CN111222153B

CN111222153B - Application program authority management method and device and storage medium

Info

Publication number: CN111222153B
Application number: CN202010012481.3A
Authority: CN
Inventors: 张燕; 丁海峰
Original assignee: Tencent Technology Shenzhen Co Ltd
Current assignee: Tencent Technology Shenzhen Co Ltd
Priority date: 2020-01-07
Filing date: 2020-01-07
Publication date: 2023-04-07
Anticipated expiration: 2040-01-07
Also published as: CN111222153A

Abstract

The application relates to an application program authority management method, an application program authority management device and a computer readable storage medium, wherein the method comprises the following steps: the method comprises the steps of setting initial authority of an application program on a terminal to be managed by obtaining equipment information of the terminal to be managed, initial authority and configuration information of the application program to be managed, generating authority updating information according to an authority updating request, sending the authority updating information to the terminal to be managed, updating the authority information of the application program to be managed through an authority control module, and completing an authority management process.

Description

Application program authority management method and device and storage medium

Technical Field

The present application relates to the field of computer technologies, and in particular, to a method and an apparatus for managing application program permissions, and a computer-readable storage medium.

Background

With the popularization of smart devices and the development of mobile internet, smart devices have gradually become a part of people's lives. But the security of the user mobile phone is urgently limited for large enterprises such as financial industry, government department and even processing factory. Of course, the security herein not only refers to the security of the smart device itself, but also refers to the restriction of the user's right, etc. Taking the government affair department as an example, more and more government affair office software is gradually 'internet', how to lead the government affair office to be more efficient, ensure that the government affair information is kept secret, and simultaneously lead the working environment of the staff of the government affair department to be more friendly, therefore, how to properly solve the problem becomes a difficult problem in front of the manager of the department.

In order to satisfy the dynamic management of the application program on the terminal, apple company has proposed a solution of MDM (mobile device management), but if MDM is required to perform complete authority control on the application program, it needs to be implemented by adopting a "strong management and control" scheme, and this process needs to be implemented by reformatting the terminal of the user.

Disclosure of Invention

In view of the above, it is necessary to provide an application rights management method, an apparatus, a computer-readable storage medium, and a computer device for solving the problem in the prior art that the application rights management needs to be completed at a terminal of a formatting user.

An application rights management method, comprising:

receiving an application program authority management request;

identifying a terminal to be managed and an application program to be managed according to the application program authority management request;

acquiring a device identifier of a terminal to be managed and initial authority information and configuration information of an application program to be managed;

sending initial authority information and configuration information to a terminal to be managed according to the equipment identifier;

when receiving an authority updating request of an application program to be managed, sending an authority updating message to the terminal to be managed, wherein the authority updating message carries authority updating target data and an authority control module access key in the terminal to be managed, and the authority control module is used for carrying out authority management on the application program to be managed in the running process of the application program to be managed.

An application rights management method, comprising:

receiving initial authority information and configuration information of an application program to be managed;

caching initial permission information and configuration information to initialize permission configuration information of an application program to be managed in a permission control module;

receiving an authority updating message corresponding to the application program to be managed, wherein the authority updating message carries authority updating target data and an authority control module access key;

updating the authority configuration information of the application program to be managed according to the access key of the authority control module and the authority updating target data;

and after the application program to be managed is started, performing authority management on the application program to be managed according to the updated authority configuration information in the running process of the application program to be managed.

An application rights management apparatus, the apparatus comprising:

the request acquisition module is used for receiving an application program authority management request;

the device identification module is used for identifying the terminal to be managed and the application program to be managed according to the application program authority management request;

the system comprises a configuration information acquisition module, a management module and a management module, wherein the configuration information acquisition module is used for acquiring the equipment identifier of a terminal to be managed and the initial authority information and the configuration information of an application program to be managed;

the authority information sending module is used for sending the initial authority information and the configuration information to the terminal to be managed according to the equipment identifier;

and the updating information sending module is used for sending a permission updating message to the terminal to be managed when receiving a permission updating request of the application program to be managed, wherein the permission updating message carries permission updating target data and a permission control module access key in the terminal to be managed, and the permission control module is used for carrying out permission management on the application program to be managed in the running process of the application program to be managed.

An application rights management apparatus, the apparatus comprising:

the system comprises an initial information receiving module, a management module and a management module, wherein the initial information receiving module is used for receiving initial authority information and configuration information of an application program to be managed;

the configuration information initialization module is used for caching initial permission information and configuration information so as to initialize the permission configuration information of the application program to be managed in the permission control module;

the updating information acquisition module is used for receiving the authority updating information corresponding to the application program to be managed, and the authority updating information carries authority updating target data and an access key of the authority control module;

the configuration information updating module is used for updating the authority configuration information of the application program to be managed according to the access key of the authority control module and the authority updating target data;

and the authority management module is used for carrying out authority management on the application program to be managed according to the updated authority configuration information in the running process of the application program to be managed after the application program to be managed is started.

