WO2018054230A1

WO2018054230A1 - Method and device for controlling access right of application program

Info

Publication number: WO2018054230A1
Application number: PCT/CN2017/101041
Authority: WO
Inventors: 范孟利
Original assignee: 中兴通讯股份有限公司
Priority date: 2016-09-20
Filing date: 2017-09-08
Publication date: 2018-03-29
Also published as: CN107844699A

Abstract

A method and a device for controlling the access right of an application program. The method comprises: receiving a request that is transmitted by an application program and used for granting an access right; determining whether to prohibit granting the access right to the application program; if granting the access right to the application program is prohibited, disabling the access right for the application program, and transmitting to the application program information that the access right has been granted. Thus the method does not actually grant the access right to the application program, but when the application program receives the information that the access right has been granted, it is considered that the application program has the required access right and can access a function or application corresponding to the access right, and in this case, the application program can be normally used.

Description

Access control method and device for application

Technical field

The present invention relates to the field of communications, and in particular to an access control method and apparatus for an application.

Background technique

At present, in order to improve the quality of life of users, a large number of terminal applications have emerged. These applications are used in a variety of ways, including life, entertainment, and learning.

When the application is installed in the terminal, the application will request access to the terminal, such as access to the phone, SMS, camera, address book, microphone. However, in practice most applications do not require these access rights at runtime, and the use of the application has nothing to do with these access rights. The reason why the application will request access rights that are not used may be due to the design of the programming, or it may be deliberately required to maliciously obtain the information in the terminal. If the user does not allow the application to gain access, the application will not function properly or even start. If the user opens the access required by the application, the application will not use these access permissions when running, and sometimes it will bring hidden dangers to the information security of the terminal.

For example, when installing a picture beautification software, the picture beautification software requests to obtain a final call record; when installing a historical novel reading software, the reading software requests to read the user's location information. However, the photo landscaping software does not use the call history, and the reading software has nothing to do with the user's location. If the user does not allow authorization for the access permission required by the application software, the application software cannot be used normally, or even the application software cannot be opened; if the access permission is opened for the application software, the call history, geographical location, and exposure may be unconsciously exposed. Important information such as address book and SMS memory.

Summary of the invention

The invention provides an access control method and device for an application program, which are used to solve the problem An issue where the application will not function properly when authorizing access to the application request.

In order to solve the above technical problems, the present invention is solved by the following technical solutions:

An embodiment of the present invention provides a method for controlling access rights of an application, including: receiving a request sent by an application for authorizing access rights; determining whether to prohibit granting the access permission to the application; The application grants the access right, and the access right is closed for the application, and the information that the access right has been authorized is sent to the application.

Determining whether to prohibit the granting the access right to the application includes: generating, according to the request, prompt information including information of the access authority; receiving a selection instruction determined according to the prompt information; The selection instruction is a prohibition authorization instruction, and the access authority is prohibited from being granted to the application.

Determining whether to prohibit the granting the access right to the application includes: querying, according to the request, a preset application permission comparison table; the application permission comparison table records the matching application and access rights. Information; determining whether the information of the application and the access right match; if the information of the application and the access right do not match, prohibiting granting the access right to the application.

The method further includes: if the application has been authorized to access, the access is disabled, and the application is sent the information that the access authority has been authorized.

After the access permission is closed for the application, the method further includes: in the running of the application, if the application accesses based on the closed access right, feeding back the preset to the application information.

The embodiment of the present invention further provides an access control device for an application, comprising: a receiving module, configured to receive a request sent by an application for authorizing access rights; and a determining module configured to determine whether to prohibit the The application grants the access authority; the sending module is configured to determine, in the determining module, prohibiting granting the access right to the application In the case, the access right is closed for the application, and the information that the access right has been authorized is sent to the application.

The device further includes a determining module, configured to: generate, according to the request, prompt information including information of the access authority; receive a selection instruction determined according to the prompt information; if the selection If the instruction is an authorization authorization instruction, the access authority is prohibited from being granted to the application.

