WO2018001065A1 - 应用的管理方法、装置及系统 - Google Patents

应用的管理方法、装置及系统 Download PDF

Info

Publication number
WO2018001065A1
WO2018001065A1 PCT/CN2017/087585 CN2017087585W WO2018001065A1 WO 2018001065 A1 WO2018001065 A1 WO 2018001065A1 CN 2017087585 W CN2017087585 W CN 2017087585W WO 2018001065 A1 WO2018001065 A1 WO 2018001065A1
Authority
WO
WIPO (PCT)
Prior art keywords
application
information
request information
server
client device
Prior art date
Application number
PCT/CN2017/087585
Other languages
English (en)
French (fr)
Inventor
徐进
姚尧
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2018001065A1 publication Critical patent/WO2018001065A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data

Definitions

  • the present application relates to, but is not limited to, the field of communications, and in particular, to a management method, apparatus, and system for an application.
  • the embodiment of the invention provides a management method, device and system for an application, so as to at least solve the problem of the lack of a method for managing application rights in the related art.
  • a management method of an application including: a client device receiving request information of a user, wherein the request information is used to request a permission for managing a specified application from a server, where Specifying an application as an application in a specified storage space in the client device; the client device sends the request information to a server; the client device receives the permission information fed back by the server according to the request information, and according to the The rights information manages the specified application.
  • the client device verifies the rights information according to the first preset rule, and the rights information passes the verification. In case, the client device manages the specified application according to the permission information.
  • the method before the client device sends the request information to the server, the method further includes: the client device pre-processing the request information, and the pre-processed request information Sending to the server, where the pre-processing includes one of: encapsulating the request information by using a preset protocol; and encrypting the request information by using a preset key.
  • the method before the client device receives the request information of the user, the method further includes: the client device receiving the application information of the user, and creating, in the client device, according to the application information, Manage the specified storage space for your app.
  • the application includes at least one of the following: a document, a picture, an audio file, a video file, an application.
  • the managing the specified application according to the rights information includes at least one of: adding an application in the specified storage space; removing an application added to the specified storage space; applying for use Or disabling an application in the specified storage space, where an application operation authority is applied to the application when the application is specified in the specified storage space; applying to start and end the application in the specified storage space At least one of time; applying to set an operation attribute of an application in the specified storage space, the operation attribute including at least one of: writing, reading, and executing.
  • the embodiment of the present application further provides an application management method, including: receiving, by a server, request information sent by a client device, where the request information is used to request, by the server, permission to manage a specified application, where the Specifying an application as an application in a specified storage space in the client device; the server processing the request information to obtain rights information according to at least one of a predefined rule and an input information of a rights administrator; the server The rights information is sent to the client device, so that the client device manages the specified application according to the rights information.
  • the application includes at least one of the following: a document, a picture, an audio file, a video file, an application.
  • the method further includes: the server verifying the request information according to a second preset rule, where the request information is verified In case, the server processes the request information according to at least one of a predefined rule and an input information of the rights administrator to obtain the rights information.
  • an application management apparatus for application to a client device, including:
  • the first receiving module is configured to receive the request information of the user, where the request information is used to request the server to manage the specified application, where the specified application is in the specified storage space in the client device application;
  • a first sending module configured to send the request information to a server
  • the management module is configured to receive the authority information fed back by the server according to the request information, and manage the specified application according to the authority information.
  • the management module may be further configured to: before the management of the specified application according to the rights information, verify the rights information according to the first preset rule, where the rights information is verified, The specified application is managed according to the permission information.
  • the first sending module may be further configured to: before sending the request information to the server, pre-processing the request information, and sending the pre-processed request information to a server, wherein the preprocessing comprises one of the following:
  • the request information is encrypted using a preset key.
  • the first receiving module may be further configured to: before receiving the request information of the user, receive application information of the user, and create a designation for managing the application in the client device according to the application information. storage.
  • the application includes at least one of the following: a document, a picture, an audio file, a video file, an application.
  • the managing the specified application according to the rights information includes at least one of: adding an application in the specified storage space; removing an application added to the specified storage space; applying for use Or disabling an application in the specified storage space, where an application operation authority is applied to the application when the application is specified in the specified storage space; applying to start and end the application in the specified storage space At least one of time; applying to set an operation attribute of an application in the specified storage space, the operation attribute includes at least one of: writing, reading, and executing.
  • the embodiment of the present application further provides an application management apparatus, which is applied to a server, and includes:
  • the second receiving module is configured to receive the request information sent by the client device, where the request information is used to request the server to manage the specified application, where the specified application is in the client device Specify the application in the storage space;
  • a processing module configured to process the request information according to at least one of a predefined rule and an input information of a rights administrator to obtain rights information
  • the second sending module is configured to send the rights information to the client device, so that the client device manages the specified application according to the rights information.
  • the application may include at least one of the following: a document, a picture, an audio file, a video file, an application.
  • the processing module may be further configured to: after the second receiving module receives the request information sent by the client device, verify the request information according to a second preset rule, where the request information passes In the case of verification, the request information is processed according to at least one of a predefined rule and an input information of the authority administrator to obtain the authority information.
  • the embodiment of the present invention further provides an application management system, including: a client device and a server; the client device is configured to receive request information of the user, where the request information is used to request the server to specify Applying the authority for managing, wherein the specified application is an application in a specified storage space in the client device;
  • the client device is configured to send the request information to a server
  • the server is configured to receive request information sent by the client device
  • the server is configured to process the request information according to at least one of a predefined rule and an input information of a rights administrator to obtain rights information;
  • the server is configured to send the rights information to the client device
  • the client device is configured to receive the rights information sent by the server, and manage the specified application according to the rights information.
  • a machine readable medium is also provided.
  • the machine readable medium is configured to store program code for performing the steps of: the client device receiving request information of the user, wherein the request information is for requesting permission from the server to manage the specified application,
  • the specified application is an application in a specified storage space in the client device; the client device sends the request information to a server; and the client device receives the permission information that the server feeds back according to the request information. And managing the specified application according to the permission information.
  • the client device applies for the management right of the specified application to the server
  • the specified application is an application that specifies the space storage by the client
  • the client device manages the permission of the specified application according to the obtained permission information sent by the server.
  • FIG. 1 is a block diagram showing the hardware structure of a mobile terminal for performing an application management method according to an embodiment of the present invention
  • FIG. 2 is a flowchart 1 of a management method of an application according to an embodiment of the present invention.
  • FIG. 3 is a second flowchart of a method for managing an application according to an embodiment of the present invention.
  • FIG. 4 is a flowchart showing the operation of a container-based dynamic authority management method according to an embodiment of the present invention
  • FIG. 5 is a structural diagram of a container application dynamic authority management device according to an embodiment of the present invention.
  • FIG. 6 is a process flow diagram of a container application dynamic rights management message according to an exemplary embodiment of the present application
  • FIG. 7 is a diagram showing a structure of a feature information processing module according to an exemplary embodiment of the present application.
  • FIG. 8 is a flowchart showing an operation of a feature information generating unit according to an exemplary embodiment of the present application.
  • FIG. 9 is a message processing flowchart of a feature information extracting unit according to an exemplary embodiment of the present application.
  • FIG. 10 is a message processing flowchart of a feature information auditing unit according to an exemplary embodiment of the present application.
  • FIG. 11 is a structural block diagram 1 of a management apparatus of an application according to an embodiment of the present invention.
  • FIG. 12 is a structural block diagram 2 of a management apparatus of an application according to an embodiment of the present invention.
  • FIG. 1 is a hardware structural block diagram of a mobile terminal that performs an application management method according to an embodiment of the present invention.
  • mobile terminal 10 may include one or more (only one shown) processor 102 (processor 102 may include, but is not limited to, a microprocessor (MCU) or a programmable logic device (FPGA), etc. Processing device), memory 104 for storing data, and transmission device 106 for communication functions.
  • processor 102 may include, but is not limited to, a microprocessor (MCU) or a programmable logic device (FPGA), etc. Processing device
  • memory 104 for storing data
  • transmission device 106 for communication functions.
  • the structure shown in FIG. 1 is merely illustrative and does not limit the structure of the above electronic device.
  • the mobile terminal 10 may also include more or fewer components than those shown in FIG. 1, or have a different configuration than that shown in FIG.
  • the memory 104 can be used to store software programs and modules of the application software, such as program instructions/modules corresponding to the management method of an application in the embodiment of the present invention, and the processor 102 runs the software programs and modules stored in the memory 104, thereby The above methods are implemented by performing various functional applications and data processing.
  • Memory 104 may include high speed random access memory, and may also include non-volatile memory such as one or more magnetic storage devices, flash memory, or other non-volatile solid state memory.
  • memory 104 may further include memory remotely located relative to processor 102, which may be connected to mobile terminal 10 over a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.
  • Transmission device 106 is for receiving or transmitting data via a network.
  • the above network instance can A wireless network provided by a communication provider of the mobile terminal 10 is included.
  • the transmission device 106 includes a Network Interface Controller (NIC) that can be connected to other network devices through a base station to communicate with the Internet.
  • the transmission device 106 can be a Radio Frequency (RF) module for communicating with the Internet wirelessly.
  • NIC Network Interface Controller
  • RF Radio Frequency
  • FIG. 2 is a flowchart 1 of an application management method according to an embodiment of the present invention, as shown in FIG. 2 .
  • the process includes the following steps:
  • Step S202 The client device receives the request information of the user, where the request information is used to request the server to manage the specified application, where the specified application is an application in the specified storage space in the client device.
  • the specified storage space here is not limited to the spatial meaning of physical media (such as hard disk storage), but also logical meaning in the sense of space, such as the classified folder on the desktop of the terminal device.
  • Step S204 the client device sends the request information to the server
  • Step S206 The client device receives the rights information fed back by the server according to the request information, and manages the specified application according to the rights information.
  • the client device receives the request information of the user, where the request information is used to request the server to manage the specified application, where the specified application is an application in the specified storage space of the client device, the client The end device sends the request information to the server, and the client device receives the permission information fed back by the server according to the request information, and manages the specified application according to the permission information.
  • the problem of lacking the method for managing the application rights in the related art is solved, and the rights management is performed on the application in a convenient and effective manner in real time.
  • the execution body of the above steps may be a mobile terminal or a terminal, etc., but is not limited thereto.
  • the client device verifies the permission information according to the first preset rule, and if the permission information passes the verification, the client device according to the permission Information manages the specified application.
  • the first preset rule in the exemplary embodiment may be a rule preset by a server or a permission rule set by an administrator.
  • the client device before the client device sends the request information to the server, the client device performs pre-processing on the request information, and sends the pre-processed request information to the server, where the pre-processing includes One of the following: the request information is encapsulated by a preset protocol; the request information is encrypted by using a preset key.
  • the storage device is stored in the specified storage space of the client device, the client device and the server have an agreed protocol, and the protocol is mainly used for characterizing the information exchanged between the client device and the server;
  • the method may include: specifying a transmission protocol between the two, a message authentication mode between the two, an encryption algorithm of the message, and the like.
  • the agreed protocol will also be described in subsequent embodiments.
  • the client device before the client device receives the request information of the user, the client device receives the application information of the user, and the client creates a specified storage space for managing the application in the client device according to the application information.
  • the specified storage space in the client also called a container, is used to store files, applications, and the like.
  • the application includes at least one of the following: a document, a picture, an audio file, a video file, an application.
  • the management application rights applied in the above embodiments are not limited to applications, etc., and include reading and writing of files, pictures, and the like.
  • the managing the specified application according to the rights information comprises at least one of: adding an application in the specified storage space; removing an application added to the specified storage space; applying to use or disabling the designation An application in a storage space, wherein, when applying for operation in the specified storage space, applying for partial operation authority to the application; applying for at least one of a start time and an end time of an application in the specified storage space; Setting an operation attribute of an application in the specified storage space, wherein the operation attribute includes at least one of: writing, reading, and executing.
  • the start time and the end time of the application are used, for example, the time limit for using the smart device for the child; the operational attributes of the application, writing, reading, executing, etc., including reading and writing files, etc.; Or when you disable a given app, it can be part of the app's operational permissions.
  • FIG. 3 is a second flowchart of a method for managing an application according to an embodiment of the present invention. As shown in FIG. 3, the process includes the following steps:
  • step S302 the server receives the request information sent by the client device, where the request information is used to request the server to manage the specified application, where the specified application is an application in the specified storage space in the client device;
  • Step S304 the server processes the request information according to at least one of the predefined rules and the input information of the rights administrator to obtain the rights information;
  • Step S306 the server sends the permission information to the client device, so that the client device manages the specified application according to the permission information.
  • the application includes at least one of the following: a document, a picture, an audio file, a video file, an application.
  • the server verifies the request information according to a second preset rule, where the request information is verified, the server is based on a predefined rule and At least one of the input information of the rights administrator processes the request information to obtain the rights information.
  • the server receives the request information sent by the client device, detects the request information (such as identity verification, etc.) according to the rule agreed in advance with the client device, and then processes the request information.
