WO2021022729A1

WO2021022729A1 - Root permission assignment method and apparatus, storage medium, and terminal device

Info

Publication number: WO2021022729A1
Application number: PCT/CN2019/121812
Authority: WO
Inventors: 郑金国; 张燕香
Original assignee: 惠州Tcl移动通信有限公司
Priority date: 2019-08-06
Filing date: 2019-11-29
Publication date: 2021-02-11
Also published as: CN110457894A; CN110457894B

Abstract

Disclosed are a root permission assignment method and apparatus, a storage medium, and a terminal device. The terminal device comprises a system partition and a target partition. The method comprises: when a terminal device is restarted and enters a first pre-set stage, acquiring a device identification code from a terminal chip; acquiring digital signature information from a target partition; controlling, according to the digital signature information and the device identification code, a system partition to enter a writable state; and assigning root permissions to the terminal device according to a pre-set executable file.

Description

Root authority distribution method, device, storage medium and terminal equipment

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office, the application number is 201910720524.0, and the invention title is "root authority distribution method, device, storage medium and terminal equipment" on August 6, 2019. The reference is incorporated in this application.

Technical field

This application relates to the field of communication technology, and in particular to a method, device, storage medium, and terminal device for assigning root permissions.

Background technique

Root is the only super user in the system and has all the permissions in the system, such as starting or stopping a process, deleting or adding users, adding or disabling hardware, etc. For example: Google's Android Android system administrator account is called Root. The Root account has the supreme right of the entire system. It can access and modify almost all files of the terminal device and has the highest level of management authority.

The process of rooting a mobile phone (also known as obtaining the root permission of the mobile phone) is the process of obtaining the highest use permission of the mobile phone (that is, root permission). For the Android system, the process of rooting a mobile phone is actually copying the su executable file to Android In the /system/xbin directory of the system, and the process of modifying the permission to 4755, because more and more Android phones have added various protection functions, such as selinux (Security-Enhanced Linux, mandatory access control security system), users are very It is difficult to write directly to the /system/xbin directory, so that the phone cannot have root privileges.

technical problem

The embodiments of the present application provide a method, device, storage medium, and terminal device for assigning root authority, which can be applied to the assignment of root authority of various terminals with strong reliability.

Technical solutions

The embodiment of the present application provides a method for allocating root authority, which is applied to a terminal device. The terminal device is provided with multiple storage partitions. The multiple storage partitions include a system partition and a target partition. The allocation method includes:

When the terminal device restarts and enters the first preset stage, acquiring device attribute information from the terminal chip, where the device attribute information includes a device identification code;

Obtaining digital signature information from the target partition;

Controlling the system partition to enter a writable state according to the digital signature information and the device identification code;

In the writable state, root permission is assigned to the terminal device based on a preset executable file.

Further, the controlling the system partition to enter a writable state according to the digital signature information and the device identification code includes:

Determining the message digest according to the message digest algorithm and the device identification code;

Decrypt the digital signature information by using a preset public key to obtain a decrypted digest;

Judging whether the terminal device is granted modification authority according to the information summary and the decryption summary;

If the modification authority is granted, the system partition is controlled to enter a writable state.

Further, the judging whether the terminal device is granted modification authority according to the information summary and the decryption summary includes:

Determine whether the decrypted digest and the information digest are the same;

If they are the same, it is determined that the terminal device is granted modification authority;

If they are not the same, it is determined that the terminal device has not been granted modification authority.

Further, the device attribute information further includes a terminal model and/or version number, and determining the information digest according to the message digest algorithm and the device identification code includes:

Combine the device identification code with the terminal model and/or version number to obtain a combination code;

A message digest algorithm is used to process the combined code to obtain a message digest.

Further, the controlling the system partition to enter a writable state includes:

When the terminal device is in the first preset stage, turn off the write protection function of the system partition;

When the terminal device enters the second preset stage from the first preset stage, the access control module is set to the permissive mode, and the access verification module is turned off, so that the system partition enters the writable state, wherein In the permissive mode, the multiple storage partitions are allowed to be accessed illegally.

Further, the allocating root authority to the terminal device based on a preset executable file includes:

The preset executable file is stored in the target directory of the system partition, and the authority parameter is modified to a preset value to assign root authority to the terminal device.

Further, before acquiring the digital signature information from the target partition, the method further includes:

When the terminal device is powered on and enters the second preset stage, the device attribute information is obtained from the terminal chip, and the device attribute information is written into the preset offset position in the target partition for the flashing software to download from the Acquiring the device attribute information at the preset offset location, and generating digital signature information according to the device attribute information, and then storing the digital signature information at the preset offset location;

The acquiring digital signature information from the target partition includes: acquiring the digital signature information from the preset offset position in the target partition.

The embodiment of the present application also provides a root authority distribution device, which is applied to a terminal device. The terminal device is provided with multiple storage partitions. The multiple storage partitions include a system partition and a target partition. The distribution device includes:

The first obtaining unit is configured to obtain device attribute information from the terminal chip when the terminal device restarts to enter the first preset stage, where the device attribute information includes a device identification code;

The second acquiring unit is configured to acquire digital signature information from the target partition;

A control unit, configured to control the system partition to enter a writable state according to the digital signature information and the device identification code;

The allocation unit is configured to allocate root permissions to the terminal device based on a preset executable file in the writable state.

