CN114048154A

CN114048154A - Storage authority control method and device, mobile terminal and storage medium

Info

Publication number: CN114048154A
Application number: CN202111293533.XA
Authority: CN
Inventors: 黄超华
Original assignee: Meizu Technology Co Ltd
Current assignee: Meizu Technology Co Ltd
Priority date: 2021-11-03
Filing date: 2021-11-03
Publication date: 2022-02-15

Abstract

The invention relates to the field of system authority control, and discloses a storage authority control method, a device, a mobile terminal and a storage medium, wherein the method comprises the following steps: when determining that the application on the mobile terminal has a storage access operation, judging whether the storage access operation is an operation in a sharing scene; if not, displaying an authority management interface for storing the access authority; if the single authorization prompt message is detected to be triggered, performing single authorization of storage access operation on the application according to the triggered operation message; detecting whether an authority resetting condition is met after the application executes the storage access operation; if the authority resetting condition is met, resetting the storage authority of the application so as to solve the problems of authority abuse and lower information safety caused by overlarge authorized operation granularity of the existing system storage authority.

Description

Storage authority control method and device, mobile terminal and storage medium

Technical Field

The present invention relates to the field of storage right control, and in particular, to a storage right control method and apparatus, a mobile terminal, and a storage medium.

Background

At present, compared with the authorization situation of the native storage permission in the operating system, especially for the Android operating system, the native storage permission authorization in the Android is mainly provided through a popup, but the popup only includes an always-authorized option which is a persistent authorization implementation option, and in practical applications, operations of some applications may not provide a persistent authorization for the applications, for example, applications for implementing data acquisition, which cannot or are not allowed to provide the persistent authorization for the security of user information, and the storage permission basically can be applied and used by each application.

Disclosure of Invention

The invention mainly aims to provide a storage authority control method, a storage authority control device, a mobile terminal and a storage medium, and aims to solve the technical problems of authority abuse and low information security caused by overlarge authorized operation granularity of the existing system storage authority.

The invention provides a storage authority control method, which is applied to a mobile terminal and comprises the following steps: when determining that the application on the mobile terminal has a storage access operation, judging whether the storage access operation is an operation in a sharing scene; if the operation is not under the sharing scene, displaying an authority management interface for storing the access authority, wherein the authority management interface at least comprises authorization prompt information, and the authorization prompt information at least comprises single authorization prompt information; if the single authorization prompt message is detected to be triggered, performing single authorization of storage access operation on the application according to the triggered operation message; detecting whether an authority resetting condition is met after the application executes the storage access operation; and if the permission resetting condition is met, resetting the storage permission of the application.

Optionally, in a first implementation manner of the first aspect of the present invention, the permission resetting condition includes a first resetting condition and a second resetting condition; the detecting whether the application meets the permission resetting condition after executing the storage access operation includes: acquiring the current running state of the application; matching the running state with an authority resetting condition to obtain a matching result; if the matching result is that the running state is consistent with the first resetting condition, determining that the storage access operation meets an authority resetting condition; and if the matching result is that the running state is consistent with the second reset condition, determining that the permission reset condition is met after the storage access operation.

Optionally, in a second implementation manner of the first aspect of the present invention, before the single authorization of the storage access operation on the application according to the triggered operation information, the method further includes: judging whether the storage access operation is obtained by the application actively passing a storage access authority request; if so, taking the first reset condition as an authority reset condition; if not, judging whether the storage access operation is legal or not; and if the second reset condition is illegal, taking the second reset condition as an authority reset condition.

Optionally, in a third implementation manner of the first aspect of the present invention, the storage right control method further includes: when the storage access operation is judged to be an operation in a sharing scene, determining sharing rules and sharing data of the shared application based on the operation in the sharing scene; according to the triggered operation information and the sharing rule, granting a single authorization for accessing the shared data to the shared application; detecting whether an authority resetting condition is met after single authorization of the shared data is executed; and if so, resetting the storage authority of the shared application.

Optionally, in a fourth implementation manner of the first aspect of the present invention, the determining whether the storage access operation is an operation in a sharing scenario includes: acquiring a call record of a system, wherein the call record at least comprises a sharing party application, sharing data and a shared application; judging whether the application performing the storage access operation is consistent with the shared application of the call record and whether the target data performing the storage access operation is consistent with the shared data of the call record; and if so, determining that the storage access operation is an operation in a sharing scene.

Optionally, in a fifth implementation manner of the first aspect of the present invention, before the displaying the rights management interface for storing access rights, the method further includes: calling a native permission check interface of a system to check the application permission level of the application and judging whether the application permission level is higher than the level of a preset storage access permission; and if the application permission level is not higher than the storage access permission level, determining whether the application is allowed to perform the storage access operation or not as required, and executing a permission management interface for displaying the storage access permission.

Optionally, in a sixth implementation manner of the first aspect of the present invention, the rights management interface for displaying storage access rights includes: calling an original storage authorization logic in an operating system of the mobile terminal; on the basis of the native storage authorization logic, adding a logic only limited to one-time authorization to generate an authority management interface for storing access authority; and displaying the authority management interface of the storage access authority on the mobile terminal based on the storage access operation.

A second aspect of the present invention provides a storage right control apparatus, including: the first judgment module is used for judging whether the storage access operation is the operation in the sharing scene when the application on the mobile terminal is determined to have the storage access operation; the display module is used for displaying an authority management interface for storing the access authority if the operation is not under the sharing scene, wherein the authority management interface at least comprises authorization prompt information, and the authorization prompt information at least comprises single authorization prompt information; the first authorization module is used for performing single authorization of storage access operation on the application according to the triggered operation information if the single authorization prompt information is detected to be triggered; the condition detection module is used for detecting whether an authority resetting condition is met after the application executes the storage access operation; and the resetting module is used for resetting the storage authority of the application if the authority resetting condition is met.

