthermore, the methods for classifying permission types and permission levels described above can be combined. For example, data permissions can be directly divided into three levels: the first level corresponds to the first type of data permission mentioned above, and the second and third levels together correspond to the second type of data permission mentioned above. Moreover, the second and third levels correspond to the first and second type of configuration entry points, respectively. This application does not limit the specific implementation details.

[0056] In one implementation, to facilitate convenient and quick permission configuration for special groups such as the elderly and children, the user authorization information of the current user can be obtained as follows: If the user type of the current user is determined to be a preset type based on the user's identity characteristics, the pre-configured user authorization information corresponding to the preset type can be obtained. For example, if the user type of the current user is determined to be a preset type based on the user's identity characteristics, the pre-configured user authorization information corresponding to the preset type can be obtained. The preset type can be: a user type whose age is less than a first age threshold and / or whose age is greater than a second age threshold, where the first age threshold is less than the second age threshold. For example, the first age threshold can be 8, and the second age threshold can be 60. Considering that the elderly and children usually do not set permission information themselves, to simplify the operation for the elderly and children and to improve their data security and prevent user data leakage, user authorization information corresponding to the preset type can be pre-configured. For example, certain permissions that may lead to the leakage of user personal data, such as photo-taking permission, can be permanently disabled in the user authorization information corresponding to the preset type to avoid personal safety issues caused by the leakage of children's portrait information.

[0057] In one implementation, the current user's authorization information includes at least one of the following: access permissions for preset applications on the terminal device, terminal location acquisition permission, device data acquisition permission for the terminal device, and user data acquisition permission. For example, the access permissions for preset applications are used to limit whether various applications on the phone support access to various data permissions. Terminal location acquisition permission is used to authorize applications to locate the terminal. Device data acquisition permission is used to authorize applications to access various types of data stored on the device, such as contact data and camera data. User data acquisition permission is used to authorize applications to access the user's personal data, such as the user's exercise data and heart rate data.

[0058] For ease of understanding, the following example illustrates the permission management method in this disclosure embodiment.

[0059] With the widespread adoption of smart devices such as smartphones, tablets, wearable devices, and in-vehicle computers, authorized users (users who own these devices) consent to certain privacy permissions. These permissions allow the devices to collect and use the user's private information, including but not limited to facial recognition, fingerprints, body movement, location data, audio recording, photography, and video recording. However, when a smart device is temporarily lent to family, friends, or colleagues, they may not consent to these permissions. However, current technology often maintains that the granted privacy permissions remain fixed regardless of the user, potentially leading to a security risk of personal information leakage for unauthorized users (family, friends, or colleagues) using the device.

[0060] For example, some related technologies do not adequately protect the privacy of non-owner users. When non-owner users use smart terminals, there are no intelligent prompts for them to authorize privacy permissions; instead, their private information is directly collected and used, including but not limited to facial recognition, fingerprints, body movements, location, audio recording, photography, and video recording, which can easily lead to the leakage of non-owner users' privacy. Therefore, it is evident that there is currently a lack of privacy and security protection solutions specifically for non-owner users.

[0061] To address the aforementioned issues, this example pre-collects the facial features or other identity characteristics of the device owner. During the use of the smart terminal, if a face other than the owner's is detected, the user is prompted again for authorization, and the authorization status is recorded. Until the user changes, privacy permissions are controlled according to the current user's privacy authorization. This solution avoids legal risks related to privacy security, protects the privacy of non-owners, improves the user experience for non-owners, demonstrates the superiority of smart terminals, and enhances the product's market competitiveness. Privacy is one of everyone's fundamental rights. Protecting personal privacy helps safeguard individual rights. With the widespread adoption of smart terminals such as mobile phones, tablets, wearable devices, and in-vehicle computers, it is crucial to ensure that people enjoy the convenience of technology without being troubled by privacy violations. In the information age, data has become a vital resource, making the protection of personal privacy a crucial aspect of data security and information protection. Furthermore, protecting privacy is a means of upholding personal dignity; everyone has the right to protect their privacy from infringement. Privacy violations can lead to embarrassment, anxiety, or discrimination. Privacy protection helps maintain healthy social relationships. Respect for others' privacy is the foundation of interpersonal relationships based on trust and respect. Protecting privacy helps maintain boundaries between individuals and their families, friends, and colleagues. The Ministry of Industry and Information Technology's new network access standards are increasingly setting higher requirements for privacy protection and security of smart devices, and are gradually developing more comprehensive regulations.