Further, the control unit specifically includes:

A determining subunit, configured to determine a message digest according to a message digest algorithm and the device identification code;

The decryption subunit is used to decrypt the digital signature information by using the preset public key to obtain a decrypted digest;

The judging subunit is used for judging whether the terminal device is granted modification authority according to the information summary and the decryption summary;

The control subunit is used for controlling the system partition to enter the writable state if the modification authority is granted.

Further, the judgment subunit is specifically used for:

Determine whether the decrypted digest and the information digest are the same;

Further, the device attribute information further includes a terminal model and/or version number, and the determining subunit is specifically used for:

Further, the control subunit is specifically configured to:

Further, the allocation unit is specifically configured to:

Further, the device for assigning root authority further includes a storage unit for:

Before acquiring the digital signature information from the target partition, when the terminal device powers on and enters the second preset stage, acquire the device attribute information from the terminal chip, and write the device attribute information into the target partition The preset offset position for the flashing software to obtain the device attribute information from the preset offset position, and generate digital signature information according to the device attribute information, and then store the digital signature information in the At the preset offset position;

The second acquiring unit is specifically configured to acquire the digital signature information from the preset offset position in the target partition.

An embodiment of the present application also provides a computer-readable storage medium in which a plurality of instructions are stored, and the instructions are suitable for being loaded by a processor to execute any one of the above-mentioned methods for allocating root permissions.

An embodiment of the present application also provides a terminal device, including a processor and a memory, the processor is electrically connected to the memory, the memory is used to store instructions and data, and the processor is used to execute any of the above The steps in the method for assigning root permissions.

Beneficial effect

Compared with the prior art, the root authority distribution method, device, and storage medium provided in this application are applied to a terminal device. The terminal device is provided with multiple storage partitions. The multiple storage partitions include a system partition and a target partition. When the terminal device restarts and enters the first preset stage, it obtains the device attribute information from the terminal chip, the device attribute information includes the device identification code, and then obtains the digital signature information from the target partition, and according to the digital signature information and The device identification code controls the system partition to enter a writable state. In the writable state, the terminal device is assigned root authority based on a preset executable file, which can facilitate the acquisition of root authority of various terminals. The method is simple. Wide application range and strong reliability.

Description of the drawings

The following describes the specific implementations of the present application in detail with reference to the accompanying drawings, which will make the technical solutions and other beneficial effects of the present application obvious.

FIG. 1 is a schematic flowchart of a method for assigning root permissions provided by an embodiment of the application.

FIG. 2 is a schematic flowchart of the process of acquiring root authority of a mobile phone according to an embodiment of the application.

FIG. 3 is a schematic flowchart of another method for assigning root permissions according to an embodiment of the application.

FIG. 4 is a schematic structural diagram of a root authority distribution device provided by an embodiment of the application.

FIG. 5 is a schematic diagram of another structure of a root authority distribution device provided by an embodiment of the application.

FIG. 6 is a schematic structural diagram of a control unit 30 provided by an embodiment of the application.

FIG. 7 is a schematic structural diagram of a terminal device provided by an embodiment of the application.

FIG. 8 is a schematic diagram of another structure of a terminal device provided by an embodiment of the application.

Embodiments of the invention

The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative work are within the protection scope of this application.

A method for distributing root authority is applied to a terminal device. The terminal device is provided with multiple storage partitions. The multiple storage partitions include a system partition and a target partition. The method for distributing root authority includes: when the terminal device restarts and enters the first In a preset stage, obtain the device attribute information from the terminal chip, the device attribute information includes the device identification code; obtain the digital signature information from the target partition; control the system partition to be writable according to the digital signature information and the device identification code In state; in the writable state, root permissions are assigned to the terminal device based on a preset executable file.

In some embodiments, the controlling the system partition to enter the writable state according to the digital signature information and the device identification code includes:

In some embodiments, the judging whether the terminal device is authorized to modify according to the information summary and the decryption summary includes:

Determine whether the decrypted digest and the information digest are the same;

In some embodiments, the device attribute information further includes a terminal model and/or version number, and determining the information digest according to the message digest algorithm and the device identification code includes:

In some embodiments, the controlling the system partition to enter a writable state includes:

In some embodiments, the allocating root permissions to the terminal device based on a preset executable file includes:

In some embodiments, before acquiring the digital signature information from the target partition, the method further includes:

As shown in FIG. 1, FIG. 1 is a schematic flowchart of a method for allocating root permissions provided by an embodiment of the present application. The method for allocating root permissions is applied to a terminal device, and the terminal device is provided with multiple storage partitions. Including system partition and target partition, the specific process can be as follows:

S101. When the terminal device restarts and enters the first preset stage, obtain device attribute information from the terminal chip, where the device attribute information includes a device identification code.

In this embodiment, the first preset stage refers to the LK (little kernel) stage, which is the boot stage before the system kernel starts, and is mainly used to initialize hardware, load the kernel, configure initialization registers, command line parameters, and so on. The device attribute information in the terminal chip can be obtained through the system API (Application Programming Interface) of the terminal. The device attribute information mainly refers to the attribute information related to the terminal, such as the device identification code, where the device identification code is the terminal It can be the terminal SN (Serial Number, product serial number) code.

S102. Obtain digital signature information from the target partition.

