WO2023124930A1

WO2023124930A1 - Permission management method and apparatus, storage medium, and electronic device

Info

Publication number: WO2023124930A1
Application number: PCT/CN2022/138302
Authority: WO
Inventors: 钟炳鑫; 金炼城
Original assignee: 北京有竹居网络技术有限公司
Priority date: 2021-12-27
Filing date: 2022-12-12
Publication date: 2023-07-06
Also published as: CN116361777A

Abstract

The present disclosure relates to a permission management method and apparatus, a storage medium, and an electronic device. The method comprises: intercepting, by means of a first hook function, a call to a first API by an in-host application installed in a host application, at least one in-host application being installed in the host application, and the first API being used for applying for a first permission to an operating system; and granting the first permission to the in-host application under a condition that the operating system grants the first permission to the host application and a user grants the first permission to the in-host application.

Description

Rights management method, device, storage medium and electronic equipment

This disclosure claims the priority of the Chinese patent application number "202111616976.8" filed on December 27, 2021, with the title of "authority management method, device, storage medium and electronic equipment", and the entire content of the Chinese patent application Incorporated by reference in this disclosure.

technical field

The present disclosure relates to the technical field of rights management, and in particular, to a rights management method, device, storage medium and electronic equipment.

Background technique

The game box is the main way for the game industry to realize the game platform and distribution. Using the open source feature of Android (Android), the installation-free gameplay based on virtual middleware has become a common implementation method of game boxes in the industry. The virtual middleware adopts the virtual Android system. Framework, the game application running in the installation-free mode can be installed in the virtual middleware layer. However, there are serious problems in this installation-free gameplay. The Android system grants permissions in units of applications. As long as the host application (such as a game box) is authorized, all applications installed in the host can share the permissions obtained by the host. User privacy cannot be guaranteed.

Contents of the invention

This Summary is provided to introduce a simplified form of concepts that are described in detail later in the Detailed Description. This summary of the invention is not intended to identify key features or essential features of the claimed technical solution, nor is it intended to be used to limit the scope of the claimed technical solution.

In a first aspect, the present disclosure provides a rights management method, including:

Intercept calls to the first API by the host application installed in the host application through the first Hook function; wherein, at least one host application is installed in the host application, and the first API is used to apply to the operating system for the first API a authority;

When the operating system grants the first permission to the host application, and the user grants the first permission to the application in the host, grant the first permission to the application in the host.

In a second aspect, the present disclosure provides a rights management device, including:

The first Hook module is used to intercept the call of the first API by the host application installed in the host application through the first Hook function; wherein, at least one host application is installed in the host application, and the first API Used to apply for the first permission to the operating system;

A permission application management module, configured to grant the host application the first permission when the operating system grants the first permission to the host application and the user grants the first permission to the host application the first authority.

In a third aspect, the present disclosure provides a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processing device, the steps of the method described in the first aspect are implemented.

In a fourth aspect, the present disclosure provides an electronic device, including:

a storage device on which a computer program is stored;

A processing device configured to execute the computer program in the storage device to implement the steps of the method in the first aspect.

In the above technical solution, the first Hook function is used to hook the first API call, and the first Hook function first obtains the control right, so as to control the authority from the dimension of the application in the host, so that only when the "operating system grants" is satisfied at the same time Only when the host application permission" and "the user chooses to grant the application permission in the host", the application permission in the host is finally granted. When any of the above conditions is not met, the application permission in the host will not be granted, so that Ensure that the permissions of the host applications installed in the host application cannot be shared. At the same time, all authorizations require the user to perform an authorization operation. Multiple host applications cannot share permissions with each other without the user's awareness, thereby protecting user privacy.

Other features and advantages of the present disclosure will be described in detail in the detailed description that follows.

