Access control method and apparatus, and computing device

Abstract

Provided in the present application are an access control method and apparatus, and a computing device. The method comprises: providing a policy management module in a host environment; receiving an access control policy regarding a first application sandbox input by a user by means of the policy management module, and on the basis of the access control policy, performing access control on a file that can be accessed by a first application; mapping the file path of the file, which can be accessed by the first application, in a local file system of the host environment to a first file path, and mounting the first file path to an intermediate mounting point; and mapping the first file path to a second file path, and mounting the second file path to a shared file directory of the application sandbox, such that the application sandbox accesses a shared file in the local file system by means of the shared file directory. By means of establishing an independent intermediate mounting point for each application sandbox, the method achieves the file isolation of shared files among a plurality of application sandboxes, and dynamic access control of the shared files, thereby improving the security and real-time performance of access control of the shared files.

Description

Access control method, device and computing device

[0001] The present application claims priority from the Chinese patent application No. 202411400327.8 filed on September 30, 2024, and entitled "Access control method, device and computing device", the content of which is incorporated herein by reference in its entirety. TECHNICAL FIELD

[0002] The present application relates to the field of communication, and in particular to an access control method, device and computing device. BACKGROUND

[0003] Currently, application programs facing sandbox isolation face great challenges in data exchange and access control inside and outside the sandbox.

[0004] Because the file resources outside the sandbox cannot be seen after sandbox isolation, in order to realize the access control of shared files of sandbox isolation applications, the recently proposed access control scheme for application sandbox shared files usually mounts the external directory or file into the sandbox based on the static file mounting method to solve the requirement of sandbox outside data visibility in the sandbox.

[0005] When the above-mentioned access control scheme performs access control on shared files, it usually needs to stop the use of the application sandbox, and cannot achieve file isolation of shared files between application sandboxes and dynamic access control of shared files for shared file resources outside the sandbox.

[0006] It is hoped that there will be an improved scheme to achieve file isolation of shared files between application sandboxes and dynamic access control of shared files. SUMMARY

[0007] In order to improve the security and real-time performance of the access control of shared files, the present application provides an access control method, device and computing device. The method realizes file isolation of shared files between multiple applications and dynamic access control of shared files by establishing corresponding intermediate mounting points for multiple applications in the sandbox environment.

[0008] In a first aspect, the present application discloses an access control method, which is applied to a computing device, the computing device comprising a host environment and a sandbox environment, the sandbox environment comprising a first application, the method comprising: mounting an intermediate mount point to a shared file directory corresponding to the first application, the intermediate mount point being a mount point with a shared propagation attribute in the host environment; obtaining an access control policy, the access control policy being used to specify files of the host environment that can be accessed by the first application; the files comprising folders and single files; mounting a first file path to the intermediate mount point, the first file path being a file path mapped from a file path of the file; and mounting a second file path to the shared file directory, the second file path being a file path mapped from the first file path.

[0009] In the present application, by establishing multiple intermediate mount points corresponding to applications in the host environment, and mounting shared files of each application in the local file system to the intermediate mount points, a user can configure access control policies for multiple applications in the sandbox environment through the intermediate mount points in the sandbox environment runtime, thereby realizing dynamic access control of shared files and file isolation of shared files among multiple applications, and improving the security and real-time performance of the access control method.

[0010] In some possible implementation manners, after the mounting of the first file path to the intermediate mount point, the method further comprises: configuring an access permission of the first file path according to the access control policy.

[0011] In the present application, by configuring an access permission of a first file path in an intermediate mount point according to an access control policy, file isolation between a host environment and a sandbox environment is realized, and the security of the access control method is improved.

[0012] In some possible implementation manners, the file is a single file, the intermediate mount point is a single file mount point corresponding to the first application, and the shared file directory comprises a single file directory corresponding to the single file mount point, the method comprising: mounting the first file path to the single file mount point, the first file path being a file path mapped from the single file; and mounting the second file path to the single file directory.

[0013] In some possible implementation manners, the file is a folder, the intermediate mount point comprises a folder mount point corresponding to the first application, and the shared file directory comprises a folder directory corresponding to the folder mount point, the method comprising: mounting the first file path to the folder mount point, the first file path being a file path mapped from the folder; and mounting the second file path to the folder directory.

[0014] In the application, by establishing corresponding intermediate mounting points for the single files and folders accessible by the first application, data conflicts caused by the same single file name can be prevented, and the security of the access control method is improved.

[0015] In some possible implementation manners, the method further includes deleting the first file path according to the access control policy.

[0016] In the application, when the access control policy changes, the file path in the intermediate mounting point can be added or deleted without restarting, logging out and logging in again of the sandbox environment or the application in the sandbox, so that dynamic control of the access permission of the multiple applications in the sandbox environment is implemented, and the real-time performance of the file access control is improved.

[0017] In some possible implementation manners, the host environment further includes a first file system corresponding to the first application, and the access control policy is obtained by the first file system, including: the first file system obtaining the access control policy of the first application, obtaining the file path of the file according to the access control policy, the file path including a subfolder path and a single file path, and the first file system being configured to mount the first file path to the intermediate mounting point.

[0018] In the application, by establishing corresponding custom file systems for the multiple applications in the host environment, the subfolder path and the single file path under the file path are mounted to the first mounting point, the access control policy corresponding to each application is obtained by the custom file system, and the access permission of each application is controlled according to the access control policy, so that fine-grained control of file operations is implemented, the application in the sandbox does not need to be additionally adapted, multiple sandbox environments can be compatible, and the compatibility and security of the access control method are improved.

[0019] In some possible implementation manners, the method further includes: the first file system receiving an access request of the first application; the access request is used to request to access the file path; the first file system determining the access permission of the first application according to the access control policy of the first application; if the first application has the access permission, the first file system allows the access request of the first application; and if the first application does not have the access permission, the first file system rejects the access request of the first application.

[0020] In the application, by establishing corresponding custom file systems for the multiple applications in the host environment, the application in the sandbox dynamically accesses the shared resource outside the sandbox by the custom file system agent, dynamic access control is performed on the shared file of each application, and the type of the local file system in the host environment is not limited, so that the compatibility of the access control method is improved.

[0021] In a second aspect, the present application provides an access control method, which is applied to a computing device, the computing device comprising a host environment and a sandbox environment, the sandbox environment comprising a first application, and the host environment comprising a first file system, the method being applied to the first file system and comprising: obtaining an access control policy of the first application, the access control policy being used to determine a file path of a file accessible by the first application; mounting the first file system to a shared file directory of the first application according to the access control policy, the first file system being a file system corresponding to the first application; and mapping the file path to a third file path, the third file path being used to determine a file path in the shared file directory.

[0022] In some possible implementation manners, the method further comprises: receiving an access request of the first application, the access request being used to request access to the file path; determining an access permission of the first application according to the access control policy of the first application; if the first application has the access permission, the first file system allows the access request of the first application; and if the first application does not have the access permission, the first file system rejects the access request of the first application.

[0023] In the present application, by establishing a plurality of custom file systems corresponding to applications in the host environment and mounting the custom file systems into the sandbox, the dynamic access of the applications in the sandbox to the shared resources outside the sandbox is realized by a custom file system agent, and the dynamic access control of the shared files of each application is realized. Meanwhile, the type of the local file system in the host environment is not limited, and the compatibility of the access control method is improved.

[0024] In a third aspect, the present application provides an access control apparatus, the apparatus comprising: a policy management module;

[0025] The policy management module is configured to mount an intermediate mounting point to a shared file directory corresponding to a first application, obtain an access control policy, the access control policy being used to specify a file of the host environment accessible by the first application, the file comprising a folder and a single file, mount a first file path to the intermediate mounting point, the intermediate mounting point being a mounting point corresponding to the first application and having a propagation attribute, the first file path being a file path obtained by mapping a file path of the file, and mount a second file path to the shared file directory, the second file path being a file path obtained by mapping the first file path.