In this embodiment, the terminal ROM chip can be divided into multiple storage partitions. Different storage partitions are used to store different data and implement different functions. For example, the system partition is used to store system files, the cache partition is used to store cache data, and the userdata partition is used. Used to store user data, etc. The target partition refers to a designated partition in the terminal device other than the system partition, such as the Proinfo partition. It is easy to understand that the digital signature information should be stored in advance, that is, before the above step S102, the root authority distribution method further includes:

When the terminal device is powered on and enters the second preset stage, the device attribute information is obtained from the terminal chip, and the device attribute information is written into the preset offset position in the target partition for the flashing software to deviate from the preset. The device attribute information is acquired at the moving location, and digital signature information is generated according to the device attribute information, and then the digital signature information is stored at the preset offset location.

At this time, the above step S102 specifically includes: acquiring the digital signature information from the preset offset position in the target partition.

In this embodiment, the preset offset position may be manually set. For example, assuming that the storage capacity of the target partition is 10M, the preset offset position may be the start storage address where the 8th MB is located. The second preset stage refers to the kernel stage, which is the kernel startup stage, and is mainly used to start some related processes, such as starting idle processes, kernel_init processes, kthreadd processes, etc.

The flashing software can be installed on other terminal devices, such as tablet computers. Generally, the application software on other terminal devices cannot directly obtain SN information from the terminal chip of this terminal device, but can read the data in the storage partition. Considering that the system partition can only write data when it has root privileges, the terminal device must store device attribute information such as SN in a target partition other than the system partition in advance. Specifically, the terminal device can be Each time the boot enters the kernel stage, the native process is run once, in which the system API is used to obtain device attribute information from the terminal chip for storage, so that other terminal devices can obtain the device attribute information, and then other terminal devices It can generate digital signature information, which is processed by asymmetric key encryption technology and digital digest technology.

S103. Control the system partition to enter a writable state according to the digital signature information and the device identification code.

In this embodiment, the writable state means that disk read and disk write operations can be performed on the system partition.

For example, the above step S103 may specifically include:

1-1 Determine the message digest according to the message digest algorithm and the device identification code;

1-2 Use the preset public key to decrypt the digital signature information to obtain the decrypted digest;

1-3 Determine whether the terminal device is authorized to modify according to the information summary and decryption summary;

1-4 If the modification authority is granted, control the system partition into a writable state.

In this embodiment, the message digest algorithm mainly refers to MD5 (Message-Digest Algorithm) algorithm. The preset public key corresponds to the encryption private key of the digital signature information, that is, the public key and the private key can be stored on the terminal device and other terminal devices respectively. The private key is used to encrypt device attribute information in advance. The public key is used to decrypt the digital signature information when verifying authorization.

Specifically, when the device attribute information only has the device identification code (ie SN code), the information summary can be obtained by directly processing the SN code using the MD5 algorithm. In order to enhance the verification difficulty and improve the verification security, the device property information is also It may include other information, such as the terminal model and/or version number. In this case, the determination of the information summary also needs to combine this information, that is, the above step 1-1 may specifically include:

Use the message digest algorithm to process the combined code to obtain the message digest.

In this embodiment, the combination method can be set manually. It can be a simple combination of character codes in a prescribed order. The combination sequence can be device identification code, terminal model, version number, or the combination of characters before or after combination. The code undergoes certain processing, such as conversion to decimal or hexadecimal, etc., and then the MD5 algorithm is used to calculate the information digest of the combined code.

Wherein, the above steps 1-3 may specifically include:

Determine whether the decrypted digest and the information digest are the same;

In this embodiment, when the decryption digest and the information digest are equal, it means that the encryption public key and the decryption private key are a pair, and the acquisition of root authority is legal, otherwise it is illegal.

Among them, the above steps "control the system partition to enter the writable state" specifically include:

When the terminal device enters the second preset stage from the first preset stage, the access control module is set to tolerant mode, and the access verification module is turned off, so that the system partition enters a writable state. In permissive mode, the multiple storage partitions are allowed to be accessed illegally.

In this embodiment, the configuration of the write protection function is usually processed in the LK stage. The write protection function is realized by setting the EMMC register in the terminal device, which can make each storage partition of the physical EMMC in an unwritable state, and if you want To achieve root, the su executable file must be copied to the system partition. Therefore, at least the write protection function of the system partition must be turned off before copying the files, and the write protection function of other storage partitions can be retained.

Access control module selinux (security-enhanced linux) configuration is usually processed in the kernel stage. selinux is used to check the security context of each object in the system accessing system resources. It includes two modes: Enforcing Mode and Permissive Mode. By default, selinux is in Compulsory mode, where the compulsory mode is used to intercept access that is not configured by the system and print out the LOG log. The permissive mode is only used to record the LOG, but does not really block access. In forced mode, it is impossible to traverse query or modify partition directories, so the su executable file cannot be copied to the system's /system/xbin directory. Therefore, selinux must be set to permissive mode before copying files. Specifically, you can modify and compile ALLOW_PERMISSIVE_SELINUX=1, so that when selinux is started in the kernel phase, it will be obtained from androidboot.selinux instead of being configured as mandatory mode by default.

The configuration of the access verification module DM-verity (device-mapper-verity) is usually processed in the compiling phase of the kernel phase, which will generate the hash tree of the image file during the compiling phase. If the terminal device is running, the system system is used A piece of data in the partition, the system will automatically detect whether the data matches the record data in the hash tree, if it does not match, this piece of data is not allowed to be used. Under this premise, if you want to write in the system partition Enter the su executable file, you must first close DM-verity.