Description of drawings

The above and other features, advantages and aspects of the various embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numerals denote the same or similar elements. It should be understood that the drawings are schematic and that elements and elements are not necessarily drawn to scale. In the attached picture:

Fig. 1 is a flowchart of a rights management method shown according to an exemplary embodiment;

Fig. 2 is the specific flowchart of step S120 among Fig. 1;

Fig. 3 is another specific flowchart of step S120 in Fig. 1;

Fig. 4 is another flowchart of a rights management method according to an exemplary embodiment;

Fig. 5 is another flowchart of a rights management method according to an exemplary embodiment;

Fig. 6 is a schematic diagram of implementation of a rights management method according to an exemplary embodiment;

Fig. 7 is another flowchart of a rights management method according to an exemplary embodiment;

Fig. 8 is a block diagram of a rights management device according to an exemplary embodiment;

Fig. 9 is a block diagram of an electronic device according to an exemplary embodiment.

Detailed ways

Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the drawings, it should be understood that the disclosure may be embodied in various forms and should not be construed as limited to the embodiments set forth herein; A more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are for exemplary purposes only, and are not intended to limit the protection scope of the present disclosure.

It should be understood that the various steps described in the method implementations of the present disclosure may be executed in different orders, and/or executed in parallel. Additionally, method embodiments may include additional steps and/or omit performing illustrated steps. The scope of the present disclosure is not limited in this respect.

As used herein, the term "comprise" and its variations are open-ended, ie "including but not limited to". The term "based on" is "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one further embodiment"; the term "some embodiments" means "at least some embodiments." Relevant definitions of other terms will be given in the description below.

It should be noted that concepts such as "first" and "second" mentioned in this disclosure are only used to distinguish different devices, modules or units, and are not used to limit the sequence of functions performed by these devices, modules or units or interdependence.

It should be noted that the modifications of "one" and "multiple" mentioned in the present disclosure are illustrative and not restrictive, and those skilled in the art should understand that unless the context clearly indicates otherwise, it should be understood as "one or more" multiple".

The names of messages or information exchanged between multiple devices in the embodiments of the present disclosure are used for illustrative purposes only, and are not used to limit the scope of these messages or information.

Aiming at the technical problems of related technologies, that is, to install applications in the host application without installation, once the host application is authorized by the system, all applications installed in the host application can share the permissions obtained by the host. The disclosed embodiments provide a permission management method, which performs permission management and control from the dimension of a single application in a host application.

Fig. 1 is a flowchart of a rights management method according to an exemplary embodiment. The rights management method is executed by an electronic device. As shown in Fig. 1, the method includes the following steps:

Step S110, intercept the call of the first application program interface (Application Programming Interface, API) by the host application installed in the host application through the first Hook function; wherein, the application in the host applies to the operating system for the first API by calling the first API. a permission.

Wherein, at least one application (called an application in the host) is installed in the host application program. In one application scenario, the host application program is a game box, and the application in the host is a game application installed in the game box.

Wherein, the first API is used to apply for permission from the operating system, and the first permission refers to the permission applied to the operating system by the application in the host calling the first API this time. Exemplarily, the first API includes, but is not limited to, requestPermission or requestPermissions.

Step S120, when the operating system grants the first permission to the host application and the user grants the first permission to the host application, grant the first permission to the host application.

Wherein, after intercepting the call of the first API by the application in the host, respectively apply to the operating system for granting the first permission to the application in the host, and request the user to choose whether to grant the first permission to the application in the host. Only when the two conditions of "the operating system grants the first permission to the host application" and "the user chooses to grant the first permission to the host application" are met, the first permission is finally granted to the host application. When any of the above When a condition is not met, such as the operating system does not grant the first permission to the host application or the user chooses not to grant the first permission to the application in the host, refuse to grant the first permission to the application in the host. In a specific implementation manner, step S120 may include, but is not limited to, any processing flow in FIG. 2 or FIG. 3 .

In an exemplary embodiment, FIG. 2 shows a specific flow chart of executing step S120 after intercepting a call to the first API by an application in the host. As shown in FIG. 2 , step S120 includes:

Step S210, apply to the operating system for granting the first permission to the host application; if the operating system grants the first permission to the host application, execute step S220; if the operating system does not grant the first permission to the host application, execute step S240.

Step S220, generate an interactive page asking the user whether to grant the first permission to the application in the host; if the user performs an authorization operation to grant the first permission to the application in the host, then perform step S230, if the user makes an authorization operation to the application in the host For the denial operation of granting the first permission, step S240 is executed.

