WO2021169379A1 - 权限复用方法、基于权限复用的资源访问方法及相关设备 - Google Patents

权限复用方法、基于权限复用的资源访问方法及相关设备 Download PDF

Info

Publication number
WO2021169379A1
WO2021169379A1 PCT/CN2020/125970 CN2020125970W WO2021169379A1 WO 2021169379 A1 WO2021169379 A1 WO 2021169379A1 CN 2020125970 W CN2020125970 W CN 2020125970W WO 2021169379 A1 WO2021169379 A1 WO 2021169379A1
Authority
WO
WIPO (PCT)
Prior art keywords
application
virtual identity
permission
control information
virtual
Prior art date
Application number
PCT/CN2020/125970
Other languages
English (en)
French (fr)
Inventor
周冲
毛哲文
袁中举
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP20922437.7A priority Critical patent/EP4095723B1/en
Priority to US17/802,748 priority patent/US20230082375A1/en
Publication of WO2021169379A1 publication Critical patent/WO2021169379A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/44—Program or device authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/629—Protecting access to data via a platform, e.g. using keys or access control rules to features or functions of an application
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/604—Tools and structures for managing or administering access control systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2141—Access rights, e.g. capability lists, access control lists, access tables, access matrices

Definitions

  • the embodiments of the present application relate to the field of computer systems and computer networks, and in particular, to a permission multiplexing method, a resource access method based on permission multiplexing, and related equipment.
  • a distributed system is a software system built on the network. It is precisely because of the characteristics of software that distributed systems have a high degree of cohesion and transparency. Cohesion refers to the high degree of autonomy of each database distribution node and a local database management system. Transparency means that each database distribution node is transparent to the user's application, and it cannot be seen whether it is local or remote. In other words, in a distributed database system, users do not need to know which database distribution node the data is stored in, and which database distribution node the application runs on.
  • the current application permission management model in the Android operating system is based on a single device. For example, when an electronic device installed with an Android system installs an application, only the permission of the application is set on the electronic device. Wherein, even if the same application is installed on different electronic devices, the permissions of the application set on different electronic devices may be different. Specifically, when the Android system installs an application, it needs to define the user identification (UID) and permissions of the application in the Manifest file of the application (for example, the permission to make a call or the permission to send a short message). When an electronic device runs an application and accesses a certain object (such as software or hardware resources in the electronic device), access control is generally implemented by checking permissions. Specifically, when an application accesses an object, the UID of the electronic device can be used to obtain the permission set by the application on the electronic device, so as to determine whether the object is allowed to be accessed.
  • UID user identification
  • the UID of the electronic device can be used to obtain the permission set by the application on the electronic
  • Multiple computers in a distributed system present a unified whole to users, just like a system.
  • This system has a variety of general physical and logical resources. These physical and logical resources can be distributed in different computers, and information can be exchanged through the computer network between the above-mentioned multiple computers. In this way, the system can dynamically allocate tasks for the above-mentioned multiple computers, so that the above-mentioned multiple computers can realize information exchange through the above-mentioned computer network, and jointly complete the above-mentioned tasks.
  • the electronic devices of the Android system are used in a distributed system, since the authority management of the application on each electronic device is for a single device; therefore, the distributed system cannot realize the control of the application authority on the remote service across devices .
  • the UID representing the main body of the application is only valid on the local electronic device, and the standard check Permission is to check the permission of the application based on the UID.
  • This application provides a permission multiplexing method, a resource access method based on permission multiplexing, and related equipment to solve the problem of synchronization of application permissions when calling objects across devices in a distributed system.
  • this application provides a permission multiplexing method, which can be applied to a distributed system.
  • the distributed system includes a first device and a second device, and the first device includes multiple applications.
  • the application in the first device in the distributed system can call the object in the second device, and the first device is the main device, and the second device is the object device.
  • the permission multiplexing method may include: the main device sends control information to the object device, where the control information includes a first device identifier of the main device, user IDs of multiple applications on the main device, and permission information of multiple applications.
  • the permission information of an application is used to indicate which objects an application has the permission to access the subject device.
  • the subject device includes the software or hardware resources in the subject device.
  • the object on the subject device is the software or hardware in the subject device. Hardware resources.
  • the object device receives the control information sent by the main device, and creates a first virtual identity based on the control information.
  • the first virtual identity corresponds to the first device identity in the main device and UIDs of multiple applications.
  • the object device stores the first virtual identity, the authority information of multiple applications, and the correspondence between the first virtual identity and the authority information of the multiple applications.