[0026] In some possible implementation manners, the apparatus further includes a first file system; the first file system is configured to acquire an access control policy of a first application; acquire a file path of the file according to the access control policy, map the file path to a first file path, and mount the first file path to the intermediate mount point.

[0027] In a fourth aspect, the present application provides a computer program product, including computer programs / instructions, which, when executed by a processor, cause the processor to implement the access control method provided by the present application.

[0028] In a fifth aspect, the present application provides a computing device, including a processor and a memory, the memory storing program instructions executable on the processor, and the processor is configured to execute the program instructions to cause the processor to perform the access control method provided by the present application.

[0029] It should be understood that the technical solutions of the third aspect, the fourth aspect and the fifth aspect of the embodiments of the present application and the corresponding possible implementation manners have the beneficial effects as described above for the first aspect and the second aspect, which will not be described here again. BRIEF DESCRIPTION OF DRAWINGS

[0030] FIG. 1 is a schematic diagram of a scenario of access control of a shared file according to an embodiment of the present application;

[0031] FIG. 2 is a schematic diagram of a scenario of access control of a shared file according to an embodiment of the present application;

[0032] FIG. 3 is a schematic diagram of a structure of a computing device according to an embodiment of the present application;

[0033] FIG. 4 is a flowchart of an access control method according to an embodiment of the present application;

[0034] FIG. 5 is a flowchart of initialization of a sandbox environment according to an embodiment of the present application;

[0035] FIG. 6 is a schematic diagram of file paths of files accessible by various applications according to an embodiment of the present application;

[0036] FIG. 7 is a flowchart of another initialization of a sandbox environment according to an embodiment of the present application;

[0037] FIG. 8 is a schematic diagram of file paths of files accessible by various applications according to another embodiment of the present application;

[0038] FIG. 9 is a schematic diagram of a scenario of access control of a shared file according to an embodiment of the present application;

[0039] FIG. 10 is a flowchart of an access control method based on mounting a local file system directly to a shared file directory according to an embodiment of the present application. Detailed Implementation

[0040] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such terms are interchangeable where appropriate; this is merely a way of distinguishing objects with the same attributes in the embodiments of this application. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion, so that a process, method, system, product, or apparatus that comprises a series of elements is not necessarily limited to those elements, but may include other elements not explicitly listed or inherent to those processes, methods, products, or apparatuses.

[0041] To facilitate understanding of the technical solution of this application, the relevant terms used in this document are explained below.

[0042] A sandbox environment refers to a runtime environment running on a computing device to isolate application sandbox programs or code, preventing them from harming other parts of the computing device's operating system. By restricting application resource access permissions and the ability to add, delete, modify, and query data, sandboxing does not affect system stability and security. In contrast to the sandbox environment, the computing device's own runtime environment is the host environment.

[0043] Shared files refer to the process in a network environment that allows multiple users or devices to access the same set of files. This typically involves file-sharing services or protocols that enable files to be transferred and used between different systems, devices, or users. In this application, shared files are files stored in the host environment's file system that can be accessed by multiple application sandboxes in a sandbox environment.

[0044] Mounting refers to the process of connecting a storage device to a file system structure, allowing users to access and use the data on the storage device.

[0045] Because a sandbox environment provides an isolated runtime environment, applications within the sandbox cannot directly access file resources in the host environment. Therefore, applications designed for sandbox isolation face significant challenges in data exchange and access control between the sandbox and the host environment.

[0046] To achieve access control for shared files in sandboxed applications, recent proposed access control schemes for shared files in sandboxed applications typically rely on static file mounting to mount external directories or files into the sandbox, addressing the visibility requirements of data outside the sandbox within it. Alternatively, file sharing between the sandbox environment and the host environment can be achieved by creating file copies within the sandbox environment.

[0047] When the above access control scheme performs access control on the shared file, it is usually necessary to stop the use of the application in the sandbox, and the file isolation between the application sandboxes cannot be achieved for the shared file resources outside the sandbox, and dynamic access control cannot be achieved.

[0048] It is hoped that an improved scheme can achieve file isolation between the application sandboxes for the shared file, and dynamic access control for the shared file.

[0049] The present application provides an access control method, device and computing device. By setting a policy management module in the host environment, receiving an access control policy of a certain application sandbox input by a user through the policy management module, and performing access control on the shared file of the application according to the access control policy, mapping the file path of the shared file in the local file system of the host environment to a first file path, and mounting the first file path to an intermediate mounting point; mapping the first file path to a second file path, and mounting the second file path to the shared file directory of the application sandbox, so that the application sandbox accesses the shared file in the local file system through the shared file directory. The method realizes file isolation between multiple application sandboxes for the shared file, and dynamic access control for the shared file by establishing an independent intermediate mounting point for each application sandbox. The security and real-time performance of the access control of the shared file are improved.

[0050] For example, FIG. 1 is a schematic diagram of a first shared file access control scenario provided by an embodiment of the present application. As shown in FIG. 1, when the computing device 10 is running, it can include a sandbox environment 100 and a host environment 200. The sandbox environment 100 runs multiple independent application sandboxes, for example, the application sandboxes include an application sandbox 110 and an application sandbox 120. The application sandbox 110 includes an application A 111 and a shared file directory 112 corresponding to the application A, wherein the shared file directory 112 includes a folder directory a corresponding to a folder and a single file directory b corresponding to a single file. The application sandbox 120 includes an application B 121 and a shared file directory 122 corresponding to the application B, wherein the shared file directory 122 includes a folder directory c corresponding to a folder and a single file directory d corresponding to a single file.

[0051] The device type of the computing device 10 can be, but is not limited to, a desktop computer, a notebook computer, a server, etc. The computing device 10 can also include a mobile device such as a mobile phone and a tablet computer. The host environment of the computing device 10 can be an iOS, an android, a Windows, a Harmony OS or other operating system. The computing device 10 can include at least one host environment, and the host environment can be a container, a virtual machine or other running environment. In other words, the present application does not limit the device type of the computing device 10, the sandbox environment 100 and the host environment 200 of the computing device 10.

[0052] The host environment 200 of the computing device 10 includes a local file system 210, a policy management module 220, and intermediate mount points 230.

[0053] The local file system 210 is a file system that can directly interact with the hardware of the computing device 10. The local file system 210 includes text, image, program, or other types of files, which are organized based on a folder hierarchy.

[0054] The policy management module 220 can receive access control policies for the plurality of applications via a file selector. The file selector is provided by an application management configuration center (not shown) of the computing device 10.

[0055] The access control policies are used to specify the files in the local file system 210 that are accessible by the applications in the sandbox environment 100. For example, the user 20 selects, via the file selector, the folders and single files in the local file system 210 that are accessible by the application A 111, and the folders and single files that are accessible by the application B 121.

[0056] In this application, in order to achieve data synchronization and sharing between the plurality of applications in the sandbox environment and the host environment, the computing device 10 also needs to establish a corresponding intermediate mount point 230 for each application. The intermediate mount point 230 is a mount point with a shared propagation property, and each intermediate mount point includes a folder mount point of a folder that is accessible by an application, and / or a single file mount point of a single file that is accessible by an application.

[0057] In some possible embodiments, the at least one intermediate mount point corresponding to each application can be established in the host environment 200 when the sandbox environment 100 is initialized. For example, the intermediate mount points 230 include a folder mount point 231 corresponding to the folder directory a of the application A 111, and a single file mount point 232 corresponding to the single file directory b; a folder mount point 233 corresponding to the folder c of the application B 121, and a single file mount point 234 corresponding to the single file.

[0058] As a possible embodiment, the at least one intermediate mount point corresponding to each application can also be established in the host environment 200 when the sandbox environment 100 is running.