S104. In the writable state, assign root permissions to the terminal device based on a preset executable file.

For example, the above step S104 may specifically include:

Store the preset executable file in the target directory of the system partition, and modify the authority parameter to the preset value to assign root authority to the terminal device.

In this embodiment, the preset executable file is mainly the su executable file, the target directory is the root directory of the system partition, that is, /system/xbin, and the preset value is artificially set, for example, 4755.

It can be seen from the above that the method for assigning root permissions provided in this embodiment is applied to a terminal device. The terminal device is provided with multiple storage partitions. The multiple storage partitions include a system partition and a target partition. When the terminal device restarts and enters the first In the preset stage, by obtaining device attribute information from the terminal chip, the device attribute information includes the device identification code, and then obtaining the digital signature information from the target partition, and controlling the system partition according to the digital signature information and the device identification code Enter the writable state. In the writable state, root permissions are assigned to the terminal device based on the preset executable file, which can facilitate the acquisition of root permissions for various terminals. The method is simple, the scope of application is wide, and the reliability is strong. .

Please refer to Figures 2 and 3, the following will take the root permission distribution method applied to the first terminal device and the second terminal device as an example to describe it in detail, where the first terminal device is a mobile phone, and the second terminal device For a computer, the first terminal device is provided with multiple storage partitions, and the multiple storage partitions include a system partition and a target partition.

S201. When booting into the second preset stage, the first terminal device obtains device attribute information from its own terminal chip, and writes the device attribute information to a preset offset position in the target partition. The device attribute information includes the device Identification code.

For example, it can be set to use the system API in the native process to obtain the SN information in the terminal chip in the native process every time the mobile phone enters the kernel phase, and store it in the designated offset position of the Proinfo partition.

S202. The second terminal device obtains the device attribute information from the preset offset position by using the installed flashing software, and generates digital signature information according to the device attribute information, and then stores the digital signature information in the preset offset Location.

For example, the user can install the flashing software on the computer and connect the computer to the mobile phone. The flashing software can be downloaded from some platforms, and then the flashing software can obtain the SN code from the preset offset position in the mobile phone, and Sign it with the preset private key, and store the digital signature information in the mobile phone.

S203. When restarting and entering the first preset stage, the first terminal device obtains the device attribute information from its own terminal chip, and obtains the digital signature information from the preset offset position.

S204. The first terminal device determines an information digest according to the message digest algorithm and the device identification code, and decrypts the digital signature information by using the preset public key to obtain the decrypted digest.

S205. The first terminal device judges whether the decryption digest and the information digest are the same, if they are the same, the following step S206 is performed, and if they are not equal, the restart detection is not performed again.

For example, after the computer has set the digital signature information in the mobile phone, the mobile phone can be restarted, and when entering the LK stage, the SN information is obtained from the chip, and the digital signature information is obtained from the specified offset position of the Proinfo partition. , Use the preset public key to decrypt the digital signature information. Under normal circumstances, the decrypted digest obtained by the legal flashing process will be the same as the generated information digest.

S206. When in the first preset stage, the first terminal device turns off the write protection function of the system partition, and when entering the second preset stage from the first preset stage, the first terminal device sets the access control module Enter the permissive mode, and close the access verification module, so that the system partition enters a writable state, wherein, in the permissive mode, the multiple storage partitions are allowed to illegally access.

For example, when the decryption digest and the information digest are the same, it means that the permission modification is authorized. At this time, the authorization status information can be generated in the LK phase, and the authorization status information can be passed to the kernel phase through the command line. In the LK stage of the authorization state, the mobile phone can turn off the write protection function of the system partition. In the kernel stage of the authorization state, the mobile phone can modify and compile ALLOW_PERMISSIVE_SELINUX=1, so that when selinux is started in the kernel stage, it will be obtained from androidboot.selinux. Configure selinux to Permissive Mode instead of the default Enforcing Mode is mandatory mode. At the same time, during the compilation phase, the phone can turn off DM-verity.

S207. In the writable state, the first terminal device stores the preset executable file in the target directory of the system partition, and modifies the authority parameter to the preset value to assign root authority to the terminal device.

For example, the mobile phone can copy the su executable file to the root directory of the system partition, which is /system/xbin, and set the permission to 4755. At this time, the mobile phone has root permission, and the user can control any process and user in the mobile phone. Account, hardware, etc. are controlled. Of course, in order to inform the user of the result of the flashing, a prompt interface can be generated, and the prompt interface can display words such as "root success". .

According to the method described in the foregoing embodiment, this embodiment will be further described from the perspective of a root authority distribution device, and the root authority distribution device can be implemented as an independent entity.