Optionally, in a first implementation manner of the second aspect of the present invention, the condition detecting module is specifically configured to: acquiring the current running state of the application; matching the running state with an authority resetting condition to obtain a matching result; if the matching result is that the running state is consistent with the first resetting condition, determining that the storage access operation meets an authority resetting condition; and if the matching result is that the running state is consistent with the second reset condition, determining that the permission reset condition is met after the storage access operation.

Optionally, in a second implementation manner of the second aspect of the present invention, the storage right control apparatus further includes: a second determination module specifically configured to: judging whether the storage access operation is obtained by the application actively passing a storage access authority request; if so, taking the first reset condition as an authority reset condition; if not, judging whether the storage access operation is legal or not; and if the second reset condition is illegal, taking the second reset condition as an authority reset condition.

Optionally, in a third implementation manner of the second aspect of the present invention, the storage permission control device further includes a second authorization module, configured to determine, based on the operation in the sharing scenario, a sharing rule and sharing data of the shared application when it is determined that the storage access operation is an operation in the sharing scenario; according to the triggered operation information and the sharing rule, granting a single authorization for accessing the shared data to the shared application; detecting whether an authority resetting condition is met after single authorization of the shared data is executed; and the permission resetting unit is used for resetting the storage permission of the shared application if the permission resetting condition is met.

Optionally, in a fourth implementation manner of the second aspect of the present invention, the first determining module includes: the system comprises an acquisition unit, a processing unit and a processing unit, wherein the acquisition unit is used for acquiring a call record of a system, and the call record at least comprises a sharing party application, sharing data and a shared application; the judging unit is used for judging whether the application performing the storage access operation is consistent with the shared application of the calling record and whether the target data performing the storage access operation is consistent with the shared data of the calling record; and the determining unit is used for determining that the storage access operation is the operation in the sharing scene when the target data is judged to be consistent with the sharing data of the calling record.

Optionally, in a fifth implementation manner of the second aspect of the present invention, the storage authority control apparatus further includes a third determining module, which is specifically configured to: calling a native permission check interface of a system to check the application permission level of the application and judging whether the application permission level is higher than the level of a preset storage access permission; and if the application permission level is not higher than the storage access permission level, determining whether the application is allowed to perform the storage access operation or not as required, and executing a permission management interface for displaying the storage access permission.

Optionally, in a sixth implementation manner of the second aspect of the present invention, the display module is specifically configured to: calling an original storage authorization logic in an operating system of the mobile terminal; on the basis of the native storage authorization logic, adding a logic only limited to one-time authorization to generate an authority management interface for storing access authority; and displaying the authority management interface of the storage access authority on the mobile terminal based on the storage access operation.

A third aspect of the present invention provides a mobile terminal, including: a memory having instructions stored therein and at least one processor, the memory and the at least one processor interconnected by a line; the at least one processor invokes the instructions in the memory to cause the mobile terminal to perform the steps of the storage right control method described above.

A fourth aspect of the present invention provides a computer-readable storage medium having stored therein instructions, which, when run on a computer, cause the computer to perform the steps of the storage right control method described above.

According to the technical scheme, when the application on the mobile terminal is determined to have the storage access operation, whether the storage access operation is the operation in a sharing scene is judged; if not, displaying an authority management interface for storing the access authority, wherein the authority management interface at least comprises authorization prompt information, and the authorization prompt information at least comprises single-time authorization prompt information; if the single authorization prompt message is detected to be triggered, performing single authorization of storage access operation on the application according to the triggered operation message; detecting whether an authority resetting condition is met after the application executes the storage access operation; and if the permission resetting condition is met, resetting the storage permission of the application. The temporary authorization of the operating system to the storage right item is realized by adding a single-authorization prompt option in the right management interface, the using time of the temporary authorization is triggered and is ended after the right resetting condition is met, and the application does not have the right to access the storage after the using time of the temporary authorization is ended, so that the safety of the user information stored in the memory is ensured, and the abuse of the application to the storage access right is avoided.

Drawings

FIG. 1 is a schematic diagram of a first embodiment of a storage right control method in an embodiment of the present invention;

FIG. 2 is a diagram of a storage right control method according to a second embodiment of the present invention;

FIG. 3 is a diagram of a storage right control method according to a third embodiment of the present invention;

FIG. 4 is a diagram of a fourth embodiment of a storage right control method in the embodiment of the present invention;

FIG. 5 is a diagram of a fifth embodiment of a storage right control method according to an embodiment of the present invention;

FIG. 6 is a schematic diagram of an embodiment of a storage right control device in the embodiment of the present invention;

FIG. 7 is a schematic diagram of another embodiment of a storage right control device in the embodiment of the present invention;

fig. 8 is a schematic diagram of an embodiment of a mobile terminal in the embodiment of the present invention.

Detailed Description

According to the technical scheme, when the application on the mobile terminal is determined to have the storage access operation, whether the storage access operation is the operation in a sharing scene is judged; if the operation is not under the sharing scene, displaying an authority management interface for storing the access authority, wherein the authority management interface at least comprises authorization prompt information, and the authorization prompt information at least comprises single authorization prompt information; if the single authorization prompt message is detected to be triggered, performing single authorization of storage access operation on the application according to the triggered operation message; detecting whether an authority resetting condition is met after the application executes the storage access operation; and if the permission resetting condition is met, resetting the storage permission of the application. According to the invention, a single empowerment mode related to the storage access authority is additionally arranged on the authority management interface, and empowerment authority is reset after storage access operation is completed through different decision logics, so that abuse of the storage access authority by application is avoided, and the information security of the terminal is improved.