[0059] The policy management module 220 is also configured to obtain the file path of the file accessible by the application from the local file system 210. Illustratively, when the file accessible by the application is a folder, the file path of the folder points to the storage location of the folder in the local file system 210. When the file accessible by the application is a single file, the file path of the single file points to the storage location of the single file in the local file system 210.

[0060] Illustratively, the folder accessible by the application can include one or more sub-folders. Illustratively, the sub-folders can be one or more of the desktop, music, document, movie, picture, download, and trash folders.

[0061] By way of illustration and not limitation, the single file accessible by the application can be any one of the file types of music, document, movie, picture, etc., or any one of the file types of compressed file, code file, log file, etc. In other words, the embodiments of the present application do not limit the specific type of file.

[0062] Taking the application A111 (first application) as an example, the policy management module 220 can map the file path of the folder accessible by the application A111 in the local file system 210 to a first file path according to the access control policy of the application A111, the first file path being the file path of the corresponding folder in the folder mount point 231, and mount the first file path to the intermediate mount point.

[0063] Before the first application in the sandbox is started, the policy management module 220 can map the file path of the folder in the folder mount point 231 to a second file path, the second file path being the corresponding file path in the shared file directory 112, and mount the second file path to the folder directory a of the first application, so that the first application 111 accesses the folder in the local file system 210 through the folder directory a.

[0064] When the file accessible by the application A111 is a single file, the policy management module 220 can map the file path of the single file in the local file system 210 to a first file path according to the access control policy, the first file path corresponding to the file path of the corresponding single file in the single file mount point 232, and mount the first file path to the single file mount point 232.

[0065] The policy management module 220 can map the file path of the single file in the single file mount point 232 to a second file path, the second file path corresponding to the file path of the corresponding single file in the single file directory b, and mount the second file path to the single file directory b of the first application, so that the first application accesses the single file in the shared file through the single file directory b.

[0066] In some possible implementation, the policy management module 220 can also configure the access permission of the first file path of a certain application according to the access control policy input by the user 20. Illustratively, the access permission can include one or more of read, write, execute, modify, and full control.

[0067] It can be understood that in some possible implementation, the access control policy input by the user 20 can also be used to cancel the access permission of one or more folders and one or more single files in the local file system 210 that can be accessed by a certain application.

[0068] The policy management module 220 can delete the first file path corresponding to a certain application according to the access control policy.

[0069] As a possible implementation, the policy management module 220 can also be configured to generate a policy configuration file of the shared file of the computing device 10 according to the access control policy input by the user 20. During the next initialization process of the sandbox environment, the policy management module 220 can achieve the access control of the shared file of each application in the sandbox environment by loading the policy configuration file.

[0070] Illustratively, the access control policy input by the user 20 specifies the folders and single files that can be accessed by the application A 111 in the local file system 210, and the folders and single files that can be accessed by the application B 121.

[0071] During the next initialization process of the sandbox environment, the policy management module 220 can achieve the access control of the shared file of the application A 111 and the application B 121 by loading the policy configuration file generated according to the access control policy.

[0072] Further, in order to achieve fine-grained access control, the computing device 10 is also improved in the present application.

[0073] Illustratively, FIG. 2 is a schematic diagram of a second scenario of sharing file access control provided by an embodiment of the present application. As shown in FIG. 2, compared with the computing device 10 shown in FIG. 1, the improved host environment 200 of the computing device 10 further includes a custom file system 240. The custom file system 240 includes a file system corresponding to each application. Illustratively, the improved host environment 200 of the computing device 10 is provided with a file system 241 corresponding to the application A 111 and a file system 242 corresponding to the application B 121.

[0074] The policy management module 220 can generate a policy configuration file of the computing device 10 according to the access control policy input by the user 20. The policy configuration file includes the access control policy set by the user 20 for the plurality of applications. The access control policy is used to specify the files accessible by an application in the local file system 210. The files include at least one folder selected by the user 20 via the file selector, and one or more single files. Illustratively, the folders accessible by the application Al 11 include the "Downloads", "Pictures", and "Desktop" folders, and the single files accessible by the application Al 11 include Test.pdf.

[0075] The access control policy can further include configuration parameters of each file system in the custom file system 240. The policy management module 220 can initialize the file system 241 and the file system 242 according to the configuration parameters. The configuration parameters include a file system identifier, a mount location, an offset prefix, an access permission, and a file path.

[0076] Next, the configuration parameters are introduced as follows.

[0077] The file system identifier is used to distinguish the file system corresponding to an application. Illustratively, the file system identifier of the file system 241 corresponding to the application Al 11 is "SandboxFS_APP1", and the file system identifier of the file system 242 corresponding to the application B 121 is "SandboxFS_APP2".

[0078] The mount location is used to indicate the location where the file system 241 and the file system 242 need to be mounted. The file system 241 and the file system 242 can be mounted to the shared file directory or the intermediate mount point according to the mount location.

[0079] The offset prefix is used to indicate the file path of the files accessible by the plurality of applications in the local file system 210, which is an offset of the file path in the custom file system.

[0080] The access permission is used to indicate the access permission of at least one folder and one or more single files accessible by an application. Taking the application A as an example, the policy management module 220 can configure the permission of the file path of at least one folder and the file path of one or more single files accessible by the application A according to the access permission.

[0081] The policy file path is used to indicate the storage location of the policy configuration file. The file system 241 and the file system 242 can obtain the policy configuration file from the policy file path.

[0082] When the policy configuration file is updated, the policy management module 220 can determine whether to update the policy configuration file according to the unique identifier of each policy configuration file. By way of illustration and not limitation, the unique identifier of the policy configuration file can be the timestamp of the policy configuration file, or the hash value of the policy configuration file. In other words, the present application does not make any limitation on the timestamp of the policy configuration file.

[0083] When the file system 241 and the file system 242 complete the initialization, the file system 241 obtains the access control policy of the application A111 from the policy configuration file, and obtains the file path of at least one folder accessible by the application A111 and the file path of one or more single files from the local file system 210 according to the access control policy.

[0084] Taking the file system 241 as an example, the file system 241 can map the file path of at least one folder accessible by the application A111 and the file path of one or more single files to a first file path, and the above first file path is the file path in the file system 241, and the policy management module 220 mounts the file path in the file system 241 to the folder mounting point 231 of the application A111.

[0085] In some possible implementation manners, the policy management module 220 can also map the file path in the file system 241 to a third file path directly through the folder mounting point 231 of the application A111, and the policy management module 220 mounts the third file path to the shared file directory 112.

[0086] When the application A111 accesses the file in the local file system 210 through the shared file directory 112, the file system 241 is further configured to control the initiated access request of the application A111 according to the access control policy of the application A111 recorded in the policy configuration file.

[0087] In some possible implementation manners, the policy configuration file further includes a callback function, when the application A111 initiates an access request, the file system 241 reads the callback function recorded in the policy configuration file, obtains the access permission corresponding to the application A111 through the callback function, and controls the initiated access request of the application A111 according to the access permission.

[0088] Among them, the policy configuration file includes the callback function of the access control, the read path and the open path, and next, the callback function of the access control function, the read path function and the open path function will be introduced.

[0089] The access control function is called to obtain access permission of the file path of the at least one folder, and in some possible implementation manners, the callback function of the access control can be named “access”.

[0090] The read path function is a hook function for implementing a read path function. The read path function is called to indirectly call an interface “readdir” of a read path of a file system itself. In some possible implementation manners, the callback function of the read path can be named “.readdir”.

[0091] The open path function is a hook function for implementing an open path function. The open path function is called to indirectly call an interface “open” of a read path of a file system itself. In some possible implementation manners, the callback function of the read path can be named “.open”.