After intercepting the call of the first API by the application in the host, first apply to the operating system for granting the first permission to the host application, and then ask the user whether to grant the first permission to the application in the host if the operating system grants the first permission to the host application a permission.

Step S230, granting the first permission to the host application.

Step S240, refusing to grant the first permission to the application in the host.

Wherein, in response to the authorization operation performed by the user on the interactive page, the first permission is granted to the application in the host.

Wherein, when the operating system does not grant the host application the first permission, or in response to a user's rejection operation on the interactive page, it refuses to grant the first permission to the host application.

It can be understood that in the above steps, if the operating system does not grant the first permission to the host application, it can directly refuse to grant the first permission to the application in the host, without having to perform subsequent inquiries whether the user grants permission to the application in the host. The first permission step reduces the interruption to the user.

In an exemplary embodiment, FIG. 3 shows another specific flow chart of executing step S120 after intercepting the call of the first API by the application in the host. As shown in FIG. 3 , step S120 includes:

Step S310, generate an interactive page asking the user whether to grant the first permission to the application in the host; if the user performs an authorization operation to grant the first permission to the application in the host, then perform step S320, if the user makes an authorization operation to the application in the host For the denial operation of granting the first permission, step S340 is performed.

Step S320, applying to the operating system for granting the first permission to the host application.

After intercepting the call of the first API by the application in the host, first ask the user whether to grant the first permission to the application in the host, and then apply to the operating system for granting the first permission to the application in the host if the user chooses to grant the first permission to the application in the host For the first permission, if the operating system grants the host application the first permission, execute step S330; if the operating system does not grant the host application the first permission, execute step S340.

Step S330, granting the first permission to the host application.

Step S340, refusing to grant the first permission to the host application.

Wherein, in response to the denial operation performed by the user on the interactive page, or in the case that the operating system does not grant the first permission to the host application, deny granting the first permission to the host application.

It can be understood that, in the above steps, if the user chooses not to grant the first permission to the application in the host, he can directly refuse to grant the first permission to the application in the host without performing a subsequent application to the operating system for granting the application to the host The steps of the first authority reduce the execution of unnecessary steps.

It is understandable that since each in-host application is installed in the virtual middleware layer in the host application, only the role of the host application can be known to the system layer, and the role of the in-host application in the host application is agnostic , if the permission management method provided by the embodiment of the present disclosure is not used, the system can only manage the permission at the host application level, and all permissions granted by the system are for the host application and all the permissions installed in the host application. For applications in the host, the system layer cannot implement permission control of a single application dimension. Once the host application is authorized by the system, all applications installed in the host application can obtain the same permissions.

Taking the game box as the host application program as an example, after the game box or the game application A installed in the game box (the system defaults the permission application initiated by the game application A as the permission application initiated by the game box) to the operating system after applying for permission P, in All game applications installed in the game box can share the permission P. In the embodiment of the present disclosure, the first Hook function is used to hook the first API call, and the first Hook function first obtains the control right, so as to control the authority from the dimension of a single game application, so that only when the "operating system grants the game box" is satisfied at the same time Permission P” and “User chooses to grant the game application permission P” before finally granting the game application permission P. When any of the above conditions is not met, the game application permission P is refused to be granted, thereby ensuring The permissions of the game applications installed in the game box cannot be shared. At the same time, all authorizations require the user to perform an authorization operation. Multiple game applications cannot share permissions with each other without the user's awareness, thereby protecting user privacy.

In some embodiments, FIG. 4 is another flowchart of a rights management method according to an exemplary embodiment. As shown in FIG. 4, the method further includes the following steps:

Step S410, intercepting the call to the second API by the host application installed in the host application program through the second Hook function; wherein, the host application requests the operating system to verify whether it is authorized to have the second permission by calling the second API.

Wherein, the second API is used to request verification permission from the operating system, and the second permission refers to the permission of the application in the host to call the second API to request verification from the operating system. Exemplarily, the second API includes, but is not limited to, checkPermission or checkPermissions.

