WO2018059351A1

WO2018059351A1 - Application permission control method and device, and terminal

Info

Publication number: WO2018059351A1
Application number: PCT/CN2017/103182
Authority: WO
Inventors: 张园园
Original assignee: 中兴通讯股份有限公司
Priority date: 2016-09-28
Filing date: 2017-09-25
Publication date: 2018-04-05
Also published as: CN107871062A

Abstract

An application permission control method comprises: receiving, from an application, a sensitive information acquisition request; and permitting, on the basis of the request, and according to a permission level of the application with respect to acquisition of sensitive information, the application to acquire true sensitive information or virtual sensitive information in a terminal, wherein the permission level is configured on the basis of a permission configuration table, and comprises a first permission level permitting the application to access the true sensitive information and a second permission level permitting the application to access the virtual sensitive information.

Description

Application permission control method, device and terminal

Technical field

The present disclosure relates to, but is not limited to, the field of communication technologies, and in particular, to an application authority control method, apparatus, and terminal.

Background technique

Management strategies for mobile phones and other mobile terminal applications are mostly based on access control. In the common Android (android) mobile phone, the application permissions are often applied during the installation, and the permissions are obtained in the background during the installation process. Or in the application running process, according to the application request, let the user choose whether to give the corresponding permission to the application.

Summary of the invention

The following is an overview of the topics detailed in this document. This Summary is not intended to limit the scope of the claims.

In the face of some applications that forcibly obtain the user's sensitive information, you can directly allow or deny the application's permission application. However, the information security risk exists, and the application stops when it refuses. It is impossible to ensure that users continue to use such applications normally without revealing the true personal information of the users.

This paper provides an application permission control method, device and terminal, so that the application software can operate normally without obtaining real information authority.

An embodiment of the present disclosure provides a rights management method, including a dynamic rights management control method, including:

Accept the application to obtain sensitive information requests;

And obtaining, according to the request, the real-time sensitive information or the virtual sensitive information in the terminal according to the permission of the application to obtain the sensitive information; wherein the permission is configured by using a permission configuration table, including allowing the application to access the real sensitive information. The first permission, and the second permission to allow the application to access the virtual sensitive information.

An embodiment of the present disclosure further provides an apparatus with application authority control, including:

The information processing module is configured to: accept an application to obtain a sensitive information request; and, according to the request, obtain the real sensitive information or the virtual sensitive information in the terminal according to the permission of the application to obtain the sensitive information;

The storage module is configured to: store virtual sensitive information and a rights configuration table.

An embodiment of the present disclosure further provides a terminal with application authority control, where the terminal includes a processor, a memory, where:

The processor is configured to: accept an application to obtain a sensitive information request; and, according to the request, obtain the real sensitive information or the virtual sensitive information in the terminal according to the permission of the application to obtain the sensitive information; wherein the permission is passed The rights configuration table configuration includes a first permission to allow an application to access authentic sensitive information, and a second permission to allow an application to access virtual sensitive information.

The embodiment of the present disclosure further provides a computer readable storage medium storing computer executable instructions, which are implemented when the computer executable instructions are executed.

Through the embodiment of the present disclosure, in the case that the real sensitive information right is not provided to the application, the application can be notified according to the request of the application that the requested permission has been obtained, so that the application can run normally without providing real sensitive information. Can use the app. Thereby effectively preventing the leakage of sensitive information of the user, and also being able to check which applications may have security risks.

Other aspects will be apparent upon reading and understanding the drawings and detailed description.

BRIEF abstract

1 is a flow chart of a method of authority control according to an embodiment of the present disclosure;

2 is a flowchart of a method for controlling rights under an Android system according to an embodiment of the present disclosure;

3 is a flowchart of still another method for controlling rights in an Android system according to an embodiment of the present disclosure;

4 is a structural diagram of an authority control apparatus according to an embodiment of the present disclosure;

FIG. 5 is a structural diagram of an authority control terminal according to an embodiment of the present disclosure.

Preferred embodiment of the present disclosure

Embodiments of the present disclosure will be described below with reference to the accompanying drawings.

In this embodiment, an application permission control method is provided. FIG. 1 is a flowchart of a permission control method according to an embodiment of the present disclosure. As shown in FIG. 1, the process may include the following steps:

Step S101, accepting an application to obtain a sensitive information request;

Step S102, based on the request, according to the permission of the application to obtain sensitive information, allowing the application to obtain real sensitive information or virtual sensitive information in the terminal; wherein the permission is configured through the permission configuration table, including allowing the application to access the real The first privilege of sensitive information and the second privilege that allows the application to access virtual sensitive information.