The device further includes a determining module: the determining module is configured to query a preset application permission comparison table according to the request; the application permission comparison table records information of the matched application and access rights. Determining whether the information of the application and the access authority match; if the information of the application and the access right do not match, prohibiting granting the access right to the application.

The sending module is further configured to: if the application has been authorized to have access rights disabled, open the access right for the application, and send the access permission to the application has been authorized Information.

The sending module is further configured to: after the application is closed for the application, in the running of the application, if the application accesses based on the closed access right, the application is applied to the application The program feeds back the preset information.

An embodiment of the present invention further provides a storage medium, where the storage medium includes a stored program, where the program runs to execute an access permission control method of the application.

The beneficial effects of the present invention are as follows:

The present invention receives a request sent by an application for authorizing an access right; and in a case where the access right is prohibited from being granted to the application, the information that the access right has been authorized successfully is sent to the application. In this way, the application is not granted the access right, but when the application receives the authorized information, the application believes that the application already has the required access rights, and can access the function or application corresponding to the access right. In this case, the application can be used normally.

DRAWINGS

The drawings described herein are intended to provide a further understanding of the invention, and are intended to be a part of the invention. In the drawing:

1 is a flowchart of an access right control method of an application according to a first embodiment of the present invention;

2 is a flowchart of an access right control method of an application according to a second embodiment of the present invention;

3 is a flowchart of a method for controlling access rights of an application according to a third embodiment of the present invention;

4 is a system framework diagram of access authority control of an application according to a fourth embodiment of the present invention;

Figure 5 is a structural diagram of an access authority control apparatus of an application program according to a fifth embodiment of the present invention.

detailed description

The present invention provides a method for controlling access rights of an application, comprising: receiving a request sent by an application for authorizing an access right; and in the case of prohibiting granting the access right to the application, the application is The program closes the access right and sends the application the information that the access right has been authorized successfully.

In this way, the application is not granted the access right, so that the application disables the access right, but when the application receives the authorized success information, the application considers that the application has the required access rights and can access the access right. The corresponding function or application, in this case, the application can be used normally.

For example, receiving a request sent by the Mito software, the request is used to obtain access to the call record; in fact, the Mito software does not use the right to access the call record during the running process, so the access to the Mito software can be prohibited. Permission to call records; in the ban on the granting of Meitu software When accessing the call record permission, the Mito software disables the right to access the call record, and the Mito software sends the permission to access the call record has been authorized successfully, and actually does not have permission to access the call record for the Mito software, but After receiving the information that the authorization has been successfully authorized, the Meitu software considers that the call record can be accessed.

The invention can solve the problem that the application program cannot be used normally when the authorization permission requested by the application is not allowed, and the hidden danger of the terminal information security caused by the malicious request permission of the application can be avoided, and the user is convenient to use the application. At the same time, the program can also improve the security of the terminal information, and the user experience is good.

The invention will be further described in detail below with reference to the drawings and embodiments. It is understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

Embodiment 1

This embodiment provides an access permission control method for an application. The execution body of this embodiment is a terminal. An application is installed in the terminal. 1 is a flow chart of a method for controlling access rights of an application according to a first embodiment of the present invention.

Step S110, receiving a request sent by the application for granting access rights.

Receives a request from the application to grant access when the application is installed or running.

The access rights correspond to the functions or applications in the terminal. An application can access a feature or application corresponding to that access right only if the application is granted access.

For example, the navigation software needs to be granted the right to access the geographic location of the terminal, in order to obtain the geographical location of the terminal, and identify the geographical location of the terminal in the navigation software.

In step S120, it is determined whether the access authority is prohibited from being granted to the application; if yes, step S140 is performed; if not, step S130 is performed.

According to the user's input, it can be judged whether the access right can be granted to the application; or the access right that each application really needs to be used can be collected in advance, and according to the collected result, whether the access right can be granted to the application can be determined.

Step S130, in the case that the access permission is granted to the application, the access permission is turned on for the application, and the information that the access right has been authorized is sent to the application.