A computer-readable storage medium, on which a computer program is stored which, when executed by a processor, carries out the steps of:

receiving an application program authority management request;

acquiring equipment identification of a terminal to be managed and initial authority information and configuration information of an application program to be managed;

receiving initial permission information and configuration information of an application program to be managed;

The application program authority management method, the device, the computer readable storage medium and the computer equipment receive the application program authority management request; identifying a terminal to be managed and an application program to be managed according to the application program authority management request; acquiring a device identifier of a terminal to be managed and initial authority information and configuration information of an application program to be managed; sending initial authority information and configuration information to a terminal to be managed according to the equipment identifier; and when receiving an authority updating request of the application program to be managed, sending an authority updating message to the terminal to be managed. According to the method and the device, the initial authority of the application program is set on the terminal to be managed by acquiring the device information of the terminal to be managed, the initial authority of the application program to be managed and the configuration information of the application program to be managed, then the authority updating message is generated according to the authority updating request and is sent to the terminal to be managed, the authority information of the application program to be managed is updated through the authority control module, the authority management process is completed, and the whole-process authority management of the application program can be completed without formatting the terminal.

Drawings

FIG. 1 is a diagram of an application environment for a method for application rights management in one embodiment;

FIG. 2 is a flowchart illustrating a method for application rights management in one embodiment;

FIG. 3 is a flowchart illustrating steps for identifying applications to be managed and terminals to be managed in one embodiment;

FIG. 4 is a diagram showing a configuration of a server in one embodiment;

FIG. 5 is a diagram of an installation description file interface in one embodiment;

FIG. 6 is a flow diagram that illustrates the steps of generating and sending a store install message, in one embodiment;

FIG. 7 is a flowchart illustrating the steps of generating a rights update message in one embodiment;

FIG. 8 is a flowchart illustrating a method for application rights management in another embodiment;

FIG. 9 is a timing diagram of a method for application rights management in one embodiment;

FIG. 10 is a diagram showing an application environment of a rights management method of an application program in another embodiment;

FIG. 11 is a flowchart illustrating a method for application rights management in accordance with yet another embodiment;

FIG. 12 is a block diagram showing the construction of an application rights management unit according to an embodiment;

FIG. 13 is a block diagram showing the construction of an application rights management apparatus according to another embodiment;

FIG. 14 is a block diagram showing a configuration of a computer device according to an embodiment.

Detailed Description

In order to make the objects, technical solutions and advantages of the present application more apparent, the present application is described in further detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the present application and are not intended to limit the present application.

FIG. 1 is a diagram of an application environment for a method for application rights management in one embodiment. Referring to fig. 1, the application rights management method is applied to an MDM system. The MDM system includes a terminal 102 and a server 104. The terminal 102 and the server 104 are connected via a network. The terminal 102 includes a rights control module that is established based on the Runtime characteristic. Server 104 first receives an application rights management request; identifying a terminal to be managed and an application program to be managed according to the application program authority management request; then, acquiring the equipment identifier of the terminal 102 to be managed; acquiring initial authority information and configuration information of an application program to be managed; and then, according to the device identifier, sending the initial permission information and the configuration information to the terminal 102 to be managed so as to set the initial permission of the application program to be managed. The terminal to be managed 102 receives the initial authority information and the configuration information. Then, an authority control module in the terminal to be managed reads the initial authority information and the configuration information of the application program to be managed from the terminal 102 to be managed, initializes the authority configuration information of the application program to be managed according to the initial authority information and the configuration information, and then performs authority management on the application program to be managed through the authority configuration information. When receiving an authority updating request of an application program to be managed, the server 104 sends an authority updating message to the terminal to be managed, wherein the authority updating message carries authority updating target data and an authority control module access key in the terminal to be managed. The terminal 102 to be managed receives the authority updating message corresponding to the application program to be managed; updating the authority configuration information of the application program to be managed according to the access key of the authority control module and the authority updating target data; after the application program to be managed is started, the terminal 102 to be managed performs authority management on the application program to be managed according to the updated authority configuration information in the running process of the application program to be managed through the authority control module. The terminal 102 to be managed may be at least one of a mobile phone, a tablet computer, a notebook computer, and the like. The server 104 may be implemented as a stand-alone server or as a server cluster comprised of multiple servers.

As shown in FIG. 2, in one embodiment, an application rights management method is provided. The embodiment is mainly illustrated by applying the method to the server 104 in fig. 1. Referring to fig. 2, the method for managing application program rights specifically includes the following steps:

s210, receiving an application program authority management request.

The received application program authority management request may specifically be a request submitted to a server by a user, and is used to manage a certain application program to be managed on a specified terminal to be managed. The application program authority management request specifically comprises the terminal to be managed and the related information of the application program to be managed, and the terminal to be managed and the application program to be managed can be identified through the application program authority management request.

Specifically, when the application program authority management method starts to be implemented, the user may input the relevant information of the terminal to be managed to the server, and select the application program to be managed at the same time.

And S230, identifying the terminal to be managed and the application program to be managed according to the application program authority management request.

The application to be managed refers to a target application managed by the application authority management method of the application. And the terminal to be managed refers to the terminal where the application to be managed is located. The managed permissions may include network permissions, clipboard permissions, watermark setting permissions, camera permissions, pasting board permissions, sharing permissions, and the like. The terminal to be managed can be an intelligent mobile terminal carrying an IOS system or an intelligent mobile terminal carrying an Android system. The server can analyze the application program authority management request submitted by the user and identify the management target, namely the terminal to be managed and the application program to be managed.

As shown in fig. 3, in one embodiment, step S230 includes:

s231, the application program authority management request is analyzed, click position information corresponding to the application program authority management request is determined, and the device configuration information file is read at the preset device information file storage address according to the application program authority management request.