  • the specified storage space which is also referred to as a container, is located in the client device, and the container has the following features:
  • the user can add or remove an application to the secure container of the device, and the user can also apply to use or disable the application in the container;
  • the device controlled container maintains one or more applications, and the content of the application is not limited to documents, pictures, file directories, audio files, video files, applications, etc.;
  • the application added to the container in the case of no container management end authentication, the user can not operate on the application, the operation includes: read, write, execute, etc.;
  • the user may apply to operate one or more applications when applying for the operation of the container application;
  • the authentication end can dynamically modify the content of the application when responding to the user's application
  • the system resources of the container can be adjusted.
  • the resources of the container are independent of other modules of the system and can be dynamically adjusted.
  • FIG. 4 is a flowchart of a container-based dynamic rights management method according to an embodiment of the present invention.
  • the content requested by the user is processed as an event, and the processing steps are as follows:
  • step S401 the user applies for an operation container at the client.
  • Users can apply to add apps to the container, remove apps added to the container, and request to use or disable apps in the container.
  • the user can choose to open or close the permissions of some applications in the container; the time attributes that can be used additionally, such as the start time, the usage time, the end time, etc.; the operation attributes, such as writing, can be set. Read, or execute attributes, etc.
  • Step S402 the client device (Client side) receives the request information of the user, and performs characterization processing on the content of the request according to the established protocol.
  • the established protocol involves the following information processing: (1) the encapsulation format of the request information; (2) the mapping relationship list of the message when the message is mapped; (3) the client and the server (server end) message authentication mode; (4) When the feature message is encrypted, the encryption algorithm, and the like.
  • the generated information is sent to the channel.
  • a message recording module sent to the client; one is sent to the server as transmission information.
  • Step S403 the server (Server side) receives the feature data sent by the client, and parses the received data according to the protocol negotiated by the server and the client. Based on the parsed feature information, the server will perform the following message processing: (1), identity authentication, the server will verify whether the client sending the feature message has the request permission, and when the client does not have the permission, the request information can be discarded. (2) When the message mapping is adopted, the request information is inversely mapped based on the message mapping relationship list; usually, when the mapping fails, the request authentication fails. (3) Characteristic information auditing; the authority manager audits the request information of the client on the server side. The auditing method may be an automatic auditing performed by the system according to the setting policy, or may be performed manually.
  • the audit content on the server side includes all the content of the request, including the time attribute of the application, the operation attribute of the application, the number of applications, and the like; and supports the addition of the application.
  • Audit information operation After the server end completes the message audit, the server sends the obtained permission information to the communication module. The following two aspects will be handled: one is to process the audited message for the message recording module of the server; the other is to characterize the obtained permission information according to the established protocol. After characterization, the feature message is also sent to the communication module and transmitted to the client. (5) When the client first applies to add a management application to the container, the server generates a random authentication password for the client, and records the feature information of the client and the authentication password to the Server-Client relationship list.
  • the feature information of the client can be the host name of the client or the Internet Protocol (IP), or other functions that can represent the client. Particular identification.
  • IP Internet Protocol
  • the server maintains the application relationship list of the client.
  • adding an application add an application and a corresponding mapping ID to the application relationship list; when the application is removed, the corresponding entry is removed from the application relationship table.
  • step S404 the client receives the audit information from the communication pipeline.
  • the client side parses the collected feature information. Based on the parsed feature information, the client will do the following message processing: (1), Server's permission verification. Verify that the server that sends the feature message has the request permission. When the server does not have the permission, the request information can be discarded.
  • the request information is inversely mapped based on the message mapping relationship list;
  • the request authentication fails;
  • the client extracts the feature information and sends the information to the communication module for use by the client's message recording module; (4) after the authentication is completed
  • the client side makes the audit information into a scheduling policy of the container application, and stops the permission of the container to open or disable the authenticated application.
  • Figure 4 shows the container-based dynamic rights management method, which solves the process of dynamic authority application and authentication.
  • the user applies to manipulate some or all of the permissions of the application in the container, or the permissions of different start and end time, time period, period, and application attributes.
  • the audit server adjusts the application content according to the setting policy or the authentication method. After both the server and the client end authenticate, the client container manager will open or disable the container operation.
  • FIG. 5 is a structural diagram of a container application dynamic rights management device according to an embodiment of the present invention. As shown in FIG. 5, the device is deployed in an electronic terminal, and the container-based application dynamic rights management and control can be implemented.
  • the control device includes a client end and a server end (corresponding to the client device and the devices on both sides of the server in the above embodiments respectively).
  • the client side includes: a C501 information interaction module (corresponding to the function of the first receiving module 112 and some functions of the management module 116 in the fourth embodiment), a C502 feature information processing module, and a C503 communication module (corresponding to the fourth embodiment) A part of the function of the sending module 114), a C504 container authority control kernel (corresponding to part of the functions of the management module 116 in the fourth embodiment), and a C505 message recording module.
  • the server side includes: an S501 information interaction module (corresponding to the function of the second receiving module 122 in the fourth embodiment), an S502 feature information processing module, and an S503 communication module (corresponding to the partial functions of the second sending module 126 in the fourth embodiment). ), S504 container permission control kernel (equivalent to the embodiment) Part of the function of the processing module 124 in the fourth), S505 message recording module.
  • the C501 information interaction module is configured to perform information interaction between the client and the user.
  • the user can request the operation application from the device through the module, or the client can feed back the information after the server end audit to the user.
  • the C502 feature information processing module is configured to process the feature information.
  • the information of the feature information processing module is divided into two pieces, one is information that interacts with the information interaction module, and the other is information that interacts with the server.
  • the feature information processing module maps and encrypts information from the information interaction module according to a certain protocol. For the information exchanged with the server, the feature information processing module encrypts and decrypts the information, and performs the authentication operation according to the decrypted information. Only when the authentication is passed, the next effective operation is performed, such as According to the policy to open or prohibit the operation of the container application permissions, add or subtract applications to the container and so on.
  • the C503 communication module is configured to implement internal communication between the client internal module or the client and the server.
  • Support RPC Remote Procedure Call Protocol
  • IPC Inter-Process Communication
  • pipeline technology and so on.
  • the C504 container permissions control kernel is the hub of container permissions control. It controls all applications that join the container, can open or disable the application's usage rights according to the audit license policy, can add or subtract applications to the container, and so on.
  • the container authority control kernel according to the valid authentication information, formulates the authority management and control strategy, and controls the operation attributes, usage duration, and start and end time of the application in the container. At the same time, some over-limit use will be alerted.
  • the C505 message recording module is configured to record information about the operation of the container.
  • the message logging module maintains the application list in the container, maintains the operation information made during the use of the container application, maintains the configured permission list, and maintains the scheduling policy.
  • Information processed by the message logging module can be stored in memory, disk files, databases, or other curable data devices.
  • the message recording module is an interface with a data device that can manipulate the data device to add data or delete data.
  • the S501 information interaction module is configured to implement information exchange between the client or the administrator and the server.
  • the server When receiving the information request sent by the client, the server will report the valid request information to the administrator according to a certain policy. At the same time, the administrator can audit the request information through the information interaction module.
  • the S502 feature information processing module is configured to process the feature information.
  • the information of the feature information processing module is divided into two parts, one is information that interacts with the information interaction module, and the other is information that interacts with the client.
  • the feature information processing module maps and encrypts information from the information interaction module according to a certain protocol. For the information exchanged with the client, the feature information processing module encrypts and decrypts the information, and performs the authentication operation according to the decrypted information. Only when the authentication is passed, the next effective operation is performed, such as The valid information is fed back to the administrator through the information interaction module, the authority audit is performed, or the default authority audit is performed according to the default permission operation.
  • the S503 communication module is configured to implement communication between the internal module of the server and the server and the client.
  • the S504 container permission control kernel is the hub for the container to perform automatic permission control.
  • the administrator can automatically audit the client's request by configuring the privilege management policy. Turn on or disable usage rights for apps, add apps to containers, and more.
  • the privilege management and control strategy is defined to control the operation attributes, usage duration, and start and end time of the application in the client container.
  • the S505 message recording module is configured to record related information of the operation.
  • the message record module maintains the application list of the client-side container, maintains the operation information made during the use of the container application, maintains the configured permission list, and maintains the scheduling policy.
  • Information processed by the message logging module can be stored in memory, disk files, databases, or other curable data devices.
  • the message recording module is an interface with a data device that can manipulate the data device to add data or delete data.
  • FIG. 5 shows a container management apparatus that solves the problem of container-based dynamic authority control.
  • FIG. 6 is a flowchart of a container application dynamic rights management message processing according to an exemplary embodiment of the present application. As shown in FIG. 6, the steps are as follows:
  • step S601 the user requests to operate the container.
  • the user can request to add or delete an application to the container, apply for use or disable the application, and the application includes but is not limited to the following attributes: the number of applications in the application operation container is one or more; the operation permission of the application includes reading, modifying or executing , the operation permission of each application can be different; the start operation time, end operation time or time of applying for the operation application Cycles, different applications can be inconsistent; the effective time of the application can be set and so on.
  • Step S602 generating valid feature information.
  • the container management device After reading the request from the user or other modules, the container management device first performs information review according to the permission information maintained by the C505 message recording module, and outputs preliminary valid application information. Data is usually processed into encrypted data according to a certain encryption protocol to ensure data security. At the same time, the request information is recorded.
  • step S603 the server receives the feature information.
  • the server side first decrypts according to a certain decryption protocol, and extracts feature information.
  • the extracted information is usually presented in an identifiable plaintext presentation for subsequent use.
  • the authenticated client is authenticated. Only after the authentication is passed, the subsequent processing will be performed. Otherwise, the request will be discarded.
  • Step S604 the feature information is audited.
  • the server extracts the feature information, it performs information audit according to the established policy.
  • the audit mode may be manually performed by the server end holder, or may be automatically processed according to the established permission policy recorded in the S505 message recording module.
  • the post-audit information is the content that allows the client-side container to operate.
  • step S605 the audited information is processed.
  • the processing content is similar to step S602. It also involves two parts, one is to record the final audit information, and the other is to encrypt the audit information.
  • Step S606 the client side performs feature information extraction.
  • the client decrypts the information according to a certain decryption protocol to extract feature information.
  • the authenticated server will be authenticated. Only after the authentication is passed, will the subsequent processing be performed. Otherwise, the request will be discarded and the operation will be terminated.
  • Step S607 the container processes the authentication content according to the valid authentication request. Enter the container application scheduling management process.
  • Figure 6 shows the message processing flow based on container dynamic permission control.
  • the dynamic management and control of the container application authority can be implemented by the above process. Whether it is adding or deleting an application to a container, or applying the usage rights of an application in a container, it can be implemented based on the above process.
  • the special information processing module includes the following elements: a feature information generating unit 701, a feature information extracting unit 702, and a feature information auditing unit. 703 and authentication unit 704.
  • the feature information processing module is responsible for processing the request information.
  • the request information can come from the client or from other modules of the device. The feature information processing flow will be described in detail below with reference to FIG. 8, FIG. 9, and FIG.
  • FIG. 8 is a flowchart showing the operation of the feature information generating unit according to an exemplary embodiment of the present application. As shown in FIG. 8, the workflow of the feature information generation is different based on the information type of the feature information and the working mode of the node.
  • the processing flow is as follows:
  • the feature information generating unit acquires the request information.
  • the request information is either from the C501 or S501 information interaction module, and the message type is REQUEST; or the feature information auditing unit 703 from the C502 or S502 feature information processing module, and the message type is RESPONSE.
  • the message types are different, and there are differences in subsequent processing.
  • step S802 the message type is determined.
  • Step S803 the request information is corrected according to the basic relationship table applied in the container.
  • This step is mainly used to process the application ID.
  • the client side usually maintains a basic relationship table of applications in a container, and Table 1 is a basic relationship table of applications according to an exemplary embodiment of the present application.
  • the application name is an application name visible to the user on the control device, and the application content is an actual application object in the system, and the mapping ID is a unique ID value set by the client for the application added in the container, and the time granularity refers to the user. You can apply for the minimum time period for operating the application.
  • the client When adding an app to a container, the client adds a relationship to the app to add to the basic relational table. If the user adds "xx extracurricular counseling book” to the container, the user-defined application name is "My tutoring book”, the storage location of the tutoring book is specified as “/xx extracurricular tutor storage location”, and the client will assign "xx extracurricular tutoring book”.
  • a unique application ID "201” the user can set the time granularity at the time of application or use the default value "5 minutes”.
  • the application basic relationship table is first retrieved to verify the legality of the application application.
  • the requested application is deleted from the request information.
  • the legal request information is input to the next step S804.
  • Step S804 assembling valid request information.
  • a user's request can be divided into two types, one is to request an operation container, and the other is an application that requests to use the container. Therefore, the format of the effective request information for assembly is divided into two types, one is the information format for the container operation, such as adding or subtracting the application to the container; the other is requesting the information format of the application in the operation container, such as reading, writing, executing the application, etc. .
  • the request operation container request message format is:
  • the format of the information requested in the request operation container is:
  • a valid request message may contain one or more requests to operate the container request information or request information in the operation container.
  • Table 2 is an operation code correspondence table corresponding to the container operation according to an exemplary embodiment of the present application. As shown in Table 2, the operation code corresponding to the container operation is as shown in the following table:
  • read, write, and execute operations can be superimposed, and the superimposed opcodes are the sum of read, write, and execute operations. If the application is read + write, the corresponding operation code is 3; if the application is written + execution, the corresponding operation code is 6; the application for reading, writing, and executing operations, the corresponding operation code is 7.
  • the application ID, application name, and application content can be found in the basic relationship table of the application in the container.
  • Start time coding, end time coding, and use period coding are 3-bit time coding.
  • the corresponding value is multiplied by the time granularity of the application in the basic relational table applied in the container, which is the corresponding time.
  • the three have the following relationship:
  • Start time coding, end time coding, and use period coding are not all 0;
  • the start time code is multiplied by the time granularity of the application in the basic relational table of the application in the container, which is the application execution start time;
  • the end time code is multiplied by the time granularity of the application in the basic relational table of the application in the container, which is the application execution end execution time;
  • Multiplying the period code by the time granularity of the application in the basic relational table of the application in the container is the application application time;
  • start and end time code are 000
  • the start and end time is not limited, and the time control is only valid using the cycle code.
  • Table 3 is a modified container relationship table according to an exemplary embodiment of the present application. As shown in Table 3, the added information content of the container relationship table is as follows:
  • the generated valid request information is: "82015004d00798f855bfc4e66002f007800788bfe59 168f855bfc4e66".
  • Table 4 is a basic relationship table 2 of applications in a container according to an exemplary embodiment of the present application. As shown in Table 4, there are application contents of the following table:
  • the generated valid request information is: "4101008000024 4102022000004 3202000016008".
  • Step S805 adding the authentication information header to generate feature information. Add the authentication information header to verify the legitimacy of the message.
  • the added feature information header is “IP+user password”, the IP address is set to “10.1.1.191”, and the set user password is “123456”, and the generated user header is “010001001191123456”.
  • the generated feature information is “01000100119112345682015004d00798f855bfc4e66002f007800788bfe59168f855bfc4e66”.
  • the generated feature information is "01000100119112345641010080 00024 4102022000004 3202000016008".
  • Step S806 the feature information mapping is used to encrypt the feature.
  • the feature information is encrypted by a method of mapping feature information onto a picture.
  • Select a standard picture the picture format is bmp, the size is 320*256.
  • Selected map The slices are randomly modularized. The random algorithm can be set as follows:
  • x(n+1) 1-k*x(n) ⁇ 2,(n ⁇ 0,k ⁇ 1,x(0) ⁇ 1)
  • the feature information is divided into m shares, and the divided information is used as an encryption code, and an exclusive OR operation is performed with the picture block to obtain encrypted feature information.
  • Step S807 inputting the feature information of the mapping into the communication channel.
  • Feature data is sent through a related protocol.
  • FIG. 9 is a message processing flowchart of a feature information extracting unit according to an exemplary embodiment of the present application. As shown in FIG. 9, the feature information extracting process is interpreted as follows:
  • step S901 the container dynamic rights management device receives the feature information.
  • Step S902 parsing the collected feature information.
  • the feature information For the feature information obtained by the mapping process, the feature information needs to be parsed according to a certain protocol.
  • step S806 The feature information encryption use case in step S806 is followed, and the corresponding analysis method is described as follows.
  • the server will perform an exclusive OR operation with the same standard picture held by the Client to calculate the added password value. Then according to the algorithm:
  • x(n+1) 1-k*x(n) ⁇ 2,(n ⁇ 0,k ⁇ 1,x(0) ⁇ 1)
  • the seed k, x(n) similar to the data end generated by the client is extracted, the feature information position is extracted, and the feature information is calculated.
  • the feature information header information is extracted and the authority verification is performed.
  • the feature information header includes the IP of the client and the authentication password of the Client and the Server. The client's IP and password verification is correct, go to the next step, otherwise discard the request.
  • Step S903 parsing the feature header information.
  • the feature information header consists of "IP+user password”. Combining the extracted feature information, the IP address of the source of the request information and the password distributed by the client are extracted.
  • Step S904 authentication.
  • the acknowledgment side and the requesting side negotiate a user password.
  • the acknowledgment side queries the password of the user negotiated between the acknowledgment end and the requesting end from the password list, and compares it with the password in the request information. If the comparison succeeds, the authentication is passed, otherwise the authentication fails.
  • Step S905 the feature information is obtained by de-mapping the feature information in combination with the application relationship list.
  • the acknowledgment side also maintains a list of application relationships requesting the client.
  • the format and content of the table are similar to the application relationship list of step S904. This step is to parse out the corresponding request content according to the mapping code.
  • Step S906 putting the parsed feature information details into a communication channel for subsequent use.
  • step S907 the request information is discarded.
  • FIG. 10 is a message processing flowchart of a feature information auditing unit according to an exemplary embodiment of the present application.
  • the server sets a valid request reply to the user according to the configuration policy, or manually approves The way to achieve a user request for approval.
  • This process can be expressed as follows:
  • Step S1001 Acquire request information details.
  • the request information is a processing result of the feature information extracting unit.
  • the confirmer can choose whether to view the request information.
  • the confirmer needs to choose to view the information on the interface to perform the request information audit.
  • the confirmation manager can choose to view the requested content.
  • step S1002 the audit type is judged.
  • the request information There are two ways to audit the request information. One is based on the default mode, that is, the client's permission audit list maintained by the server is used for default policy auditing; the other is that the server operator performs manual auditing on the request information display terminal.
  • step S1003 to manually audit the request information.
  • step S1003 the request information is displayed on the terminal for manual auditing.
  • the auditor can adjust the information displayed on the terminal. If you adjust the permissions of the application operation, you can refuse to add or subtract applications to the container; you can modify the operation permissions of the container application, remove or add readable, writable or executable permissions; you can correct the usage time of the container application; re-edit the container application.
  • the order of use can be specified which applications are used first and which applications are deferred; the start time of the container application can be corrected, the end time of the container application can be corrected, and so on.
  • the server side regenerates valid user request information through the user request processing module.
  • step S1004 the audit information is obtained. After the feature information is audited, the audit information is read from the terminal interface after the terminal is audited.
  • step S1005 valid user request feature information is generated, and the feature information is transmitted to the channel.
  • step S1006 the process proceeds to step S1006, and the user request information is corrected based on the default authority restriction list.
  • Step S1006 the user request information is corrected according to the default permission restriction list.
  • a list of authority restrictions is maintained, and Table 5 is a list of authority restrictions according to an exemplary embodiment of the present application.
  • conf can have their own configuration (conf) or the default conf.
  • the content format of conf is as follows:
  • End 22:00 # indicates the latest available time of the application, indicating that it is available before 22 o'clock.
  • Use_time 10:20 11:00, 14:20 15:00 # Indicates the available time period of the application, ',' split
  • Add_auto true
  • #expression allows automatic addition of an application to a container
  • web.conf In combination with the request information in step S804, such as web.conf is defined as follows:
  • Period 60 # indicates the available duration of the application
  • End 22:00 # indicates the latest available time of the application, indicating that it is available before 22 o'clock.
  • Use_time 10:20 11:00, 12:20 13:00 # Indicates the available time period of the application, ',' split
  • the default.conf is defined as follows:
  • the valid request information after the audited request is as follows:
  • step S1005 valid feature information is generated, and the feature information is transmitted to the channel.
  • the confirmation terminal After generating valid feature information, the confirmation terminal needs to process valid information. For example, when you need to add an application to a container, the confirmation side needs to write the mapping relationship to the application relationship list maintained by itself. At the same time, the message recording module records the contents of this operation.
  • the method of the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, can also be through hardware, but in many cases the former is a better implementation.
  • the technical solution of the present application which is essential or contributes to the related art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk, CD-ROM).
  • the method includes a plurality of instructions for causing a terminal device (which may be a mobile phone, a computer, a server, or a network device, etc.) to perform the method of the embodiment of the present application.
  • an application management device is also provided, which is used to implement the foregoing embodiments and exemplary embodiments, and has not been described again.
  • the term "module” may implement software, hardware, or a combination of software and hardware for a predetermined function.
  • the apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.
  • FIG. 11 is a structural block diagram 1 of a management apparatus of an application according to an embodiment of the present invention.
  • the apparatus is applied to a client device, as shown in FIG. 11, the device includes:
  • the first receiving module 112 is configured to receive the request information of the user, where the request information is used to request the server to manage the specified application, where the specified application is an application in the specified storage space in the client device;
  • the first sending module 114 is connected to the first receiving module 112 and configured to send the request information to the server.
  • the management module 116 is connected to the first sending module 114, configured to receive the authority information fed back by the server according to the request information, and manage the specified application according to the authority information.
  • the management module 116 may be further configured to: before the management of the specified application according to the permission information, verify the rights information according to the first preset rule, where the rights information is verified, according to the The permission information manages the specified application.
  • the first sending module 114 may be further configured to: before sending the request information to the server, pre-processing the request information, and sending the pre-processed request information to the server, where Preprocessing includes one of the following:
  • the request information is encrypted using a preset key.
  • the first receiving module 112 may be further configured to: before receiving the request information of the user, receive the application information of the user, and create a specified storage space for managing the application in the client device according to the application information. .
  • the application may include at least one of the following: a document, a picture, an audio file, a video file, an application.
  • the managing the specified application according to the permission information may include at least one of: adding an application in the specified storage space; removing an application added to the specified storage space; applying to use or disabling the application Specifying an application in the storage space, wherein when applying for the application in the specified storage space, applying for partial operation authority to the application; applying for using at least one of a start time and an end time of the application in the specified storage space; Apply to set the operation attribute of the application in the specified storage space, and the operation attribute includes at least one of the following: write, read, and execute.
  • FIG. 12 is a structural block diagram 2 of a management apparatus of an application according to an embodiment of the present invention.
  • the apparatus is applied to a server. As shown in FIG. 12, the apparatus includes:
  • the second receiving module 122 is configured to receive the request information sent by the client device, where the request information is used to request the server to manage the specified application, where the specified application is the specified storage space in the client device.
  • the processing module 124 is connected to the second receiving module 122, and configured to process the request information according to at least one of the predefined rules and the input information of the rights administrator to obtain the rights information;
  • the second sending module 126 is connected to the processing module 124 and configured to send the rights information to the client device, so that the client device manages the specified application according to the rights information.
  • the application may include at least one of the following: a document, a picture, an audio file, a video file, an application.
  • the processing module 124 may be further configured to: after the second receiving module 122 receives the request information sent by the client device, verify the request information according to the second preset rule, where the request information is verified. In the case, the request information is processed according to at least one of the predefined rules and the input information of the authority administrator to obtain the authority information.
  • the above modules can be implemented by software or hardware. For the latter, It can be implemented in the following manner, but is not limited thereto: the above modules are implemented by the same processor; or the above modules are implemented by different processors.
  • An embodiment of the present invention provides an application management system, including: a client device and a server;
  • the client device is configured to receive the request information of the user, where the request information is used to request the server to manage the specified application, where the specified application is an application in the specified storage space in the client device;
  • the client device is further configured to send the request information to the server;
  • the server is configured to receive request information sent by the client device
  • the server is further configured to process the request information according to at least one of a predefined rule and an input information of the rights administrator to obtain rights information;
  • the server is further configured to send the permission information to the client device
  • the client device is further configured to receive the permission information sent by the server, and manage the specified application according to the permission information.
  • Embodiments of the present invention provide a machine readable medium.
  • the above machine readable medium may be arranged to store program code for performing the following steps:
  • the client device receives the request information of the user, where the request information is used to request the server to manage the specified application, where the specified application is an application in the specified storage space in the client device.
  • the client device sends the request information to the server.
  • the client device receives the permission information fed back by the server according to the request information, and manages the specified application according to the permission information.
  • the above machine readable medium may be arranged to store program code for performing the following steps:
  • the server receives the request information sent by the client device, where the request information is used to request the server to manage the specified application, where the specified application is the client.
  • the application in the specified storage space in the standby;
  • the server processes the request information according to at least one of a predefined rule and an input information of the rights administrator to obtain the permission information.
  • the server sends the permission information to the client device, where the client device manages the specified application according to the permission information.
  • the above machine readable medium may include, but is not limited to, a USB flash drive, a Read-Only Memory (ROM), a Random Access Memory (RAM), a mobile hard disk, a magnetic disk, or A variety of media such as optical discs that can store program code.
  • the processor may perform the method steps of the above-described embodiments in accordance with stored program code in the machine readable medium.
  • Such software may be distributed on a machine-readable medium, such as a computer-readable medium, which may include computer storage media (or non-transitory media) and communication media (or transitory media).
  • a computer-readable medium includes volatile and nonvolatile, implemented in any method or technology for storing information, such as computer readable instructions, data structures, program modules or other data. Sex, removable and non-removable media.
  • Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridge, magnetic tape, magnetic disk storage or other magnetic storage device, or may Any other medium used to store the desired information and that can be accessed by the computer.
  • communication media typically includes computer readable instructions, data structures, program modules, or other data in a modulated data signal, such as a carrier wave or other transport mechanism, and Any information delivery medium can be included.
  • the embodiment of the present application provides a management method, device, and system for an application, which solves the problem of lack of management of application rights in the related art, and manages the rights of the application in a convenient and effective manner in real time.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • General Health & Medical Sciences (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Health & Medical Sciences (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Bioethics (AREA)
  • Storage Device Security (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