Turning on access for an application grants the application access to the application, enabling the application to access the application or feature for that access.

In the case that the application is allowed to grant the access right, an instruction for granting the access right to the application may be received, the access permission is opened for the application according to the instruction, and the access right is sent to the application. Authorize successful information to notify the application that the access is already available.

Step S140, in the case that the access right is prohibited from being granted to the application, the access right is closed for the application, and the information that the access right has been authorized is sent to the application.

Turning off access for an application means that the application is not granted access, so that the application cannot access the application or function corresponding to the access.

In the case that the application is prohibited from granting the access right, an instruction to prohibit the application from being granted the access right may be received, the access permission is closed for the application according to the instruction, and the application is disabled at the bottom of the system. Access rights, but in order for the application to be used normally, send information to the application that the access has been authorized successfully to notify the application that the access is already available.

After the application believes that the required access rights are all authorized, the application can be used normally.

If the access rights that the application has been authorized are prohibited, the information that the access rights have been authorized is sent to the application. Further, if the access permission that the application does not need to be used is authorized, the access right may be turned off, and the access right is authorized to be sent to the application when the application is opened or during the running of the application. The successful information makes the application not to be used normally because access rights are prohibited.

While the application is running, if the application is accessed based on the closed access rights, The preset information is fed back to the application. Further, if it is forbidden to grant an access right to the application, the access right is closed for the application, and the information that the access right has been authorized successfully is sent to the application, the application accesses the corresponding access right. When the function or application is used, the application is prohibited from accessing the function or application corresponding to the access right, and the preset information is fed back to the application, so that the application believes that the access right can be used normally. The preset information may be a null value or information having a preset content.

In this embodiment, the application considers that the required access rights have been authorized, and always believes that the required access rights have been authorized, so that the application can be used normally by the user, but the application cannot be truly used during use. The function or application corresponding to the access right is accessed, so that the information security of the terminal is not threatened.

Embodiment 2

In the scenario of requesting authorization, the terminal system includes security restrictions. This safety limit includes: Dangerous rating. The hazard level indicates a potential risk, the system does not automatically authorize the application, and needs to be confirmed by the user to authorize. An application is installed in the terminal, and the application requesting access rights is considered by the end system to be a dangerous level.

In this embodiment, according to the request for authorizing the access authority sent by the application, the prompt information including the information of the access right may be generated; and the selection instruction determined according to the prompt information may be received; if the selection instruction is If the authorization instruction is not allowed, the access authority is prohibited from being granted to the application; if the selection instruction is an authorization authorization instruction, the application is allowed to grant the access authority.

In order to make the present invention more understandable, in the present embodiment, the application has not been authorized to access one. In the actual scenario, if the application has not been authorized to have multiple access rights, it is determined whether to grant the access permission to the application for each access right that has not been authorized.

2 is a flow chart of a method for controlling access rights of an application according to a second embodiment of the present invention.

In step S210, when the application is started, the access permission required by the application is queried according to the request of the application.

The access rights required by the application are the access rights that the application is expected to get when designing the application. The access required by the application is not necessarily the access that is required to run the application.

The application's request is used to request authorization for the access required by the application.

In the request, the information of the access authority may not be carried, and the information of the access authority required by the application may be queried by querying the configuration information of the application. If the request carries the information of the access right, step S220 may be directly executed after receiving the request.

Step S220, determining whether the access authority requested by the application has been authorized; if yes, executing step S270; if not, executing step S230.

In order to prevent the user from having to turn off the access required by the application before opening the application, it is possible to first determine whether the access rights required by the application have been authorized. Further, a rights management option is set in the terminal system, in which the access rights of the application can be turned on or off.

Step S230, providing the user with the prompt information including the information of the access authority, and receiving the selection instruction determined according to the prompt information.

Provide prompt information to the user in the form of a pop-up prompt box. The prompt box includes information on whether to allow the application to grant the access permission, and sets whether or not to allow the application to grant the access permission. With this option the user can enter a selection command.

