WO2017220014A1

WO2017220014A1 - System permission management method and apparatus, and intelligent terminal

Info

Publication number: WO2017220014A1
Application number: PCT/CN2017/089743
Authority: WO
Inventors: 刘华
Original assignee: 中兴通讯股份有限公司
Priority date: 2016-06-24
Filing date: 2017-06-23
Publication date: 2017-12-28
Also published as: CN107545170A

Abstract

A system permission management method and apparatus, and an intelligent terminal. A valid signature list is preset, the preset valid signature list comprising signature information of at least one operator in addition to system signature information of an intelligent system. After an application to be installed is obtained on the intelligent terminal (S101), signature information of the application is directly matched with valid signature information in the preset valid signature list (S103). If the signature information of the application is successfully matched with any valid signature information in the valid signature list (S104), the application is allowed to be installed on the intelligent terminal and is set to possess a system permission (S105). The intelligent system can support two or more system signatures, the operator does not need to send the application to a terminal vender for helping setting the signature, and the terminal vender does not need to send signature information of the terminal vender to the operator. Support and management of the system permission of the operator application can be simply and conveniently implemented, and the security can be improved.

Description

System authority management method, device and intelligent terminal

Technical field

The present invention relates to the field of intelligent terminals, and in particular, to a system rights management method, device, and intelligent terminal.

Background technique

At present, applications in various intelligent terminals (such as mobile phones, set-top boxes, IPADs, etc.) on the market need to obtain terminal system authority, and all need to pass system signature authentication. Currently, various intelligent terminals only support one type of system signature. The signature is the default signature information set by the terminal manufacturer. Therefore, in the current smart terminal, the built-in application of the terminal basically has system authority, and the signature of the third-party application provided by each operator is generally the operator's own signature information, which leads to The application provided by the operator cannot obtain the terminal system authority normally. For example, if the user is preparing to install a non-system-signed apk in the Android smart terminal, the apk cannot obtain the system permission. As can be seen from the above description, the current smart device is a device that only supports a single signature. If the user installs an apk that is inconsistent with the system signature, the use of the apk is limited, which actually limits the smart device. Universal support for a variety of applications also reduces device compatibility, which will certainly seriously affect the user experience, especially for carrier customers with special needs. At present, in order to solve the above problems, each operator wants to make its apk have system permissions, generally there are two ways:

method one:

1. Add the android:sharedUserId="android.uid.system" attribute to the manifest node in the AndroidManifest.xml of the application.

2. Modify the Android.mk file and add the line LOCAL_CERTIFICATE:=platform.

3. Use the mm command to compile

Method Two:

1. Same as above, add the attribute android:sharedUserId="android.uid.system".

2. Use eclipse to compile the apk file, but this apk file is not available.

3. Open the apk file with the compression software and delete the CERT.SF and CERT.RSA files in the META-INF directory.

4. Re-sign the apk file with the platform key of the target system. This step is more troublesome.

A, first find the key file, in the location of my Android source directory

Is "build/target/product/security/", the following two files, platform.pk8 and platform.x509.pem.

B, then use the Signapk tool provided by Android to sign, the source code of signapk is under "build/tools/signapk", the usage is "signapk platform.x509.pem platform.pk8input.apk output.apk" generated apk run In the system process, and has system privileges.

The above two methods are complicated to use and difficult to operate. The first method requires the operator to send the apk to the terminal manufacturer for signature, but the operator application mall has a lot of apks and often needs to be upgraded, which is difficult to operate. In the second method, the manufacturer needs to provide the signature file to the operator, so that the operation will cause the leakage of the signature information of the manufacturer to a certain extent, and there is a big hidden danger to the information and technical security of the manufacturer. It can be seen that the existing methods all try to set the signature of the application to the unique system signature information specified by the intelligent terminal manufacturer to obtain the system authority. According to the above analysis, the method has the problems of high operation difficulty and potential security risks.

Summary of the invention

The system rights management method, device and intelligent terminal provided by the embodiments of the present invention mainly solve the technical problem that the existing signature of the application is set as the unique system signature information set by the smart terminal manufacturer as much as possible to obtain the system authority, and the operation exists. Difficulties and security risks.