The embodiment of the present application provides a root authority distribution device, which is applied to a terminal device. The terminal device is provided with multiple storage partitions. The multiple storage partitions include a system partition and a target partition. The distribution device includes:

In some embodiments, the control unit specifically includes:

In some embodiments, the judgment subunit is specifically configured to:

Determine whether the decrypted digest and the information digest are the same;

In some embodiments, the device attribute information further includes a terminal model and/or version number, and the determining subunit is specifically configured to:

In some embodiments, the control subunit is specifically configured to:

In some embodiments, the allocation unit is specifically configured to:

In some embodiments, the device for assigning root authority further includes a storage unit for:

Please refer to FIG. 4, which specifically describes the root authority distribution device provided by an embodiment of the present application, which is applied to a terminal device. The terminal device may include a mobile phone, a tablet computer, a personal PC, etc., and the terminal device has multiple storage partitions. The multiple storage partitions include a system partition and a target partition, and the apparatus for assigning root authority may include: a first obtaining unit 10, a second obtaining unit 20, a control unit 30, and a distribution unit 40, wherein:

(1) The first acquisition unit 10

The first obtaining unit 10 is configured to obtain device attribute information from the terminal chip when the terminal device restarts and enters the first preset stage, where the device attribute information includes a device identification code.

(2) The second acquisition unit 20

The second obtaining unit 20 is configured to obtain digital signature information from the target partition.

In this embodiment, the terminal ROM chip can be divided into multiple storage partitions. Different storage partitions are used to store different data and implement different functions. For example, the system partition is used to store system files, the cache partition is used to store cache data, and the userdata partition is used. Used to store user data, etc. The target partition refers to a designated partition in the terminal device other than the system partition, such as the Proinfo partition. It is easy to understand that the digital signature information should be stored in advance, that is, referring to Figure 5, the root authority distribution device further includes a storage unit 50 for:

Before obtaining the digital signature information from the target partition, when the terminal device is booted into the second preset stage, the device attribute information is obtained from the terminal chip, and the device attribute information is written into the preset offset in the target partition. Move the position so that the flashing software obtains the device attribute information from the preset offset position, and generates digital signature information according to the device attribute information, and then stores the digital signature information at the preset offset position.

At this time, the second obtaining unit 20 is specifically configured to obtain the digital signature information from the preset offset position in the target partition.

(3) Control unit 30

The control unit 30 is configured to control the system partition to enter a writable state according to the digital signature information and the device identification code.

For example, referring to FIG. 6, the control unit 30 specifically includes:

The determining subunit 31 is configured to determine the message digest according to the message digest algorithm and the device identification code;

The decryption subunit 32 is used to decrypt the digital signature information by using the preset public key to obtain a decrypted digest;

The judging subunit 33 is used for judging whether the terminal device is granted modification authority according to the information digest and the decryption digest;

The control subunit 34 is configured to control the system partition to enter a writable state if the modification authority is granted.

Specifically, when the device attribute information only has the device identification code (ie SN code), the information summary can be obtained by directly processing the SN code using the MD5 algorithm. In order to enhance the verification difficulty and improve the verification security, the device property information is also It may include other information, such as the terminal model and/or version number. At this time, the determination of the information summary also needs to combine this information, that is, the device attribute information also includes the terminal model and/or version number. The determination subunit 31 Specifically used for:

Wherein, the judgment subunit 33 is specifically used for:

Determine whether the decrypted digest and the information digest are the same;

Wherein, the control subunit 34 is specifically used for:

(4) Distribution unit 40

The allocation unit 40 is configured to allocate root permissions to the terminal device based on a preset executable file in the writable state.

For example, the allocation unit 40 is specifically used for:

During specific implementation, each of the above units can be implemented as an independent entity, or can be combined arbitrarily, and implemented as the same or several entities. For the specific implementation of each of the above units, please refer to the previous method embodiments, which will not be repeated here.

It can be seen from the above that the method for assigning root permissions provided in this embodiment is applied to a terminal device. The terminal device is provided with multiple storage partitions. The multiple storage partitions include a system partition and a target partition. When the terminal device restarts and enters the first In the preset stage, the device attribute information is obtained from the terminal chip through the first obtaining unit 10, and the device attribute information includes the device identification code. Then, the second obtaining unit 20 obtains the digital signature information from the target partition, and the control unit 30 according to The digital signature information and the device identification code control the system partition to enter a writable state. In the writable state, the adjustment module 40 assigns root permissions to the terminal device based on a preset executable file, which can benefit various terminals The method of obtaining root authority is simple, widely applicable, and reliable.

In addition, the embodiment of the present application also provides a terminal device, which may be a device such as a smart phone or a tablet computer. As shown in FIG. 7, the terminal device 200 includes a processor 201 and a memory 202. Wherein, the processor 201 and the memory 202 are electrically connected.

The processor 201 is the control center of the terminal device 200. It uses various interfaces and lines to connect the various parts of the entire terminal device. It executes the terminal by running or loading the application program stored in the memory 202 and calling the data stored in the memory 202. Various functions and processing data of the equipment, so as to monitor the terminal equipment as a whole.

In this embodiment, the terminal device 200 is provided with multiple storage partitions, and the multiple storage partitions include a system partition and a target partition. The processor 201 in the terminal device 200 will perform one or more applications according to the following steps The instructions corresponding to the process of the program are loaded into the memory 202, and the processor 201 runs the application programs stored in the memory 202, thereby realizing various functions:

When the terminal device restarts and enters the first preset stage, obtain device attribute information from the terminal chip, where the device attribute information includes a device identification code;

Obtain digital signature information from the target partition;

Control the system partition to enter the writable state according to the digital signature information and the device identification code;

In the writable state, root authority is assigned to the terminal device based on the preset executable file.