And S233, searching the program identification information of the application program to be managed in the preset application program list according to the click position information.

And S235, identifying the application program to be managed according to the program identification information.

S237, reading the device configuration information file at the storage address of the preset device information file according to the application program authority management request.

And S239, identifying the terminal to be managed according to the equipment configuration information file.

The click position information refers to position information of an application program to be managed in a preset application program list determined by a user, a preset device information file storage address can be a preset fixed address and can be selected according to the actual situation of the user, and the user can upload a device configuration information file corresponding to a terminal to be managed to the preset device information file storage address. The device configuration information file is specifically a file for describing configuration information of the terminal to be managed, and includes a file specifically in an XML (Extensible markup language) format, and the user may upload the device configuration information file to a storage address of the preset device information file in an https (Hyper text transfer protocol secure token layer) form. The program identification information refers to information for identifying a program to be managed, and the server discriminates and recognizes the program by the program identification information.

Specifically, a user can upload an equipment configuration information file to a server, then the server can push all application programs to be managed to the user in a list form, after the user determines the application programs to be managed, the server can generate corresponding application program authority management requests by clicking the corresponding position of the list and pressing a 'confirm' button, and starts an authority management process. And meanwhile, after the server receives the application program authority management request, the server can directly read the device configuration information file at the preset device information file storage address and identify the terminal to be managed. Through the application program identification, the application program to be managed can be more effectively identified. And S250, acquiring the equipment identifier of the terminal to be managed and the initial authority information and the configuration information of the application program to be managed.

The device identifier is identification information for identifying a terminal to be managed, and includes information such as an identification code of the device. In one embodiment, the terminal to be managed may specifically be an intelligent mobile terminal of the IOS system, and the device identifier may specifically be a devicetoken and a UDID (unique identifier) of the IOS system, where the devicetoken is a device identifier of the IOS system. And UDID is a unique identification code of an IOS terminal consisting of 40 letters and numbers. In one embodiment, the acquired information further includes an MDM identifier. The MDM identifier is the unique identifier of the marking device when the MDM server is used for pushing. The initial permission information specifically includes initial setting information of permissions such as a network permission, a shear plate permission, a watermark setting permission, a camera permission, a pasting plate permission and a sharing permission, and the initial permission information is corresponding application initial default permission information. In the authority control process of the authority management method, the authority of the application program needs to be managed at a specified moment or according to an input instruction, and in order to ensure that the application program can be operated smoothly after being installed, initial authority needs to be set for the application program through initial-test authority information. The basic configuration information is information used for initial configuration of the application program.

In one embodiment, the server 104 of the present application is installed with a Universal Energy Management (UEM) system, in one embodiment, the server is an IOS system server, the server 104 further includes a background server and a configuration server, the server may specifically refer to fig. 4, a user may manage the authority of an application program on a terminal in a server area through the UEM system, and the user may know the installation condition of the application program on a controlled terminal and the operation condition of the application program through the UEM system very clearly. And management of application rights and the like can be accomplished through the UEM system. The UEM system mainly comprises an environment safety detection module, a device management module, a user management module, an application management module and the like. The application management module is used for realizing the functions of application installation, application deletion, application release, application upgrade and the like. The application management module is also used for realizing the authority management function of the application. The authority of management specifically comprises a network authority, a shear plate authority, a watermark setting authority, a camera authority, a pasting plate authority, a sharing authority and the like. And the database connected with the background server stores the equipment identification and the MDM identifier of each terminal. When a user needs to perform authority management on a specified terminal to be managed, the user can select the terminal to be managed on a corresponding interface of the UEM system, then the UEM system extracts a device identifier and an MDM identifier corresponding to the selected terminal to be managed from a database through a background server, and meanwhile, the background server can also take out initial authority information and configuration information of an application program to be managed from a configuration server. The J server can also perform initial authority control on the terminal to be managed by reading the authority setting description file. In one embodiment, the terminal to be managed is an IOS terminal, the rights setting description file may specifically be a file in a profile format, and the rights setting description file is substantially a file in an XML format and includes the following contents: data such as the address where the initial rights information and configuration information are stored, security policies and restrictions for the device, system configuration information, wireless local area network settings, email accounts, and calendar accounts. The authority setting description file comprises an address of a storage server which stores initial authority information and configuration information, and the server can acquire the initial authority information and the configuration information from the storage server through the installed authority setting description file. The configuration description file can quickly load the initial permission information and the configuration information on the equipment. The process of installing the description file may specifically refer to fig. 5. The server can more efficiently acquire the information related to the device configuration through the authority description file.

In one embodiment, step S250 includes: generating a device awakening message according to the device configuration information file and a pre-stored URL address, and sending the device awakening message to a terminal to be managed; when receiving a state feedback message fed back by the equipment to be managed according to the equipment awakening message, sending an equipment information query message to the terminal to be managed; and acquiring the equipment identifier fed back by the terminal to be managed according to the equipment information query instruction.

The pre-stored URL website may be a URL website corresponding to an MDM server included in the server of the present application, the state feedback message specifically refers to state feedback of whether the current terminal to be managed is in an idle state, and the MDM server may manage the terminal to be managed in the idle state.