The terms "first," "second," "third," "fourth," and the like in the description and in the claims, as well as in the drawings, if any, are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It will be appreciated that the data so used may be interchanged under appropriate circumstances such that the embodiments described herein may be practiced otherwise than as specifically illustrated or described herein. Furthermore, the terms "comprises," "comprising," or "having," and any variations thereof, are intended to cover non-exclusive inclusions, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed, but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.

For convenience of understanding, a specific flow of the embodiment of the present invention is described below, and referring to fig. 1, a first embodiment of a storage right control method in the embodiment of the present invention includes:

101. when the application on the mobile terminal is determined to have the storage access operation, judging whether the storage access operation is the operation in a sharing scene;

it is to be understood that the execution subject of the present invention may be a storage authority control device, and may also be a terminal or a server, which is not limited herein. The embodiment of the present invention is described by taking a terminal as an execution subject.

In practical application, the authorization state of the application is checked through a native related interface of an Android system.

Specifically, in the Android 11, the native implementation of the partition storage is based on the Fuse user space file system, and the implementation of the Fuse user space file system at a higher layer is based on the Media Provider process, and thus almost all storage access operations pass through the Media Provider process, and the process can be monitored to implement the determination and interception of the application storage access operations.

In this embodiment, if it is determined that the application has a storage access operation through the Media Provider process, it is determined whether the storage access operation is performed based on an operation wakeup application in a sharing scenario.

102. If the operation is not under the sharing scene, displaying an authority management interface for storing the access authority, wherein the authority management interface at least comprises authorization prompt information, and the authorization prompt information at least comprises single authorization prompt information;

in this embodiment, when it is determined that the application initiating the storage access operation does not belong to the operation in the sharing scenario, a rights management interface pops up to allow the user to select whether to authorize the application, and the rights management interface should at least include a single-authorization option.

In practical applications, the pop-up rights management interface is not only required to contain the option of single authorization, but is also common, and includes but is not limited to: multiple options, such as deny authorization, always authorization, authorization while using, or authorization within a fixed time limit, may occur in combination, and are not limited herein.

103. If the fact that the single authorization prompt message is triggered is detected, single authorization of storage access operation is conducted on the application according to the triggered operation information;

in this embodiment, if and only if the user selects the single-authorization prompt message on the rights management interface, that is, after clicking the option of single authorization, the single-authorization prompt message is triggered to confirm that the single-authorization action is performed on the application performing the storage access operation.

104. Detecting whether an authority resetting condition is met after the application executes the storage access operation;

specifically, after the user confirms that the application performing the storage access operation is subjected to the single authorization action, the storage access operation of the application is performed on the Media Provider process, and whether the permission resetting condition is met is monitored.

105. And if the permission resetting condition is met, resetting the storage permission of the application.

In this step, the right reset condition includes a first reset condition and a second reset condition. Wherein, the first reset condition is background operation and process priority reduction. The second reset condition is that one storage access operation is completed; if the matching result is at least one of background operation and process priority reduction, determining that the permission resetting condition is met after the storage access operation; and if the matching result is that one storage access operation is finished, determining that the storage access operation meets the permission resetting condition.

In the embodiment, a single-time empowerment mode related to the storage access authority is newly added on the authority management interface, and empowerment authority is reset after storage access operation is completed through different judgment logics, so that abuse of the storage access authority by application is avoided, and information security of the terminal is improved.

Referring to fig. 2, a second embodiment of the storage right control method according to the embodiment of the present invention includes:

201. when the application on the mobile terminal is determined to have the storage access operation, judging whether the storage access operation is the operation in a sharing scene;

202. if the operation is not under the sharing scene, displaying an authority management interface for storing the access authority, wherein the authority management interface at least comprises authorization prompt information, and the authorization prompt information at least comprises single authorization prompt information;

203. if the fact that the single authorization prompt message is triggered is detected, whether the storage access operation is obtained when the application actively passes the storage access permission request is judged;

in this embodiment, if and only if the user selects the single-authorization prompt message on the authorization management interface, that is, after clicking the option of single authorization, the single-authorization prompt message is triggered to start to determine whether the application has a request for actively initiating the storage access authorization before performing the storage access operation.

In practical application, for detecting that the single authorization prompt message is triggered, specifically, a value of a pressure sensor on a screen of the terminal is collected, and the comparison is performed based on the value and a triggered set value, and when the comparison result is greater than the set value, it is determined that the single authorization is triggered, for example, the pressure sensor in an area where the single authorization prompt message is displayed in the authority management interface is monitored.

Even, after the authority management interface is displayed on the screen, whether the sliding track is the same as the sliding track triggering single authorization is identified by detecting the sliding operation on the screen and extracting the sliding track of the sliding operation, and if the sliding track is the same as the sliding track triggering single authorization, the triggering is determined, or a gesture action above the screen is detected.

Specifically, whether the application applies the authorization record or not can be checked through a native related interface of the Android system.

204. If so, taking the first reset condition as an authority reset condition;

in this embodiment, when the application determines that the application is authorized by the directed system, the first reset condition is selected as a determination condition for subsequent reset authorization, and the specific determination condition is background running and process priority reduction.