To solve the above technical problem, an embodiment of the present invention provides a system rights management method, including:

After obtaining the application to be installed, the smart terminal acquires signature information of the application;

And matching the signature information with the legal signature information in the preset legal signature list, where the preset legal signature list includes system signature information of the smart terminal system and at least one operator signature information;

When the matching of the signature information and the legal signature information is successful, the application is allowed to be installed on the smart terminal, and the application is set to have system authority.

An embodiment of the present invention further provides a system rights management apparatus, including:

The signature information obtaining module is configured to acquire signature information of the application after the smart terminal acquires the application to be installed;

The authentication module is configured to match the signature information with the legal signature information in the preset legal signature list, where the preset legal signature list includes system signature information of the smart terminal system and at least one operator signature information;

The rights management module is configured to allow the application to be installed on the smart terminal when the matching of the signature information and the legal signature information is successful, and set the application to have system rights.

The embodiment of the invention further provides an intelligent terminal, comprising the system rights management device as described above.

The embodiment of the invention further provides a computer storage medium, wherein the computer storage medium stores computer executable instructions, and the computer executable instructions are used to execute the foregoing system authority management method.

The beneficial effects of the embodiments of the present invention are:

According to the system rights management method, device, intelligent terminal and storage medium provided by the embodiment of the present invention, the legal signature list may be preset. The preset legal signature list may include at least the system signature information of the intelligent terminal system. An operator signature information, that is, the signature information of the corresponding operator can be added to the legal signature list of the smart terminal in advance. In this way, after the smart terminal obtains the application to be installed, the signature information and the preset of the application can be directly legal. The legal signature information in the signature list is matched. If the legal signature information in the legal signature list is successfully matched, the application is allowed to be installed on the smart terminal, and the application is set to have system authority. In the above manner, the smart terminal no longer supports only one system signature, and it can support more than two system signatures; the operator does not need to send the application to the terminal manufacturer to help set the signature, and the terminal manufacturer does not need to sign his own. The information is sent to the operator, which can support and manage the rights of the operator's application system more easily and conveniently, and improve security.

DRAWINGS

1 is a schematic flowchart of a system authority management method in an application installation process according to Embodiment 1 of the present invention;

2 is a schematic flowchart of a system authority management method in an application upgrade process according to Embodiment 1 of the present invention;

3 is a schematic flowchart of a system authority management method in an application running process according to Embodiment 1 of the present invention;

4 is a schematic structural diagram of an intelligent terminal according to Embodiment 2 of the present invention;

5 is a schematic structural diagram 1 of a system authority management apparatus according to Embodiment 2 of the present invention;

6 is a second schematic structural diagram of a system rights management apparatus according to Embodiment 2 of the present invention;

FIG. 7 is a schematic structural diagram 3 of a system authority management apparatus according to Embodiment 2 of the present invention.

detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, but not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

Embodiment 1:

The system rights management method provided by this embodiment is applicable to various types of intelligent terminals of various systems, for example, for Android, iOS, windows phone, Symbian, BlackBerry OS, windows mobile, etc., and is also applicable to mobile phones, IPAD, various Mobile terminals such as readers are also suitable for non-mobile type smart terminals.

In this embodiment, for the management of the authority of the intelligent terminal system, a legal signature list may be set first, and the legal signature information is pre-stored in the legal signature list, which naturally includes the system signature information of the intelligent terminal system, that is, the intelligence. The default signature information of the terminal manufacturer. In addition, the legal signature information in this embodiment further includes at least one operator signature information. Specifically, each operator can negotiate with the corresponding smart terminal manufacturer, and let the terminal manufacturer store the operator's operator signature information as legal information in the legal signature list. Therefore, the number of the operator signature information included in the embodiment and the signature information of the specific carrier may be flexibly set according to the actual application scenario. Through the above settings, when the intelligent terminal performs system authority management through signature authentication, it no longer manages only according to the system signature information of the terminal, but also manages each application according to the legal signature information in the signature legal list, when the application signature information When matching with any of the operator signature information, the system authority can also be issued to the application. In this way, the operator is not required to frequently send the application to the terminal manufacturer for signature, saving manpower, material resources and cost; at the same time, the operator does not need to send its own signature information to the operator to avoid security risks.