Specifically, the server may generate a device wake-up message according to the device configuration information file and the pre-stored URL address, send the device wake-up message to the terminal to be managed, wake up the terminal to be managed by the device wake-up message to perform management, after the terminal to be managed receives the device wake-up message, the terminal to be managed may generate a state feedback message according to the pre-stored URL address when the terminal is idle, and send the state feedback message to the MDM server, at this time, a call between the MDM server and the terminal to be managed may be started, and at this time, the MDM server may request the device identification information from the server through a device information query instruction.

And step S270, sending the initial authority information and the configuration information to the terminal to be managed according to the equipment identifier.

Specifically, the terminal to be managed comprises a system data storage area, the system data storage area is confidential, the server can send the device identifier and the MDM identifier to the terminal to be managed and write the data into the system data storage area, and the authority control module in the terminal to be managed can read the initial authority information and the configuration information from the system data storage area so as to complete the initial authority setting process of the application program to be managed.

As shown in fig. 6, in one embodiment, step S270 includes:

s272, an application installation instruction is generated.

And S274, calling a preset packaging script, and packaging the application program installation instruction, the initial permission information and the configuration information according to the packaging script to generate a storage installation message.

S276, sending a data storage installation message to the terminal to be managed according to the equipment identifier, wherein the storage installation message is used for indicating the terminal to be managed to store the initial authority information and the configuration information into a preset system data storage area, and responding to an installation instruction to install the application program to be managed.

The system data storage area is a special encrypted storage area on the terminal to be managed and is used for storing initial authority information and configuration information. The application program installation instruction is used for indicating the terminal to be managed to install the application program to be managed.

Specifically, the server can call a preset shell packaging script through the equipment identifier and the MDM identifier, package the application program installation instruction, the initial permission information and the configuration information according to the packaging script to generate an application program installation instruction for installing the application program to be managed, and then install the application program to be managed at the terminal to be managed through the application program installation instruction. Meanwhile, the initial authority information and the configuration information can be sent to a system data storage area of the terminal to be managed for authority management, and then the application program to be managed is installed on the terminal to be managed by sending an application program installation instruction to the terminal to be managed. The server can more conveniently complete the installation process of the application program to be managed through the program installation instruction. Meanwhile, the effectiveness of initial permission setting can be ensured.

Step S290, when receiving the authority updating request of the application program to be managed, sending an authority updating message to the terminal to be managed, wherein the authority updating message carries authority updating target data and an authority control module access key in the terminal to be managed, and the authority control module is used for carrying out authority management on the application program to be managed in the running process of the application program to be managed.

The authority updating request refers to a corresponding file generated when the authority of the application program to be managed needs to be changed, and the authority updating request is used for claiming a corresponding authority updating instruction. The server can complete the process of authority management through the authority control module by sending the authority updating instruction to the authority control module on the terminal to be managed. The authority updating target data refers to a file used for updating the application program to be managed, the authority control module access key refers to a key used by the terminal for accessing a storage address of the authority control module, the authority control module is an encryption module for the terminal to be controlled, and the authority updating process can be completed only through the access key. The authority control module is a module for carrying out authority adaptation on the application program through a Runtime characteristic. Runtime refers to dynamically creating a class, and dynamically adding and modifying the attribute and method of the class in the program running process; or traversing all member variables, attributes, and all methods in a class; or the characteristics of the effect of message transmission and forwarding are realized, in the application, the authority control module is mainly constructed through the Runtime characteristic, and then the authority control module is used for carrying out dynamic authority management on the program in the program running process.

Specifically, the permission updating request may be a request sent by the terminal to be managed to the server or a request input by the user for forcibly updating the permission. The server acquires the authority updating request of the application program to be managed, generates a corresponding authority updating message according to the authority updating request, and then sends the authority updating message to the terminal to be managed, the terminal accesses the storage area of the key access authority control module through the authority control module in the authority updating message, and completes the authority updating process according to the authority updating target data. And the authority control module updates the authority information corresponding to the application program to be managed through the authority updating message, so that the authority management process of the application program is completed.

As shown in fig. 7, step S290 includes:

s292, when receiving the authority updating request of the application program to be managed, obtaining the authority updating configuration information of the application program to be managed according to the authority updating request.

S294, comparing the authority updating configuration information with the initial authority information.

And S296, when the authority updating configuration information is different from the initial authority information, generating an authority updating message according to the authority updating configuration information.

And S298, sending the authority updating message to the terminal to be managed.

The permission updating configuration information refers to setting information corresponding to each permission, such as network permission, shear plate permission, watermark setting permission, camera permission, paste plate permission, sharing permission and the like in new permission configuration.

The server can receive the authority updating request sent by the terminal to be managed, then the authority updating configuration information of the application program to be managed is searched and obtained, whether the authority configuration before and after updating is the same or not is compared, when the authority configuration information is different, the authority updating information is generated according to the new authority configuration information, and then the authority of the program on the terminal to be managed is managed through the authority updating information. In one embodiment, the terminal to be managed can send an authority updating request to the server at a preset time interval to request a new authority, after receiving the authority updating request, the server searches the authority updating configuration information corresponding to the current application program to be managed, when the authority is changed, an authority updating message can be generated to control the authority of the application program to be managed on the terminal to be managed, and if the authority is not changed, the authority updating message does not need to be sent. In addition, after the server sends the authority updating message, the initial authority information is also updated through the authority updating configuration information, the initial authority information is replaced by the authority updating configuration information, and the consistency with the authority information in the terminal to be managed is guaranteed. Through the comparison of the front and the back authorities, the waste of computing resources can be effectively reduced.