  • the object device receives the control information and creates the first virtual identity according to the control information.
  • the first virtual identity corresponds to the first device identity in the main device and the UIDs of multiple applications, and the first virtual identity corresponds to permission information of multiple applications in the main device.
  • the object device saves the authority information on the subject device, and the first virtual identity on the object device corresponds to the authority information on the subject device, so that the authority on the subject device is reused to the object device.
  • the checking authority on the object device can use the first virtual identity to confirm that the application is in The permission on the object device to determine whether the object on the object device is called by the application on the main device.
  • the main device includes the first application.
  • the host device runs the first application, it can send an access request to the object device.
  • the access request is used to request the first application to access the first object in the object device, and the first object is a software or hardware resource in the object device. Since the access request is issued by the application on the main device, the access request includes the first device identification of the main device and the UID of the first application.
  • the object device receives the aforementioned access request, and in response to the access request, the object device determines the first virtual identity corresponding to the subject device.
  • the object device queries the first authority information corresponding to the first virtual identity from the stored authority information.
  • the object device provides the first application with the access service of the first resource according to the permission indicated by the first permission information.
  • the above-mentioned first permission information is information of all application permissions in the main device, and the object device can determine whether the first application on the main device has the permission to access the first resource of the object device according to the first permission information. So that the object resource provides the access service of the first resource for the first application on the host device.
  • the main device further includes a second device identifier, and both the first device identifier and the second device identifier are used to identify the first device, but the first device identifier and the second device identifier may be different.
  • the first device identification and the second device identification are both used to indicate the main device. That is to say, even if the first device identification is different from the actual device identification of the main device, as long as there is a corresponding relationship between the first device identification and the main device, the first device identification can be mapped to the main device.
  • This method not only satisfies the mapping of the virtual UID on the object device to the main device, realizes the authority reuse of the main device, but also avoids the leakage of the device identification of the main device and protects the device security of the main device.
  • the host device before the host device sends the control information to the guest device, the host device establishes a connection with the guest device.
  • the object device deletes the first virtual identity and the permission information of multiple applications corresponding to the first virtual identity.
  • the guest device deletes the first virtual identity, which can improve the use efficiency of the guest device.
  • the object device may determine whether the second virtual identity is stored, and the device identity in the second virtual identity corresponds to the first device identity in the control information.
  • the creation of the first virtual identity according to the control information includes: if the second virtual identity is not saved in the object device, the object device creates the first virtual identity according to the control information; if the object device has the second virtual identity, the object The device updates the permission information of the multiple applications corresponding to the second virtual identity according to the permission information of the multiple applications in the control information.
  • the operating systems used in the host device and the guest device are both developed based on the Linux kernel.
  • that the object device creates the first virtual identity according to the control information includes: the object device creates a virtual machine according to the control information, and the virtual machine corresponds to the host device.
  • the device identification of the virtual machine is the first device identification of the main device.
  • the UID of the virtual machine is the UID of multiple users in the main device.
  • this application also provides a permission multiplexing method, which is applied to an object device in a distributed system.
  • the method may include: the object device receives control information from the main device, where the control information includes the information of the main device The first device identifier, the user identifiers of multiple applications on the main device and the authority information of the multiple applications.
  • the permission information of an application is used to indicate which objects an application has the permission to access the subject device.
  • the subject device includes the software or hardware resources in the subject device.
  • the object on the subject device is the software or hardware in the subject device. Hardware resources.
  • the object device creates a first virtual identity identifier according to the control information, and the first virtual identity identifier corresponds to the first device identifier in the subject device and UIDs of multiple applications.
  • the object device stores the first virtual identity, the authority information of multiple applications, and the correspondence between the first virtual identity and the authority information of the multiple applications.
  • the object device receives an access request from the host device.