In addition, according to the above description, the legal signature information in the legal signature list in this embodiment can support real-time update. For example, when a new operator joins or the signature information of the previously joined operator changes, it can be directly or The terminal manufacturer sends corresponding update information to the smart terminal, and correspondingly updates the legal signature information in the legal signature list according to the update message.

Based on the above settings, as shown in FIG. 1, the system rights management method in this embodiment includes:

S101: The smart terminal acquires an application to be installed.

In this step, the smart terminal can be obtained from the operator application mall or through other sources. Install the application's installation package.

S102: Acquire signature information of the application.

Specifically, the signature information may be obtained from the installation package of the application. The signature information at this time is generally the signature information of the operator, but may also be the system signature information of the terminal system, for example, the system that the operator has acquired the terminal system before. When signing information, it may be system signature information.

S103: Match the obtained signature information with the legal signature information in the preset legal signature list.

S104: Determine whether the matching is successful, if yes, go to S105; otherwise, go to S106.

In the determining step, if the acquired signature information matches any of the legal signature information in the legal signature list, the matching is successful.

S105: Allow the above-mentioned application to be installed to be installed on the smart terminal, and set the application to have system authority, that is, the application can apply for system authority after the installation.

S106: Allow the above-mentioned application to be installed to be installed on the smart terminal, and set the application to have no system authority, that is, the application cannot be applied to the system after the application is installed. In this way, the intelligent terminal can support multiple signatures, and the system can be safely operated to the utmost extent.

In this embodiment, not all applications need to apply for system rights in the application of the terminal. Therefore, for an application that needs to apply for system rights, the installation package generally has identification information for applying for system rights. Therefore, in this embodiment, for the application to be installed, before the signature information is obtained for matching, the identifier of the application system permission may be determined in the installation package of the application, and if yes, the process proceeds to S102. The signature information is followed by a subsequent judgment; otherwise, the application is directly transferred to the above S106, but after installation, it cannot apply for system authority. The following uses the application apk of the Android system as an example.

For the Android system's apk software installation package, you can check whether it has the above identification information in its AndroidManifest.xml. If it does not, it does not apply for system permissions. This type of apk can be directly installed to the smart terminal without verifying the signature information. in.

In the above S103, when the obtained signature information is matched with the legal signature information in the preset legal signature list, the following matching rules may be matched:

The obtained signature information is first matched with the system signature information in the legal signature list. If the matching is successful, the signature authentication is successful. Otherwise, the signature information is matched with the remaining operator signature information. Legal signature list When the operator signature information includes multiple items, you can match them one by one at this time. You can also set the priority of each operator's signature information in advance. For example, the more operators that publish applications, the higher the priority, and then Match the priority to match; or directly match randomly.

In this embodiment, when there is an application to be upgraded in the smart terminal (for example, one or more applications need to be upgraded, and the upgrade can be completed by means of self-upgrade), it is necessary to first determine whether the signature information of the application before and after the upgrade is consistent. If there is an inconsistency, there may be a possibility of being tampered with. For the current situation, the existing upgrade is forbidden. However, there will be a signature information 1 used by the operator when the application is started to be released, but the signature information 2 is used instead when the application is upgraded. In this case, prohibiting the upgrade of the application may cause the normal upgrade to fail. In this case, the signature information 2 may be added to the legal signature list as the legal signature information through the above update process; and then the signature information 2 and the legal signature list are determined by the above-mentioned determination that the signature information 2 is inconsistent with the signature information 1. The legal signature information in the matching is matched, and the matching can be matched according to the above matching rule. If the matching is successful, the application to be upgraded is allowed to be upgraded, and the system authority is set; if the matching fails, it is determined that the application may be maliciously tampered. This upgrade is not allowed. The specific process is shown in Figure 2, including:

S201: An application to be upgraded on the smart terminal needs to be upgraded.

At this time, only the terminal can obtain the corresponding upgrade package through various channels.

S202: Obtain the signature information 2 after the upgrade of the application to be upgraded and the current signature information 1 before the upgrade.

Specifically, the upgraded signature information can be obtained from the upgrade package.