In one embodiment, step S960 includes: when the authority updating configuration information is different from the initial authority information, acquiring the updated authority parameters according to the authority updating configuration information; acquiring a configuration element label in a preset authority configuration template, and identifying an authority configuration item corresponding to the updated authority parameter according to the configuration element label; updating the corresponding authority configuration item according to the updated authority parameter; and generating an authority updating message according to the preset authority configuration template after the authority configuration item is updated.

The permission parameters specifically refer to permission setting parameters corresponding to each permission, for example, permission to start a camera, no permission to call a media library, and the like, the configuration element tags refer to tags set by the server for each permission configuration item in a preset permission configuration template, and the corresponding permission configuration items can be more conveniently searched and determined through the configuration element tags and then correspondingly replaced.

Specifically, when the server recognizes that the permission update configuration information is different from the initial permission information, the server may obtain the updated permission parameters according to the permission update configuration information, and in one embodiment, the server may determine which permission parameters need to be updated according to the detected difference, and then obtain only the permission parameters of the part that needs to be updated. After the authority parameters are obtained, the server calls a preset authority configuration template, configuration element labels are extracted, authority configuration items corresponding to the updated authority parameters are identified according to the configuration element labels, and then the corresponding authority configuration items in the preset authority configuration template are updated according to the updated authority parameters to generate authority updating information. By setting the authority updating template, the generation process of the authority updating message can be completed more efficiently, and the efficiency of authority configuration is improved.

The application program authority management method receives the application program authority management request; identifying a terminal to be managed and an application program to be managed according to the application program authority management request; acquiring a device identifier of a terminal to be managed and initial authority information and configuration information of an application program to be managed; sending initial authority information and configuration information to a terminal to be managed according to the equipment identifier; and when receiving the authority updating request of the application program to be managed, sending an authority updating message to the terminal to be managed. According to the method and the device, the initial authority of the application program is set on the terminal to be managed by acquiring the device information of the terminal to be managed, the initial authority of the application program to be managed and the configuration information of the application program to be managed, then the authority updating message is generated according to the authority updating request and is sent to the terminal to be managed, the authority information of the application program to be managed is updated through the authority control module, the authority management process is completed, and the whole-process authority management of the application program can be completed without formatting the terminal.

As shown in FIG. 7, in one embodiment, a method for application rights management is provided. The embodiment is mainly illustrated by applying the method to the terminal 102 to be managed in fig. 1. Referring to fig. 8, the method for managing application program rights specifically includes the following steps:

s410, receiving initial authority information and configuration information of the application program to be managed.

The initial authority information and the configuration information of the application program to be managed are specifically stored in a system data storage area of the current terminal to be managed. After receiving the initial permission information and the configuration information of the application program to be managed, the permission control module in the terminal can directly read the initial permission information and the configuration information of the application program to be managed from the system data storage area.

S430, caching the initial permission information and the configuration information to initialize the permission configuration information of the application program to be managed in the permission control module.

The permission configuration information refers to permission information corresponding to the user starting the application program to be managed. The application specifically carries out permission configuration on the application program to be managed in the using process through the permission control module, and the configurable permission comprises network permission, shear plate permission, watermark setting permission, camera permission, paste plate permission, sharing permission and the like.

The terminal to be managed can cache the initial permission information and the configuration information to the system data storage area, and then the permission control module can directly read the initial permission information and the configuration information of the application program to be managed from the system data storage area and initialize the permission configuration information of the current application program to be managed according to the initial permission information and the configuration information. When the user needs to start the application program to be managed, the application program to be managed can be started by the initial authority information and the configuration information.

S450, receiving an authority updating message corresponding to the application program to be managed, wherein the authority updating message carries authority updating target data and an authority control module access key.

The permission update message is used for updating the permission configuration information. Including rights update target data and rights control module access keys.

The terminal to be managed can communicate with the server 104 through a network. When the server needs to update the authority of the application program to be managed and modify the authority configuration information of the application program to be managed, the authority can be updated by sending an authority updating message to the terminal to be managed.

In one embodiment, step S450 is preceded by: and reading time information corresponding to the current moment. And comparing the time information with the preset authority updating time point, and sending an authority updating request when the preset authority updating time point comprises the time point corresponding to the time information.

The preset authority updating time point refers to a preset time point for updating a plurality of authorities, and the preset authority updating time point can be set according to the actual needs of users. For example, a camera in an area that is prohibited from starting an application between 9 am and 12 am, the permission update time point may be set by setting a permission update time point at 9 am and 12 am, respectively.

Specifically, the permission control module determines a current time point, and when the preset permission update time point includes a time point corresponding to the time information, the terminal sends a permission update request to the background server to request the server to update the permission of the current application program to be managed. In another embodiment, the right control module continuously sends a right update request to the server at preset time intervals to request a right update message of the server. The authority of the application program can be managed in time slots by setting the time of the authority update.

And S470, updating the authority configuration information of the application program to be managed according to the access key of the authority control module and the authority updating target data.

The authority updating target data refers to a file used for updating the application program to be managed, the authority control module access key refers to a key used by the terminal for accessing a storage address of the authority control module, the authority control module is an encryption module for the terminal to be controlled, and the authority updating process can be completed only through the access key.