Step S420, in the case that the operating system has granted the second permission to the host application and the user has granted the second permission to the host application, return authorized to the host application, otherwise return unauthorized to the host application .

Understandably, before adopting this technical solution, when the application in the host invokes the second API to request the operating system to verify whether the second authority is authorized, if the system has authorized the second authority to the host application, it will The application in the host is directly considered to have the second permission. If the system has not authorized the second permission to the host application, it will be considered that the application in the host does not have the second permission.

After adopting this technical solution, the second Hook function is used to hook the second API call, and the second Hook function first obtains the control right, so as to determine whether the application in the host is granted the second permission from the dimension of a single application, if The application in the host has been granted the second permission through steps S110-S120 before, then return the authorized to the application in the host, otherwise return unauthorized to the application in the host. Specifically, in the case that the operating system has granted the second permission to the host application, and the user has granted the second permission to the application in the host, it is determined that the application in the host has the second permission, and then returned to the application in the host. Authorization, otherwise return Unauthorized to the application in the host.

In some embodiments, FIG. 5 is another flowchart of a rights management method according to an exemplary embodiment. As shown in FIG. 5, the method further includes the following steps:

Step S510, intercepting the call of the third API by the host application installed in the host application program through the third Hook function; wherein, the third API is a system API that needs to be called with corresponding permissions.

Among them, the third API includes but is not limited to camera API, recorder API, API for obtaining International Mobile Equipment Identity (IMEI) and other system APIs that need to be called with corresponding permissions. For example, the camera API is allowed to be called only when the app in the host has the corresponding camera permission. For example, the recorder API is allowed to be called only when the app in the host has the corresponding recording permission. When the app in the host is not granted the corresponding In the case of permissions, the application is not allowed to call the third API.

Step S520, in the case that the operating system has granted the corresponding permission of the third API to the host application, and the user has granted the corresponding permission to the application in the host, allow the application in the host to call the third API, otherwise deny the application in the host The application in the host calls the third API.

Understandably, before adopting this technical solution, the host application or application A in the host applies to the operating system for camera permissions. Once the operating system agrees to the application, the host application and all applications in the host can share Camera permissions, so that the camera API can be called and the camera can be started.

After adopting this technical solution, use the third Hook function to hook the third API (such as the camera API) that needs the corresponding authority to call, and the third Hook function first obtains the control right, so as to determine the host from the dimension of a single application. Whether the application has been granted the camera permission required to call the camera API. If the application in the host has been granted the camera permission through steps S110-S120 before, the application in the host is allowed to call the camera API and start the camera, otherwise the host is rejected The internal application calls the camera API, and returns a call exception or call failure to the host internal application. Specifically, only when the operating system has granted the camera permission to the host application and the user has granted the camera permission to the application in the host, the application in the host can call the camera API and start the camera, otherwise the call will fail.

Fig. 6 is a schematic diagram of implementation of the rights management method shown in the above embodiments. As shown in Figure 6, the embodiment of the present disclosure utilizes JVM (Java Virtual Machine, Java virtual machine)/ART (Android RunTime) virtual machine Hook technology and C/C++ Hook technology, etc., to the permission-related APIs of the Android system (including The first API and the second API) and each system API (the third API) that requires permission calls are intercepted, and after the interception, permission management is performed with the application in the host as the dimension.

After intercepting the first API used to apply for the first permission, apply to the operating system for granting the first permission to the host application and request the user to choose whether to grant the first permission to the application in the host, while satisfying the requirements of "granting the host application by the operating system." Only when the two conditions of "the first permission of the program" and "the user chooses to grant the first permission to the application in the host" are finally granted the first permission to the application in the host. After intercepting the second API for verifying whether the second permission is authorized, verify whether the host application that calls the second API is authorized to have the second permission, and the operating system has granted the second permission to the host application, And only when the user has granted the second permission to the application in the host, the authorization is returned to the application in the host, otherwise, the unauthorized is returned to the application in the host. After intercepting the third API that needs permission to call, determine whether the host application that calls the third API this time has the corresponding permission required to call the third API. Specifically, the operating system has granted the corresponding permission to the host application, and The application in the host is allowed to call the third API only when the user has granted the corresponding permission to the application in the host.