S203: determining whether the two signature information is consistent, if yes, go to S204; otherwise, go to S205;

S204: Allow the application to be upgraded to be upgraded.

S205: Match the signature information 2 with the legal signature information in the preset legal signature list. The specific matching rule can also use the matching rule of the above example.

S206: Determine whether the matching is successful, if yes, go to S207; otherwise, go to S208.

S207: Allow the application to be upgraded to be upgraded and set it to have system authority.

S208: The application to be upgraded is not allowed to be upgraded.

Through the above further judging process, it is possible to avoid the problem that the application of the operator cannot be upgraded normally when the signature information of the operator changes. It can further improve the rationality and accuracy of system authority management.

In this embodiment, each application that has been installed on the smart terminal is in the operation process, in particular, an application having the system permission to apply for the system is in operation, and one of the actions actually needs to use the system permission (for example, downloading and installing or uninstalling other applications) In this embodiment, in order to further improve the security of management, further authentication of these applications may be performed. At this time, the system permission application request sent by the application of the smart terminal during the running process is received, and then the signature information of the application that initiates the system permission application request is obtained, and the legal signature information in the legal signature list is matched, and the matching is allowed to be applied. Execute system permissions, that is, allow them to continue to perform the above actions; otherwise, the application is prohibited from executing system permissions, that is, it is prohibited from continuing to perform the above actions, and a corresponding error prompt may be popped up. The specific process is shown in Figure 3, including:

S301: The application in a certain running process on the smart terminal sends a system permission application request.

S302: Acquire signature information of an application that initiates a system permission application request.

S303: Match the obtained signature information with the legal signature information in the preset legal signature list. The specific matching rule can also use the matching rule of the above example.

S304: Determine whether the matching is successful, if yes, go to S305; otherwise, go to S306.

S305: The application that allows the system permission application request to be initiated continues to perform the above actions.

S306: The application that initiates the system permission request request is not allowed to perform the above actions.

In this embodiment, the operator's signature information is set as a legal sign in advance in the smart terminal. The name information is used for subsequent signature authentication, which enables the intelligent terminal to support multi-signature authentication under the premise of minimal modification. Compared with the existing intelligent terminal, only one signature authentication scheme is supported, which is lower in cost, more flexible in control, and more secure. .

Embodiment 2:

The embodiment provides an intelligent terminal. The system of the smart terminal may be any one of a system such as Android, iOS, windows phone, Symbian, BlackBerry OS, and Windows mobile, and the terminal may be a mobile phone, an IPAD, or the like. A mobile terminal of a mobile type such as a reader may also be a non-mobile type smart terminal. Referring to FIG. 4, the intelligent terminal includes a system authority management device 10. As shown in FIG. 5, the system rights management apparatus 10 includes a list maintenance module 11, a signature information acquisition module 12, an authentication module 13, and an authority management module 14.

The list maintenance module 11 is configured to maintain a pre-set legal signature list on the smart terminal, where the legal signature list pre-stores legal signature information that allows the use of the system authority, which naturally includes the system signature information of the intelligent terminal system, that is, the smart terminal manufacturer. Pre-default signature information. In addition, the legal signature information in this embodiment further includes at least one operator signature information. Specifically, each operator can negotiate with the corresponding smart terminal manufacturer, and let the terminal manufacturer store the operator's operator signature information as legal information in the legal signature list. Therefore, the number of the operator signature information included in the embodiment and the signature information of the specific carrier may be flexibly set according to the actual application scenario. Through the above settings, when the intelligent terminal performs system authority management through signature authentication, it no longer manages only according to the system signature information of the terminal, but also manages each application according to the legal signature information in the signature legal list, when the application signature information When matching with any of the operator signature information, the system authority can also be issued to the application. In this way, the operator is not required to frequently send the application to the terminal manufacturer for signature, saving manpower, material resources and cost; at the same time, the operator does not need to send its own signature information to the operator to avoid security risks.

In addition, the legal signature information in the legal signature list in this embodiment can support real-time update, for example, when a new operator joins or the signature information of the previously joined operator changes. The corresponding update information may be sent to the smart terminal directly or by the terminal manufacturer, and the list maintenance module 11 may perform corresponding update on the legal signature information in the legal signature list according to the update message.