Through the above steps, when accepting the application to obtain the sensitive information request, if the virtual sensitive permission record in the permission configuration table is matched, the application is allowed to access the virtual sensitive information. If you match the real permission record, you can also allow the app to access real sensitive information. Both approaches ensure that the application can continue to run without termination due to lack of permissions. At the same time, according to the actual needs of the user, the virtual sensitive information authority is provided for the untrusted application, thereby ensuring that the user's privacy is not leaked.

Optionally, the method for configuring the permission includes: when accepting the request for obtaining the sensitive information permission by the application, recording, in the permission configuration table, the second permission that allows the application to access the virtual sensitive information, and returning the application permission to the application Successful results.

Through the permission configuration method, when the application requests the sensitive information permission, the application can be granted permission to access the real sensitive information, so that the application can continue to run. More secure user privacy.

Optionally, the privilege configuration table configuration method includes at least one of the following: setting through a setting interface; setting by using a parameter; setting by using a privilege selection interface.

Through the setting interface, specific permissions of the application can be configured, especially for certain applications, such as an APP (Application, Computer Application), which needs to be configured to give partial real sensitive information access without wishing to access it. For all true and sensitive information, each configuration is configured independently and recorded in the permission configuration table. It enables users to control sensitive information permissions more clearly, and thus achieve better control and management effects.

By setting the permission by parameter, it can be through some preset parameters, such as the permissions configured for some or some types of applications are virtual sensitive information rights, or for certain or certain types of applications, for example A game that can be performed by gravity sensing, etc., directly sets the permission configuration table through parameters. It saves the user's tedious configuration for specific permissions and saves time for user configuration permissions.

Through the permission selection interface, when the system receives the application requesting the sensitive permission, the virtual permission option is added in the permission selection interface of the system, and after the user selects the item, the virtual authority corresponding to the selection is recorded in the item configuration table. The advantage of this approach is that it does not require prior configuration and is easy to implement. For example, in another example, it is mentioned that in the Android system 6.0 and later versions, the "rights configuration table" is (runtime-permissions.xml), and when the application obtains the sensitive information permission, the dialog window popped up in the native interface adds a "" Virtual option. If the user selects the "virtual" option, the framework code adds a record to the list of permissions for the corresponding application in the native "permission configuration table" (runtime-permissions.xml). This allows you to rely directly on the system itself without having to add other applications.

The above three privilege configuration table configuration methods have their own advantages. In the embodiment of the present disclosure, at least one or more modes may be combined in combination with actual requirements to provide a more convenient privilege configuration table configuration for the user. method.

Optionally, the sensitive information includes information related to user privacy.

There are a lot of different information on the terminal, and if all are configured, it will make the user feel redundant, which is not conducive to selecting the permissions that need to be configured. Therefore, the sensitive information of the configuration management is limited to the information related to the privacy of the user, and the control and management functions of the configuration table can be more effectively utilized, and the interests of the user are better protected.

Optionally, the information related to user privacy includes sensitive information corresponding to Dangerous rights defined by the Android system.

In Android 6.0, the user privacy information rights may include normal rights and dangerous rights, and ordinary rights may be automatically granted by the system. But the dangerous permission system lets the user decide whether to grant. Therefore, with the mechanism, the partial authority can be independently configured. On the one hand, the system can be configured to implement sensitive information, and on the other hand, the sensitive information corresponding to the authority is grasped, which is the core interest of the user. , making the entire permission configuration more clear.

Optionally, the virtual sensitive information setting method includes at least one of the following methods: setting through an interface; and setting by using a parameter.

For virtual sensitive information, you can configure the default parameters through parameters. This saves users' configuration time and improves the smooth running of the application. You can also configure the specific permissions for each application through the settings interface. On the one hand, you can check which applications have security risks through different virtual information accessed by different applications. On the other hand, for specific applications, if the requirements are specific Sensitive information can be customized by this method.

By combining at least one of the two methods or a combination of the two methods, the user can be provided with more targeted virtual information setting methods.

Optionally, the virtual sensitive information loading time includes at least one time point: when the terminal starts, according to the permission, when the application accesses the virtual sensitive information.

For virtual sensitive information, it can be loaded when needed to reduce the time spent on resources. Or load it at boot time with enough resources to reduce the time it takes to launch the app. By combining at least one of the two methods or a combination of the two, the most appropriate setting for system performance can be obtained.

The present disclosure also provides another embodiment based on the same inventive concept.

In this embodiment, a method for implementing application control on Android 6.0 and later systems is provided.