In addition, it is worth noting that there are still the following problems in the installation-free method of installing host applications in the host application: after the virtual middleware layer in the host application is installed, the host applications are not isolated from each other, and each host application Both can directly obtain the information of the host application list installed in the virtual middleware layer or the information of a single installed host application.

In some embodiments, FIG. 7 is another flowchart of a rights management method according to an exemplary embodiment, so as to solve the above-mentioned problem. As shown in Figure 7, the method includes the following steps:

Step S610, using the fourth Hook function to intercept the call of the fourth API by the host application installed in the host application; wherein, the fourth API is used to obtain the information of the installed host application in the host application.

Exemplarily, the fourth API includes an API for obtaining information about a list of installed applications in the host application, such as getInstalledPackages, getInstalledPackagesAsUser, getInstalledApplications, getInstalledApplicationsAsUser, etc., and also includes an API for obtaining a single installed application in the host application. APIs for information of applications in the host, for example, getPackageInfo, getApplicationInfo, etc.

Step S620, returning the self-information of the application in the host to the application in the host.

Wherein, after intercepting the call of the fourth API by the application in the host, the information of the installed application list in the host application or the information of a single installed application in the host is not returned to the application in the host, but the information of the installed application in the host is returned. Self-information of the application in the host.

The embodiment of the present disclosure utilizes Hook technologies such as JVM/ART virtual machine Hook and C/C++ Hook to intercept the fourth API used to obtain the installed host application information in the host application program, so that each host application can It can only perceive its own information, but cannot obtain the information of other host applications, so that multiple host applications installed in the host application are isolated from each other, thereby protecting user privacy.

To sum up, in the embodiment of the present disclosure, based on the Hook technology, the API called by the host application is intercepted. Only when the operating system grants the host application permission, and the user also grants the permission to the host application, the actual grant This permission is applied in the host, and the application in the host cannot obtain the user's private information by calling the system API without the user's awareness. In addition, each application installed in the host application is isolated from each other, and it is not aware of whether other applications are installed, which effectively improves security.

Based on the same inventive concept, an embodiment of the present disclosure also provides a rights management device, please refer to FIG. 8 , the rights management device 700 includes:

The first Hook module 710 is configured to intercept the call of the first API by the host application installed in the host application through the first Hook function; wherein, at least one host application is installed in the host application, and the first The API is used to apply for the first permission to the operating system;

A permission application management module 720, configured to grant the host application the first permission when the operating system grants the first permission to the host application and the user grants the first permission to the host application the first authority.

In some embodiments, the permission application management module 720 is used to:

Applying to the operating system for granting the first permission to the host application;

When the operating system grants the host application the first permission, generate an interactive page asking the user whether to grant the first permission to the host application;

In response to an authorization operation performed by the user on the interactive page, the first permission is granted to the host application.

generating an interactive page asking the user whether to grant the first permission to the application in the host;

In response to an authorization operation performed by the user on the interactive page, apply to the operating system for granting the first permission to the host application;

When the operating system grants the first permission to the host application, grant the first permission to the host application.

In some embodiments, the device 700 also includes:

The second Hook module is used to intercept the call of the second API by the host application installed in the host application program through the second Hook function; wherein, the second API is used to request the operating system to verify whether the authorization has the second permission ;

A permission verification management module, configured to send the host application the second permission if the operating system has granted the second permission to the host application and the user has granted the second permission to the host application. The internal application returns authorized, otherwise returns unauthorized to the host internal application.

In some embodiments, the device 700 also includes:

The third Hook module is used to intercept the call of the third API by the host application installed in the host application program through the third Hook function; wherein, the third API is a system API that needs to be called with corresponding permissions;

A call permission management module, configured to allow the application in the host to call The third API, otherwise deny the application in the host to call the third API.

In some embodiments, the device 700 also includes:

The fourth Hook module is used to intercept the call of the fourth API by the host application installed in the host application through the fourth Hook function; wherein, the fourth API is used to obtain the information of the installed host application in the host application ;

An information isolation module, configured to return the self-information of the application in the host to the application in the host.