The signature information obtaining module 12 is configured to obtain the signature information of the application after the smart terminal acquires the application to be installed; specifically, the signature information may be obtained from the installation package of the application.

The authentication module 13 is configured to match the signature information acquired by the signature information acquiring module 12 with the legal signature information in the legal signature list. The authentication module 13 can be matched by the following matching rules:

The rights management module 14 is configured to allow the application to be installed on the smart terminal when the matching of the signature information and the legal signature information is successful, and set the application to have the system authority; otherwise, the application to be installed is Install on the smart terminal and set the application to have no system permissions, that is, the application cannot be applied to the system after installation. In this way, the intelligent terminal can support multiple signatures, and the system can be safely operated to the utmost extent.

In this embodiment, not all applications need to apply for system rights in the application of the terminal. Therefore, for an application that needs to apply for system rights, the installation package generally has identification information for applying for system rights. Therefore, as shown in FIG. 6, in the embodiment, the system rights management apparatus 10 further includes an application type determining module 15 configured to determine whether there is identification information of the application system authority in the installation package of the application to be installed, if yes, notify The signature information acquisition module 12 acquires its signature information and makes subsequent judgments.

Referring to FIG. 7, the system rights management apparatus in this embodiment further includes an upgrade processing module 16, in an application upgrade process:

The signature information obtaining module 12 is further configured to: when the smart terminal has an application to be upgraded, obtain the signature information of the upgraded application and the current signature information before the upgrade of the application to be upgraded;

The upgrade processing module 16 is configured to determine whether the signature information of the upgraded application and the current signature information before the upgrade of the application to be upgraded are consistent;

The authentication module 13 is further configured to match the upgraded signature information with the legal signature information in the legal signature list when the determination result of the upgrade processing module 16 is inconsistent;

The rights management module 14 is further configured to allow the application to be upgraded to be upgraded when the authentication module 13 is successfully matched, and set the application to be upgraded to have system authority; otherwise, the application to be upgraded is not allowed to be upgraded to prevent malicious tampering. In this way, when the operator's signature information changes, the previous application of the operator cannot be upgraded normally, and malicious tampering can be avoided. It can further improve the rationality and accuracy of system authority management.

In this embodiment, each application that has been installed on the smart terminal is in the operation process, in particular, an application having the system permission to apply for the system is in operation, and one of the actions actually needs to use the system permission (for example, downloading and installing or uninstalling other applications) In this embodiment, in order to further improve the security of management, further authentication of these applications may be performed. At this time, the signature information acquiring module 12 is further configured to acquire signature information of the application that initiates the system permission application request when the application of the smart terminal is requested to be sent by the system during the running process;

The authentication module 13 is further configured to match the signature information with the legal signature information in the legal signature list; the matching rule may also adopt the foregoing matching rule, or may adopt other rules different from the foregoing rules.

The rights management module 14 is further configured to allow the application to execute the system authority when the authentication module is successfully matched, that is, to allow the application to continue to perform the above actions; otherwise, the application is prohibited from executing the system permission, that is, it is prohibited from continuing to perform the above actions, and may pop up a Corresponding error message.

The smart terminal in this embodiment sets the signature information of the operator to the legal signature information in advance to perform subsequent signature authentication, so that the smart terminal can support multi-signature authentication with minimal modification, and only one signature is supported by the existing smart terminal. The certified solution has lower cost, more flexible control and better security.

Embodiments of the present invention also provide a storage medium including a stored program, wherein the program described above executes the method of any of the above.

Optionally, in the embodiment, the foregoing storage medium may include, but is not limited to, a USB flash drive, a Read-Only Memory (ROM), and a Random Access Memory (RAM). A variety of media that can store program code, such as a hard disk, a disk, or an optical disk.

Embodiments of the present invention also provide a processor for running a program, wherein the program is executed to perform the steps of any of the above methods.

It will be apparent to those skilled in the art that the various modules or steps of the present invention described above can be implemented by a general-purpose computing device that can be centralized on a single computing device or distributed across a network of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein. The steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated as a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software.

The above is a detailed description of the embodiments of the present invention in conjunction with the specific embodiments, and the specific embodiments of the present invention are not limited to the description. It will be apparent to those skilled in the art that the present invention may be made without departing from the spirit and scope of the invention.