2 is a flow chart of a method for controlling rights under an Android system according to an embodiment of the present disclosure. The process can include the following steps:

Step S202: accepting the application request to obtain the sensitive information permission, and adding a “virtual” option to the dialog window popped up in the native permission selection interface.

Step S204: If the user selects the "virtual" option, the framework code adds a record in the permission list of the corresponding application in the native "permission configuration table" (runtime-permissions.xml): the applied permission type + virtual attribute. Then return the result of the successful application application, indicating that the application has been granted permissions.

Step S206: When the application reads and writes sensitive information through a specific interface, the framework code is matched from the “permission configuration table” (runtime-permissions.xml). If the user who is configured to access the sensitive information is configured as a "virtual" attribute, the corresponding virtual information result is queried and returned to the application.

For example, in the native system, by replacing the android system's native ActivityCompat class library File, extend the requestPermissions() interface of the ActivityCompat class library file, and add the "virtual" option to the pop-up permission selection window. After the user chooses to grant the virtual permission of the application-specific sensitive information, the application application permission returns the result directly for the authorization. The framework code is marked as Virtual in the READ_CONTACTS of CONTACTS in the Permission Group of the Permissions Configuration Table. When the application accesses the sensitive information, the read/write interface of the framework can add the hook function to match the content in the runtime-permission.xml, and find that the specific sensitive information of the application is authorized as the "Virtual" attribute, and the corresponding information can be obtained directly from the virtual configuration file. The virtual value of the sensitive information is returned to the application.

By modifying the original code of the system, the virtual control of sensitive information is realized more simply in the native permission configuration window, thereby implementing the virtual access method more conveniently.

For example, as shown in FIG. 3, FIG. 3 is a flowchart of another method for controlling the rights of the present disclosure in the Android system, and the process may include:

Step S301: When the mobile phone is powered on, the framework loads the virtual information configuration file, where all the virtual configuration files of the sensitive permissions of android6.0 are recorded.

Step S302: After an application of the mobile phone is opened by the user, the application applies for obtaining the location information, and the android system can query the setting of the user before the application in the permission configuration table runtime-permission.xml, and if there is no record, go to step S303. If there is a record, it is "allow" to return the real location information, "virtual" can return the virtual location information, "reject" can return null directly, and then the whole process ends.

Step S303: Applying the first application for location information permission, the android system pops up a prompt box, respectively, three options of “allow”, “reject”, “virtual”, wait for the user to select, and record the selection result to the permission configuration table runtime- Permission.xml for the next query. If the user selects "Allow", then go to step S304; if the user selects "Virtual", go to step S305; if the user selects "Reject", return directly to null, and then the entire process ends.

Step S304: The user selects “Allow”, indicating that the real location information authority of the application can be authorized, and the application directly returns the real geographical location when acquiring the location information. Then the whole process ends.

Step S305: The user selects “virtual”, indicating that the current application is not trusted, and the application directly returns to the virtual geographic location when acquiring the location information, and then the entire process ends.

The present disclosure also provides another embodiment based on the same inventive concept. There is provided a permission control device, and FIG. 4 is a structural diagram of an authority control device according to an embodiment of the present disclosure, and the device may include:

Through the device, if the right of the application is not provided with the real sensitive information, the application can also be notified according to the request of the application that the requested permission has been obtained, so that the application can run normally, and the application can be used without providing real sensitive information. . Thereby effectively preventing the leakage of sensitive information of the user, and also being able to check which applications may have security risks.

Optionally, the device further includes:

The human-computer interaction module is configured to: when the application requests the sensitive information permission, the human-computer interaction module can provide the sensitive information permission selection option, allowing the application to obtain the virtual sensitive information permission, and record the permission information in the permission configuration table.

Through the human-computer interaction module, the user's virtual rights configuration selection for the application can be received and recorded in the rights configuration table, thereby facilitating control of the specific rights of the application.

The present disclosure also provides another embodiment based on the same inventive concept. FIG. 5 is a structural diagram of a rights control terminal according to an embodiment of the present disclosure. As shown in FIG. 5, the terminal may include:

Through the terminal, if the real sensitive information permission is not provided to the application, the application can also be notified according to the request of the application that the requested permission has been obtained, so that the application can run normally, and the application can be used without providing real sensitive information. . Thereby effectively preventing the leakage of sensitive information of the user, and also being able to check which applications may have security risks.

Embodiments of the present disclosure also provide a computer readable storage medium storing a computer executable The instructions, when the computer executable instructions are executed, implement the above application permission control method.