Choices include: a selection that allows the application to be granted the access and a selection that prohibits the application from being granted the access. A selection instruction that allows authorization can be entered by an option that allows the application to be granted the access. A selection instruction that prohibits authorization can be entered by disabling the option to grant the access to the application.

The selection instruction is: permission authorization instruction or prohibition authorization instruction.

Step S240, determining, according to the selection instruction, whether the user is allowed to grant the application The access authority is granted; if yes, step S250 is performed; if no, step S260 is performed.

If the selection instruction is an permission authorization instruction, it may be determined that the user is allowed to grant the access authority to the application; if the selection instruction is the prohibition authorization instruction, it may be determined that the user is not allowed to grant the access right to the application.

For example, when launching the Mito software, a prompt box pops up in the user interface, and a prompt message "Whether the Mito software is allowed to access the current location information" is set in the prompt box, and the options "Yes" and "No" are set, if the user If "Yes" is selected, the user is allowed to access the current location information; if the user selects "No", the user is not allowed to access the current location information.

Step S250, authorizing the access right, and returning information to the application that the access right has been authorized.

Step S260, the access authority is not authorized, and information that the access right has been authorized is returned to the application.

In step S270, the application is run.

After the application receives the information that the access rights have been authorized, it is determined that the access rights have been authorized. If all the access rights required by the application receive the information that has already been authorized, it can run normally.

The application works fine because the application believes that its required access rights are already authorized. If the user finds that there is no need to provide an access right for the application, in the setup menu, the access permission can be turned off, and the authorization for the access permission is disabled.

Embodiment 3

Querying a preset application permission comparison table according to a request sent by the application for authorizing access rights; the application permission comparison table records information of the matched application and access rights; determining the application and the Whether the information of the access right matches; if the information of the application and the access right do not match, the access right is prohibited from being granted to the application; if the application and the access right match, the permission is allowed The application Grant the access rights.

3 is a flow chart of a method for controlling access rights of an application according to a third embodiment of the present invention.

In step S310, an application permission comparison table is set in advance.

The application permissions comparison table is used to record matching applications and access rights. Applications and access rights can be replaced with identifiers in the application permissions comparison table.

Matching the application and access rights means that the application will use that access right during the run. For example, the navigation software matches the access rights of the geographic location, and the access rights of the Mito software and the photo album match.

A mismatch between the application and the access rights indicates that the application does not use the access right during the run or that the application uses the access right as a malicious behavior during the run.

Malicious behavior includes that the information obtained by the application based on the access rights is not used in the running of the application, but directly sends the obtained information to the preset server.

For example, the access rights of the Mito software and the geographical location do not match; the Mito software obtains the call record in the terminal based on the call record access right, and sends the call record to the server for sending the short message, which is a malicious behavior.

In step S320, when the application is started, the access permission required by the application is queried according to the request of the application.

In step S330, it is determined whether the access rights requested by the application are all authorized; if yes, step S370 is performed; if not, step S340 is performed.

Step S340, querying whether the information of the application and the access authority match according to the application permission comparison table; if yes, executing step S350; if not, executing step S360.

In the application permission comparison table, query whether there is a correspondence between the identifier of the application and the identifier of the information of the access authority; if it exists, the application matches the access right; if not, the description is The app does not match this access.

Step S350, authorizing the access right, and returning information to the application that the access right has been authorized.

Step S360, the access authority is not authorized, and information that the access right has been authorized is returned to the application.

In step S370, the application is run.

In this embodiment, if it is found that the application does not match the access right, the prompt information including the information of the access right may be generated, and the selection instruction input according to the prompt information may be received; if the selection instruction is the prohibition authorization instruction, Not authorizing the access right, and returning to the application information that the access right has been authorized; if the selecting instruction is an allow authorization command, authorizing the access right, and returning the access right to the application has been Authorized information.