[0092] By way of illustration and not limitation, the callback functions described above include callback functions of renaming, soft linking, creating a directory, and the like, in addition to the access control, the read path, and the open path. The callback functions described above are called

[0093] For example, FIG. 3 is a structural schematic diagram of a computing device according to the present application. As shown in FIG. 3, the computing device 10 includes a processor 300 and a memory 400. The processor 300 is a computing core and a control core of the computing device 10, and can include one or more of an application processor (AP), a modem, a graphics processing unit (GPU), an image signal processor (ISP), a controller, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU).

[0094] The memory 400 can store file data. When an operating system of the computing device 10 is running, the processor 400 can manage the file data in the memory 400 through the local file system 210.

[0095] The memory 400 can further store a software program 410, which can be run by the processor 300 to enable the processor 300 to perform the access control method of the shared file provided in the embodiments of the present application.

[0096] The software program 410 can include a sandbox application environment module 411, a communication module 412, a policy management module 413, an access control module 414, a shared file management module 415, and a health check module 416.

[0097] The sandbox application environment module 411 runs a sandbox environment of the computing device 10. The computing device 10 can manage the sandbox environment 100 and the application sandboxes in the sandbox environment 100 through the application sandbox environment module 411, for example, to perform an initialization operation on the sandbox environment 100.

[0098] The sandbox application environment module 411 is further configured to provide a unified application program interface for the sandbox environment 100, and abstract the application program interface to the policy management module 413 in the host environment through the communication module 412.

[0099] The policy management module 413 is configured to establish a corresponding intermediate mount point for each application in the sandbox environment during the initialization process or runtime of the sandbox environment.

[0100] The policy management module 413 is configured to receive the access control policy of the plurality of applications input by the user 20 through the file selector. In some possible embodiments, the policy management module 413 is further configured to update the access control policy input by the user. The file selector is provided by the application management configuration center of the computing device 10.

[0101] The policy management module 413 is configured to mount the intermediate mount point of the plurality of applications to the shared file directory corresponding to each application.

[0102] The policy management module 413 can map the shared file path of the plurality of applications in the local file system 210, or the file path of at least one folder accessible by each application in the plurality of custom file systems, to the first file path of each application according to the access control policy. The policy management module 413 can mount the first file path to the intermediate mount point corresponding to each application.

[0103] In some possible embodiments, the policy management module 413 is configured to map the file path of a single file of the plurality of applications in the local file system 210, or the file path of a single file accessible by each application in the plurality of custom file systems, to the first file path of each application, and mount the first file path to the intermediate mount point corresponding to each application.

[0104] The policy management module 413 is configured to map the first file path of each application to a second file path, and mount the second file path to the shared file directory corresponding to each application.

[0105] As a possible implementation, the policy management module 413 is further configured to obtain the access permission of the first file path according to the access control policy sent by the policy management module 413, and send the access permission of the first file path to the access control module 440.

[0106] The access control module 440 is configured to receive the access permission of the first file path, and control the access permission of the related file in the shared file management module 415 according to the above-mentioned access permission.

[0107] In some possible embodiments, the access control module 440 further comprises the custom file system 240 shown in FIG. 2, and the computing device 10 can perform access control on an application through the file system corresponding to the application in the custom file system 240.

[0108] The shared file management module 415 can provide the sandbox environment 100 with the files in the local file system 210 that the client specifies through the file selector and that multiple applications need to access.

[0109] The health check module 416 is configured to detect the running health status of the sandbox environment above the sandbox application environment module 411, so as to enhance the availability and resilience of the software program 321.

[0110] It is worth noting that the embodiment shown in FIG. 3 is only schematic. For example, the division of various software units in the software program is only a logical functional division, and there can be another division manner in actual implementation. For example, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Meanwhile, each functional unit in each embodiment of the present application can be integrated in one processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit.

[0111] Next, based on the above description, an access control method provided by the embodiments of the present application is introduced. It can be understood that the method is proposed based on the above description, and part or all of the contents in the method can be referred to the description above.

[0112] Please refer to FIG. 4, which is a flow chart of an access control method disclosed by the embodiments of the present application. As shown in FIG. 4, the access control of the shared file can be realized through steps S410 to S440. It can be understood that when the access control of the shared file is performed, the method is executed by the processor 300 of the computing device 10 shown in FIG. 3.

[0113] S410: mount the intermediate mounting point to the shared file directory corresponding to the first application.

[0114] As mentioned above, the computing device 10 can include a sandbox environment 100 and a host environment 200, and the sandbox environment 100 can run a plurality of application sandboxes. In some possible implementation, the processor 300 can establish one or more sandbox environments in the computing device 10 by the application sandbox environment module 411.

[0115] For example, the processor 300 can establish intermediate mount points for the plurality of applications in the host environment 200, and mount the intermediate mount points to the corresponding shared file directories of the applications.

[0116] In some possible implementation, the intermediate mount points of each application include the folder mount points and / or the single file mount points established in the host environment, and the shared file directories of each application include the folder directories of the corresponding folder mount points and / or the single file directories of the corresponding single file mount points. In some possible implementation, each intermediate mount point is a mount point with a propagation attribute, and can be accessed by the applications in the sandbox.

[0117] In some possible implementation, the processor 300 can establish the at least one intermediate mount point for each application by the policy management module 220 during the initialization of the sandbox environment 100.

[0118] For example, FIG. 5 is a flowchart of the initialization of the sandbox environment, and as shown in FIG. 5, the processor 300 can establish the intermediate mount points by the policy management module 220 through steps S411-S413.

[0119] S411: The processor 300 determines whether the function of sharing files is enabled for the sandbox environment 100 by the policy management module 220.

[0120] If the function of sharing files is enabled, step S412 is performed; if the function of sharing files is not enabled, the initialization of the sandbox environment 100 is continued, and the function of sharing files for the sandbox environment 100 is enabled after the initialization of the sandbox environment 100 is completed.

[0121] S412: The processor 300 determines whether the intermediate mount points are established for the sandbox environment 100 by the policy management module 220.

[0122] If the intermediate mount points 230 are established for the sandbox environment 100, the processor 300 continues the initialization of the sandbox environment.

[0123] If the intermediate mount points 230 are not established for the sandbox environment 100, step S413 is performed.

[0124] S413: The processor 300 establishes the intermediate mount points for the plurality of applications in the sandbox environment 100 by the policy management module 220.

[0125] Illustratively, taking the application A 111 (first application) and the application B 121 shown in FIG. 1 as examples, the intermediate mounting points established by the policy management module 220 for the application A 111 include the folder mounting point 231 of the application A 111 and the single file mounting point 232 of the application A 111, the folder mounting point 233 of the application B 121 and the single file mounting point 234 of the application B 121. Wherein, each intermediate mounting point is established at the same time as the root directory corresponding to the mounting point.

[0126] Illustratively, the root directory in the folder mounting point 231 is “ / xxx / mid_dir / ”, the root directory in the single file mounting point 232 is “ / SingleFile / ”; the root directory in the folder mounting point 233 is “ / xxx / mid_dir / ”, and the root directory in the single file mounting point 234 is “ / SingleFile / ”.

[0127] Wherein, the above intermediate mounting points are mounting points with shared propagation properties, and each intermediate mounting point corresponds to a synchronization pipeline of shared files between the host environment and the sandbox environment.

[0128] In some possible implementations, the processor 300 can use the policy management module 220 to establish a folder mounting point for the application A 111 in the host environment 200 in addition to the folder mounting point 231 and the single file mounting point 232, so as to achieve more fine-grained access control of the shared files of the application A 111.

[0129] After the intermediate mounting points are established, the processor 300 can use the policy management module 220 to mount the folder mounting point 231 to the shared file directory 112 of the application A 111, mount the single file mounting point 232 to the single file directory b of the application A 111, mount the mounting point 233 to the shared file directory 122 of the application B 121, and mount the mounting point 234 to the single file directory 123 of the application B 121.