The server can update the authority configuration information of the application program to be managed according to the authority control module access key and the authority update target data carried in the authority update message

In one embodiment, step S470 includes: storing the authority updating target data to an authority management storage area of the authority control module according to the access key of the authority control module; and updating the authority configuration information of the application program to be managed according to the authority updating target data.

Specifically, the authority control module is an encryption module for the terminal to be controlled, and the terminal can access the storage area of the key access authority control module through the authority control module and replace the original authority configuration file in the storage area with the authority configuration file in the authority updating target data. And finishing the process of updating the authority configuration.

And S490, after the application program to be managed is started, performing authority management on the application program to be managed according to the updated authority configuration information in the running process of the application program to be managed.

After the authority configuration file is updated, the terminal can complete authority management on the application program to be managed through the authority control module through the updated authority configuration information. The authority management is specifically to perform authority management in the running process of the application program to be managed based on the Runtime characteristic through an authority management module, so that the timeliness of the authority management process is guaranteed.

The application program authority management method receives the initial authority information and the configuration information of the application program to be managed; initializing authority configuration information of an application program to be managed in the authority control module according to the initial authority information and the configuration information; receiving an authority updating message corresponding to the application program to be managed, wherein the authority updating message carries authority updating target data and an authority control module access key; updating the authority configuration information of the application program to be managed according to the access key of the authority control module and the authority updating target data;

and after the application program to be managed is started, the application program to be managed can be subjected to authority management according to the updated authority configuration information based on the Runtime characteristic. According to the method and the device, initial management is performed on the authority through the introduction of the initial authority information, then the authority of the application program to be managed is managed through the authority control module and the authority updating message, and the whole-process authority management of the application program can be completed without formatting the terminal.

Fig. 9 is a timing diagram of an application rights management method in an embodiment, where a server first receives an application rights management request, identifies a terminal to be managed and an application to be managed according to the application rights management request, and then obtains a device identifier and an MDM identifier of the terminal to be managed; simultaneously acquiring initial permission information and configuration information of an application program to be managed; and then, sending initial permission information and configuration information to the terminal to be managed according to the equipment identifier and the MDM identifier, reading the initial permission information and the configuration information from the terminal to be managed by the permission setting module, and carrying out permission configuration on the application program to be managed according to the initial permission information and the configuration information. Meanwhile, the server can also obtain an authority updating request of the application program to be managed and send authority updating messages corresponding to the authority updating request to the terminal to be managed, and the terminal to be managed receives the authority updating messages and updates the authority configuration. And then the authority control module carries out authority management on the application program to be managed through the updated authority configuration.

FIG. 10 is a diagram illustrating an exemplary application environment of the method for managing application program rights in one embodiment. The management system comprises a server, a permission control module and a background server, wherein the server specifically comprises a UEM client and the background server, a terminal to be managed is a terminal of an IOS system, the permission control module is a forwarding module constructed by the Runtime characteristic of IOSObject-C, in the implementation process, a user firstly sends a request to the background server through the UEM client, and the background sends a device identifier and an MDM identifier of the terminal to be managed by the server; and giving the initial authority information, the configuration information and other authority and configuration information of the application program to be managed to the UEM client. The device identifier of the terminal to be managed and the MDM identifier can also be input to the UEM client from the outside by the user. And then the UEM client writes the initial permission information and the configuration information of the application program to be managed into a system data storage area of the IOS system, and then the Warpping module can read the initial permission information and the configuration information of the application program to be managed from the system data storage area of the IOS and perform permission management on the application program to be managed. And then the forwarding module can send an authority updating request to the background server at regular time, and after the terminal receives the authority information fed back by the background server, the authority of the application program to be managed in the IOS system can be modified according to the fed-back authority information.

FIG. 11 is a flowchart illustrating a method for application rights management in one embodiment. It should be understood that, although the steps in the flowchart of fig. 11 are shown in order as indicated by the arrows, the steps are not necessarily performed in order as indicated by the arrows. The steps are not performed in the exact order shown and described, and may be performed in other orders, unless explicitly stated otherwise. Moreover, at least a portion of the steps in fig. 11 may include multiple sub-steps or multiple stages that are not necessarily performed at the same time, but may be performed at different times, and the order of performance of the sub-steps or stages is not necessarily sequential, but may be performed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

In one embodiment, as shown in figure 12, there is provided an application rights management apparatus, the apparatus comprising:

a request obtaining module 210, configured to receive an application program authority management request;

the device identification module 230 is configured to identify a terminal to be managed and an application to be managed according to the application permission management request;

a configuration information obtaining module 250, configured to obtain a device identifier of the terminal to be managed and initial permission information and configuration information of the application to be managed;

the permission information sending module 270 is configured to send the initial permission information and the configuration information to the terminal to be managed according to the device identifier;

the update information sending module 290 is configured to send, when receiving an authority update request of the application program to be managed, an authority update message to the terminal to be managed, where the authority update message carries authority update target data and an authority control module access key in the terminal to be managed, and the authority control module is configured to perform authority management on the application program to be managed in an operation process of the application program to be managed.

In one embodiment, the device identification module 230 is specifically configured to: analyzing the application program authority management request, determining click position information corresponding to the application program authority management request, and reading a device configuration information file at a preset device information file storage address according to the application program authority management request; searching program identification information of the application program to be managed in a preset application program list according to the click position information; identifying the application program to be managed according to the program identification information; reading a device configuration information file at a preset device information file storage address according to the application program authority management request; and identifying the terminal to be managed according to the equipment configuration information file.