[0062] This example protects the privacy of non-owner users, preventing their private information from being directly collected and used, thus avoiding privacy leaks and addressing the previous lack of privacy protection for non-owner users.

[0063] In this example, identity verification needs to be automatically triggered at an appropriate time to intelligently identify whether the current user is not the owner of the device. The timing for triggering identity verification can be: when the screen of the mobile phone or other smart terminal is turned on. During the screen-on process, when the front-facing camera detects a face entering directly in front and the face distance reaches a threshold value, verification is performed. The threshold value is defined to avoid interference from the surrounding environment, ensuring that the face being verified is that of a valid user of the smart terminal.

[0064] In addition, to control power consumption, facial recognition and other identification methods can also adopt a timed triggering method, allowing users to customize the time interval. Besides facial recognition, smart terminals can also use other biometrics for identification, with the basic process being the same. Examples include voiceprints and fingerprints; smartwatches can use heart rate and blood pressure readings.

[0065] In addition, artificial intelligence technology can be used to analyze users' usage habits, including but not limited to physical activities, frequently used functions, usage time, and location. If the usage does not match the user's habits, it can be assumed that the user is not the owner and an identity verification operation can be automatically triggered.

[0066] In addition, in this example, privacy permissions are pre-classified into three levels, with different levels of privacy permissions corresponding to different authorization and management methods, thereby ensuring the owner's control over the smart terminal and privacy security.

[0067] Level 1 permissions are granted only to the phone owner. This level is designed to ensure the owner's basic control and privacy, preventing the leakage of critical information when used by someone other than the owner. Level 1 permissions include, but are not limited to: obtaining phone identification information and accessing the calendar. These permissions relate to the security of personal data within the phone; therefore, they can be set to be granted only to the phone owner. This type of permission corresponds to the first type of data permissions mentioned above.

[0068] Level Two: Authorization is possible for non-owner users, but requires authorization from the owner. The authorization process involves monitoring the owner's face or fingerprint information. This level ensures that the owner can selectively control the smart device's status while the user is not actively using it. Level Two permissions include, but are not limited to: location, call logs, SMS, and MMS. The privacy of these permissions is lower than Level One; therefore, authorization can be granted to non-owner users, but for data security reasons, authorization from the owner is required. Level Two permissions correspond to the permissions in the second category of data permissions mentioned above, specifically the permissions associated with the second category of configuration entry points.

[0069] Level 3: Authorization is granted by non-owners. This level of permissions primarily concerns non-owner behaviors that the owner does not need to concern themselves with or control. Non-owners can independently authorize privacy permissions for data generated during use. Level 3 permission information includes, but is not limited to: face, fingerprint, body movement, audio recording, photography, video recording, nearby connected devices (WLAN, Bluetooth, car, etc.), browser history, images, audio, and video. Level 3 permission information corresponds to the permissions in the first type of configuration entry point within the second type of data permissions mentioned above.

[0070] Additionally, when a child or elderly person is detected as a non-owner user, a default recommended privacy permission combination can be provided for them. If such users need to change the permission combination later, it can be dynamically adjusted. Furthermore, the owner user can flexibly adjust the permission level division method to avoid non-owners being unable to use certain functions due to restrictions on some privacy permissions.

[0071] In addition, to facilitate easier use of the terminal device for non-owner users, this example also supports owner change operations. This allows a non-owner user to be temporarily authorized as the new owner. For example, during an owner change, a non-owner user, with the original owner's authorization, can update the owner's facial information, effectively becoming the new owner. Furthermore, when temporarily authorizing an owner, the non-owner user needs to create a temporary owner user with the original owner's privacy permissions and record their facial information. This temporary owner user can be deleted later as needed.

[0072] Figure 2 shows a flowchart of the permission management method. As shown in Figure 2, the permission management method includes the following steps S201 to S206.

[0073] Step S201: If the identity recognition conditions are met, obtain the current user's identity feature information on the terminal device.

[0074] The identification criteria can be any of the conditions mentioned above. In this example, the user's facial information is collected in advance after informing the user and obtaining their consent. Then, feature extraction and analysis are performed on the user's facial information, and the data is stored in the user's facial data and privacy permission storage module.