一种应用的管理方法、装置及系统，其中，该方法包括：客户端设备接收用户的请求信息，其中，该请求信息用于向服务器请求对指定应用进行管理的权限，其中，该指定应用为该客户端设备中指定存储空间中的应用（S202）；客户端设备将该请求信息发送到服务器（S204）；该客户端设备接收该服务器依据该请求信息反馈的权限信息，并依据该权限信息对该指定应用进行管理（S206）。如此，解决了相关技术中缺乏对应用权限管理的方法的问题，实时便捷有效地对应用进行了权限管理。

Description

应用的管理方法、装置及系统 技术领域
本申请涉及但不限于通信领域，尤其涉及一种应用的管理方法、装置及系统。
背景技术
随着信息技术发展，各种电子终端已经遍布人们生活各处。电子终端为人们的工作、生活、学习带来了种种便利，随之而来的信息安全、信息管控等问题也正变得日益突出。智能手机为人们的生活带了便利，但是安装在其上的游戏、音视频等，如利用不当可能给孩子成长带来不良影响。工作电脑中安装了许多软件，如不能劳逸结合有效利用，就不能很好的提高工作效率。
针对相关技术中缺乏对应用权限管理的方法的问题，目前还没有有效的解决方案。
发明概述
以下是对本文详细描述的主题的概述。本概述并非是为了限制权利要求的保护范围。
本发明实施例提供了一种应用的管理方法、装置及系统，以至少解决相关技术中缺乏对应用权限管理的方法的问题。
根据本申请的一个方面，提供了一种应用的管理方法，包括：客户端设备接收用户的请求信息，其中，所述请求信息用于向服务器请求对指定应用进行管理的权限，其中，所述指定应用为所述客户端设备中指定存储空间中的应用；客户端设备将所述请求信息发送到服务器；所述客户端设备接收所述服务器依据所述请求信息反馈的权限信息，并依据该权限信息对所述指定应用进行管理。
在示例性实施方式中，依据该权限信息对所述指定应用进行管理之前，所述客户端设备依据第一预设规则验证权限信息，在所述权限信息通过验证 的情况下，所述客户端设备依据所述权限信息对所述指定应用进行管理。
在示例性实施方式中，在客户端设备将所述请求信息发送到服务器之前，所述方法还包括：所述客户端设备对所述请求信息进行预处理，将所述预处理后的请求信息发送到服务器，其中，所述预处理包括以下之一：采用预设协议封装所述请求信息；采用预设密钥加密所述请求信息。
在示例性实施方式中，在客户端设备接收用户的请求信息之前，所述方法还包括：所述客户端设备接收用户的申请信息，依据所述申请信息在所述客户端设备内创建用于管理应用的指定存储空间。
在示例性实施方式中，所述应用包括以下至少之一：文档、图片、音频文件、视频文件、应用程序。
在示例性实施方式中，所述依据该权限信息对所述指定应用进行管理包括以下至少之一：在所述指定存储空间内添加应用；移除添加到所述指定存储空间的应用；申请使用或禁用所述指定存储空间中的应用，其中，在申请操作所述指定存储空间中应用时，申请对所述应用的部分操作权限；申请使用所述指定存储空间中的应用的开始时间和结束时间中的至少一项；申请设置所述指定存储空间中的应用的操作属性，所述操作属性包括以下至少之一：写入、读取、执行。
本申请实施例还提供了一种应用管理方法，包括：服务器接收客户端设备发送的请求信息，其中，所述请求信息用于向所述服务器请求对指定应用进行管理的权限，其中，所述指定应用为所述客户端设备中指定存储空间中的应用；所述服务器依据预定义规则和权限管理员的输入信息中的至少一项处理所述请求信息得到权限信息；所述服务器将所述权限信息发送到所述客户端设备，以便所述客户端设备依据所述权限信息对所述指定应用进行管理。
在示例性实施方式中，所述应用包括以下至少之一：文档、图片、音频文件、视频文件、应用程序。
在示例性实施方式中，在所述服务器接收客户端设备发送的请求信息之后，所述方法还包括：所述服务器依据第二预设规则验证所述请求信息，在所述请求信息通过验证的情况下，所述服务器依据预定义规则和权限管理员的输入信息中的至少一项处理所述请求信息得到权限信息。
根据本申请的另一个方面，提供了一种应用的管理装置，应用于客户端设备，包括：
第一接收模块，配置为接收用户的请求信息，其中，所述请求信息用于向服务器请求对指定应用进行管理的权限，其中，所述指定应用为所述客户端设备中指定存储空间中的应用；
第一发送模块，配置为将所述请求信息发送到服务器；
管理模块，配置为接收所述服务器依据所述请求信息反馈的权限信息，并依据该权限信息对所述指定应用进行管理。
在示例性实施方式中，所述管理模块还可以配置为在依据该权限信息对所述指定应用进行管理之前，依据第一预设规则验证权限信息，在所述权限信息通过验证的情况下，依据所述权限信息对所述指定应用进行管理。
在示例性实施方式中，所述第一发送模块还可以配置为在将所述请求信息发送到服务器之前，对所述请求信息进行预处理，将所述预处理后的请求信息发送到服务器，其中，所述预处理包括以下之一：
采用预设协议封装所述请求信息；
采用预设密钥加密所述请求信息。
在示例性实施方式中，所述第一接收模块还可以配置为在接收用户的请求信息之前，接收用户的申请信息，依据所述申请信息在所述客户端设备内创建用于管理应用的指定存储空间。
在示例性实施方式中，所述应用包括以下至少之一：文档、图片、音频文件、视频文件、应用程序。
在示例性实施方式中，所述依据该权限信息对所述指定应用进行管理包括以下至少之一：在所述指定存储空间内添加应用；移除添加到所述指定存储空间的应用；申请使用或禁用所述指定存储空间中的应用，其中，在申请操作所述指定存储空间中应用时，申请对所述应用的部分操作权限；申请使用所述指定存储空间中的应用的开始时间和结束时间中的至少一项；申请设置所述指定存储空间中的应用的操作属性，操作属性包括以下至少之一：写入、读取、执行。
本申请实施例还提供了一种应用管理装置，应用于服务器，包括：
第二接收模块，配置为接收客户端设备发送的请求信息，其中，所述请求信息用于向所述服务器请求对指定应用进行管理的权限，其中，所述指定应用为所述客户端设备中指定存储空间中的应用；
处理模块，配置为依据预定义规则和权限管理员的输入信息中的至少一项处理所述请求信息得到权限信息；
第二发送模块，配置为将所述权限信息发送到所述客户端设备，以便所述客户端设备依据所述权限信息对所述指定应用进行管理。
在示例性实施方式中，所述应用可以包括以下至少之一：文档、图片、音频文件、视频文件、应用程序。
在示例性实施方式中，所述处理模块还可以配置为在所述第二接收模块接收客户端设备发送的请求信息之后，依据第二预设规则验证所述请求信息，在所述请求信息通过验证的情况下，依据预定义规则和权限管理员的输入信息中的至少一项处理所述请求信息得到权限信息。
本发明实施例还提供了一种应用的管理系统，包括：客户端设备、服务器；所述客户端设备配置为接收用户的请求信息，其中，所述请求信息用于向所述服务器请求对指定应用进行管理的权限，其中，所述指定应用为所述客户端设备中指定存储空间中的应用；
所述客户端设备配置为将所述请求信息发送到服务器；
所述服务器配置为接收所述客户端设备发送的请求信息；
所述服务器配置为依据预定义规则和权限管理员的输入信息中的至少一项处理所述请求信息得到权限信息；
所述服务器配置为将所述权限信息发送到所述客户端设备；
所述客户端设备配置为接收所述服务器发送的所述权限信息，并依据该权限信息对所述指定应用进行管理。
根据本申请的又一个方面，还提供了一种机器可读介质。该机器可读介质设置为存储用于执行以下步骤的程序代码：客户端设备接收用户的请求信息，其中，所述请求信息用于向服务器请求对指定应用进行管理的权限，其 中，所述指定应用为所述客户端设备中指定存储空间中的应用；客户端设备将所述请求信息发送到服务器；所述客户端设备接收所述服务器依据所述请求信息反馈的权限信息，并依据该权限信息对所述指定应用进行管理。
通过本申请实施例，客户端设备向服务器申请对指定应用的管理权限，该指定应用为客户端指定空间存储的应用，客户端设备依据接收到的服务器下发的权限信息，管理指定应用的权限。如此，解决了相关技术中缺乏对应用权限管理的方法的问题，实时便捷有效地对应用进行了权限管理。
在阅读并理解了附图和详细描述后，可以明白其他方面。
附图概述
此处所说明的附图用来提供对本申请的进一步理解，构成本申请的一部分，本申请的示意性实施例及其说明用于解释本申请，并不构成对本申请的不当限定。在附图中：
图1是执行本发明实施例的一种应用的管理方法的移动终端的硬件结构框图；
图2是根据本发明实施例的一种应用的管理方法的流程图一；
图3是根据本发明实施例的一种应用的管理方法的流程图二；
图4是根据本发明实施例的一种基于容器的动态权限管控方法的工作流程图；
图5是根据本发明实施例的一种容器应用动态权限管控装置的结构图；
图6是根据本申请示例性实施例的容器应用动态权限管控消息的处理流程图；
图7是根据本申请示例性实施例的特征信息处理模块的框架结构图；
图8是根据本申请示例性实施例的特征信息生成单元的工作流程图；
图9是根据本申请示例性实施例的特征信息提取单元的消息处理流程图；
图10是根据本申请示例性实施例的特征信息审计单元的消息处理流程图；
图11是根据本发明实施例的应用的管理装置的结构框图一；
图12是根据本发明实施例的应用的管理装置的结构框图二。
详述
下文中将参考附图并结合实施例来详细说明本申请。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。
需要说明的是，本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。
实施例一
本申请实施例一所提供的方法实施例可以在移动终端、计算机终端或者类似的运算装置中执行。以运行在移动终端上为例，图1是执行本发明实施例的一种应用的管理方法的移动终端的硬件结构框图。如图1所示，移动终端10可以包括一个或多个(图中仅示出一个)处理器102(处理器102可以包括但不限于微处理器(MCU)或可编程逻辑器件(FPGA)等的处理装置)、用于存储数据的存储器104、以及用于通信功能的传输装置106。本领域普通技术人员可以理解，图1所示的结构仅为示意，其并不对上述电子装置的结构造成限定。例如，移动终端10还可包括比图1中所示更多或者更少的组件，或者具有与图1所示不同的配置。
存储器104可用于存储应用软件的软件程序以及模块，如本发明实施例中的一种应用的管理方法对应的程序指令/模块，处理器102通过运行存储在存储器104内的软件程序以及模块，从而执行各种功能应用以及数据处理，即实现上述的方法。存储器104可包括高速随机存储器，还可包括非易失性存储器，如一个或者多个磁性存储装置、闪存、或者其他非易失性固态存储器。在一些实例中，存储器104可进一步包括相对于处理器102远程设置的存储器，这些远程存储器可以通过网络连接至移动终端10。上述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网及其组合。
传输装置106用于经由一个网络接收或者发送数据。上述的网络实例可 包括移动终端10的通信供应商提供的无线网络。在一个实例中，传输装置106包括一个网络适配器(Network Interface Controller，NIC)，其可通过基站与其他网络设备相连从而可与互联网进行通信。在一个实例中，传输装置106可以为射频(Radio Frequency，RF)模块，其用于通过无线方式与互联网进行通信。
在本实施例中提供了一种运行于上述移动终端或网络架构的一种应用的管理方法，图2是根据本发明实施例的一种应用的管理方法的流程图一，如图2所示，该流程包括如下步骤：
步骤S202，客户端设备接收用户的请求信息，其中，该请求信息用于向服务器请求对指定应用进行管理的权限，其中，该指定应用为该客户端设备中指定存储空间中的应用。需要强调的是，这里的指定存储空间不局限于物理介质的空间含义(比如硬盘存储)，还可以是逻辑意义上的空间含义，比如终端设备桌面上的分类文件夹。
步骤S204，客户端设备将该请求信息发送到服务器；
步骤S206，该客户端设备接收该服务器依据该请求信息反馈的权限信息，并依据该权限信息对该指定应用进行管理。