In one embodiment, the configuration information obtaining module 250 is configured to: generating a device awakening message according to the device configuration information file and a pre-stored URL address, and sending the device awakening message to a terminal to be managed; when receiving a state feedback message fed back by the equipment to be managed according to the equipment awakening message, sending an equipment information query message to the terminal to be managed; and acquiring the equipment identifier fed back by the terminal to be managed according to the equipment information query instruction.

In one embodiment, the permission information sending module 270 is configured to: generating an application program installation instruction; calling a preset packaging script, and packaging the application program installation instruction, the initial permission information and the configuration information according to the packaging script to generate a storage installation message; and sending a data storage installation message to the terminal to be managed according to the equipment identifier, wherein the storage installation message is used for indicating the terminal to be managed to store the initial authority information and the configuration information into a preset system data storage area, and responding to an installation instruction to install the application program to be managed.

In one embodiment, the update information sending module 290 is configured to: when receiving an authority updating request of an application program to be managed, acquiring authority updating configuration information of the application program to be managed according to the authority updating request; comparing the authority updating configuration information with the initial authority information; when the authority updating configuration information is different from the initial authority information, generating an authority updating message according to the authority updating configuration information; and sending the authority updating message to the terminal to be managed.

In one embodiment, the update information sending module 290 is further configured to: when the authority updating configuration information is different from the initial authority information, acquiring updated authority parameters according to the authority updating configuration information; acquiring a configuration element label in a preset authority configuration template, and identifying an authority configuration item corresponding to the updated authority parameter according to the configuration element label; updating the corresponding authority configuration item according to the updated authority parameter; and generating an authority updating message according to the preset authority configuration template after the authority configuration item is updated.

In one embodiment, as shown in fig. 13, there is provided an application rights management apparatus, including:

an initial information receiving module 410, configured to receive initial permission information and configuration information of an application to be managed;

a configuration information initialization module 430, configured to cache the initial permission information and the configuration information, so as to initialize the permission configuration information of the application program to be managed in the permission control module;

the update information acquisition module 450 is configured to receive an authority update message corresponding to the application to be managed, where the authority update message carries authority update target data and an authority control module access key;

the configuration information updating module 470 is configured to update the permission configuration information of the application to be managed according to the permission control module access key and the permission update target data;

and the authority management module 490 is configured to perform authority management on the application program to be managed according to the updated authority configuration information based on the Runtime characteristic after the application program to be managed is started.

FIG. 14 is a diagram illustrating an internal structure of a computer device in one embodiment. The computer device may specifically be the terminal 102 (or the server 104) in fig. 1. As shown in fig. 14, the computer apparatus includes a processor, a memory, a network interface, an input device, and a display screen connected through a system bus. Wherein the memory includes a non-volatile storage medium and an internal memory. The non-volatile storage medium of the computer device stores an operating system and may also store a computer program that, when executed by the processor, causes the processor to implement the application rights management method. The internal memory may also have stored therein a computer program that, when executed by the processor, causes the processor to perform the application rights management method. The display screen of the computer equipment can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer equipment can be a touch layer covered on the display screen, a key, a track ball or a touch pad arranged on the shell of the computer equipment, an external keyboard, a touch pad or a mouse and the like.

It will be appreciated by those skilled in the art that the configuration shown in fig. 14 is a block diagram of only a portion of the configuration associated with the present application, and is not intended to limit the computing device to which the present application may be applied, and that a particular computing device may include more or fewer components than shown, or may combine certain components, or have a different arrangement of components.

In one embodiment, the application program authority management device provided by the application program can be implemented in a form of a computer program, and the computer program can run on a computer device as shown in fig. 14. The memory of the computer device may store various program modules constituting the application program authority management apparatus, such as a device information acquisition module, an initial information acquisition module, an authority information transmission module, and an update information transmission module shown in fig. 10. The computer program constituted by the respective program modules causes the processor to execute the steps in the application program authority management method of the respective embodiments of the present application described in the present specification.

In one embodiment, a computer device is provided, comprising a memory and a processor, the memory storing a computer program which, when executed by the processor, causes the processor to perform the steps of the application rights management method described above. The steps of the application right management method herein may be the steps in the application right management methods of the various embodiments described above.

In one embodiment, a computer readable storage medium is provided, storing a computer program that, when executed by a processor, causes the processor to perform the steps of the application rights management method described above. The steps of the application right management method herein may be the steps in the application right management methods of the various embodiments described above.

It will be understood by those skilled in the art that all or part of the processes in the methods of the embodiments described above can be implemented by instructing related hardware through a computer program, and a program corresponding to the application program right management method can be stored in a non-volatile computer-readable storage medium, and when executed, the program can include the processes of the embodiments of the methods described above. Any reference to memory, storage, database, or other medium used in the embodiments provided herein may include non-volatile and/or volatile memory, among others. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically Programmable ROM (EPROM), electrically Erasable Programmable ROM (EEPROM), or flash memory. Volatile memory can include Random Access Memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms such as Static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double Data Rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous Link DRAM (SLDRAM), rambus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

The technical features of the above embodiments can be arbitrarily combined, and for the sake of brevity, all possible combinations of the technical features in the above embodiments are not described, but should be considered as the scope of the present specification as long as there is no contradiction between the combinations of the technical features.