FIG. 8 shows a specific structural block diagram of a terminal device provided by an embodiment of the present invention, and the terminal device can be used to implement the root authority distribution method provided in the foregoing embodiment. The terminal device 300 may be a smart phone or a tablet computer.

The RF circuit 310 is used to receive and send electromagnetic waves, realize the mutual conversion between electromagnetic waves and electrical signals, and communicate with a communication network or other devices. The RF circuit 310 may include various existing circuit elements for performing these functions, for example, an antenna, a radio frequency transceiver, a digital signal processor, an encryption/decryption chip, a subscriber identity module (SIM) card, a memory, and so on. The RF circuit 310 can communicate with various networks such as the Internet, an intranet, and a wireless network, or communicate with other devices through a wireless network. The aforementioned wireless network may include a cellular telephone network, a wireless local area network, or a metropolitan area network. The above-mentioned wireless network can use various communication standards, protocols and technologies, including but not limited to the Global System for Mobile Communications (Global System for Mobile Communication, GSM), enhanced mobile communication technology (Enhanced Data GSM Environment, EDGE), wideband code division multiple access technology (Wideband Code Division Multiple Access, WCDMA), Code Division Multiple Access (Code Division Multiple Access) Access, CDMA), Time Division Multiple Access (TDMA), Wireless Fidelity (Wireless Fidelity, Wi-Fi) (such as the American Institute of Electrical and Electronics Engineers standards IEEE 802.11a, IEEE 802.11b, IEEE 802.11g and/or IEEE 802.11n), Internet telephony (Voice over Internet Protocol, VoIP), Worldwide Interconnection for Microwave Access (Worldwide Interoperability for Microwave Access, Wi-Max), other protocols used for mail, instant messaging and short messages, and any other appropriate communication protocols, even those that have not yet been developed.

The memory 320 may be used to store software programs and modules, such as the program instructions/modules corresponding to the automatic light-filling system and method for taking pictures of the front camera in the above-mentioned embodiments. The processor 380 executes the software programs and modules stored in the memory 320 by running Various functional applications and data processing, that is, realize the function of automatically filling light when taking pictures with the front camera. The memory 320 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 320 may further include a memory remotely provided with respect to the processor 380, and these remote memories may be connected to the terminal device 300 through a network. Examples of the aforementioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

The input unit 330 may be used to receive inputted digital or character information, and generate keyboard, mouse, joystick, optical or trackball signal input related to user settings and function control. Specifically, the input unit 330 may include a touch-sensitive surface 331 and other input devices 332. The touch-sensitive surface 331, also called a touch screen or a touchpad, can collect user touch operations on or near it (for example, the user uses any suitable objects or accessories such as fingers, stylus, etc.) on or on the touch-sensitive surface 331. Operation near the touch-sensitive surface 331), and drive the corresponding connection device according to the preset program. Optionally, the touch-sensitive surface 331 may include two parts: a touch detection device and a touch controller. Among them, the touch detection device detects the user's touch position, detects the signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts it into contact coordinates, and then sends it To the processor 380, and can receive and execute the commands sent by the processor 380. In addition, the touch-sensitive surface 331 can be realized by various types such as resistive, capacitive, infrared, and surface acoustic wave. In addition to the touch-sensitive surface 331, the input unit 330 may also include other input devices 332. Specifically, the other input device 332 may include, but is not limited to, one or more of a physical keyboard, function keys (such as volume control buttons, switch buttons, etc.), trackball, mouse, and joystick.

The display unit 340 may be used to display information input by the user or information provided to the user and various graphical user interfaces of the terminal device 300. These graphical user interfaces may be composed of graphics, text, icons, videos, and any combination thereof. The display unit 340 may include a display panel 341. Optionally, an LCD (Liquid The display panel 341 is configured in the form of Crystal Display (liquid crystal display), OLED (Organic Light-Emitting Diode, organic light-emitting diode). Further, the touch-sensitive surface 331 may cover the display panel 341. When the touch-sensitive surface 331 detects a touch operation on or near it, it is transmitted to the processor 380 to determine the type of the touch event, and then the processor 380 responds to the touch event. The type provides corresponding visual output on the display panel 341. Although in FIG. 8, the touch-sensitive surface 331 and the display panel 341 are used as two independent components to implement input and output functions, in some embodiments, the touch-sensitive surface 331 and the display panel 341 can be integrated to implement input. And output function.

The terminal device 300 may also include at least one sensor 350, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor may include an ambient light sensor and a proximity sensor. The ambient light sensor can adjust the brightness of the display panel 341 according to the brightness of the ambient light, and the proximity sensor can close the display panel 341 when the terminal device 300 is moved to the ear. And/or backlight. As a kind of motion sensor, the gravity acceleration sensor can detect the magnitude of acceleration in various directions (usually three-axis), and can detect the magnitude and direction of gravity when it is stationary. It can be used to identify mobile phone posture applications (such as horizontal and vertical screen switching, related Games, magnetometer posture calibration), vibration recognition related functions (such as pedometer, percussion), etc.; as for the terminal device 300 that can also be configured with other sensors such as gyroscope, barometer, hygrometer, thermometer, infrared sensor, etc., here No longer.