205. If not, judging whether the storage access operation is legal or not;

in this embodiment, when the application determines that the application does not apply authorization to the system, a determination condition needs to be added to determine whether the application that does not apply authorization to store access authority is legal, where the determination condition of validity is whether the application performing the store access operation already has the store access authority. If the storage access operation of the application is legal, the storage access authority of the application is authorized permanently. On the contrary, the storage access operation of the application is illegal, which indicates that the storage access right of the application is not authorized.

206. If the authority is illegal, taking the second reset condition as an authority reset condition;

in this embodiment, the storage access operation of the application is illegal, which indicates that the storage access right of the application is not authorized. A second reset condition will be used for the end decision of the single grant.

207. Performing single authorization of storage access operation on the application according to the triggered operation information;

208. acquiring the current running state of the application;

in this embodiment, the current running state of the application includes at least, but is not limited to, background running, process prioritization, and completing one storage access operation.

The background running means that a user closes the display of the application through specific operation to realize the background running, and even when the current display interface of the application is replaced by the display interfaces of other applications, the current display interface of the application is switched to the background running.

The process Priority is a value from 0 to 31, which means that there is a final Priority of 32 levels in the system native setting, and is called a Base Priority Level (Base Priority Level). The system schedules the process operation according to different priorities, the 0-15 level is a common priority, the priority of the process can be dynamically changed, the high-priority process is preferentially operated, only the high-priority process is not operated, the low-priority process is scheduled to be operated, and the processes with the same priority are alternately operated according to time slices. The lower the priority value of a process, the higher the priority of the process. The 16-31 level is a real-time priority, and the real-time priority is the biggest difference from the ordinary priority in that the processes with the same priority do not run according to the time slice rotation, but the process running first controls the CPU first, and if the process does not actively give up control, the process with the same level or low priority cannot run. When the priority is lowered, the process is said to complete the current storage read-write operation.

The completion of one storage access operation refers to an application which initiates the storage access operation currently, and the MediaProvider process completes one task of reading or writing target data, namely, the current storage access permission can be reset according to the judgment condition.

209. Matching the running state with the permission resetting condition to obtain a matching result;

in the present embodiment, by obtaining the running status in 208, the determination requirement of the reset authority of the application is determined based on the selection of the authority reset conditions in 204 and 206.

210. If the matching result is that the running state is consistent with the first reset condition, determining that the permission reset condition is met after the storage access operation;

211. and if the matching result is that the running state is consistent with the second reset condition, determining that the permission reset condition is met after the storage access operation.

212. And if the permission resetting condition is met, resetting the storage permission of the application.

The embodiment describes in detail the implementation process and determination conditions of a specific single authorization on the basis of the foregoing embodiment. When determining that the application on the mobile terminal has a storage access operation, judging whether the storage access operation is an operation in a sharing scene; if the operation is not under the sharing scene, displaying an authority management interface for storing the access authority, wherein the authority management interface at least comprises authorization prompt information, the authority management interface at least comprises the authorization prompt information, and the authorization prompt information at least comprises single-time authorization prompt information; if the fact that the single authorization prompt message is triggered is detected, whether the storage access operation is obtained when the application actively passes a storage access permission request is judged; if so, taking the first reset condition as an authority reset condition; if not, judging whether the storage access operation is legal or not; and if the second reset condition is illegal, taking the second reset condition as an authority reset condition. Performing single authorization of storage access operation on the application according to the triggered operation information; acquiring the current running state of the application; matching the running state with an authority resetting condition to obtain a matching result; if the matching result is that the running state is consistent with the first resetting condition, determining that the storage access operation meets an authority resetting condition; if the matching result is that the running state is consistent with the second reset condition, determining that the permission reset condition is met after the storage access operation; and if the permission resetting condition is met, resetting the storage permission of the application. In the embodiment, the specific logic of single authorization and the judgment method under different conditions are determined, so that the application authority management can be optimized, and the information security is improved.

Referring to fig. 3, a third embodiment of the storage right control method in the embodiment of the present invention includes:

301. when the application on the mobile terminal is determined to have storage access operation, obtaining a calling record of a system, wherein the calling record at least comprises a sharing party application, sharing data and a shared application;

specifically, the corresponding call records need to be generated in the system service due to the operation in the sharing scene, and the call records generated here can improve the transparency of authority call and discriminate whether malicious applications are started to apply for storage access authorities by themselves. And the management fine granularity of the storage access authority is improved.

In practical applications, the call record includes a tape that is not limited to a sharing side application, shared data, a shared application, a sharing timestamp, a sharing result, and the like, and is used to completely record the start to the end of the operation in each sharing scenario.

302. Judging whether the application performing the storage access operation is consistent with the shared application of the call record and whether the target data performing the storage access operation is consistent with the shared data of the call record;

in practical applications, the operation in the sharing scenario is that the sharing party applies the sharing picture to the shared application, for example, opens a gallery to select the picture to share to the WeChat. The gallery is a sharing application, the shared picture is shared data, and the WeChat is a shared application.

Preferably, the timestamp in the call record may be added as another judgment basis for the sharing scene, for example, it is set that one sharing scene must be judged within ten minutes after initiating the sharing action, and if the actual time is more than ten minutes from the timestamp, the sharing information of the application secondary read-write user exists, and the risk of secondary abuse exists.

303. If the storage access operation is consistent with the sharing operation, determining that the storage access operation is an operation in a sharing scene;

in this embodiment, when the determination of 302 is passed, it is determined as an operation in the sharing scenario. If the judgment in 302 fails, or passes any item, it is considered as not belonging to the operation in the sharing scenario. The default single authorization of the operation in the sharing scene is not applicable, and the user is required to select options in the authority management interface to determine whether the application authorization for the storage access operation is performed.