[0075] In daily use, the system initially determines whether the current user is the owner of the device based on facial contours. If it is determined that the current user is not the owner, the system prompts the user to collect and store facial information. If the user agrees, facial information is collected; if the user does not agree, facial information is not collected, and no further authorization of various privacy permissions is granted.

[0076] Step S202: Determine whether the current user's identity feature information matches the pre-stored identity feature information of authorized users.

[0077] If the user agrees to have their facial information collected, the collected facial information will be matched with the owner's facial information. If the matching degree threshold is met, the user is considered to be the owner; otherwise, the user is considered not to be the owner.

[0078] Step S203: If there is no match, query the pre-stored authorization data to see if the current user's authorization information exists.

[0079] If the person is not the owner of the device, the system can check the facial data and privacy permission storage module of the non-owner to determine whether the user's authorization information exists in the pre-stored authorization data.

[0080] Furthermore, if a match is found, the process will proceed directly based on the user authorization information already set by the authorized user. Consequently, the device permission information of the terminal device will remain unchanged and will not require updating. Therefore, if it is the owner of the device, the user can continue to use it according to the privacy permissions already agreed upon by the owner.

[0081] Step S204: If it does not exist, display permission configuration prompt information, respond to the permission configuration instruction triggered by the permission configuration prompt information, obtain the current user's user authorization information, and update the current user's user authorization information into the authorization data.

[0082] If the user is not the non-owner user whose privacy permissions have been recorded, the user will be prompted to authorize the privacy permissions, and the authorization result will be recorded in the non-owner's facial data and privacy permission storage module for subsequent matching.

[0083] Step S205: If it exists, retrieve the current user's authorization information from the pre-stored authorization data.

[0084] If the current user's identity information matches the pre-stored identity information of non-owner users, the current user is considered a non-owner user whose privacy permissions have been recorded, and the privacy permissions agreed to by the non-owner user are taken into account.

[0085] Step S206: Update the device permission information of the terminal device according to the current user's user authorization information.

[0086] Update the device permission information of the terminal device to match the current user's authorization information. For example, based on the correspondence between various applications and permissions contained in the user authorization information, you can disable access to certain applications for certain types of permissions, or enable access to certain applications for certain types of permissions.

[0087] Therefore, it can be seen that the permission management method adopted in this example can protect the privacy of non-owners when a smart terminal is temporarily lent to relatives, friends, or colleagues through privacy permission management. Its application scenarios can include at least the following two scenarios.

[0088] Scenario 1: A child at home is using an adult's mobile phone.

[0089] In this scenario, the child using the phone is not the owner. When it's detected that a child is using the phone, a pop-up window is displayed to re-authorize their privacy permissions. Permissions such as recording, taking photos, and recording videos can be disabled for non-owners, preventing unauthorized applications from obtaining the child's voiceprint, facial features, and other characteristic information. Otherwise, based on this characteristic information, artificial intelligence could synthesize it, potentially leading criminals to falsely claim the child has been kidnapped or impersonate the child to defraud parents. This scenario seriously threatens the safety of family members and their property. The permission management method used in this example avoids such risks by protecting the child's privacy. In this scenario, the child can be directly identified as a user of a preset type, automatically obtaining pre-configured user authorization information corresponding to that preset type. This facilitates configuring preset privacy permission combinations for special groups such as children and the elderly.

[0090] Scenario 2: Borrowing a friend's smartwatch

[0091] Smartwatches generate numerous records for outdoor activities, including activity tracking (speed, steps, calories burned, activity trajectory, etc.) and health monitoring (heart rate, blood pressure, blood oxygen saturation, etc.). However, this information falls under the category of personal privacy and is related to two privacy permissions: physical activity and location. If paired with a phone via Bluetooth, it may also involve the following privacy permission: nearby connected devices (Bluetooth). Location permission requires authorization from the owner, indicating that the owner agrees not to record the location of non-owners. This allows the borrower to prevent the owner from seeing their personal activity records, preserving necessary privacy and providing a more user-friendly experience for non-owners, increasing the likelihood of them purchasing the smartwatch after experiencing it.