Regarding the apparatus in the foregoing embodiments, the specific manner in which each module executes operations has been described in detail in the embodiments related to the method, and will not be described in detail here.

Based on the same inventive concept, an embodiment of the present disclosure further provides a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processing device, the rights management method provided by the embodiment of the present disclosure is implemented.

Based on the same inventive concept, an embodiment of the present disclosure also provides an electronic device, including:

a storage device on which a computer program is stored;

A processing device, configured to execute the computer program in the storage device, so as to implement the rights management method provided by the embodiments of the present disclosure.

Referring to FIG. 9 , it shows a schematic structural diagram of an electronic device 800 suitable for implementing the embodiments of the present disclosure. The electronic equipment in the embodiment of the present disclosure may include but not limited to such as mobile phone, notebook computer, digital broadcast receiver, PDA (personal digital assistant), PAD (tablet computer), PMP (portable multimedia player), vehicle terminal (such as mobile terminals such as car navigation terminals) and fixed terminals such as digital TVs, desktop computers and the like. The electronic device shown in FIG. 9 is only an example, and should not limit the functions and application scope of the embodiments of the present disclosure.

As shown in FIG. 9, an electronic device 800 may include a processing device (such as a central processing unit, a graphics processing unit, etc.) Various appropriate actions and processes are executed by programs in the memory (RAM) 803 . In the RAM 803, various programs and data necessary for the operation of the electronic device 800 are also stored. The processing device 801, the ROM 802, and the RAM 803 are connected to each other through a bus 804. An input/output (I/O) interface 805 is also connected to the bus 804 .

Typically, the following devices can be connected to the I/O interface 805: input devices 806 including, for example, a touch screen, touchpad, keyboard, mouse, camera, microphone, accelerometer, gyroscope, etc.; including, for example, a liquid crystal display (LCD), speaker, vibration an output device 807 such as a computer; a storage device 808 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 809. The communication means 809 may allow the electronic device 800 to communicate with other devices wirelessly or by wire to exchange data. While FIG. 9 shows electronic device 800 having various means, it is to be understood that implementing or having all of the means shown is not a requirement. More or fewer means may alternatively be implemented or provided.

In particular, according to an embodiment of the present disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product, which includes a computer program carried on a non-transitory computer readable medium, where the computer program includes program code for executing the method shown in the flowchart. In such an embodiment, the computer program may be downloaded and installed from a network via communication means 809, or from storage means 808, or from ROM 802. When the computer program is executed by the processing device 801, the above-mentioned functions defined in the methods of the embodiments of the present disclosure are executed.

It should be noted that the computer-readable medium mentioned above in the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the two. A computer readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to, electrical connections with one or more wires, portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable Programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In the present disclosure, however, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave carrying computer-readable program code therein. Such propagated data signals may take many forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which can transmit, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device . Program code embodied on a computer readable medium may be transmitted by any appropriate medium, including but not limited to wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

The above-mentioned computer-readable medium may be included in the above-mentioned electronic device, or may exist independently without being incorporated into the electronic device.

The above-mentioned computer-readable medium carries one or more programs, and when the above-mentioned one or more programs are executed by the electronic device, the electronic device: uses the first Hook function to intercept the host application installed in the host application program to the first API call; wherein, at least one application in the host is installed in the host application, and the first API is used to apply for a first permission from the operating system; the operating system grants the first permission to the host application If the user grants the first permission to the application in the host, grant the first permission to the application in the host.

Computer program code for carrying out operations of the present disclosure may be written in one or more programming languages, or combinations thereof, including but not limited to object-oriented programming languages—such as Java, Smalltalk, C++, and Includes conventional procedural programming languages - such as "C" or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user computer through any kind of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (for example, using an Internet service provider to connected via the Internet).

The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in a flowchart or block diagram may represent a module, program segment, or portion of code that contains one or more logical functions for implementing specified executable instructions. It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or they may sometimes be executed in the reverse order, depending upon the functionality involved. It should also be noted that each block of the block diagrams and/or flowchart illustrations, and combinations of blocks in the block diagrams and/or flowchart illustrations, can be implemented by a dedicated hardware-based system that performs the specified functions or operations , or may be implemented by a combination of dedicated hardware and computer instructions.