通过上述步骤，客户端设备接收用户的请求信息，其中，该请求信息用于向服务器请求对指定应用进行管理的权限，其中，该指定应用为该客户端设备中指定存储空间中的应用，客户端设备将该请求信息发送到服务器，该客户端设备接收该服务器依据该请求信息反馈的权限信息，并依据该权限信息对该指定应用进行管理。如此，解决了相关技术中缺乏对应用权限管理的方法的问题，实时便捷有效地对应用进行了权限管理。
在示例性实施方式中，上述步骤的执行主体可以为移动终端或者终端等，但不限于此。
在示例性实施方式中，依据该权限信息对该指定应用进行管理之前，该客户端设备依据第一预设规则验证权限信息，在该权限信息通过验证的情况下，该客户端设备依据该权限信息对该指定应用进行管理。本示例性实施例中的第一预设规则可以是服务器预先设置的规则，或者是管理员设置的权限规则。
在示例性实施方式中，在客户端设备将该请求信息发送到服务器之前，该客户端设备对该请求信息进行预处理，将该预处理后的请求信息发送到服务器，其中，该预处理包括以下之一：采用预设协议封装该请求信息；采用预设密钥加密该请求信息。在客户端设备中的指定存储空间进行存放应用时，客户端设备与服务器有着约定的协议，该协议主要用于对客户端设备和服务器之间交互的信息进行特征化处理；其中，特征化处理，可以包括：规定二者之间的传输协议、二者之间的消息认证方式、消息的加密算法等等。在后续实施例中还会介绍该约定好的协议。
在示例性实施方式中，在客户端设备接收用户的请求信息之前，该客户端设备接收用户的申请信息，该客户端依据该申请信息在该客户端设备内创建用于管理应用的指定存储空间。该客户端内指定存储空间，又叫容器，用于存放文件、应用等。
在示例性实施方式中，该应用包括以下至少之一：文档、图片、音频文件、视频文件、应用程序。在上述实施例中申请的管理应用权限，不局限于应用程序等，还包括对文件、对图片的读写等等。
在示例性实施方式中，该依据该权限信息对该指定应用进行管理包括以下至少之一：在该指定存储空间内添加应用；移除添加到该指定存储空间的应用；申请使用或禁用该指定存储空间中的应用，其中，在申请操作该指定存储空间中应用时，申请对该应用的部分操作权限；申请使用该指定存储空间中的应用的开始时间和结束时间中的至少一项；申请设置该指定存储空间中的应用的操作属性，其中，操作属性包括以下至少之一：写入、读取、执行。在本实施例中，使用应用的开始时间和结束时间，例如对儿童使用智能设备的时间限制；对应用的操作属性，写入、读取、执行等，包括读写文件等等；在申请使用或者禁用指定应用时，可以是该应用的部分操作权限。
图3是根据本发明实施例的一种应用的管理方法的流程图二，如图3所示，该流程包括以下步骤：
步骤S302，服务器接收客户端设备发送的请求信息，其中，该请求信息用于向该服务器请求对指定应用进行管理的权限，其中，该指定应用为该客户端设备中指定存储空间中的应用；
步骤S304，该服务器依据预定义规则和权限管理员的输入信息中的至少一项处理该请求信息得到权限信息；
步骤S306，该服务器将该权限信息发送到该客户端设备，以便该客户端设备依据该权限信息对该指定应用进行管理。
图3记载的方法流程图中的方法步骤，是运行在服务器一侧的。
在示例性实施方式中，该应用包括以下至少之一：文档、图片、音频文件、视频文件、应用程序。
在示例性实施方式中，在该服务器接收客户端设备发送的请求信息之后，该服务器依据第二预设规则验证该请求信息，在该请求信息通过验证的情况下，该服务器依据预定义规则和权限管理员的输入信息中的至少一项处理该请求信息得到权限信息。服务器接收到客户端设备发送的请求信息，依据该与客户端设备预先约定的规则检测该请求信息(比如身份验证等)，然后，再处理该请求信息。
在上述实施例中记载的指定存储空间，又叫容器，位于客户端设备，该容器具备的特征包括：
(1)、用户可以向装置的安全容器添加或移除应用，用户也可以申请使用或禁用容器中的应用；
(2)、装置管控的容器维护一个或多个应用，应用的内容不仅限于文档、图片、文件目录、音频文件、视频文件、应用程序等；
(3)、添加到容器中的应用，在无容器管控端认证情况下，用户无法对应用做操作，操作包括：读、写、执行等；
(4)、用户在申请操作容器应用时，可以申请操作一个或多个应用；
(5)、认证端在答复用户申请时，可以动态修改申请的内容；
(6)、容器的系统资源可以调整，容器的资源独立于系统其他模块，可动态调整。
图4是根据本发明实施例的一种基于容器的动态权限管控方法的工作流程图，用户请求的内容会作为一种事件去处理，处理步骤如下：
步骤S401，用户在客户端申请操作容器。用户可以申请为容器添加应用、移除添加到容器的应用，申请使用或禁用容器中的应用。用户在申请操作容器中应用时，可以选择开通或关闭容器中部分应用的权限；可以附加使用的时间属性，如开始使用时间、使用时长、结束使用时间等；可以设置操作属性，如写入、读取、或者是执行属性等。
步骤S402，客户端设备(Client端)收到用户的请求信息，依据既定的协议，对请求内容做特征化处理。
既定协议涉及如下信息处理：(1)、请求信息的封装格式；(2)、采用消息映射时，消息的映射关系列表；(3)、Client、服务器(Server端)消息认证方式；(4)、特征消息做加密处理时，加密的算法等。
特征信息产生后，会将生成信息发送到信道中。一个发送到Client端的消息记录模块；一个是作为传输信息发送到Server端。
步骤S403，服务器(Server端)在收到Client端发送来的特征数据，并依据Server和Client协商的协议对收到的数据进行解析。基于解析出的特征信息，Server端会做如下消息处理：(1)、身份认证，Server端会验证发送特征消息的Client是否具有请求权限，当Client没有权限时，可选择丢弃请求信息。(2)、采用消息映射时，基于消息的映射关系列表，对请求信息进行反映射；通常，在映射失败时，认为请求认证失败。(3)、特征信息审计；权限管理者在Server端对Client的请求信息进行审计。审计方式可以是采用系统根据设置策略进行的自动审计，也可以采用人工操作的方式进行。Server端的审计内容包括请求的所有内容，包括应用的时间属性、应用的操作属性、应用个数等等；同时支持增加应用。(4)、审计信息操作。Server端完成消息审计后，Server端将得到的权限信息发送到通信模块。将做如下两方面的处理：一方面是供Server的消息记录模块处理审计后的消息；一个是按照既定协议，将得到的权限信息做特征化处理。特征化后，特征消息还会发送到通信模块，并传输给Client。(5)、当Client端初次申请向容器增加管控应用时，Server端会为Client产生一个随机的认证口令，并记录Client的特征信息和认证口令到Server-Client关系列表。Client的特征信息可以是Client的主机名或网络协议(Internet Protocol，简称为IP)，或其他能表征Client 特殊性的标识。(6)、当Client申请向容器添加或移除应用时，Server端会维护Client的应用关系列表。添加应用时，向应用关系列表添加应用及对应的映射ID；移除应用时，从应用关系表中移除对应的条目。
步骤S404，Client端从通信管道收取审计信息。Client端对收取的特征信息进行解析。基于解析出的特征信息，Client端会做如下消息处理：(1)、Server的权限验证。验证发送特征消息的Server是否具有请求权限，当Server端不具有权限时，可选择丢弃请求信息；(2)、进行消息映射时，基于消息的映射关系列表，对请求信息进行反映射；通常，在映射失败时，可认为请求认证失败；(3)、审计后信息操作；Client端提取特征信息后将信息发送到通信模块，供Client的消息记录模块取用；(4)、在认证完成后，Client端将审计信息做成容器应用的调度策略，停止容器开放或禁用认证的应用的权限。
综上所述，图4给出了基于容器的动态权限管控的方法，解决了动态权限申请和认证的过程。用户申请操控容器中应用的部分或全部权限，或不同起止时间、时段、周期、应用属性的权限，审计Server端根据设置策略或者认证方法会调整申请内容。在Server端、Client端双方认证通过后，Client容器管理端才会开放或禁止容器操作。
图5是根据本发明实施例的一种容器应用动态权限管控装置的结构图，如图5所示，该装置部署在电子终端，可以实现基于容器的应用动态权限管控。该管控装置包括Client端和Server端(分别对应于上述实施例中的客户端设备和服务器两侧的装置)。
Client端包括：C501信息交互模块(相当于实施例四中的第一接收模块112的功能和管理模块116的部分功能)、C502特征信息处理模块、C503通信模块(相当于实施例四中的第一发送模块114的部分功能)、C504容器权限控制内核(相当于实施例四中的管理模块116的部分功能)、C505消息记录模块。
Server端包括：S501信息交互模块(相当于实施例四中的第二接收模块122的功能)、S502特征信息处理模块、S503通信模块(相当于实施例四中的第二发送模块126的部分功能)、S504容器权限控制内核(相当于实施例 四中的处理模块124的部分功能)、S505消息记录模块。
上述模块的详述如下：
C501信息交互模块，配置为进行Client和用户间的信息交互。用户可以通过该模块向装置请求操作应用，也可以是Client将Server端审计后的信息反馈给用户。
C502特征信息处理模块，配置为处理特征信息。特征信息处理模块的信息分成两块，一个是同信息交互模块交互的信息，一个是同Server端交互的信息。特征信息处理模块会将来自信息交互模块的信息依据一定的协议进行映射和加密。对于同服务端交互的信息，特征信息处理模块会对信息进行加解密，同时会依据解密后的信息进行鉴权操作，只有在鉴权通过的情况下，才会执行接下来的有效操作，如依据策略开放或禁止操作容器应用的权限，向容器增减应用等等操作。
C503通信模块，配置为实现Client内部模块或Client同Server端进行通信。支持RPC(Remote Procedure Call Protocol，远程调用协议)、IPC(Inter-Process Communication，进程间通信)、管道技术等等。
C504容器权限控制内核，是容器权限控制的中枢。它管控所有加入容器的应用，可以依据审计许可的策略开通或禁用应用的使用权限，可以向容器增减应用等等。容器权限控制内核，依据有效的认证信息，制定权限管控策略，对容器内应用的操作属性、使用时长、起止使用时间等进行管控。同时，会对一些超限使用进行预警。
C505消息记录模块，配置为记录容器操作的相关信息。消息记录模块维护容器中应用列表，维护容器应用使用过程中所做的操作信息，维护配置的权限列表，维护调度策略等。消息记录模块处理的信息可以存储在内存、磁盘文件、数据库或其他可固化数据设备。消息记录模块是和数据设备的接口，可以操控数据设备进行增加数据或删除数据。
S501信息交互模块，配置为实现Client端或管理员同Server进行的信息交互。Server端收到Client发送来的信息请求时候，会依据一定的策略将有效的请求信息反馈给管理员。同时，管理员可以通过信息交互模块审计请求信息。
S502特征信息处理模块，配置为处理特征信息。特征信息处理模块的信息分成两块，一个是同信息交互模块交互的信息，一个是同Client端交互的信息。特征信息处理模块会将来自信息交互模块的信息依据一定的协议进行映射和加密。对于同Client端交互的信息，特征信息处理模块会对信息进行加解密，同时会依据解密后的信息进行鉴权操作，只有在鉴权通过的情况下，才会执行接下来的有效操作，如将有效信息通过信息交互模块反馈给管理员，进行权限审计，或者依据默认的权限操作进行默认权限审计。
S503通信模块，配置为实现Server端内部模块或Server同Client端进行通信。支持RPC、IPC、管道技术等等。
S504容器权限控制内核，是容器进行自动权限控制的中枢。支持管理员通过配置权限管控策略，对Client的请求进行自动审计。开通或禁用应用的使用权限，向容器增减应用等等。制定的权限管控策略包括，对Client端容器内应用的操作属性、使用时长、起止使用时间等进行管控。