304. If the operation is not under the sharing scene, displaying an authority management interface for storing the access authority, wherein the authority management interface at least comprises authorization prompt information, and the authorization prompt information at least comprises single authorization prompt information;

305. if the single authorization prompt message is detected to be triggered, performing single authorization of storage access operation on the application according to the triggered operation message;

306. detecting whether an authority resetting condition is met after the application executes the storage access operation;

307. if the permission resetting condition is met, resetting the storage permission of the application;

308. determining sharing rules and sharing data of the shared application based on the operation in the sharing scene;

309. according to the triggered operation information and the sharing rule, granting a single authorization for accessing the shared data to the shared application;

310. detecting whether an authority resetting condition is met after single authorization of the shared data is executed;

311. and if so, resetting the storage authority of the shared application.

On the basis of the previous embodiment, the storage authority control process of the operation in the sharing scene is added. When the application on the mobile terminal is determined to have storage access operation, obtaining a calling record of a system, wherein the calling record at least comprises a sharing party application, sharing data and a shared application; judging whether the application performing the storage access operation is consistent with the shared application of the call record and whether the target data performing the storage access operation is consistent with the shared data of the call record; if the storage access operation is consistent with the sharing operation, determining that the storage access operation is an operation in a sharing scene; if the operation is not under the sharing scene, displaying an authority management interface for storing the access authority, wherein the authority management interface at least comprises authorization prompt information, and the authorization prompt information at least comprises single authorization prompt information; if the single authorization prompt message is detected to be triggered, performing single authorization of storage access operation on the application according to the triggered operation message; detecting whether an authority resetting condition is met after the application executes the storage access operation; if the permission resetting condition is met, resetting the storage permission of the application; determining sharing rules and sharing data of the shared application based on the operation in the sharing scene; according to the triggered operation information and the sharing rule, granting a single authorization for accessing the shared data to the shared application; detecting whether an authority resetting condition is met after single authorization of the shared data is executed; and if so, resetting the storage authority of the shared application. Compared with the existing storage authority control method, the method has the advantages that an authorization mode that operation silence under a sharing scene passes through single storage access authority is added, authorization steps are simplified, and use experience is improved.

Referring to fig. 4, a fourth embodiment of the storage right control method in the embodiment of the present invention includes:

401. when the application on the mobile terminal is determined to have the storage access operation, judging whether the storage access operation is the operation in a sharing scene;

402. if the operation is not under the sharing scene, calling a native permission check interface of the system to check the application permission level of the application, and judging whether the application permission level is higher than the preset storage access permission level;

in this embodiment, in the operation in the non-sharing scenario, it is preferable to check the permission level of the application through the permission check interface in advance, and determine whether the permission level of the application is higher than the storage access permission level. In the installation process of the application, a step of selecting whether the installation application is authorized exists, so that the permission level of the application for performing the storage access operation is inquired, and the number of popup in the subsequent step can be effectively reduced.

Specifically, the application in the Android system does not have any authority by default. By default, an application has no authority to perform operations that may cause security impacts. The security impact includes whether the application may pose a security threat to other applications, operating systems, or user information. If an application does require some security rights, the rights requirements are reasonable, and the rights that need to be used need to be declared statically in android manifest.

403. If the application permission level is not higher than the storage access permission level, determining whether the application is allowed to perform storage access operation or not, and executing a permission management interface for displaying the storage access permission;

in this embodiment, if the result obtained by querying through the permission check interface is that the application does not have the storage access permission or the permission level of the application is lower than the preset storage access permission level, the user is required to confirm and confirm the validity of the storage access operation of the application.

Specifically, if the result obtained by querying through the permission check interface is that the application has the storage access permission or the permission level of the application is higher than the preset storage access permission level, the step of determining the single storage access permission is not required, and the storage access operation belongs to a legal behavior.

404. Calling an original storage authorization logic in an operating system of the mobile terminal;

in practical application, the native storage authorization logic of the Android system does not have single authorization logic at present, so that the conditions of large authorization fine granularity and abuse of authority are caused.

405. On the basis of the native storage authorization logic, adding a logic only limited to one-time authorization to generate an authority management interface for storing access authority;

406. displaying a permission management interface for storing access permission on the mobile terminal based on storage access operation, wherein the permission management interface at least comprises authorization prompt information, and the authorization prompt information at least comprises single authorization prompt information;

in this embodiment, the trigger condition for displaying the rights management interface is to pop up the rights management interface when it is determined that the application has a storage access operation through the Media Provider process and the application right is lower than the storage access right.

Specifically, the storage right management interface includes, but is not limited to, options of always allowing, allowing only in use, rejecting and single authorizing, and determines the right corresponding to the application by detecting whether different options are triggered.

407. If the fact that the single authorization prompt message is triggered is detected, single authorization of storage access operation is conducted on the application according to the triggered operation information;

408. detecting whether an authority resetting condition is met after the application executes the storage access operation;

409. and if the permission resetting condition is met, resetting the storage permission of the application.