Embodiment 4

In order to implement the information that the access authority has been authorized to be sent to the application in the case of forbidding the access permission to the application, the embodiment adds a rights management layer in the system architecture of the terminal, and the authority The management is responsible for controlling access to the application. 4 is a system framework diagram of access authority control of an application according to a fourth embodiment of the present invention.

The system running on the terminal can be an Android (Android) system.

The system framework includes: application framework layer, rights management layer and application layer.

Application layer for running applications.

The rights management layer is used to control access rights of the application.

The application framework layer is used to manage the access rights of the application, that is, to enable or disable access rights.

The rights management layer is located between the application layer and the application framework layer. Authority management and applications The sequence layer can exchange information. The rights management layer and the application framework layer need to interact with each other through the system API.

The application generates a request for authorizing an access right at the application layer, and discriminates whether the user is allowed to authorize the access authority requested by the application, and the result is sent to the authority management layer; Next, the rights management layer controls the application framework layer to open the access authority, and forwards the information that the access authority of the application framework layer has been authorized to the application; if the authorization is not allowed, the rights management layer controls the application framework layer The access permission is not turned on, and the information that the access permission of the application framework layer is not authorized is intercepted, and information that the access authority has been authorized is generated according to the information and forwarded to the application; the application framework layer is opened under the control of the authority management layer or The access right is closed, and the corresponding information that the access right has been authorized or not authorized is generated, and the information is sent to the rights management layer. In the process, the rights management layer may also discard the information that the access authority of the application framework layer is not authorized, and generate a message that the access authority has been authorized and send it to the application.

Specifically, when the application is installed, the application can request access to the rights management layer. The rights management layer reads the configuration information of the application according to the request, and queries the access rights required by the application.

The rights management layer pops up a prompt box at the application layer asking if the user is allowed to grant access.

If the user allows authorization for the access, the rights management layer sets a true identity for the access to the application and records it. The true identity indicates that the access permission is enabled for the application at the application framework layer. The rights management layer controls the application framework layer to enable this access for the application. After the application framework layer opens the access right for the application, the permission management layer returns information to the application that the access right has been authorized.

If the user does not allow authorization for the access, the rights management layer sets a pseudo identity for the access to the application and records it. This pseudo-identification indicates that the access right is disabled for the application at the application framework layer. The rights management layer controls the application framework layer not to open the access rights, but when the rights management layer returns information to the application that the access rights are not authorized, The rights management layer intercepts the information and modifies the information to information that the access rights have been authorized. The rights management layer then sends the modified information to the application.

In the process of using the application, if the application accesses based on the access right, the rights management layer may first query whether the identifier corresponding to the access right is a true identifier or a pseudo identifier; if it is a true identifier, the application is allowed to utilize the access permission. Accessing the corresponding function or application; if it is a pseudo-identity, the application is prohibited from accessing the corresponding function or application by using the access right. When the application is prohibited from accessing the corresponding function or application by using the access right, the preset information can be returned to the application. This does not affect the normal use of the application, but also protects the security of user information and privacy.

In this embodiment, the rights management option can be added in the setting menu, and the user can actively set the access rights of the application in the setting menu, and enable or disable the access right.

In the process of using the application, if the user finds that he does not need to provide an access right for the application, he can close the access right in the setting menu; in the setting menu, close an access right for an application, Triggering a request to prohibit the authorization of the access right of the application, after receiving the request, the rights management layer sets a pseudo identity for the access permission of the application and updates the record; Under the control of the application framework layer, the access permission granted to the application is disabled. When the permission management layer returns the information that the access right is not authorized to the application, the rights management layer intercepts the information and modifies the information to the Access rights have been granted, and the application still considers that access rights are available when it receives the modified information.

Embodiment 5

This embodiment provides an access authority control apparatus for an application. Figure 5 is a block diagram showing an access authority control apparatus of an application program according to a fifth embodiment of the present invention. The apparatus described in this embodiment can be set in the above-mentioned authority management layer.

The device includes:

The receiving module 510 is configured to receive, by the application, an authorization to authorize access rights. Request.