The modules involved in the embodiments described in the present disclosure may be implemented by software or by hardware. Among them, the name of the module does not constitute a limitation on the module itself under certain circumstances. For example, the first Hook module can also be described as "intercepting the first Hook application installed in the host application through the first Hook function. API call module".

The functions described herein above may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: Field Programmable Gate Arrays (FPGAs), Application Specific Integrated Circuits (ASICs), Application Specific Standard Products (ASSPs), System on Chips (SOCs), Complex Programmable Logical device (CPLD) and so on.

In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media would include one or more wire-based electrical connections, portable computer discs, hard drives, random access memory (RAM), read only memory (ROM), erasable programmable read only memory (EPROM or flash memory), optical fiber, compact disk read only memory (CD-ROM), optical storage, magnetic storage, or any suitable combination of the foregoing.

According to one or more embodiments of the present disclosure, Example 1 provides a rights management method, including:

According to one or more embodiments of the present disclosure, Example 2 provides the method of Example 1, the operating system grants the first permission to the host application, and the user grants the first permission to the host application In the case of the first permission, granting the first permission to the host application includes:

According to one or more embodiments of the present disclosure, Example 3 provides the method of Example 1, the operating system grants the first permission to the host application, and the user grants the first permission to the host application In the case of the first permission, granting the first permission to the host application includes:

According to one or more embodiments of the present disclosure, Example 4 provides the method of Example 1, further comprising:

Intercepting calls to the second API by the host application installed in the host application program through the second Hook function; wherein, the second API is used to request the operating system to verify whether it is authorized to have the second permission;

In the case that the operating system has granted the second permission to the host application and the user has granted the second permission to the application in the host, return the authorization to the application in the host, otherwise send The in-host application returns Unauthorized.

According to one or more embodiments of the present disclosure, Example 5 provides the method of Example 1, further comprising:

The third API is intercepted by the host application installed in the host application through the third Hook function; wherein, the third API is a system API that needs to be called with corresponding permissions;

In the case that the operating system has granted the corresponding permission to the host application, and the user has granted the corresponding permission to the application in the host, allow the application in the host to call the third API, otherwise Denying the application in the host to call the third API.

According to one or more embodiments of the present disclosure, Example 6 provides the method of Example 1, further comprising:

Intercepting the call of the fourth API by the host application installed in the host application through the fourth Hook function; wherein, the fourth API is used to obtain the information of the installed host application in the host application;

The self information of the application in the host is returned to the application in the host.

According to one or more embodiments of the present disclosure, Example 7 provides a rights management device, including:

A permission application management module, configured to grant the host application the first permission when the operating system grants the first permission to the host application and the user grants the first permission to the host application the first permission.

According to one or more embodiments of the present disclosure, Example 8 provides the device of Example 7, and the rights application management module is used for:

According to one or more embodiments of the present disclosure, Example 9 provides the device of Example 7, and the rights application management module is used for:

According to one or more embodiments of the present disclosure, Example 10 provides the device of Example 7, further comprising:

According to one or more embodiments of the present disclosure, Example 11 provides the device of Example 7, further comprising:

According to one or more embodiments of the present disclosure, Example 12 provides the device of Example 7, further comprising:

According to one or more embodiments of the present disclosure, Example 13 provides a computer-readable storage medium, on which a computer program is stored, and when the program is executed by a processing device, the method described in any one of Examples 1 to 6 is implemented. A step of.

According to one or more embodiments of the present disclosure, Example 14 provides an electronic device, comprising:

a storage device on which a computer program is stored;

A processing device configured to execute the computer program in the storage device, so as to implement the steps of the method in any one of examples 1 to 6.