On the basis of the previous embodiment, the present embodiment adds the situation that the application has obtained the storage access right in advance, and the specific generation process of the storage right management interface. When the application on the mobile terminal is determined to have the storage access operation, judging whether the storage access operation is the operation in a sharing scene; if the operation is not under the sharing scene, calling a native permission check interface of the system to check the application permission level of the application, and judging whether the application permission level is higher than the preset storage access permission level; if the application permission level is not higher than the storage access permission level, determining whether the application is allowed to perform storage access operation or not, and executing a permission management interface for displaying the storage access permission; calling an original storage authorization logic in an operating system of the mobile terminal; on the basis of the native storage authorization logic, adding a logic only limited to one-time authorization to generate an authority management interface for storing access authority; and displaying a permission management interface of the storage access permission on the mobile terminal based on the storage access operation. The authority management interface at least comprises authorization prompt information, and the authorization prompt information at least comprises single authorization prompt information; if the fact that the single authorization prompt message is triggered is detected, single authorization of storage access operation is conducted on the application according to the triggered operation information; detecting whether an authority resetting condition is met after the application executes the storage access operation; and if the permission resetting condition is met, resetting the storage permission of the application. The embodiment increases the processing process under the existing permission condition, defines the calling of the permission management interface and increases the specific generation process of single authorization, optimizes the fine granularity of the storage access permission, reduces the permission selection times of partial conditions in user perception, optimizes the user experience and improves the safety of the stored data.

Referring to fig. 5, a fifth embodiment of the storage right control method in the embodiment of the present invention includes:

501. selecting sharing data from the gallery application, and clicking a sharing option;

in this embodiment, the user selects data to be shared in the gallery application, and after selection, the address of the selected data can be recorded in the sharing record through the sharing option of the system itself.

The sharing operation is essentially to click a sharing button by a user and record the data address of the shared data to achieve the purpose of calling the subsequent wechat application.

502. The system searches for applications which are listed in parallel and support sharing scenes;

in this embodiment, the system queries an installation application existing in the mobile terminal, checks whether the installation application supports a sharing scenario, and if the installation application supports the sharing scenario, obtains a name of the installation application and generates a corresponding link option for a user to select. The specific listing manner includes, but is not limited to, sorting manners according to installation time, application size, application recent use duration and the like.

503. Acquiring an application selected by a user and generating a sharing record;

in this embodiment, the application to be shared, that is, the WeChat application, is determined by clicking different options by the user.

Specifically, according to step 501, a sharing record is generated. The sharing record includes, but is not limited to, a gallery application name, a WeChat application name, a sharing data address, a sharing time, and the like.

504. The system wakes up the WeChat application, and the WeChat application initiates storage access operation based on the sharing record;

in this embodiment, the system wakes up the wechat application selected by the user, and the wechat application initiates a storage access operation through the shared data address in the shared record based on the shared record generated in step 503.

505. Checking whether the WeChat application has storage access rights;

in this embodiment, the Media Provider process is monitored to obtain the application name initiating the storage access operation through the process, and then whether the application has the storage access right is checked based on the application name.

Specifically, monitoring is performed in the Media Provider process, when storage access operation exists in the application, the application is inevitably operated in the Media Provider process through the Fuse user space file system, and the system can intercept most of the storage access operation of the application based on the process.

506. If the WeChat application does not have the storage access right, checking whether the WeChat application is in a sharing scene;

in this embodiment, the permission of the application is obtained through a native inspection permission interface of the Android system. And if the application performing the storage access operation does not have the storage access authority, acquiring the sharing record, comparing the target data addresses of the application and the application performing the storage access operation, and if the target data addresses are consistent, determining that the WeChat application is in the sharing scene. And if not, determining that the application of the receiver is not in the sharing scene.

If the application performing the storage access operation already has the storage access right, whether the application is in the sharing scene does not need to be judged, and the related storage access operation can be directly performed based on the storage access right of the application.

507. And if the system is in the sharing scene, the system directly authorizes the single storage access authority to the application.

In this embodiment, the system directly authorizes the single storage access right to the wechat application, so that the wechat application has the right of the single storage access operation. Wherein, resetting the reset condition based on the single storage access right in the sharing scene includes but is not limited to a first reset condition and a second reset condition.

Specifically, the system can automatically adjust different reset conditions through different applications, different types of shared data and different sizes of the shared data.

For example, if a video file with a size of 3Gb is shared to a wechat application from a gallery, because the size of the shared data is large, the time for performing a storage access operation on the video file is long, and if the storage access operation is reset by using the first reset condition, the specific determination condition is that the background runs and the process priority is reduced, and it is likely that the storage access operation is erroneously ended due to the fact that the operation duration is long, and the user jumps to another application to wait in the process, so that it is more appropriate to reset the storage access operation by using the second reset condition in this example.

On the basis of the previous embodiment, the present embodiment adds selection examples of the generation condition, the judgment mechanism and different reset conditions in a specific sharing scenario. Selecting sharing data from the gallery application, and clicking to share; the system searches for applications which are listed in parallel and support sharing scenes; acquiring a WeChat application selected by a user and generating a sharing record; the system wakes up the WeChat application, and the WeChat application initiates storage access operation based on the sharing record; checking whether the WeChat application has storage access rights; if the WeChat application does not have the storage access right, checking whether the WeChat application is in a sharing scene; and if the system is in the sharing scene, the system directly authorizes the single storage access authority to the WeChat application. According to the embodiment, specific application scenes in the sharing scene are increased, steps in the sharing scene are detailed, and the application empowerment condition in the steps is clarified.

The storage right control method in the embodiment of the present invention is described above, and the storage right control apparatus in the embodiment of the present invention is described below with reference to fig. 6, where an embodiment of the storage right control apparatus in the embodiment of the present invention includes:

a determining module 601, configured to determine whether a storage access operation exists in an application on the mobile terminal, where the storage access operation is an operation in a sharing scenario;

a display module 602, configured to display an authority management interface for storing access authority if the operation is not in the sharing scenario, where the authority management interface at least includes authorization prompt information, and the authorization prompt information at least includes single-authorization prompt information;

a first authorization module 603, configured to perform single authorization for a storage access operation on the application according to the triggered operation information if it is detected that the single authorization prompt information is triggered;

a condition detection module 604, configured to detect whether a condition that satisfies an authority reset condition exists after the application executes the storage access operation;

a resetting module 605, configured to reset the storage right of the application if the right resetting condition is met.