The audio circuit 360, the speaker 361, and the microphone 362 can provide an audio interface between the user and the terminal device 300. The audio circuit 360 can transmit the electric signal converted from the received audio data to the speaker 361, and the speaker 361 converts it into a sound signal for output; on the other hand, the microphone 362 converts the collected sound signal into an electric signal, and the audio circuit 360 After being received, it is converted into audio data, and then processed by the audio data output processor 380, and then sent to, for example, another terminal via the RF circuit 310, or the audio data is output to the memory 320 for further processing. The audio circuit 360 may also include an earplug jack to provide communication between a peripheral earphone and the terminal device 300.

The terminal device 300 can help users send and receive emails, browse web pages, and access streaming media through the transmission module 370 (such as a Wi-Fi module), and it provides users with wireless broadband Internet access. Although FIG. 8 shows the transmission module 370, it is understandable that it is not a necessary component of the terminal device 300 and can be omitted as needed without changing the essence of the invention.

The processor 380 is the control center of the terminal device 300, which uses various interfaces and lines to connect the various parts of the entire mobile phone, runs or executes software programs and/or modules stored in the memory 320, and calls data stored in the memory 320 , Perform various functions of the terminal device 300 and process data, thereby monitoring the mobile phone as a whole. Optionally, the processor 380 may include one or more processing cores; in some embodiments, the processor 380 may integrate an application processor and a modem processor, where the application processor mainly processes the operating system, user interface, and For application programs, the modem processor mainly deals with wireless communication. It can be understood that the foregoing modem processor may not be integrated into the processor 380.

The terminal device 300 also includes a power source 390 (such as a battery) for supplying power to various components. In some embodiments, the power source may be logically connected to the processor 380 through a power management system, so as to manage charging, discharging, and power consumption through the power management system. Management and other functions. The power supply 190 may also include one or more DC or AC power supplies, a recharging system, a power failure detection circuit, a power converter or inverter, a power status indicator, and any other components.

Although not shown, the terminal device 300 may also include a camera (such as a front camera, a rear camera), a Bluetooth module, etc., which will not be repeated here. Specifically, in this embodiment, the display unit of the terminal device is a touch screen display, and the terminal device also includes a memory and one or more programs. One or more programs are stored in the memory and configured to be configured by one or more programs. The above processor executes one or more programs including instructions for performing the following operations:

Obtain digital signature information from the target partition;

Determine whether the decrypted digest and the information digest are the same;

During specific implementation, each of the above modules can be implemented as an independent entity, or can be combined arbitrarily, and implemented as the same or several entities. For the specific implementation of each of the above modules, please refer to the previous method embodiments, which will not be repeated here.

A person of ordinary skill in the art can understand that all or part of the steps in the various methods of the foregoing embodiments can be completed by instructions, or by instructions to control related hardware. The instructions can be stored in a computer-readable storage medium. And loaded and executed by the processor. To this end, an embodiment of the present invention provides a storage medium in which a plurality of instructions are stored, and the instructions can be loaded by a processor to execute the steps in any root permission allocation method provided in the embodiments of the present invention.

Wherein, the storage medium may include: read-only memory (ROM, Read Only Memory), random access memory (RAM, Random Access Memory), disk or CD, etc.

Because the instructions stored in the storage medium can execute the steps of any root permission distribution method provided in the embodiment of the present invention, any root permission distribution method provided in the embodiment of the present invention can be implemented. For the beneficial effects that can be achieved, refer to the previous embodiment for details, which will not be repeated here.

For the specific implementation of the above operations, please refer to the previous embodiments, which will not be repeated here.

In summary, although the application has been disclosed as above in preferred embodiments, the above-mentioned preferred embodiments are not intended to limit the application, and those of ordinary skill in the art can make various decisions without departing from the spirit and scope of the application. Such changes and modifications, so the protection scope of this application is subject to the scope defined by the claims.

Claims

A method for assigning root authority is applied to a terminal device, wherein the terminal device is provided with multiple storage partitions, the multiple storage partitions include a system partition and a target partition, and the method for assigning root authority includes:

When the terminal device restarts and enters the first preset stage, acquiring device attribute information from the terminal chip, where the device attribute information includes a device identification code;

Obtaining digital signature information from the target partition;

Controlling the system partition to enter a writable state according to the digital signature information and the device identification code;

In the writable state, root permission is assigned to the terminal device based on a preset executable file.
The method for distributing root authority according to claim 1, wherein the controlling the system partition to enter the writable state according to the digital signature information and the device identification code comprises:

Determining the message digest according to the message digest algorithm and the device identification code;

Decrypt the digital signature information by using a preset public key to obtain a decrypted digest;

Judging whether the terminal device is granted modification authority according to the information summary and the decryption summary;

If the modification authority is granted, the system partition is controlled to enter a writable state.
The method for distributing root authority according to claim 2, wherein the judging whether the terminal device is granted modification authority according to the information digest and the decryption digest comprises:

Determine whether the decrypted digest and the information digest are the same;

If they are the same, it is determined that the terminal device is granted modification authority;

If they are not the same, it is determined that the terminal device has not been granted modification authority.
The method for distributing root authority according to claim 2, wherein the device attribute information further includes a terminal model and/or version number, and the determining the information digest according to the message digest algorithm and the device identification code includes:

Combine the device identification code with the terminal model and/or version number to obtain a combination code;

A message digest algorithm is used to process the combined code to obtain a message digest.
The method for distributing root authority according to claim 2, wherein said controlling said system partition to enter a writable state comprises:

When the terminal device is in the first preset stage, turn off the write protection function of the system partition;