The above description is only a preferred embodiment of the present disclosure and an illustration of the applied technical principle. Those skilled in the art should understand that the disclosure scope involved in this disclosure is not limited to the technical solution formed by the specific combination of the above-mentioned technical features, but also covers the technical solutions formed by the above-mentioned technical features or Other technical solutions formed by any combination of equivalent features. For example, a technical solution formed by replacing the above-mentioned features with (but not limited to) technical features with similar functions disclosed in this disclosure.

In addition, while operations are depicted in a particular order, this should not be understood as requiring that the operations be performed in the particular order shown or to be performed in sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Likewise, while the above discussion contains several specific implementation details, these should not be construed as limitations on the scope of the disclosure. Certain features that are described in the context of separate embodiments can also be implemented in combination in a single embodiment. Conversely, various features that are described in the context of a single embodiment can also be implemented in multiple embodiments separately or in any suitable subcombination.

Although the subject matter has been described in language specific to structural features and/or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are merely example forms of implementing the claims. Regarding the apparatus in the above embodiments, the specific manner in which each module executes operations has been described in detail in the embodiments related to the method, and will not be described in detail here.

Claims

A rights management method, which includes:

Intercept calls to the first API by the host application installed in the host application through the first Hook function; wherein, at least one host application is installed in the host application, and the first API is used to apply to the operating system for the first API a authority;

When the operating system grants the first permission to the host application, and the user grants the first permission to the application in the host, grant the first permission to the application in the host.
The method according to claim 1, wherein when the operating system grants the first permission to the host application, and the user grants the first permission to the application in the host, granting Applying the first permission in the host includes:

Applying to the operating system for granting the first permission to the host application;

When the operating system grants the host application the first permission, generate an interactive page asking the user whether to grant the first permission to the host application;

In response to an authorization operation performed by the user on the interactive page, the first permission is granted to the host application.
The method according to claim 1, wherein when the operating system grants the first permission to the host application, and the user grants the first permission to the application in the host, granting Applying the first permission in the host includes:

generating an interactive page asking the user whether to grant the first permission to the application in the host;

In response to an authorization operation performed by the user on the interactive page, apply to the operating system for granting the first permission to the host application;

When the operating system grants the first permission to the host application, grant the first permission to the host application.
The method of claim 1, further comprising:

Intercepting calls to the second API by the host application installed in the host application program through the second Hook function; wherein, the second API is used to request the operating system to verify whether it is authorized to have the second permission;

In the case that the operating system has granted the second permission to the host application and the user has granted the second permission to the application in the host, return the authorization to the application in the host, otherwise send The in-host application returns Unauthorized.
The method of claim 1, further comprising:

The third API is intercepted by the host application installed in the host application through the third Hook function; wherein, the third API is a system API that needs to be called with corresponding permissions;

In the case that the operating system has granted the corresponding permission to the host application, and the user has granted the corresponding permission to the application in the host, allow the application in the host to call the third API, otherwise Denying the application in the host to call the third API.
The method of claim 1, further comprising:

Intercepting the call of the fourth API by the host application installed in the host application through the fourth Hook function; wherein, the fourth API is used to obtain the information of the installed host application in the host application;

The self information of the application in the host is returned to the application in the host.
A rights management device, characterized in that it includes:

The first Hook module is used to intercept the call of the first API by the host application installed in the host application through the first Hook function; wherein, at least one host application is installed in the host application, and the first API Used to apply for the first permission to the operating system;

A permission application management module, configured to grant the host application the first permission when the operating system grants the first permission to the host application and the user grants the first permission to the host application the first permission.
The apparatus of claim 7, further comprising:

The second Hook module is used to intercept the call of the second API by the host application installed in the host application program through the second Hook function; wherein, the second API is used to request the operating system to verify whether the authorization has the second permission ;

A permission verification management module, configured to send the host application the second permission if the operating system has granted the second permission to the host application and the user has granted the second permission to the host application. The internal application returns authorized, otherwise returns unauthorized to the host internal application.
A computer-readable storage medium, on which a computer program is stored, wherein, when the program is executed by a processing device, the steps of the method described in any one of claims 1-6 are implemented.
An electronic device comprising:

a storage device on which a computer program is stored;

A processing device configured to execute the computer program in the storage device to implement the steps of the method according to any one of claims 1-6.