Those skilled in the art will appreciate that the above-described modules or steps of the embodiments of the present disclosure may be implemented by a general-purpose computing device, which may be centralized on a single computing device or distributed over a network of multiple computing devices. Alternatively, they may be implemented by program code executable by a computing device such that they may be stored in a storage device by a computing device and, in some cases, may be executed in a different order than herein. The steps shown or described are either made separately into different integrated circuit modules, or a plurality of modules or steps are fabricated as a single integrated circuit module. Thus, embodiments of the present disclosure are not limited to any specific combination of hardware and software.

Those of ordinary skill in the art will appreciate that all or some of the steps, systems, and functional blocks/units of the methods disclosed above may be implemented as software, firmware, hardware, and suitable combinations thereof. In a hardware implementation, the division between functional modules/units mentioned in the above description does not necessarily correspond to the division of physical components; for example, one physical component may have multiple functions, or one function or step may be composed of several physical The components work together. Some or all of the components may be implemented as software executed by a processor, such as a digital signal processor or microprocessor, or as hardware, or as an integrated circuit, such as an application specific integrated circuit. Such software may be distributed on a computer readable medium, which may include computer storage media (or non-transitory media) and communication media (or transitory media). As is well known to those of ordinary skill in the art, the term computer storage medium includes volatile and nonvolatile, implemented in any method or technology for storing information, such as computer readable instructions, data structures, program modules or other data. Sex, removable and non-removable media. Computer storage media include, but are not limited to, Random Access Memory (RAM), Read-Only Memory (ROM), and Electrically Erasable Programmable Read-only Memory (EEPROM). Flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical disc storage, magnetic cassette, magnetic tape, disk storage or other magnetic storage device, or Any other medium used to store the desired information and that can be accessed by the computer. Moreover, it is well known to those skilled in the art that communication media typically includes computer readable instructions, data structures, program modules, or other data in a modulated data signal, such as a carrier wave or other transport mechanism, and can include any information delivery media. .

A person skilled in the art can understand that the technical solutions of the present disclosure may be modified or equivalent, without departing from the spirit and scope of the present disclosure, and should be included in the scope of the claims of the present disclosure.

Industrial applicability

Through the embodiment of the present disclosure, in the case that the real sensitive information right is not provided to the application, the application can be notified according to the request of the application that the requested permission has been obtained, so that the application can run normally without providing real sensitive information. Can use the app.

Claims

An application permission control method, comprising:

Accept the application to obtain sensitive information requests;

And obtaining, according to the request, the real-time sensitive information or the virtual sensitive information in the terminal according to the permission of the application to obtain the sensitive information; wherein the permission is configured by using a permission configuration table, including allowing the application to access the real sensitive information. The first permission, and the second permission to allow the application to access the virtual sensitive information.
The application permission control method according to claim 1, wherein the method for configuring the permission comprises: when accepting the request for obtaining the sensitive information permission by the application, recording the second permission for allowing the application to access the virtual sensitive information in the permission configuration table And return a successful result to the application request permission.
The application authority control method according to claim 1, wherein the rights configuration table configuration method comprises at least one of the following:

Set through the settings interface;

By parameter setting;

Set through the permission selection interface.
The application authority control method according to claim 1, wherein said sensitive information includes information relating to user privacy.
The application authority control method according to claim 4, wherein the information relating to user privacy includes sensitive information corresponding to dangerous Dangerous rights defined by the Android system.
The application authority control method according to claim 1, wherein the virtual sensitive information setting method comprises at least one of the following:

Set through the settings interface;

Set by parameters.
The application authority control method according to claim 1, wherein the virtual sensitive information loading time comprises at least one of the following:

When the terminal is started;

According to the permission, when the application accesses the virtual sensitive information.
A device with application permission control, comprising:

The information processing module is configured to: accept an application to obtain a sensitive information request; and, according to the request, obtain the real sensitive information or the virtual sensitive information in the terminal according to the permission of the application to obtain the sensitive information;

The storage module is configured to: store virtual sensitive information and a rights configuration table.
The device with application authority control according to claim 8, further comprising:

The human-computer interaction module is configured to: when the application requests the sensitive information permission, the human-computer interaction module can provide the sensitive information permission selection option, allowing the application to obtain the virtual sensitive information permission, and record the permission information in the permission configuration table.
A terminal having application authority control, the terminal comprising a processor; wherein:

The processor is configured to: accept an application to obtain a sensitive information request; and, according to the request, obtain the real sensitive information or the virtual sensitive information in the terminal according to the permission of the application to acquire the sensitive information; wherein the permission Configuration through the rights configuration table, including the first permission to allow the application to access the real sensitive information, and the second permission to allow the application to access the virtual sensitive information.
A computer readable storage medium storing computer executable instructions, the computer executable instructions being executed to implement the application authority control method according to any one of claims 1 to 7.