When the terminal device enters the second preset stage from the first preset stage, the access control module is set to the permissive mode, and the access verification module is turned off, so that the system partition enters the writable state, wherein In the permissive mode, the multiple storage partitions are allowed to be accessed illegally.
The method for assigning root authority according to claim 1, wherein the assigning root authority to the terminal device based on a preset executable file comprises:

The preset executable file is stored in the target directory of the system partition, and the authority parameter is modified to a preset value to assign root authority to the terminal device.
The method for distributing root authority according to claim 1, wherein before obtaining the digital signature information from the target partition, the method further comprises:

When the terminal device is powered on and enters the second preset stage, the device attribute information is obtained from the terminal chip, and the device attribute information is written into the preset offset position in the target partition for the flashing software to download from the Acquiring the device attribute information at the preset offset location, and generating digital signature information according to the device attribute information, and then storing the digital signature information at the preset offset location;

The acquiring digital signature information from the target partition includes: acquiring the digital signature information from the preset offset position in the target partition.
A root authority distribution device is applied to a terminal device, wherein the terminal device is provided with multiple storage partitions, the multiple storage partitions include a system partition and a target partition, and the distribution device includes:

The first obtaining unit is configured to obtain device attribute information from the terminal chip when the terminal device restarts to enter the first preset stage, where the device attribute information includes a device identification code;

The second acquiring unit is configured to acquire digital signature information from the target partition;

A control unit, configured to control the system partition to enter a writable state according to the digital signature information and the device identification code;

The allocation unit is configured to allocate root permissions to the terminal device based on a preset executable file in the writable state.
The root authority distribution device according to claim 8, wherein the control unit specifically comprises:

A determining subunit, configured to determine a message digest according to a message digest algorithm and the device identification code;

The decryption subunit is used to decrypt the digital signature information by using the preset public key to obtain a decrypted digest;

The judging subunit is used for judging whether the terminal device is granted modification authority according to the information summary and the decryption summary;

The control subunit is used for controlling the system partition to enter the writable state if the modification authority is granted.
The device for assigning root authority according to claim 9, wherein the judging subunit is specifically configured to:

Determine whether the decrypted digest and the information digest are the same;

If they are the same, it is determined that the terminal device is granted modification authority;

If they are not the same, it is determined that the terminal device has not been granted modification authority.
The apparatus for assigning root authority according to claim 9, wherein the device attribute information further includes a terminal model and/or version number, and the determining subunit is specifically used for:

Combine the device identification code with the terminal model and/or version number to obtain a combination code;

A message digest algorithm is used to process the combined code to obtain a message digest.
The root authority distribution device according to claim 9, wherein the control subunit is specifically configured to:

When the terminal device is in the first preset stage, turn off the write protection function of the system partition;

When the terminal device enters the second preset stage from the first preset stage, the access control module is set to the permissive mode, and the access verification module is turned off, so that the system partition enters the writable state, wherein In the permissive mode, the multiple storage partitions are allowed to be accessed illegally.
The root authority distribution device according to claim 8, wherein the distribution unit is specifically configured to:

The preset executable file is stored in the target directory of the system partition, and the authority parameter is modified to a preset value to assign root authority to the terminal device.
The device for assigning root authority according to claim 8, wherein the device for assigning root authority further comprises a storage unit for:

Before acquiring the digital signature information from the target partition, when the terminal device powers on and enters the second preset stage, acquire the device attribute information from the terminal chip, and write the device attribute information into the target partition The preset offset position for the flashing software to obtain the device attribute information from the preset offset position, and generate digital signature information according to the device attribute information, and then store the digital signature information in the At the preset offset position;

The second acquiring unit is specifically configured to acquire the digital signature information from the preset offset position in the target partition.
A computer-readable storage medium, wherein a plurality of instructions are stored in the storage medium, and the instructions are adapted to be loaded by a processor to execute the method for allocating root authority according to claim 1.
A terminal device, comprising a processor and a memory, the processor is electrically connected to the memory, the memory is used to store instructions and data, and the processor is used to execute the root authority of claim 1 Steps in the allocation method.
The terminal device according to claim 16, wherein the processor is specifically configured to execute:

Determining the message digest according to the message digest algorithm and the device identification code;

Decrypt the digital signature information by using a preset public key to obtain a decrypted digest;

Judging whether the terminal device is granted modification authority according to the information summary and the decryption summary;

If the modification authority is granted, the system partition is controlled to enter a writable state.
The terminal device according to claim 17, wherein the processor is specifically configured to execute:

Determine whether the decrypted digest and the information digest are the same;

If they are the same, it is determined that the terminal device is granted modification authority;

If they are not the same, it is determined that the terminal device has not been granted modification authority.
The terminal device according to claim 17, wherein the device attribute information further includes a terminal model and/or version number, and the processor is specifically configured to execute:

Combine the device identification code with the terminal model and/or version number to obtain a combination code;

A message digest algorithm is used to process the combined code to obtain a message digest.
The terminal device according to claim 17, wherein the processor is specifically configured to execute:

When the terminal device is in the first preset stage, turn off the write protection function of the system partition;

When the terminal device enters the second preset stage from the first preset stage, the access control module is set to the permissive mode, and the access verification module is turned off, so that the system partition enters the writable state, wherein In the permissive mode, the multiple storage partitions are allowed to be accessed illegally.