[0092] For ease of understanding, Figure 3 shows a schematic diagram of the structure of the terminal device (such as a smart terminal) in this example. As shown in Figure 3, the terminal device in this example includes the following modules: face acquisition module 31, host data storage module 32, host face data comparison module 33, non-host data storage module 34, and non-host face data comparison module 35.

[0093] (1) Face acquisition module 31: calls the front camera of the smart terminal to collect the user's facial feature data.

[0094] (2) Owner data storage module 32: Stores the collected facial feature data of the owner user. For example, the owner data storage module can be a facial data and privacy permission storage module for the owner, used to store the collected facial data of the owner and the authorized privacy permissions.

[0095] (3) User face data comparison module 33: The collected user face data is matched with the user face data.

[0096] (4) Non-owner data storage module 34: For example, it can be a non-owner face data and privacy permission storage module, used to store the collected non-owner face data and the authorized privacy permissions.

[0097] (5) Non-owner face data comparison module 35: Matches the collected non-owner user face data with the non-owner user face data whose privacy permissions have been recorded.

[0098] Figure 4 illustrates the permission management method flowchart of the above example, combining the various modules contained in the terminal device. As shown in Figure 4, the above example specifically includes the following steps S401 to S407.

[0099] Step S401: Collect the current user's facial data through the face acquisition module.

[0100] Step S402: The current user's facial data is compared with the owner's facial data stored in the owner's data storage module using the owner's facial data comparison module.

[0101] Step S403: If the comparison result determines that the current user is the owner user, then proceed with subsequent processing based on the privacy permissions authorized by the owner in the owner data storage module.

[0102] Step S404: If the comparison result determines that the current user is not the owner of the device, then the non-owner face data comparison module compares the current user's face data with the non-owner face data stored in the non-owner data storage module.

[0103] Step S405: If the comparison result determines that the current user is a non-owner user whose privacy permissions have been recorded, then proceed with subsequent processing based on the corresponding non-owner authorized privacy permissions in the non-owner data storage module.

[0104] Step S406: If the comparison results determine that the current user is a non-owner user whose privacy permissions have not been recorded, then display a permission configuration prompt message to prompt the current user to configure privacy permissions.

[0105] Step S407: Perform subsequent processing based on the privacy permissions configured by the current user, and store the privacy permissions configured by the current user in the non-host data storage module.

[0106] In summary, this example, based on facial recognition technology, offers superior protection for the privacy of non-owner users in an era where privacy is increasingly important, demonstrating significant effectiveness and value. This example is applicable to smart terminals such as mobile phones, tablets, and wearable devices, and is also suitable for in-vehicle computers. This example can protect user privacy, mitigate legal risks, and promote product market penetration.

[0107] Secondly, embodiments of this disclosure provide an electronic device, including a memory and a processor; the memory stores a computer program that can be executed by the processor, and the computer program is executed by the processor, causing the processor to implement the permission management method provided in embodiments of this disclosure.

[0108] Figure 5 is a block diagram of an electronic device provided in an embodiment of this disclosure.

[0109] Referring to FIG5, an embodiment of the present disclosure provides an electronic device, which includes: at least one processor 101; at least one memory 102; and one or more I / O interfaces 103 connected between the processor 101 and the memory 102; the memory 102 stores at least one computer program that can be executed by at least one processor 101, and the at least one computer program is executed by at least one processor 101 to enable at least one processor 101 to perform the above-described permission management method.

[0110] A processor is a device with data processing capabilities, including but not limited to a central processing unit (CPU); a memory is a device with data storage capabilities, including but not limited to random access memory (RAM, more specifically SDRAM, DDR, etc.), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), and flash memory (FLASH); an I / O interface (read / write interface) connects the processor and the memory, enabling information exchange between the memory and the processor, including but not limited to a data bus (Bus).

[0111] Thirdly, embodiments of this disclosure also provide a computer-readable storage medium having a computer program stored thereon, the computer program being executed by a processor to enable the processor to implement the above-described permission management method.

[0112] Fourthly, this disclosure also provides a computer program product, including a computer program that is executed by a processor, causing the processor to implement the above-described permission management method.

[0113] Those skilled in the art will understand that all or some of the steps, functional modules / units in the apparatus disclosed above can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0114] In hardware implementations, the division between functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be executed by several physical components working together.