S505消息记录模块，配置为记录操作的相关信息。消息记录模块维护Client端容器的应用列表，维护容器应用使用过程中所做的操作信息，维护配置的权限列表，维护调度策略等。消息记录模块处理的信息可以存储在内存、磁盘文件、数据库或其他可固化数据设备。消息记录模块是和数据设备的接口，可以操控数据设备进行增加数据或删除数据。
综上所述，图5给出了一种容器管理装置，解决了基于容器的动态权限控制的问题。通过在电子终端安装部署本设备，使用者可以动态申请使用容器内容，认证者可以实现对申请权限的控制。如此，实现了基于容器的动态权限认证问题。
以下是本发明实施例的示例性实施方式，将结合附图，进行详细的阐述。
图6是根据本申请示例性实施例的容器应用动态权限管控消息处理流程图，如图6所示，步骤如下：
步骤S601，用户请求操作容器。用户可以请求向容器中添加或删除应用，申请使用或者禁用应用，申请包括但不限于如下属性：申请操作容器中应用的个数为一个或多个；申请的操作权限包括读取、修改或执行，每个应用的操作权限可以不一样；申请操作应用的开始操作时间、结束操作时间或时间 周期，不同应用可以不一致；申请的有效时间可以设置等等。
步骤S602，生成有效的特征信息。容器管理装置在读取来自用户或其他模块的请求后，会先根据C505消息记录模块维护的权限信息进行信息审核，输出初步有效的申请信息。数据通常会依据一定的加密协议被处理成加密数据，以保证数据的安全性。同时，会记录请求信息。
步骤S603，Server端收取特征信息。当收取的特征信息是加密数据时，Server端会先按照一定的解密协议进行解密，提取特征信息。提取的信息通常是以可识别的明文方式展现处理，供后续使用。同时，对提请的Client端进行身份认证，只有认证通过，才会进行后续处理，否则，会丢弃掉本次请求。
步骤S604，特征信息审计。Server端提取特征信息完成后，会依据既定的策略进行信息审计。审计方式可以是Server端持有者通过手动方式进行，也可以是依照S505消息记录模块中记录的既定权限策略进行自动化处理。审计后的信息才是允许Client端容器操作的内容。
步骤S605，对审计后的信息进行处理。处理内容和步骤S602类似。也涉及两部分内容，一个是记录最终审计信息，另一个是对审计信息的加密处理。
步骤S606，Client端进行特征信息提取。收取的特征信息是加密数据时，Client会按照一定的解密协议进行信息解密，提取特征信息。同时，会对提请的Server进行身份认证，只有认证通过，才会进行后续处理，否则，会丢弃掉本次请求，终止操作。
步骤S607，容器根据有效的认证请求处理认证内容。进入容器应用调度管理流程。
综上所述，图6给出了基于容器的动态权限控制的消息处理流程。解决了Client、Server进行动态权限管控过程中信息传递流程问题。无论Server端、Client端是部署在同一终端，还是部署在不同的终端，容器应用权限的动态管控都可以借助上述流程实现。不管是向容器增加、删除应用，还是申请容器中应用的使用权限，都可以基于上述流程实现。
图7是根据本申请示例性实施例的特征信息处理模块的框架结构图，如图7所示，特信息处理模块包括以下单元：特征信息生成单元701、特征信息提取单元702、特征信息审计单元703和鉴权单元704。特征信息处理模块负责处理请求信息。请求信息可以来自用户端，也可以来自装置的其他模块。下面将结合图8、图9、图10对特征信息处理流程做详细说明。
图8是根据本申请示例性实施例的特征信息生成单元的工作流程图，如图8所示，基于特征信息的信息类型、节点的工作模式不同，特征信息产生的工作流程有不同。处理流程如下：
步骤S801，特征信息生成单元获取请求信息。请求信息要么来自C501或S501信息交互模块，此时消息类型为请求(REQUEST)；要么来自C502或S502特征信息处理模块的特征信息审计单元703，此时消息类型为响应(RESPONSE)。消息类型不一样，后续的处理上也有差别。
步骤S802，判断消息类型。
下面将分别论述请求REQUEST和响应RESPONSE类型消息时的处理过程。
情况1，当请求信息为REQUEST消息类型时，处理流程如下：
步骤S803，根据容器中应用的基本关系表修正请求信息。这一步主要是用来处理应用ID的。Client端通常会维护一个容器中应用的基本关系表，表1是根据本申请示例性实施例中的应用的基本关系表。
表1
Figure PCTCN2017087585-appb-000001
其中，应用名称是管控装置上用户可视的应用名，应用内容是系统中实际的应用对象，映射ID是Client为添加在容器中的应用设定的唯一的ID值，时间粒度，是指用户可以申请操作应用的最小时间周期。
在向容器添加应用时，Client会向基本关系表添加应用添加一条关系信息。如用户向容器添加“xx课外辅导书”，用户定义应用名称为“My辅导书”，指定辅导书的存储位置“/xx课外辅导书存储位置”，同时Client会为“xx课外辅导书”分配一个唯一的应用ID“201”，用户在申请时候可以设定时间粒度也可以使用默认值“5分钟”。
在申请操作容器中应用时候，会先检索应用基本关系表，检验申请应用的合法性。当检验到所申请的应用不在容器应用基本关系表时，会将所请求应用从请求信息中删除。检验完成，合法的请求信息将输入到下一个步骤S804。
情况2，当请求信息为RESPONSE消息类型时，直接执行步骤S804。
步骤S804，组装有效请求信息。用户的请求可以分为两种，一种是请求操作容器，一种是请求使用容器的应用。因此，组装的有效请求信息格式分为两种，一种是对容器操作的信息格式，如向容器增减应用；一种是请求操作容器中应用的信息格式，如读、写、执行应用等。
在本实施例中定义如下：
请求操作容器请求信息格式为：
操作码+应用ID+应用名称+应用内容
请求操作容器中应用的信息格式为：
操作码+应用ID+开始时间编码+结束时间编码+使用周期编码
一条有效请求信息中，可以包含一条或多条请求操作容器请求信息或请求操作容器中应用的信息。
其中，表2是根据本申请示例性实施例的容器操作对应的操作码对应关系表，如表2所示，容器操作对应的操作码对应关系如下表所示：
表2
操作内容 操作码
读操作 1
写操作 2
执行操作 4
添加应用 8
移除应用 9
通常，读、写、执行操作可以叠加，叠加后的操作码为读、写、执行操作的和。如申请读+写，则对应的操作码为3；申请写+执行操作，则对应的操作码为6；申请读、写、执行操作，对应操作码为7。
应用ID、应用名称、应用内容见容器中应用的基本关系表。
开始时间编码、结束时间编码、使用周期编码是3位时间编码。对应值乘上容器中应用的基本关系表中应用的时间粒度，就是对应的时间。三者间有如下关系：
开始时间编码≤结束时间编码；
开始时间编码、结束时间编码、使用周期编码不全为0；
开始时间编码乘以容器中应用的基本关系表中应用的时间粒度，是申请应用开始执行时间；
结束时间编码乘以容器中应用的基本关系表中应用的时间粒度，是申请应用结束执行时间；
使用周期编码乘以容器中应用的基本关系表中应用的时间粒度，是申请应用使用时间；
开始时间编码、结束时间编码为000时，对起止时间不做限制，时间控制仅使用周期编码有效。
下面结合实际用例对有效请求信息组成做进一步说明。
例如，还以向容器添加“xx课外辅导书”为例说明。表3是根据本申请示例性实施例的修正后的容器关系表，如表3所示，容器关系表修正后的添加信息内容如下：
表3
Figure PCTCN2017087585-appb-000002
生成的有效请求信息为：“82015004d00798f855bfc4e66002f007800788bfe59 168f855bfc4e66”。
表4是根据本申请示例性实施例的容器中应用的基本关系表二，如表4所示，有如下表应用内容：
表4
Figure PCTCN2017087585-appb-000003
现在假设有效的请求信息如下：
1、申请使用xx Web浏览器，
使用时长：120分钟，
开始时间：12：00(当前时间11：20)，
结束时间：不限制，
使用权限：执行权限；
2、申请使用音乐播放器
使用时长：40分钟，
开始时间：13：10(当前时间11：20)，
结束时间：不限制，
使用权限：执行权限；
3、申请使用Xy辅导书
使用时长：40分钟，
开始时间：不限制，
结束时间：12：40(当前时间11：20)，
使用权限：读、写权限；
则生成的有效请求信息为：“4101008000024 4102022000004 3202000016008”。
步骤S805，加入认证信息表头生成特征信息。加入认证信息表头，用以验证消息的合法性。
在本实施例中，加入的特征信息头为“IP+用户口令”，设定IP为“10.1.1.191”，设定的用户口令为“123456”，则生成的用户表头为“010001001191123456”。接步骤S804例，在添加应用时，生成的特征信息为“01000100119112345682015004d00798f855bfc4e66002f007800788bfe59168f855bfc4e66”。在申请操作容器应用时，生成的特征信息为“01000100119112345641010080 00024 4102022000004 3202000016008”。
步骤S806，特征信息映射，用于对特征进行加密。
在本实施例中，采用将特征信息映射到图片上的方法，对特征信息进行加密。选取一张标准图片，图片格式为bmp，大小为320*256。对选取的图 片进行随机模块化。随机算法可设置如下：
x(n+1)＝1-k*x(n)^2，(n≥0，k＜1，x(0)＜1)
将特征信息分成m份，以分成的信息作为加密码，分别和图片块进行异或运算，得出加密的特征信息。
步骤S807，将映射完成的特征信息输入通信信道。通过相关协议，发送特征数据。
图9是根据本申请示例性实施例的特征信息提取单元的消息处理流程图，如图9所示，特征信息提取流程解读如下：
步骤S901，容器动态权限管控装置收取特征信息。
步骤S902，解析收取的特征信息。对于收取得做过映射处理的特征信息，需要依据一定的协议对特征信息进行解析。
上接步骤S806特征信息加密用例，对应的解析方法描述如下。
算取图片加密模块。Server将和Client持有的相同的标准图片进行异或运算，计算出加密码值。然后根据算法：
x(n+1)＝1-k*x(n)^2，(n≥0，k＜1，x(0)＜1)
取用和Client端产生数据端相似的种子k、x(n)，提取出特征信息位置，计算出特征信息。提取特征信息头信息，进行权限验证。特征信息头包括Client的IP和Client和Server的认证口令。Client的IP和口令验证无误，进入下一步骤，否则丢弃该请求。
步骤S903、解析出特征头信息。特征信息头由“IP+用户口令”组成。结合提取出的特征信息，提取出请求信息来源端的IP地址和Client分发的口令。
步骤S904、鉴权。首先验证信息来源的IP地址和请求信息带的IP是否是同一个地址，若不是同一个地址的鉴权失败，若是同一个地址则比对口令。确认端和请求端协商有用户口令。确认端从口令列表查询出确认端和请求端协商的用户口令，同请求信息中的口令进行比对，若比对成功则鉴权通过，否则鉴权失败。
图9中的S904的情况1，身份认证通过。身份认证通过时，作如下处理：
步骤S905，结合应用关系列表反映射特征信息获取请求详情。确认端也同样维护一个请求Client的应用关系列表，表的格式和内容和步骤S904应用关系列表相似。本步骤是根据映射码，解析出对应的请求内容。
步骤S906，将解析出的特征信息详情放入通信信道供后续使用。
图9中的S904的情况2，身份认证未通过。身份认证失败时，作如下处理：
步骤S907，丢弃请求信息。
图10是根据本申请示例性实施例的特征信息审计单元的消息处理流程图，如图10所示，在这一过程中，Server会依据配置策略给用户设置有效的请求回复，或者通过手工审批的方式实现给用户请求进行批复。本流程可表述如下：