[0130] Illustratively, the root directory of the folder directory a is “ / ShareFiles”, the root directory of the single file directory b is “ / SingleFile / ”; the root directory of the folder directory c is “ / ShareFiles”, and the root directory of the single file directory d is “ / SingleFile / ”.

[0131] By establishing independent intermediate mounting points for each application and establishing independent root directories in the respective intermediate mounting points, file isolation of shared files between multiple application sandboxes is achieved. The security of the access control of the shared files is improved.

[0132] As a possible implementation, the processor 300 can utilize the policy management module 220 to establish at least one intermediate mount point for each application of the sandbox environment 100 at runtime of the sandbox environment 100. And mount the at least one intermediate mount point to the shared file directory or the single file directory of the corresponding application.

[0133] In some possible implementations, the processor 300 can utilize the policy management module 220 to receive the access control policy input by the user 20, and delete the intermediate mount point of the sandbox environment 100 according to the access control policy.

[0134] It is worth noting that the above-mentioned operations of establishing or deleting the mount point take effect after the next start of the application.

[0135] By establishing the intermediate mount points of multiple applications for the sandbox environment at runtime of the sandbox environment 100, dynamic access control of the shared files in the sandbox environment is achieved. The real-time performance of the access control of the shared files is improved.

[0136] S420: Obtain the access control policy.

[0137] As mentioned above, when a sandbox environment is running, the processor 300 can also utilize the policy management module 220 to enable the function of the shared files of the sandbox environment.

[0138] When the function of the shared files of a sandbox environment is enabled, the processor 300 can utilize the policy management module 220 to receive the access control policy input by the user 20 through the file selector. Wherein, the access control policy input by the user 20 is used to specify the files accessible by multiple applications in the local file system 210.

[0139] For example, FIG. 6 is a schematic diagram of the file paths of the files accessible by each application in an embodiment of the present application. As shown in FIG. 6, the file path of the folder accessible by the application A111 (i.e. application 1 in FIG. 6) specified by the user 20 in the local file system 210 is “C: / xxx / APP1 / DOCS”, and the file path of the single file accessible by the application A111 in the local file system 210 is “C: / xxx / APP1 / test.pdf”.

[0140] The file path of the folder accessible by the application B121 (i.e. application 2 in FIG. 6) specified by the user 20 in the local file system 210 is “C: / xxx / APP2 / DOCS”, and the file path of the single file accessible by the application B121 in the local file system 210 is “C: / xxx / APP2 / test.pdf”.

[0141] S430: Mount the first file path to the intermediate mount point.

[0142] As mentioned above, the files accessible to the first application in the local file system 210 include folders and single files.

[0143] If the file accessible to the first application is a folder, the processor 300 can use the policy management module 220 to obtain the file path of the folder accessible to each application from the local file system 210 according to the access control policy, map the file path of the folder to the first file path of each application, the first file path being the file path corresponding to the folder mount point of each application, and mount the first file path to the folder mount point corresponding to each application.

[0144] In some possible embodiments, if the file accessible to the first application is a single file, the processor 300 can also use the policy management module 220 to obtain the file path of the single file accessible to each application from the local file system 210 according to the access control policy, map the file path of the single file to the first file path of each application, the first file path being the file path of the single file mount point of each application, and mount the third file path to the mount point of the single file corresponding to each application.

[0145] The access control policy further includes the access permissions of the folders and / or single files accessible to each application. After the policy management module 220 obtains the first file path through address mapping, it also needs to configure the access permissions of the first file path corresponding to each application according to the access permissions in the access control policy.

[0146] For example, the processor 300 can use the policy management module 220 to obtain the file path of the folder accessible to the application A111, i.e., "C: / xxx / APP1 / DOCS", and the file path of the single file accessible to the application A111, i.e., "C: / xxx / APP1 / test.pdf", from the local file system 210.

[0147] As shown in FIG. 6, the processor 300 can use the policy management module 220 to map the file path of the folder accessible to the application A111, i.e., "C: / xxx / APP1 / DOCS", to the first file path, i.e., " / xxx / mid_dir / APP1", and mount the first file path to the root directory of the folder mount point 231.

[0148] It is worth noting that, in order to prevent data conflicts caused by the same file name, when performing address mapping of the file path of a single file, the complete absolute path of the single file in the local file system 210 needs to be added to the first file path.

[0149] Illustratively, the absolute path of the accessible single file of application A111 in the local file system 210 is "C: / xxx / APP1 / test.pdf". The processor 300 maps the above path "C: / xxx / APP1 / test.pdf" to a first file path " / SingleFile / xxx / APP1 / test.pdf" using the policy management module 220, and mounts the first file path to the root directory of the single file mount point 232.

[0150] It can be appreciated that the processor 300 can also map the file path of the accessible folder of application 2 "C: / xxx / APP2 / DOCS" to " / xxx / mid_dir / APP2" and the file path of the accessible single file of application 2 "C: / xxx / APP2 / test.pdf" to " / xxx / APP2_singleFile / test.pdf" using the policy management module 220 in the same manner, and mount the above paths to the root directories of the corresponding intermediate mount points.

[0151] As a possible implementation, the processor 300 can also delete the first file path corresponding to an application using the policy management module 220 when the sandbox environment 100 is running.

[0152] It is worth noting that the above deletion of the first file path takes effect after the next start of the application.

[0153] S440: Mount the second file path to the shared file directory.

[0154] If the file accessible by the first application is a folder, the processor 300 can map the file path in each application folder mount point to a second file path using the policy management module 220, the second file path being the file path corresponding to the folder directory of each application, and mount the second file path to the folder directory of the first application, so that the first application accesses the folder stored in the local file system 210 through the folder directory.

[0155] In some possible implementations, if the file accessible by the first application is a single file, the processor 300 can also map the file path in each application single file mount point to a second file path using the policy management module 220, the second file path being the file path corresponding to the single file directory, and mount the second file path to the single file directory of the first application, so that the first application accesses the single file stored in the local file system 210 through the single file directory.

[0156] With reference to FIG. 1 and FIG. 6, taking the application Al 11 as an example, the processor 300 can use the policy management module 220 to map the first file path " / xxx / mid_dir / APP1" of the application Al 11 to the second file path " / ShareFiles", and mount the second file path to the folder directory a of the application Al 11 in the sandbox.

[0157] It is worth noting that, in order to prevent data conflicts caused by the same file name, when performing address mapping of the third file path, the complete absolute path of the single file in the local file system 210 needs to be added in the fourth file path.

[0158] Illustratively, the processor 300 uses the policy management module 220 to map the first file path " / SingleFile / xxx / APP1 / test.pdf" of the application Al 11 to the second file path " / SingleFile / xxx / APP1 / test.pdf", and mount the fourth file path to the single file directory b of the application Al 11.

[0159] It can be understood that the processor 300 can use the policy management module 220 to map the first file path " / xxx / mid_dir / APP2" of the application 2 to the second file path " / ShareFiles" in the same way, and mount the second file path to the folder directory c corresponding to the application B121.

[0160] The processor 300 can also use the policy management module 220 to map the first file path " / xxx / APP2_singleFile / test.pdf" of the application 2 to the second file path " / SingleFile / xxx / APP2 / test.pdf", and mount the second file path to the single file directory d corresponding to the application B121.

[0161] When starting the application Al 11 and / or the application B121, the application Al 11 and / or the application B121 can access the folder accessible by each application stored on the local file system 210 through the shared file directory, and access the single file accessible by each application stored on the local file system 210 through the single directory.

[0162] As a possible implementation, the processor 300 can use the access control policy module 212 to generate a configuration file of the shared files of the computing device 10 based on the access control policy input by the user. In the next initialization process of the sandbox environment, the computing device 10 can realize the access control of the shared files of each application in the sandbox environment by loading the above-mentioned configuration file.