Industrial applicability

As described above, the system rights management method, device, and intelligent terminal provided by the embodiments of the present invention have the following beneficial effects: when the smart terminal obtains the application to be installed, the signature information and the preset information of the application can be directly legalized. The legal signature information in the signature list is matched. If the legal signature information in the legal signature list is successfully matched, the application is allowed to be installed on the smart terminal, and the application is set to have system authority. In the above manner, the smart terminal no longer supports only one system signature, which can support more than two system signatures; the operator does not need Send the application to the terminal manufacturer to help them set the signature. The terminal manufacturer does not need to send its own signature information to the operator. It can realize the support and management of the operator application system rights and improve the security. Sex.

Claims

A system rights management method includes:

After obtaining the application to be installed, the smart terminal acquires signature information of the application;

Matching the signature information with legal signature information in a preset legal signature list, where the legal signature list includes system signature information of the intelligent terminal system and an operator signature information;

When the matching of the signature information and the legal signature information is successful, the application is allowed to be installed on the smart terminal, and the application is set to have system authority.
The system rights management method of claim 1, further comprising:

When the smart terminal has an application to be upgraded, it is determined whether the upgraded signature information of the application to be upgraded is consistent with the current signature information before the upgrade, and if not, the upgraded signature information is in the legal signature list. The legal signature information is matched, and the matching succeeds to allow the application to be upgraded to be upgraded, and the application to be upgraded is set to have system authority.
The system rights management method of claim 1, further comprising:

And receiving, by the application of the smart terminal, the signature information of the application that initiates the system permission request, and matching the legal signature information in the legal signature list, and the matching succeeds. The application executes system permissions; otherwise, the application is prohibited from executing system permissions.
The system rights management method according to any one of claims 1 to 3, wherein before acquiring the signature information of the application, the method further includes:

Determining whether the installation package of the application has the identification information for applying the system authority, and if yes, acquiring the signature information; otherwise, allowing the application to be installed on the smart terminal, and setting the application does not have the system authority.
The system rights management method according to any one of claims 1 to 3, wherein the matching the signature information with the legal signature information comprises: first matching the signature information with the system signature information, and matching The failure then matches the carrier signature information.
The system rights management method according to any one of claims 1 to 3, further comprising:

The signature update information sent by the operator is received, and the legal signature information in the legal signature list is updated correspondingly according to the signature update information.
A system authority management device, including:

The signature information obtaining module is configured to acquire signature information of the application after the smart terminal acquires the application to be installed;

An authentication module, configured to match the signature information with legal signature information in a legal signature list, where the legal signature list includes system signature information of the intelligent terminal system and at least one operator signature information;

The rights management module is configured to allow the application to be installed on the smart terminal when the matching of the signature information and the legal signature information is successful, and set the application to have system rights.
The system rights management apparatus according to claim 7, comprising an upgrade processing module;

The signature information obtaining module is further configured to: when the smart terminal has an application to be upgraded, obtain the signature information of the upgraded application and the current signature information before the upgrade of the application to be upgraded;

The upgrade processing module is configured to determine whether the signature information of the upgraded application and the current signature information before the upgrade of the application to be upgraded are consistent;

The authentication module is further configured to match the upgraded signature information with legal signature information in the legal signature list when the determination result of the upgrade processing module is inconsistent;

The rights management module is further configured to allow the application to be upgraded to be upgraded when the authentication module is successfully matched, and set the to-be-upgraded application to have system rights.
A system authority management apparatus according to claim 7 or 8, wherein said signature The information obtaining module is further configured to: obtain, when the application of the smart terminal is a system permission application request sent during the running process, the signature information of the application that initiates the system permission application request;

The authentication module is further configured to match the signature information with legal signature information in the legal signature list;

The rights management module is further configured to allow the application that initiates the system permission request to execute the system authority when the authentication module matches successfully; otherwise, the application that executes the system permission request request is prohibited from executing the system authority.
An intelligent terminal comprising the system rights management device according to any one of claims 7-9.
A storage medium, the storage medium comprising a stored program, wherein the program is executed to perform the method of any one of claims 1 to 6.