步骤S1001，获取请求信息详情。请求信息是特征信息提取单元的处理结果。确认者可以选择是否查看请求信息。当进行人工审计时，确认者需要选择在界面上查看信息以进行请求信息审计。当进行默认策略审计时，确认管理者可以选择查看请求内容。
步骤S1002，审计类型判断。请求信息的审计有两种方式，一种是基于默认方式，即使用Server端维护的Client端的权限审计列表进行默认策略审计；一种是Server端操作者通过在请求信息展示终端进行人工审计。
图10中S1002的情况1，当选择人工审计时，进入步骤S1003人工审计请求信息。
步骤S1003，请求信息在终端展示出来，供人工审计。审计人员可以对显示在终端请求信息进行调整。如调整申请操作的权限，可以拒绝向容器增减应用；可以修改容器应用的操作权限，去除或增加可读、可写或可执行的权限；可以修正容器应用的使用时长；重新编订容器应用的使用顺序，可以指定哪些应用优先使用，哪些应用延后使用；可以修正容器应用的开始使用时间，可以修正容器应用的结束使用时间等等。Server端通过用户请求处理模块重新生成有效的用户请求信息。
步骤S1004，获取审计信息。特征信息审计完成后，审计终端后从终端界面读取审计信息。
步骤S1005，生成有效的用户请求特征信息，特征信息传送到信道。
图10中S1002的情况2，当选择不进行人工审计时，进入步骤S1006，根据默认权限限制列表修正用户请求信息。
步骤S1006，根据默认权限限制列表修正用户请求信息。在确认端，维护一个权限限制列表，表5是根据本申请示例性实施例的权限限制列表。
表5
Figure PCTCN2017087585-appb-000004
列表中的应用可以有自己独立的配置(conf)，也可以使用默认的conf。conf的内容格式如下：
……
      Permission＝x，r，w   #表示应用的执行权限
      Period＝120           #表示应用的可用时长
      Start＝null          #表示应用的可用的起始时间，null表示无限制
      End＝22：00          #表示应用的可用的最晚时间，表示22点前可用
      Use_time＝10:20 11:00, 14:20 15:00 #表示应用的可用的时段，’,’分割
      Unuse_time＝＝19:20 20:00, 21:20 22:00#表示应用不可用的时段，’,’分割
Add_auto＝true；           #表述允许自动向容器添加应用；
Delete_auto＝true；        #表述允许自动删除容器中的应用；
……
结合步骤S804中的请求信息，如web.conf定义如下：
……
      Permission＝x，w     #表示应用的执行权限
      Period＝60           #表示应用的可用时长
      Start＝null          #表示应用的可用的起始时间，null表示无限制
      End＝22：00          #表示应用的可用的最晚时间，表示22点前可用
      Use_time＝10:20 11:00, 12:20 13:00 #表示应用的可用的时段，’,’分割
……
default.conf定义如下：
……
      Permission＝x，w，r
      Period＝120
      Start＝null
      End＝22：00
      Unuse_time＝10:20 11:00,13:00 14:00
……
则审计后的请求后的有效请求信息如下：
1、申请使用xx Web浏览器，
使用时长：40分钟，
开始时间：12：20，
结束时间：13:00，
使用权限：执行权限；
2、申请使用音乐播放器
使用时长：0分钟，
开始时间：13：10，
结束时间：不限制，
使用权限：执行权限；
3、申请使用Xy辅导书
使用时长：40分钟，
开始时间：不限制，
结束时间：12：40，
使用权限：读、写权限；
将得出的信息结合应用关系列表进行映射，得出有效的请求信息。进入步骤S1005，生成有效的特征信息，特征信息传送到信道。
生成有效的特征信息后，确认端需要对有效的信息进行处理。如当需要向容器添加应用时，确认端需要向自己维护的应用关系列表中写入映射的关系。同时，消息记录模块要记录本次操作内容。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到根据 上述实施例的方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本申请的技术方案本质上或者说对相关技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端设备(可以是手机，计算机，服务器，或者网络设备等)执行本申请实施例的方法。
实施例二
在本实施例中还提供了一种应用的管理装置，该装置用于实现上述实施例及示例性实施方式，已经进行过说明的不再赘述。如以下所使用的，术语“模块”可以实现预定功能的软件、硬件、或软件和硬件的组合。尽管以下实施例所描述的装置较佳地以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。
图11是根据本发明实施例的应用的管理装置的结构框图一，该装置应用于客户端设备，如图11所示，该装置包括：
第一接收模块112，配置为接收用户的请求信息，其中，该请求信息用于向服务器请求对指定应用进行管理的权限，其中，该指定应用为该客户端设备中指定存储空间中的应用；
第一发送模块114，与第一接收模块112连接，配置为将该请求信息发送到服务器；
管理模块116，与第一发送模块114连接，配置为接收该服务器依据该请求信息反馈的权限信息，并依据该权限信息对该指定应用进行管理。
在示例性实施方式中，该管理模块116还可以配置为在依据该权限信息对该指定应用进行管理之前，依据第一预设规则验证权限信息，在该权限信息通过验证的情况下，依据该权限信息对该指定应用进行管理。
在示例性实施方式中，该第一发送模块114还可以配置为在将该请求信息发送到服务器之前，对该请求信息进行预处理，将该预处理后的请求信息发送到服务器，其中，该预处理包括以下之一：
采用预设协议封装该请求信息；
采用预设密钥加密该请求信息。
在示例性实施方式中，该第一接收模块112还可以配置为在接收用户的请求信息之前，接收用户的申请信息，依据该申请信息在该客户端设备内创建用于管理应用的指定存储空间。
在示例性实施方式中，该应用可以包括以下至少之一：文档、图片、音频文件、视频文件、应用程序。
在示例性实施方式中，该依据该权限信息对该指定应用进行管理可以包括以下至少之一：在该指定存储空间内添加应用；移除添加到该指定存储空间的应用；申请使用或禁用该指定存储空间中的应用，其中，在申请操作该指定存储空间中应用时，申请对该应用的部分操作权限；申请使用该指定存储空间中的应用的开始时间和结束时间中的至少一项；申请设置该指定存储空间中的应用的操作属性，操作属性包括以下至少之一：写入、读取、执行。
图12是根据本发明实施例的应用的管理装置的结构框图二，该装置应用于服务器，如图12所示，该装置包括：
第二接收模块122，配置为接收客户端设备发送的请求信息，其中，该请求信息用于向该服务器请求对指定应用进行管理的权限，其中，该指定应用为该客户端设备中指定存储空间中的应用；
处理模块124，与第二接收模块122连接，配置为依据预定义规则和权限管理员的输入信息中的至少一项处理该请求信息得到权限信息；
第二发送模块126，与处理模块124连接，配置为将该权限信息发送到该客户端设备，以便该客户端设备依据该权限信息对该指定应用进行管理。
在示例性实施方式中，该应用可以包括以下至少之一：文档、图片、音频文件、视频文件、应用程序。
在示例性实施方式中，该处理模块124还可以配置为在该第二接收模块122接收客户端设备发送的请求信息之后，依据第二预设规则验证该请求信息，在该请求信息通过验证的情况下，依据预定义规则和权限管理员的输入信息中的至少一项处理该请求信息得到权限信息。
需要说明的是，上述模块是可以通过软件或硬件来实现的，对于后者， 可以通过以下方式实现，但不限于此：由同一处理器实现上述模块；或者，由不同的处理器实现上述模块。
实施例三
本发明实施例提供了一种应用的管理系统，包括：客户端设备、服务器；
该客户端设备配置为接收用户的请求信息，其中，该请求信息用于向该服务器请求对指定应用进行管理的权限，其中，该指定应用为该客户端设备中指定存储空间中的应用；
该客户端设备还配置为将该请求信息发送到服务器；
该服务器配置为接收该客户端设备发送的请求信息；
该服务器还配置为依据预定义规则和权限管理员的输入信息中的至少一项处理该请求信息得到权限信息；
该服务器还配置为将该权限信息发送到该客户端设备；
该客户端设备还配置为接收该服务器发送的该权限信息，并依据该权限信息对该指定应用进行管理。
实施例四
本发明实施例提供了一种机器可读介质。在本实施例中，上述机器可读介质可以被设置为存储用于执行以下步骤的程序代码：
S1，客户端设备接收用户的请求信息，其中，该请求信息用于向服务器请求对指定应用进行管理的权限，其中，该指定应用为该客户端设备中指定存储空间中的应用；
S2，客户端设备将该请求信息发送到服务器；
S3，该客户端设备接收该服务器依据该请求信息反馈的权限信息，并依据该权限信息对该指定应用进行管理。
在示例性实施方式中，上述机器可读介质可以被设置为存储用于执行以下步骤的程序代码：
S4，服务器接收客户端设备发送的请求信息，其中，该请求信息用于向该服务器请求对指定应用进行管理的权限，其中，该指定应用为该客户端设 备中指定存储空间中的应用；
S5，该服务器依据预定义规则和权限管理员的输入信息中的至少一项处理该请求信息得到权限信息；
S6，该服务器将该权限信息发送到该客户端设备，其中，该客户端设备依据该权限信息对该指定应用进行管理。
在本实施例中，上述机器可读介质可以包括但不限于：U盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。
在本实施例中，处理器可以根据机器可读介质中已存储的程序代码执行上述实施例的方法步骤。
本实施例中的示例可以参考上述实施例及示例性实施方式中所描述的示例，本实施例在此不再赘述。
本领域普通技术人员可以理解，上文中所公开方法中的全部或某些步骤、系统、装置中的功能模块/单元可以被实施为软件、固件、硬件及其适当的组合。在硬件实施方式中，在以上描述中提及的功能模块/单元之间的划分不一定对应于物理组件的划分；例如，一个物理组件可以具有多个功能，或者一个功能或步骤可以由若干物理组件合作执行。某些组件或所有组件可以被实施为由处理器，如数字信号处理器或微处理器执行的软件，或者被实施为硬件，或者被实施为集成电路，如专用集成电路。这样的软件可以分布在机器可读介质(比如，计算机可读介质)上，计算机可读介质可以包括计算机存储介质(或非暂时性介质)和通信介质(或暂时性介质)。如本领域普通技术人员公知的，术语计算机存储介质包括在用于存储信息(诸如计算机可读指令、数据结构、程序模块或其他数据)的任何方法或技术中实施的易失性和非易失性、可移除和不可移除介质。计算机存储介质包括但不限于RAM、ROM、EEPROM、闪存或其他存储器技术、CD-ROM、数字多功能盘(DVD)或其他光盘存储、磁盒、磁带、磁盘存储或其他磁存储装置、或者可以用于存储期望的信息并且可以被计算机访问的任何其他的介质。此外，本领域普通技术人员公知的是，通信介质通常包含计算机可读指令、数据结构、程序模块或者诸如载波或其他传输机制之类的调制数据信号中的其他数据，并且 可包括任何信息递送介质。
以上所述仅为本申请的示例性实施例而已，并不用于限制本申请，对于本领域的技术人员来说，本申请可以有各种更改和变化。凡在本申请的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。
工业实用性
本申请实施例提供一种应用的管理方法、装置及系统，解决了相关技术中缺乏对应用权限管理的问题，实时便捷有效地对应用进行了权限管理。