[0163] As mentioned above, in order to realize the fine-grained access control of the shared file, the computing device 10 is further improved, and please refer to FIG. 2. The improved computing device 10 further comprises a custom file system 240. The custom file system 240 comprises a file system corresponding to each application. As shown in FIG. 2, the computing device 10 comprises a file system 241 (first file system) of an application A 111 and a file system 242 of an application B 121.

[0164] Therefore, the step 410 of mounting the intermediate mounting point to the shared file directory corresponding to the first application further comprises the following contents.

[0165] In combination with FIG. 1 and FIG. 2, since the custom file system corresponding to each application is established in the host environment, the custom file system is managed according to the access control of the file path of the file specified in the policy configuration file, wherein the file path comprises a subfolder path and a single file path.

[0166] Since the application in the sandbox dynamically accesses the shared resource outside the sandbox through the proxy of the custom file system 240, the host environment 200 of FIG. 2 does not need to independently set the corresponding single file mounting point and single file directory for each application that can access the single file.

[0167] The processor 300 can initialize the custom file system 240 in the process of initializing the sandbox environment by using the policy management module 220.

[0168] Illustratively, FIG. 7 is another flowchart of the process of initializing the sandbox environment. As shown in FIG. 7, the processor 300 can complete the initialization of the sandbox environment by using the policy management module 220 through steps S710-S730.

[0169] S710: The processor 300 determines whether the intermediate mounting point 230 of the sandbox environment 100 is established by using the policy management module 220.

[0170] If the intermediate mounting point 230 of the sandbox environment 100 is not established, step S720 is performed.

[0171] If the intermediate mounting point 230 of the sandbox environment 100 is established, step S730 is performed.

[0172] S720: The processor 300 establishes the root directory of the mounting point corresponding to multiple applications by using the policy management module 220. The policy management module 220 can set the sharing propagation attribute of the mounting point according to the user demand, and mount the root directory of the mounting point corresponding to multiple applications to the shared file directory of each application.

[0173] S730: The processor 300 determines, by using the policy management module 220, whether the corresponding folder mount point 231 for the application Al 11 and the corresponding folder mount point 233 for the application B 121 are established in the intermediate mount point 230.

[0174] If the corresponding mount points for the application Al 11 and the application B 121 are established, step S740 is performed to initialize the custom file system 240.

[0175] If the corresponding mount points for the application Al 11 and the application B 121 are not established, the processor 300 continues the initialization of the sandbox environment 100. When the sandbox environment 100 is running, the corresponding mount points for the application Al 11 and the application B 121 are established, and the initialization of the file system 241 and the file system 242 is performed.

[0176] S740: The processor 300 initializes the custom file system by using the policy management module 220, and mounts the custom file system to the corresponding mount point.

[0177] As described above, the access control policy can further include configuration parameters of each file system in the custom file system 240. The configuration parameters include a file system identifier, a mount location, an offset prefix, an access permission, and a file path.

[0178] The policy management module 220 can initialize and configure the file system 241 and the file system 242 according to the configuration parameters described above.

[0179] Illustratively, the processor 300 can send the mount location in the configuration parameters to the file system 241 according to the file system identifier "SandboxFS_APP1" by using the policy management module 220. The file system 241 can be mounted to the location specified by the user 20 according to the mount location. According to the user's requirements, the mount location in the configuration parameters can be set to the folder mount point 231 corresponding to the application Al 11, or can be set to the shared file directory 112 of the application Al 11.

[0180] It can be understood that the processor 300 can send the mount location of the file system 242 according to the file system identifier "SandboxFS_APP2" by using the policy management module 220. The file system 242 can be mounted to the location specified by the user 20 according to the mount location.

[0181] As mentioned above, the processor 300 can initialize the custom file system 240 at the runtime of the sandbox environment 100 by using the policy management module 220. The file system 241 and the file system 242 can read the policy configuration file according to the file path in the configuration parameter, obtain the configuration parameters of the mounting position, the offset prefix and the access permission of the application A 111, and complete the initialization of themselves according to the configuration parameters of the mounting position, the offset prefix and the access permission.

[0182] Step S420: obtaining the access control policy, further comprising the following contents.

[0183] Firstly, the processor 300 can receive the access control policy set by the user 20 for each application through the file selector 210 by using the policy management module 220, and generate the policy configuration file of the computing device 10 according to the above-mentioned access control policy.

[0184] Then, the file system 241 and the file system 242 in the custom file system 240 can read the above-mentioned policy configuration file, and respectively obtain the access control policy of the application A 111 and the application B 121 corresponding to each file system.

[0185] As mentioned above, the above-mentioned access control policy is used to specify the files that can be accessed by a certain application in the local file system 210. The above-mentioned files include at least one folder selected by the user 20 through the file selector, and one or more single files. For example, referring to FIG. 2, the folders that can be accessed by the application A 111 selected by the user 20 through the file selector include the “Download”, “Images” and “Desktop” folders, and the single files that can be accessed by the application A 111 include Test.pdf.

[0186] For example, FIG. 8 is a schematic diagram of the file paths of the files that can be accessed by each application in another embodiment of the present application. As shown in FIG. 8, the folders that can be accessed by the application A 111 specified by the user 20 are “ / xxx / DOCS”, which includes the subfolder “Download”, the subfolder “Images”, the subfolder “Desktop”, and the single file “Test.pdf”.

[0187] Among them, the file path of the folder “Download” is “ / xxx / DOCS / Download”, the file path of the folder “Images” is “ / xxx / DOCS / Images”, the file path of the folder “Desktop” is “ / xxx / DOCS / Desktop”, and the file path of the single file “Test.pdf” is “ / xxx / DOCS / test.pdf”.

[0188] Step S430: mounting the first file path to the intermediate mounting point, further comprising the following contents.

[0189] The processor 300 can utilize the custom file system 240 corresponding to each application to obtain the file paths of the files accessible by each application from the local file system 210 according to the access control policy, map the file paths to the first file paths of each application, and utilize the policy management module 220 to mount the first file paths to the folder mount points corresponding to each application.

[0190] Taking the file system 241 as an example, first, the processor 300 can utilize the file system 241 to obtain the file path “ / xxx / DOCS” of the folder accessible by the application A 111 from the local file system 210, and the file path “ / xxx / DOCS / Download” of the subfolder “Download”, the file path “ / xxx / DOCS / Images” of the subfolder “Images”, the file path “ / xxx / DOCS / Desktop” of the subfolder “Desktop”, and the file path “ / xxx / DOCS / test.pdf” of the single file “Test.pdf” under the folder.

[0191] Then, the processor 300 utilizes the file system 241 to map the file paths to the first file paths. In some possible implementation, the file system 241 can map the file paths to the first paths in a way of path offset.

[0192] Referring to FIG. 8, illustratively, the user specifies the offset prefix of the file system 241 as “ / xxx / DOCS / ”, and the file system 241 can remove the offset field to offset the file paths of the local files to the paths in the file system 241 (the first file paths).

[0193] Illustratively, the folder “ / xxx / DOCS / ” is offset to “ / ” in the file system 241. The file path “ / xxx / DOCS / Download” of the subfolder “Download” is offset to “ / Download” in the file system 241. The file path “ / xxx / DOCS / Images” of the subfolder “Images” is offset to “ / Images” in the file system 241. The file path “ / xxx / DOCS / Desktop” of the subfolder “Desktop” is offset to “ / Desktop” in the file system 241. And the file path “ / xxx / DOCS / test.pdf” of the single file “Test.pdf” is offset to “ / test.pdf” in the file system 241.

[0194] Finally, the processor 300 can use the policy management module 220 to mount the file path of the offset folder " / ", the file path of the subfolder "Download", the file path of the subfolder "Images", the file path of the subfolder "Desktop", and the file path of the single file "Test.pdf" to the folder mount point 231 corresponding to the application A 111.