In the embodiment of the invention, the storage authority control device running the storage authority control method comprises the steps of judging whether the storage access operation is under a sharing scene when determining that the application on the mobile terminal has the storage access operation; if the operation is not under the sharing scene, displaying an authority management interface for storing the access authority, wherein the authority management interface at least comprises authorization prompt information, and the authorization prompt information at least comprises single authorization prompt information; if the single authorization prompt message is detected to be triggered, performing single authorization of storage access operation on the application according to the triggered operation message; detecting whether an authority resetting condition is met after the application executes the storage access operation; and if the permission resetting condition is met, resetting the storage permission of the application. According to the invention, a single empowerment mode related to the storage access authority is additionally arranged on the authority management interface, and empowerment authority is reset after storage access operation is completed through different decision logics, so that abuse of the storage access authority by application is avoided, and the information security of the terminal is improved.

Referring to fig. 7, a second embodiment of a storage right control apparatus according to an embodiment of the present invention includes:

a first determining module 601, configured to determine whether a storage access operation exists in an application on the mobile terminal, where the storage access operation is determined to be an operation in a sharing scenario;

In this embodiment, the condition detecting module 604 is specifically configured to:

acquiring the current running state of the application;

matching the running state with an authority resetting condition to obtain a matching result;

if the matching result is that the running state is consistent with the first resetting condition, determining that the storage access operation meets an authority resetting condition;

and if the matching result is that the running state is consistent with the second reset condition, determining that the permission reset condition is met after the storage access operation.

In this embodiment, the storage right control apparatus further includes a second determining module 606, where the second determining module 606 is specifically configured to:

judging whether the storage access operation is obtained by the application actively passing a storage access authority request;

if so, taking the first reset condition as an authority reset condition;

if not, judging whether the storage access operation is legal or not;

and if the second reset condition is illegal, taking the second reset condition as an authority reset condition.

In this embodiment, the storage right control apparatus further includes a second authorization module 607, where the second authorization module 607 is specifically configured to:

when the storage access operation is judged to be an operation in a sharing scene, determining sharing rules and sharing data of the shared application based on the operation in the sharing scene;

according to the triggered operation information and the sharing rule, granting a single authorization for accessing the shared data to the shared application;

detecting whether an authority resetting condition is met after single authorization of the shared data is executed;

and if the permission resetting condition is met, resetting the storage permission of the shared application.

In this embodiment, the first determining module 601 includes:

an obtaining unit 6011, configured to obtain a call record of a system, where the call record at least includes a sharing party application, shared data, and a shared application;

a determining unit 6012, configured to determine whether the application performing the storage access operation is consistent with the shared application in the call record, and whether target data performing the storage access operation is consistent with the shared data in the call record;

a determining unit 6013, configured to determine the storage access operation as an operation in a sharing scene when it is determined that the target data is consistent with the shared data of the call record.

In this embodiment, the storage authority control apparatus further includes a third determining module 608, where the third determining module 608 is specifically configured to:

calling a native permission check interface of a system to check the application permission level of the application and judging whether the application permission level is higher than the level of a preset storage access permission;

and if the application permission level is not higher than the storage access permission level, determining whether the application is allowed to perform the storage access operation or not as required, and executing a permission management interface for displaying the storage access permission.

In this embodiment, the display module 602 is specifically configured to:

calling an original storage authorization logic in an operating system of the mobile terminal;

on the basis of the native storage authorization logic, adding a logic only limited to one-time authorization to generate an authority management interface for storing access authority;

and displaying the authority management interface of the storage access authority on the mobile terminal based on the storage access operation.

The present embodiment describes in detail the specific functions of each module and the unit structure of a part of the modules on the basis of the previous embodiment. When the application on the mobile terminal is determined to have the storage access operation, judging whether the storage access operation is the operation in a sharing scene; if the operation is not under the sharing scene, calling a native permission check interface of the system to check the application permission level of the application, and judging whether the application permission level is higher than the preset storage access permission level; if the application permission level is not higher than the storage access permission level, determining whether the application is allowed to perform storage access operation or not, and executing a permission management interface for displaying the storage access permission; calling an original storage authorization logic in an operating system of the mobile terminal; on the basis of the native storage authorization logic, adding a logic only limited to one-time authorization to generate an authority management interface for storing access authority; and displaying a permission management interface of the storage access permission on the mobile terminal based on the storage access operation. The authority management interface at least comprises authorization prompt information, and the authorization prompt information at least comprises single authorization prompt information; if the fact that the single authorization prompt message is triggered is detected, single authorization of storage access operation is conducted on the application according to the triggered operation information; detecting whether an authority resetting condition is met after the application executes the storage access operation; and if the permission resetting condition is met, resetting the storage permission of the application. The embodiment increases the processing process under the existing permission condition, defines the calling of the permission management interface and increases the specific generation process of single authorization, optimizes the fine granularity of the storage access permission, reduces the permission selection times of partial conditions in user perception, optimizes the user experience and improves the safety of the stored data.

Fig. 6 and 7 describe the mid-storage right control device in the embodiment of the present invention in detail from the perspective of the modular functional entity, and the mobile terminal in the embodiment of the present invention is described in detail from the perspective of hardware processing.