Claims (19)

  1. 一种应用的管理方法，包括：
    客户端设备接收用户的请求信息，其中，所述请求信息用于向服务器请求对指定应用进行管理的权限，其中，所述指定应用为所述客户端设备中指定存储空间中的应用；
    所述客户端设备将所述请求信息发送到服务器；
    所述客户端设备接收所述服务器依据所述请求信息反馈的权限信息，并依据该权限信息对所述指定应用进行管理。
  2. 根据权利要求1所述的方法，在依据该权限信息对所述指定应用进行管理之前，所述方法还包括：所述客户端设备依据第一预设规则验证所述权限信息；
    所述依据该权限信息对所述指定应用进行管理，包括：在所述权限信息通过验证的情况下，所述客户端设备依据所述权限信息对所述指定应用进行管理。
  3. 根据权利要求1所述的方法，在客户端设备将所述请求信息发送到服务器之前，所述方法还包括：
    所述客户端设备对所述请求信息进行预处理，将所述预处理后的请求信息发送到服务器，其中，所述预处理包括以下之一：
    采用预设协议封装所述请求信息；
    采用预设密钥加密所述请求信息。
  4. 根据权利要求1所述的方法，在客户端设备接收用户的请求信息之前，所述方法还包括：
    所述客户端设备接收用户的申请信息，依据所述申请信息在所述客户端设备内创建用于管理应用的指定存储空间。
  5. 根据权利要求1至4中任一项所述的方法，其中，所述应用包括以下至少之一：文档、图片、音频文件、视频文件、应用程序。
  6. 根据权利要求1所述的方法，其中，所述依据该权限信息对所述指 定应用进行管理包括以下至少之一：
    在所述指定存储空间内添加应用；
    移除添加到所述指定存储空间的应用；
    申请使用或禁用所述指定存储空间中的应用；
    申请使用所述指定存储空间中的应用的开始时间和结束时间中的至少一项；
    申请设置所述指定存储空间中的应用的操作属性，其中，所述操作属性包括以下至少之一：写入、读取、执行。
  7. 一种应用的管理方法，包括：
    服务器接收客户端设备发送的请求信息，其中，所述请求信息用于向所述服务器请求对指定应用进行管理的权限，其中，所述指定应用为所述客户端设备中指定存储空间中的应用；
    所述服务器依据预定义规则和权限管理员的输入信息中的至少一项处理所述请求信息得到权限信息；
    所述服务器将所述权限信息发送到所述客户端设备，以便所述客户端设备依据所述权限信息对所述指定应用进行管理。
  8. 根据权利要求7所述的方法，其中，所述应用包括以下至少之一：文档、图片、音频文件、视频文件、应用程序。
  9. 根据权利要求7所述的方法，在所述服务器接收客户端设备发送的请求信息之后，所述方法还包括：
    所述服务器依据第二预设规则验证所述请求信息；
    所述服务器依据预定义规则和权限管理员的输入信息中的至少一项处理所述请求信息得到权限信息，包括：在所述请求信息通过验证的情况下，所述服务器依据预定义规则和权限管理员的输入信息中的至少一项处理所述请求信息得到权限信息。
  10. 一种应用的管理装置，应用于客户端设备，包括：
    第一接收模块，配置为接收用户的请求信息，其中，所述请求信息用于 向服务器请求对指定应用进行管理的权限，其中，所述指定应用为所述客户端设备中指定存储空间中的应用；
    第一发送模块，配置为将所述请求信息发送到服务器；
    管理模块，配置为接收所述服务器依据所述请求信息反馈的权限信息，并依据该权限信息对所述指定应用进行管理。
  11. 根据权利要求10所述的装置，其中，所述管理模块还配置为在依据该权限信息对所述指定应用进行管理之前，依据第一预设规则验证所述权限信息，在所述权限信息通过验证的情况下，依据所述权限信息对所述指定应用进行管理。
  12. 根据权利要求10所述的装置，其中，所述第一发送模块还配置为在将所述请求信息发送到服务器之前，对所述请求信息进行预处理，将所述预处理后的请求信息发送到服务器，其中，所述预处理包括以下之一：
    采用预设协议封装所述请求信息；
    采用预设密钥加密所述请求信息。
  13. 根据权利要求10所述的装置，其中，所述第一接收模块还配置为在接收用户的请求信息之前，接收用户的申请信息，并依据所述申请信息在所述客户端设备内创建用于管理应用的指定存储空间。
  14. 根据权利要求10至13中任一项所述的装置，其中，所述应用包括以下至少之一：文档、图片、音频文件、视频文件、应用程序。
  15. 根据权利要求10所述的装置，其中，所述管理模块配置为通过以下至少之一方式依据该权限信息对所述指定应用进行管理：
    在所述指定存储空间内添加应用；
    移除添加到所述指定存储空间的应用；
    申请使用或禁用所述指定存储空间中的应用；
    申请使用所述指定存储空间中的应用的开始时间和结束时间中的至少一项；
    申请设置所述指定存储空间中的应用的操作属性，其中，所述操作属性 包括以下至少之一：写入、读取、执行。
  16. 一种应用的管理装置，应用于服务器，包括：
    第二接收模块，配置为接收客户端设备发送的请求信息，其中，所述请求信息用于向所述服务器请求对指定应用进行管理的权限，其中，所述指定应用为所述客户端设备中指定存储空间中的应用；
    处理模块，配置为依据预定义规则和权限管理员的输入信息中的至少一项处理所述请求信息得到权限信息；
    第二发送模块，配置为将所述权限信息发送到所述客户端设备，以便所述客户端设备依据所述权限信息对所述指定应用进行管理。
  17. 根据权利要求16所述的装置，其中，所述应用包括以下之一：文档、图片、音频文件、视频文件、应用程序。
  18. 根据权利要求16所述的装置，其中，所述处理模块还配置为在所述第二接收模块接收客户端设备发送的请求信息之后，依据第二预设规则验证所述请求信息，在所述请求信息通过验证的情况下，依据预定义规则和权限管理员的输入信息中的至少一项处理所述请求信息得到权限信息。
  19. 一种应用的管理系统，包括：客户端设备、服务器；
    所述客户端设备配置为接收用户的请求信息，其中，所述请求信息用于向所述服务器请求对指定应用进行管理的权限，其中，所述指定应用为所述客户端设备中指定存储空间中的应用；
    所述客户端设备配置为将所述请求信息发送到服务器；
    所述服务器配置为接收所述客户端设备发送的请求信息；
    所述服务器配置为依据预定义规则和权限管理员的输入信息中的至少一项处理所述请求信息得到权限信息；
    所述服务器配置为将所述权限信息发送到所述客户端设备；
    所述客户端设备配置为接收所述服务器发送的所述权限信息，并依据该权限信息对所述指定应用进行管理。
PCT/CN2017/087585 2016-06-27 2017-06-08 应用的管理方法、装置及系统 WO2018001065A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610482746.XA CN107545188B (zh) 2016-06-27 2016-06-27 应用的管理方法、装置及系统
CN201610482746.X 2016-06-27

Publications (1)

Publication Number Publication Date
WO2018001065A1 true WO2018001065A1 (zh) 2018-01-04

Family

ID=60785095

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/087585 WO2018001065A1 (zh) 2016-06-27 2017-06-08 应用的管理方法、装置及系统

Country Status (2)

Country Link
CN (1) CN107545188B (zh)
WO (1) WO2018001065A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109669718A (zh) * 2018-09-26 2019-04-23 深圳壹账通智能科技有限公司 系统权限配置方法、装置、设备及存储介质
CN110324338A (zh) * 2019-06-28 2019-10-11 深圳前海微众银行股份有限公司 数据交互方法、装置、堡垒机与计算机可读存储介质
CN113608729A (zh) * 2021-08-18 2021-11-05 山东新一代信息产业技术研究院有限公司 一种部署client端实现方法

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110362355B (zh) * 2018-04-02 2022-06-28 青岛海信移动通信技术股份有限公司 一种应用界面显示方法及装置
CN111831994B (zh) * 2020-07-15 2022-06-03 神思电子技术股份有限公司 一种基于web浏览器的设备权限认证方法
CN112580003B (zh) * 2020-12-23 2024-03-26 深圳市捷顺科技实业股份有限公司 一种基于bs架构的权限控制方法及服务器

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102281324A (zh) * 2011-06-17 2011-12-14 袁程 一种移动通信终端系统菜单项远程授权管理的方法
CN102387139A (zh) * 2011-10-17 2012-03-21 迈普通信技术股份有限公司 一种与应用业务分离的权限控制方法、系统及装置
CN103152722A (zh) * 2013-01-28 2013-06-12 东莞宇龙通信科技有限公司 应用操作的控制方法及系统
CN103841192A (zh) * 2014-03-05 2014-06-04 天闻数媒科技（北京）有限公司 一种远程控制移动终端应用软件的方法和系统
CN104468986A (zh) * 2014-11-20 2015-03-25 深圳市世纪安软信息技术有限公司 手机多用户操作模式管理方法及系统
CN105450714A (zh) * 2014-09-19 2016-03-30 中兴通讯股份有限公司 一种对终端应用安装进行远程控制的方法及装置

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102446256A (zh) * 2011-08-24 2012-05-09 宇龙计算机通信科技(深圳)有限公司 终端和应用程序管理方法

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102281324A (zh) * 2011-06-17 2011-12-14 袁程 一种移动通信终端系统菜单项远程授权管理的方法
CN102387139A (zh) * 2011-10-17 2012-03-21 迈普通信技术股份有限公司 一种与应用业务分离的权限控制方法、系统及装置
CN103152722A (zh) * 2013-01-28 2013-06-12 东莞宇龙通信科技有限公司 应用操作的控制方法及系统
CN103841192A (zh) * 2014-03-05 2014-06-04 天闻数媒科技（北京）有限公司 一种远程控制移动终端应用软件的方法和系统
CN105450714A (zh) * 2014-09-19 2016-03-30 中兴通讯股份有限公司 一种对终端应用安装进行远程控制的方法及装置
CN104468986A (zh) * 2014-11-20 2015-03-25 深圳市世纪安软信息技术有限公司 手机多用户操作模式管理方法及系统

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109669718A (zh) * 2018-09-26 2019-04-23 深圳壹账通智能科技有限公司 系统权限配置方法、装置、设备及存储介质
CN110324338A (zh) * 2019-06-28 2019-10-11 深圳前海微众银行股份有限公司 数据交互方法、装置、堡垒机与计算机可读存储介质
CN113608729A (zh) * 2021-08-18 2021-11-05 山东新一代信息产业技术研究院有限公司 一种部署client端实现方法
CN113608729B (zh) * 2021-08-18 2023-07-04 山东新一代信息产业技术研究院有限公司 一种部署client端实现方法

Also Published As

Publication number Publication date
CN107545188B (zh) 2023-09-22
CN107545188A (zh) 2018-01-05

Similar Documents

Publication Publication Date Title
WO2018001065A1 (zh) 应用的管理方法、装置及系统
US10623406B2 (en) Access authentication for cloud-based shared content
US9886563B2 (en) Personalized online content access experiences using inferred user intent to configure online session attributes
US10325076B2 (en) Personalized online content access experiences using online session attributes
US8935532B2 (en) Content distribution and aggregation
WO2017202312A1 (zh) 消息权限管理方法及设备、存储介质
US10084790B2 (en) Peer to peer enterprise file sharing
US8621036B1 (en) Secure file access using a file access server
WO2017129016A1 (zh) 一种资源访问方法、装置及系统
US20160285832A1 (en) Secure consumption of platform services by applications
US20170371625A1 (en) Content delivery method
US10095848B2 (en) System, method and apparatus for securely distributing content
US20150205973A1 (en) Method and apparatus for providing data sharing
CN108289074B (zh) 用户账号登录方法及装置
US20150327064A1 (en) Message transmission system and method for a structure of a plurality of organizations
CN110602132A (zh) 一种数据加解密处理方法
JP5678150B2 (ja) ユーザ端末、鍵管理システム、及びプログラム
EP3975015B9 (en) Applet package sending method and device and computer readable medium
US10628439B1 (en) System and method for movie digital content version control access during file delivery and playback
US11977644B2 (en) Systems and methods for remote ownership and content control of media files on untrusted systems
CN107770095B (zh) 一种用于控制虚拟机元数据访问的方法与设备
KR20230090808A (ko) 블록체인을 이용한 사회 관계망 서비스 제공 시스템
CN116781295A (zh) 数据加密方法、数据访问方法、系统、装置以及存储介质
KR20230090805A (ko) 블록체인을 이용한 신원 및 신분 관리 서비스 어플리케이션
CN116861490A (zh) 第三方服务平台接入方法、装置、计算机设备和存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17819062

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17819062

Country of ref document: EP

Kind code of ref document: A1