[0195] Step S440: mounting the second file path to the shared file directory, further comprising the following.

[0196] The processor 300 can use the policy management module 220 to map the first file path of each application to the second file path, and mount the second file path to the shared file directory of the first application, so that the first application accesses the folder stored on the local file system 210 through the shared file directory.

[0197] Referring to FIG. 8, schematically, first, the processor 300 uses the policy management module 220 to map the folder " / " in the file system 241 to " / ShareFiles", map the file path of "Download" to " / ShareFiles / Download", map the file path of "Images" to " / ShareFiles / Images", map the file path of "Desktop" to " / ShareFiles / Desktop", and map the file path of the single file "Test.pdf" to " / ShareFiles / test.pdf".

[0198] Then, the processor 300 uses the policy management module 21 to mount the mapped root directory " / ShareFiles", the file path of "Download", the file path of "Images", the file path of "Desktop", and the file path of the single file "Test.pdf" to the shared file directory 112 of the application A 111.

[0199] Finally, when the application A111 is started, the file path " / Download" of the "Download" folder in the file system 241, the file path " / Images" of the "Images" folder in the file system 241, the file path " / ShareFiles / Desktop" of the "Desktop" folder in the file system 241, and the file path " / ShareFiles / test.pdf" of the single file "Test.pdf" in the file system 241 can be viewed through the root directory " / ShareFiles" in the shared file directory 112, and an access request for the relevant files in the local file system 210 is initiated.

[0200] As mentioned above, the policy configuration file further includes a callback function. When the application A111 initiates an access request, the file system 241 reads the callback function in the policy configuration file, obtains the access permission of the application A111 through the callback function, and controls the initiated access request of the application A111 according to the access permission.

[0201] Illustratively, taking the access request of the "Download" folder initiated by the application A111 through the shared file directory 112 as an example. The above-mentioned access request includes the file path " / Download" of the "Download" folder in the file system 241

[0202] Firstly, the file system 241 will splice the file path " / Download" of the "Download" folder in the file system 241 according to the aforementioned offset prefix " / xxx / DOCS / ", and obtain the path " / xxx / DOCS / Download" of the "Download" folder in the local file system 210.

[0203] Then, the file system 241 will call the callback function in the policy configuration file to obtain the access permission of the path " / xxx / DOCS / Download" recorded in the policy configuration file.

[0204] If the application A111 has the access permission of the path " / xxx / DOCS / Download", the file system 241 allows the application A111 to access the files under the path " / xxx / DOCS / Download" in the local file system 210, and returns the result of allowing access to the application A111.

[0205] If the application A111 does not have the access permission of the path " / xxx / DOCS / Download", the file system 241 rejects the access request of the application A111, and returns the result of access failure due to insufficient permission.

[0206] The application sets a policy management module in the host environment, receives an access control policy of a first application sandbox input by a user through the policy management module, and performs access control on a file accessible by the first application according to the access control policy, maps a file path of the file accessible by the first application in a local file system 210 of the host environment to a first file path, and mounts the first file path to an intermediate mounting point; maps the first file path to a second file path, and mounts the second file path to a shared file directory of the application sandbox, so that the application sandbox accesses a shared file in the local file system through the shared file directory. The method realizes file isolation of shared files among multiple application sandboxes and dynamic access control of the shared files by establishing an independent intermediate mounting point for each application sandbox, and improves the security and real-time performance of access control of the shared files.

[0207] In a second aspect, the application provides an access control method based on the computing device 10 shown in FIG. 3.

[0208] For example, FIG. 9 is a schematic diagram of a third scenario of access control of shared files provided by an embodiment of the application. As shown in FIG. 9, the intermediate mounting point 230 is not set in the computing device 10, and the custom file system 240 can be mounted to the shared file directory of each application according to the mounting position in the configuration parameter.

[0209] For example, the file system 241 is mounted to the shared file directory 112 of the application A 111, and the file system 242 is mounted to the shared file directory 122 of the application B 121.

[0210] Based on the third scenario of access control of shared files, the application discloses an access control method, which is shown in FIG. 10 and takes the application A 111 as an example. The access control of the shared files of the application A 111 can be realized through steps S10 to S90. It can be understood that the method is executed by the processor 300 of the computing device 10 shown in FIG. 3 when the access control of the shared files is performed.

[0211] S10: The processor 300 can use the policy control module 220 to start the application A in the sandbox environment and configure the related dependencies of the application A. In some possible embodiments, the related dependencies of the application A include configuration files and / or dependent library files required by the application A.

[0212] S20: The processor 300 uses the policy control module 220 to obtain the access control policy input by the user, triggers the initialization of the file system 241 in the starting process of the sandbox environment, and sends the configuration parameters in the access control policy to the file system 241. The configuration parameters include the mounting position, the offset prefix, and the access permission.

[0213] S30: The file system 241 completes the initialization by mounting itself to the shared file directory 112 of the application A according to the mounting location of the configuration parameters. In some possible implementation, the file system 241 can also complete the initialization by obtaining the access control policy in the policy configuration file according to the file path obtaining strategy in the configuration parameters. The policy configuration file is generated by the policy control module 220 based on the access control policy input by the user.

[0214] S40: In the running phase of the sandbox environment, the file path of at least one folder accessible by the first application can be obtained according to the access control policy, the file path is mapped to a file path (third file path) in the custom file system, and the file path in the shared file directory 112 is determined based on the third file path.

[0215] For example, the folder accessible by the application A 111 selected by the user 20 through the file selector includes the "Download" folder and the "Desktop" folder, and the single file accessible by the application A 111 includes Test.pdf. The file system 241 can add the offset prefix " / xxx / DOCS / " specified by the user 20 to the file path in a path offset manner to achieve address mapping of the file path.

[0216] In step 30, the file system 241 has mounted itself to the shared file directory 112. When the application A views the file path in the file system 241 through the shared file directory 112, the file system 241 can determine the file path in the shared file directory 112 based on the third file path in a path offset manner to enable the application A to view.

[0217] S50: The application A 111 initiates an access request for the shared file directory 112. For example, the access request of the application A 111 is used to request access to the file path of the "Download" folder, and the file path of the "Download" folder is " / Download" shown in FIG. 8.

[0218] S70: The file system 241 reads the callback function in the configuration file and obtains the access permission of the "Download" folder related to the application A 111 through the access control function "access" in response to the access request.

[0219] S80: If the application A 111 has the access permission of the "Download" folder.

[0220] First, the file system 241 allows the access request of the application A 111, and adds the offset prefix " / xxx / DOCS / " to the file path of the "Download" folder to obtain the file path " / xxx / DOCS / Download" before address offset.

[0221] Then, the file system 241 opens the file path " / xxx / DOCS / Download" before the address offset by using the callback function ".open".

[0222] Finally, the file system 241 reads the file by using the callback function ".readdir" and returns the related file and the file path of the file to the application A 111.

[0223] S90: If the application A 111 has no access right to the "download" folder, the file system 241 rejects the access request of the application A 111 and returns the result of the access failure caused by insufficient right.

[0224] In the present application, by establishing multiple custom file systems corresponding to the applications in the host environment and mounting the custom file systems into the sandbox, the custom file system agent realizes the dynamic access of the applications in the sandbox to the shared resources outside the sandbox and the dynamic access control of the shared files of each application. Fine-grained access control is realized.

[0225] Meanwhile, the method does not limit the type of the local file system 210 in the host environment and does not need to adapt to the access mechanism of multiple applications in the sandbox environment, which improves the compatibility of the access control method.

[0226] It can be understood that the size of the serial number of each step in the above embodiment does not mean the order of execution, the execution order of each process should be determined according to its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiments of the present application. In addition, in some possible implementation manners, each step in the above embodiment can be selectively executed, partially executed or fully executed according to the actual situation, which is not limited here.