[0115] Some or all of the physical components may be implemented as software executed by a processor (such as a central processing unit (CPU), digital signal processor, or microprocessor), or as hardware, or as an integrated circuit, such as an application-specific integrated circuit (ASIC). Such software may be distributed on a computer-readable medium, which may include computer storage media (or non-transitory media) and communication media (or transient media). As is known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technique for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, random access memory (RAM, more specifically SDRAM, DDR, etc.), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory (FLASH) or other disk storage; read-only optical disc (CD-ROM), digital versatile disc (DVD) or other optical disc storage; magnetic cartridges, magnetic tapes, disk storage or other magnetic storage; and any other media that can be used to store desired information and can be accessed by a computer. Furthermore, as is known to those skilled in the art, communication media typically contain computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

[0116] This disclosure has disclosed exemplary embodiments and implementations, and although specific terminology has been used, it is for general illustrative purposes only and should not be construed as limiting. In some instances, it will be apparent to those skilled in the art that features, characteristics, and / or elements described in connection with particular embodiments and implementations may be used alone or in combination with features, characteristics, and / or elements described in connection with other embodiments and implementations, unless otherwise expressly stated. Therefore, those skilled in the art will understand that various changes in form and detail may be made without departing from the scope of this disclosure as set forth by the appended claims.

Claims

1. A method for managing access permissions, comprising: If the identity recognition conditions are met, obtain the current user's identity feature information on the terminal device; If the current user's identity feature information does not match the pre-stored identity feature information of authorized users, the user authorization information of the current user is obtained; Update the device permission information of the terminal device according to the user authorization information of the current user; wherein the initial state of the device permission information of the terminal device is configured according to the user authorization information of the authorized user.

2. The method according to claim 1, wherein, The identity verification conditions include at least one of the following: The current user's operation behavior is detected to be inconsistent with the pre-stored historical operation behavior of authorized users; The terminal device was detected to switch from a black screen state to a bright screen state. The facial contour information of the current user does not match the facial contour information of the authorized user.

3. The method according to claim 1, wherein, The process of obtaining the current user's authorization information includes: If the user authorization information of the current user is not found in the pre-stored authorization data, a permission configuration prompt message will be displayed; In response to the permission configuration instruction triggered by the permission configuration prompt information, the user authorization information of the current user is obtained and updated to the authorization data.

4. The method according to claim 3, wherein, The display permission configuration prompt information includes: Obtain multiple data permissions included in the set of data permissions supported by the terminal device; Display a permission configuration interface that includes a permission configuration entry; wherein, the permission configuration entry corresponds to the data permission.

5. The method according to claim 4, further comprising: Before displaying the permission configuration prompt, in response to the received level setting instruction, the various data permissions contained in the data permission set are divided into at least two permission levels; The permission configuration entry includes at least two types of permission configuration entry corresponding to the at least two permission levels.

6. The method according to claim 5, wherein, The at least two types of permission configuration entry points include: A first type of configuration entry used to trigger permission configuration instructions when the current user's triggering operation is detected; The second type of configuration entry is used to trigger permission configuration instructions when the authorization operation of the authorized user is detected.

7. The method according to claim 4, further comprising: Before displaying the permission configuration prompt, in response to the received type setting instruction, the various data permissions contained in the data permission set are divided into at least two permission types. The at least two permission types include: a first type of data permission corresponding to authorized users, and a second type of data permission corresponding to unauthorized users; and the permission configuration entry corresponds to the second type of data permission.

8. The method according to any one of claims 1 to 7, wherein, The process of obtaining the current user's authorization information includes: If the user type of the current user is determined to be a preset type based on the current user's identity feature information, the user authorization information of the current user corresponding to the preset type is obtained in advance.

9. The method according to any one of claims 1 to 7, wherein, The current user's authorization information includes at least one of the following: Access permissions for preset applications on the terminal device, terminal location access permissions, terminal device data access permissions, and user data access permissions.

10. An electronic device, comprising a memory and a processor; the memory storing a computer program executable by the processor, the computer program being executed by the processor to cause the processor to implement the access control method according to any one of claims 1 to 9.

11. A computer-readable storage medium having a computer program stored thereon, the computer program being executed by a processor such that the processor implements the access control method according to any one of claims 1 to 9.

12. A computer program product comprising a computer program that is executed by a processor, causing the processor to implement the access control method according to any one of claims 1 to 9.

Images