Fig. 8 is a schematic structural diagram of a mobile terminal 800 according to an embodiment of the present invention, where the mobile terminal 800 may have a relatively large difference due to different configurations or performances, and may include one or more processors (CPUs) 810 (e.g., one or more processors) and a memory 820, and one or more storage media 830 (e.g., one or more mass storage devices) for storing applications 833 or data 832. Memory 820 and storage medium 830 may be, among other things, transient or persistent storage. The program stored in the storage medium 830 may include one or more modules (not shown), each of which may include a series of instructions for operating the mobile terminal 800. Further, the processor 810 may be configured to communicate with the storage medium 830, and execute a series of instruction operations in the storage medium 830 on the mobile terminal 800 to implement the steps of the storage right control method described above.

The mobile terminal 800 may also include one or more power supplies 840, one or more wired or wireless network interfaces 850, one or more input-output interfaces 860, and/or one or more operating systems 831, such as Windows Server, Mac OS X, Unix, Linux, FreeBSD, etc. Those skilled in the art will appreciate that the mobile terminal configuration illustrated in fig. 8 is not intended to be limiting of the mobile terminals provided herein and may include more or fewer components than those illustrated, or some components may be combined, or a different arrangement of components.

The present invention also provides a computer-readable storage medium, which may be a non-volatile computer-readable storage medium, or a volatile computer-readable storage medium, having stored therein instructions, which, when executed on a computer, cause the computer to perform the steps of the storage right control method.

It is clear to those skilled in the art that, for convenience and brevity of description, the specific working processes of the above-described systems, apparatuses, and units may refer to the corresponding processes in the foregoing method embodiments, and are not described herein again.

The integrated unit, if implemented in the form of a software functional unit and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention may be embodied in the form of a software product, which is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the method according to the embodiments of the present invention. And the aforementioned storage medium includes: various media capable of storing program codes, such as a usb disk, a removable hard disk, a read-only memory (ROM), a Random Access Memory (RAM), a magnetic disk, or an optical disk.

The above-mentioned embodiments are only used for illustrating the technical solutions of the present invention, and not for limiting the same; although the present invention has been described in detail with reference to the foregoing embodiments, it will be understood by those of ordinary skill in the art that: the technical solutions described in the foregoing embodiments may still be modified, or some technical features may be equivalently replaced; and such modifications or substitutions do not depart from the spirit and scope of the corresponding technical solutions of the embodiments of the present invention.

Claims

1. A storage authority control method is applied to a mobile terminal and is characterized by comprising the following steps:

when determining that the application on the mobile terminal has a storage access operation, judging whether the storage access operation is an operation in a sharing scene;

if the operation is not under the sharing scene, displaying an authority management interface for storing the access authority, wherein the authority management interface at least comprises authorization prompt information, and the authorization prompt information at least comprises single authorization prompt information;

if the single authorization prompt message is detected to be triggered, performing single authorization of storage access operation on the application according to the triggered operation message;

detecting whether an authority resetting condition is met after the application executes the storage access operation;

and if the permission resetting condition is met, resetting the storage permission of the application.

2. The storage right control method according to claim 1, wherein the right reset condition includes a first reset condition and a second reset condition; the detecting whether the application meets the permission resetting condition after executing the storage access operation includes:

acquiring the current running state of the application;

3. The storage right control method according to claim 2, further comprising, before the single authorization of the storage access operation to the application according to the triggered operation information:

if so, taking the first reset condition as an authority reset condition;

if not, judging whether the storage access operation is legal or not;

4. The storage authority control method according to claim 2, further comprising:

and if so, resetting the storage authority of the shared application.

5. The storage authority control method according to claim 1, wherein the determining whether the storage access operation is an operation in a sharing scenario includes:

acquiring a call record of a system, wherein the call record at least comprises a sharing party application, sharing data and a shared application;

judging whether the application performing the storage access operation is consistent with the shared application of the call record and whether the target data performing the storage access operation is consistent with the shared data of the call record;

and if so, determining that the storage access operation is an operation in a sharing scene.

6. The storage authority control method according to any one of claims 1 to 5, further comprising, before the displaying the authority management interface for storing access authority:

7. The storage authority control method according to any one of claims 1 to 5, wherein the authority management interface for displaying storage access authority includes:

8. A storage authority control apparatus, which is applied to a storage authority control system, the storage authority control apparatus comprising:

the first judgment module is used for judging whether the storage access operation is the operation in the sharing scene when the application on the mobile terminal is determined to have the storage access operation;

the display module is used for displaying a permission management interface of the storage access permission when the storage access operation is judged not to be the operation in the sharing scene, wherein the permission management interface at least comprises authorization prompt information, and the authorization prompt information at least comprises single authorization prompt information;

the first authorization module is used for performing single authorization of storage access operation on the application according to the triggered operation information when the single authorization prompt information is detected to be triggered;

the condition detection module is used for detecting whether an authority resetting condition is met after the application executes the storage access operation;

and the resetting module is used for resetting the storage authority of the application when the condition that the authority resetting condition is met is detected.

9. A mobile terminal, characterized in that the mobile terminal comprises: a memory having instructions stored therein and at least one processor, the memory and the at least one processor interconnected by a line;

the at least one processor invokes the instructions in the memory to cause the mobile terminal to perform the steps of the storage right control method according to any of claims 1-7.

10. A computer-readable storage medium, on which a computer program is stored, which, when being executed by a processor, carries out the steps of the storage right control method according to any one of claims 1 to 7.