[0227] In addition to the method, apparatus, and electronic device described above, the embodiments of the present disclosure can further provide a computer program product comprising computer program instructions, which, when executed by a processor, cause the processor to perform the steps of the disclosed access control method according to various embodiments of the present disclosure described in the above “METHOD” section of the present specification. The computer program product can be written in any combination of one or more programming languages, including an object-oriented programming language such as Java, C++, Rust, and the like, and conventional procedural programming languages, such as the “C” programming language, or the like. The computer program code can be in the form of source code, object code, executable code, or some intermediate form, among others. The computer program code can be executed completely on the user's computing device, partially on the user's computing device and partially on a remote computing device, or entirely on the remote computing device or server.

[0228] In addition, the embodiments of the present disclosure can further provide a computer-readable storage medium having stored thereon computer program instructions, which, when executed by a processor, cause the processor to perform the steps of the disclosed access control method according to various embodiments of the present disclosure described in the above “METHOD” section of the present specification. The computer-readable storage medium can employ any combination of one or more non-transitory media. The non-transitory media can be a non-transitory signal or a non-transitory storage medium. The non-transitory storage medium can include, for example, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the non-transitory storage medium include an electrical connection having one or more wires, a portable disc, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. It should be noted that the computer-readable medium contained herein can be appropriately increased or decreased according to requirements of legislation and patent practice in a jurisdiction, for example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electrical carrier signals and telecommunication signals.

[0229] In the above-described embodiments, the description of each embodiment has its own focus, and the parts not described or recorded in detail in a certain embodiment can be referred to the relevant description of other embodiments.

[0230] It should be understood that the size of the serial number of each step in the above embodiment does not mean the order of execution, and the execution order of each process should be determined according to its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the application.

[0231] The above describes the basic principles of the present application in combination with specific embodiments. However, it should be pointed out that the advantages, advantages, effects and the like mentioned in the present application are only examples and not limitations, and these advantages, advantages, effects and the like cannot be considered as the necessary possession of each embodiment of the present disclosure. In addition, the specific details of the above disclosure are only for the purpose of example and for the purpose of understanding, and are not limited to the above specific details, and the above details do not limit the present disclosure to be necessarily implemented with the above specific details.

[0232] The block diagrams of the devices, apparatuses, equipment, systems involved in the present disclosure are only illustrative examples and are not intended to require or imply the connection, arrangement, configuration shown in the block diagram. As those skilled in the art will recognize, these devices, apparatuses, equipment, systems can be connected, arranged, configured in any manner. Words such as "include", "contain", "have" and the like are open-ended words, which mean "including but not limited to", and can be used interchangeably. The words "or" and "and" used herein mean the word "and / or", and can be used interchangeably unless the context clearly indicates otherwise. The word "such as" used herein means the phrase "such as but not limited to", and can be used interchangeably.

[0233] It should also be noted that in the devices, equipment and methods of the present disclosure, each component or each step can be decomposed and / or recombined. These decompositions and / or recombination should be considered as equivalent solutions of the present disclosure.

[0234] The above description has been given for the purpose of example and description. Furthermore, this description is not intended to limit the embodiments of the present disclosure to the forms disclosed herein. Although a number of example aspects and embodiments have been discussed above, those skilled in the art will recognize certain modifications, alterations, changes, additions and sub-combinations thereof.

[0235] It can be understood that the various numerical numbers involved in the embodiments of the present application are only for the convenience of differentiation in the description, and are not used to limit the scope of the embodiments of the present application. The above specific embodiments further illustrate the purpose, technical solutions and advantages of the present application, and it should be understood that the above description is only for the specific embodiments of the present application, and is not used to limit the protection scope of the present application. Any modification, equivalent replacement, improvement and the like made within the spirit and principle of the present application should be included in the protection scope of the present application.

[0236] The above detailed description of the specific embodiments of the present application has been given to understand the purpose, technical solutions and beneficial effects of the present application. It should be understood that the above description is only a specific embodiment of the present application and is not used to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. An access control method characterized by, The method is applied to a computing device including a host environment and a sandbox environment, the sandbox environment including a first application, and the method includes: mounting an intermediate mount point to a shared file directory corresponding to the first application, the intermediate mount point being a mount point with a shared propagation attribute in the host environment; obtaining an access control policy, the access control policy being used to specify files of the host environment that can be accessed by the first application; the files including folders and single files; mounting a first file path to the intermediate mount point, the first file path being a file path mapped from a file path of the file; mounting a second file path to the shared file directory, the second file path being a file path mapped from the first file path.

2. The method of claim 1, wherein, The method further includes, after mounting the first file path to the intermediate mount point, configuring an access permission of the first file path according to the access control policy.

3. The method of claim 1, wherein, The file is a single file, the intermediate mount point is a single file mount point corresponding to the first application, and the shared file directory includes a single file directory corresponding to the single file mount point, and the method includes: mounting the first file path to the single file mount point, the first file path being a file path mapped from the single file; mounting the second file path to the single file directory.

4. The method of claim 1, wherein, The file is a folder, the intermediate mount point includes a folder mount point corresponding to the first application, and the shared file directory includes a folder directory corresponding to the folder mount point, and the method includes: mounting the first file path to the folder mount point, the first file path being a file path mapped from the folder; mounting the second file path to the folder directory.

5. The method according to any one of claims 1 to 4, characterized in that, The method further includes: deleting the first file path according to the access control policy.

6. The method according to any one of claims 1 to 5, characterized in that, The host environment further includes a first file system corresponding to the first application, and the obtaining of the access control policy includes: The first file system obtains an access control policy of the first application, obtains a file path of the file according to the access control policy, the file path including a subfolder path and a single file path, and the first file system is configured to mount the first file path to the intermediate mount point.

7. The method of claim 6, wherein, The method further includes: The first file system receives an access request of the first application; the access request is used to request access to the file path; The first file system determines an access permission of the first application according to the access control policy of the first application; If the first application has the access permission, the first file system allows the access request of the first application; If the first application does not have the access permission, the first file system rejects the access request of the first application.

8. An access control method characterized by, The method is applied to a computing device including a host environment and a sandbox environment, the sandbox environment including a first application, and the host environment including a first file system, and the method is applied to the first file system and includes: obtaining an access control policy of a first application, the access control policy being used to determine a file path of a file accessible by the first application; mounting a first file system to a shared file directory of the first application according to the access control policy, the first file system being a file system corresponding to the first application; mapping the file path to a third file path, and determining a file path in the shared file directory based on the third file path.

9. The method of claim 8, wherein, The method further comprises: receiving an access request of the first application, the access request being used to request access to the file path; determining an access right of the first application according to the access control policy of the first application; if the first application has the access right, the first file system allows the access request of the first application; if the first application does not have the access right, the first file system rejects the access request of the first application.

10. An access control device, characterized in that The apparatus comprises a policy management module. The policy management module is configured to mount an intermediate mount point to a shared file directory corresponding to a first application, obtain an access control policy, the access control policy being used to specify a file of a host environment accessible by the first application, the file comprising a folder and a single file, mount a first file path to the intermediate mount point, the intermediate mount point being a mount point corresponding to the first application and having a propagation attribute, the first file path being a file path obtained by mapping the file, and mount a second file path to the shared file directory, the second file path being a file path obtained by mapping the first file path.

11. The apparatus of claim 10, wherein, The apparatus further comprises a first file system. The first file system is configured to obtain an access control policy of a first application, obtain a file path of the file according to the access control policy, map the file path to a first file path, and mount the first file path to the intermediate mount point.

12. A computer program product comprising computer programs / instructions, which, when executed by a processor, cause the processor to implement the method of any one of claims 1-7 or 8-9.

13. A computing device, comprising: The computing device comprises a processor and a memory, the memory storing program instructions, and the processor being configured to execute the program instructions to cause the processor to perform the method of any one of claims 1-7 or 8-9.

Images