The above examples only express several embodiments of the present application, and the description thereof is more specific and detailed, but not construed as limiting the scope of the present application. It should be noted that, for a person skilled in the art, several variations and modifications can be made without departing from the concept of the present application, which falls within the scope of protection of the present application. Therefore, the protection scope of the present patent application shall be subject to the appended claims.

Claims

1. An application rights management method, comprising:

receiving an application program authority management request;

acquiring the equipment identification of the terminal to be managed and the initial authority information and the configuration information of the application program to be managed;

sending the initial permission information and the configuration information to the terminal to be managed according to the equipment identifier;

when receiving an authority updating request of the application program to be managed, sending an authority updating message to the terminal to be managed, wherein the authority updating message carries authority updating target data and an authority control module access key in the terminal to be managed, and the authority control module is used for carrying out authority management on the application program to be managed in the running process of the application program to be managed.

2. The method according to claim 1, wherein the identifying the terminal to be managed and the application to be managed according to the application rights management request comprises:

analyzing the application program authority management request, determining click position information corresponding to the application program authority management request, and reading a device configuration information file at a preset device information file storage address according to the application program authority management request;

searching program identification information of the application program to be managed in a preset application program list according to the click position information;

identifying the application program to be managed according to the program identification information;

reading a device configuration information file at a preset device information file storage address according to the application program authority management request;

and identifying the terminal to be managed according to the equipment configuration information file.

3. The method according to claim 2, wherein the obtaining the device identifier of the terminal to be managed comprises:

generating a device awakening message according to the device configuration information file and a pre-stored URL address, and sending the device awakening message to the terminal to be managed;

when receiving a state feedback message fed back by the terminal to be managed according to the equipment awakening message, sending an equipment information query message to the terminal to be managed;

and acquiring the equipment identifier fed back by the terminal to be managed according to the equipment information inquiry instruction.

4. The method according to claim 1, wherein the sending the initial permission information and the configuration information to the terminal to be managed according to the device identifier comprises:

generating an application program installation instruction;

calling a preset packaging script, and packaging the application program installation instruction, the initial permission information and the configuration information according to the packaging script to generate a storage installation message;

and sending a data storage installation message to the terminal to be managed according to the equipment identifier, wherein the storage installation message is used for indicating the terminal to be managed to store the initial permission information and the configuration information into a preset system data storage area, and responding to the installation instruction to install the application program to be managed.

5. The method according to claim 1, wherein the sending of the permission update message to the terminal to be managed when receiving the permission update request of the application to be managed comprises:

when receiving an authority updating request of the application program to be managed, acquiring authority updating configuration information of the application program to be managed according to the authority updating request;

comparing the permission updating configuration information with the initial permission information;

when the authority updating configuration information is different from the initial authority information, generating an authority updating message according to the authority updating configuration information;

and sending the authority updating message to the terminal to be managed.

6. The method of claim 5, wherein when the permission update configuration information is different from the initial permission information, generating a permission update message according to the permission update configuration information comprises:

when the authority updating configuration information is different from the initial authority information, acquiring updated authority parameters according to the authority updating configuration information;

acquiring a configuration element label in a preset authority configuration template, and identifying an authority configuration item corresponding to the updated authority parameter according to the configuration element label;

updating the corresponding authority configuration item according to the updated authority parameter;

and generating an authority updating message according to the preset authority configuration template after the authority configuration item is updated.

7. An application rights management method, comprising:

caching the initial permission information and the configuration information to initialize the permission configuration information of the application program to be managed in the permission control module;

8. An application rights management apparatus, the apparatus comprising:

the configuration information acquisition module is used for acquiring the equipment identifier of the terminal to be managed and the initial authority information and the configuration information of the application program to be managed;

9. The apparatus of claim 8, wherein the device identification module is specifically configured to: analyzing the application program authority management request, determining click position information corresponding to the application program authority management request, and reading a device configuration information file at a preset device information file storage address according to the application program authority management request;

10. The apparatus of claim 9, wherein the configuration information obtaining module is configured to: generating a device awakening message according to the device configuration information file and a pre-stored URL address, and sending the device awakening message to the terminal to be managed;

11. The apparatus of claim 8, wherein the permission information sending module is configured to: generating an application program installation instruction;

12. The apparatus of claim 8, wherein the update information sending module is configured to: when receiving an authority updating request of the application program to be managed, acquiring authority updating configuration information of the application program to be managed according to the authority updating request;

and sending the authority updating message to the terminal to be managed.

13. The apparatus of claim 12, wherein the update information sending module is further configured to: when the authority updating configuration information is different from the initial authority information, acquiring updated authority parameters according to the authority updating configuration information;

14. An application rights management apparatus, the apparatus comprising:

the configuration information initialization module is used for caching the initial permission information and the configuration information so as to initialize the permission configuration information of the application program to be managed in the permission control module;

the updating information acquisition module is used for receiving an authority updating message corresponding to the application program to be managed, and the authority updating message carries authority updating target data and an access key of the authority control module;

15. A computer-readable storage medium, storing a computer program which, when executed by a processor, causes the processor to perform the steps of the method according to any one of claims 1 to 3 or 4 to 6.

16. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that the processor is caused to perform the steps of the method according to any one of claims 1 to 3 or 4 to 6.