The determining module 520 is configured to determine whether to prohibit granting the access right to the application.

The sending module 530 is configured to: when the determining module 520 determines that the access permission is not granted to the application, disable the access right for the application, and send the access permission to the application Authorized information.

In an embodiment, the determining module 520 is configured to generate prompt information including information of the access authority according to the request, receive a selection instruction determined according to the prompt information, and if the selection instruction is prohibited Authorization instructions prohibit the granting of the access rights to the application.

In another embodiment, the determining module 520 is configured to query a preset application permission comparison table according to the request; the application permission comparison table records information of the matched application and access rights; Whether the information of the application and the access authority match; if the application does not match the access right, prohibiting granting the access right to the application.

In still another embodiment, the sending module 530 is further configured to: if the application has been authorized to have access rights disabled, open the access right for the application, and send the access to the application The information that the permission has been authorized.

In still another embodiment, the sending module 530 is further configured to: after the access authority is closed for the application, in the running of the application, if the application accesses based on the closed access right, then Feed back the preset information to the application.

The functions of the device in this embodiment have been described in the method embodiments shown in FIG. 1 to FIG. 4, and therefore, in the description of the present embodiment, reference may be made to the related description in the foregoing embodiment. This will not be repeated.

While the preferred embodiments of the present invention have been disclosed for purposes of illustration, those skilled in the art will recognize that various modifications, additions and substitutions are possible, and the scope of the invention should not be limited to the embodiments described above.

Industrial applicability

Claims

An application access control method includes:

Receiving a request sent by an application to authorize access rights;

Determining whether to prohibit granting the access right to the application;

If the access right is prohibited from being granted to the application, the access right is turned off for the application, and the information that the access right has been authorized is sent to the application.
The method of claim 1, wherein determining whether to prohibit granting the access right to the application comprises:

Generating, according to the request, prompt information including information of the access authority;

Receiving a selection instruction determined according to the prompt information;

If the selection instruction is a prohibition authorization instruction, the access authority is prohibited from being granted to the application.
The method of claim 1, wherein determining whether to prohibit granting the access right to the application comprises:

And querying, according to the request, a preset application permission comparison table; the application permission comparison table records information of the matched application and the access authority;

Determining whether the information of the application and the access authority match;

If the information of the application and the access rights do not match, the access authority is prohibited from being granted to the application.
The method of any of claims 1-3, further comprising:

If the application has been authorized to access access is disabled, then the application The program closes the access rights and sends the application the information that the access rights have been authorized.
The method of any of claims 1-3, wherein after the accessing the access is closed for the application, the method further comprises:

In the application running, if the application accesses based on the closed access right, the preset information is fed back to the application.
An access control device for an application, comprising:

a receiving module, configured to receive a request sent by an application for authorizing access rights;

a determining module, configured to determine whether to prohibit granting the access right to the application;

a sending module, configured to: when the determining module determines to prohibit granting the access right to the application, shutting down the access right for the application, and sending the access right to the application has been Authorized information.
The apparatus of claim 6, wherein the determining module is configured to generate prompt information including information of the access authority according to the request; receive a selection instruction determined according to the prompt information; The selection instruction is a prohibition authorization instruction, and the access authority is prohibited from being granted to the application.
The device of claim 6, wherein the determining module is configured to query a preset application permission comparison table according to the request; the application permission comparison table records the matching application and access rights. Information; determining whether the information of the application and the access right match; if the information of the application and the access right do not match, prohibiting granting the access right to the application.
The apparatus according to any one of claims 6-8, wherein the sending module is further configured to: if the application has been authorized to have access rights disabled, to close the access right for the application, And transmitting, to the application, the information that the access right has been authorized.
The apparatus according to any one of claims 6-8, wherein the transmitting module is further configured to: after the accessing the access authority for the application, in the application running, if the application The access is fed back to the application based on the access rights that are turned off.
A storage medium, the storage medium comprising a stored program, wherein the program is executed to perform the method of any one of claims 1 to 5.