  • the access request is used to request the first application to access the first object in the object device, and the first object is a software or hardware resource in the object device. Since the access request is issued by the application on the main device, the access request includes the first device identification of the main device and the UID of the first application.
  • the object device determines the first virtual identity corresponding to the main device. The object device queries the first authority information corresponding to the first virtual identity from the stored authority information. The object device provides the first application with the access service of the first resource according to the permission indicated by the first permission information.
  • the host device before the host device sends the control information to the guest device, the host device establishes a connection with the guest device.
  • the object device deletes the first virtual identity and the permission information of multiple applications corresponding to the first virtual identity.
  • the object device may determine whether the second virtual identity is stored, and the device identity in the second virtual identity corresponds to the first device identity in the control information.
  • the creation of the first virtual identity according to the control information includes: if the second virtual identity is not saved in the object device, the object device creates the first virtual identity according to the control information; if the object device has the second virtual identity, the object The device updates the permission information of the multiple applications corresponding to the second virtual identity according to the permission information of the multiple applications in the control information.
  • the operating system used in the guest device is developed based on the Linux kernel.
  • that the object device creates the first virtual identity according to the control information includes: the object device creates a virtual machine according to the control information, and the virtual machine corresponds to the host device.
  • the device identification of the virtual machine is the first device identification of the main device.
  • the UID of the virtual machine is the UID of multiple users in the main device.
  • this application also provides a resource access method based on permission multiplexing, which is applied to a distributed system, and the distributed system includes a main device and an object device.
  • the host device may include multiple applications, and the method may include: the object device receives an access request from the host device, where the access request is used to request the first application to access a first object in the object device, and the first object is the object device
  • the access request includes the main device identifier of the main device and the UID of the first application.
  • the object device queries the first virtual identity from the virtual identity stored in the object device, and the first virtual identity corresponds to the subject device identity included in the access request and the user identity of the first application.
  • the object device queries the first permission information corresponding to the first virtual identity from the permission information saved by the object device; the object device provides the first application with the access service of the first resource according to the permission indicated by the first permission information.
  • the virtual identity created based on multiple devices and the authority information of each application in each device are stored in the object device.
  • the multiple devices include the main device, and the virtual identity created based on the main device includes the identity of the main device and multiple applications.
  • the user identification of the main device, the authority information of an application in the main device is used to indicate which objects an application has the authority to access the main device.
  • the application on the main device runs. If the application on the main device needs to call the object resource on the object device, the checking authority can determine whether the application can call the object resource on the object device according to the virtual UID on the object device and the application authority corresponding to the virtual UID. Realize the purpose of calling objects across devices in a distributed system.
  • the present application also provides an electronic device.
  • the electronic device is a main device.
  • the main device includes: a memory and one or more processors; the memory and the processors are coupled; wherein the memory is used to store computer program codes and computer programs
  • the code includes computer instructions, and when the processor executes the computer instructions, the electronic device executes the method in the first aspect, the second aspect, and any one of the possible implementation manners thereof.
  • this application also provides an electronic device.
  • the electronic device is an object device.
  • the object device includes: a memory and one or more processors; the memory and the processor are coupled; wherein the memory is used to store computer program codes and computer programs.
  • the code includes computer instructions, and when the processor executes the computer instructions, the electronic device executes the method in the first aspect, the second aspect, and any one of the possible implementation manners thereof.
  • the present application also provides a distributed system, including the subject device in the above-mentioned fourth aspect and the guest device in the above-mentioned fifth aspect.
  • the present application also provides a computer-readable storage medium, including computer instructions, which when the computer instructions run on an electronic device, cause the electronic device to execute the first aspect and any of its possible implementations, and second Aspect and any of its possible implementation manners, the method in the third aspect.
  • FIG. 1 is a block diagram of application permissions on an electronic device provided by an embodiment of the application
  • FIG. 2 is a block diagram of application permission management of an electronic device of the Android system provided by an embodiment of the application;
  • FIG. 3 is a schematic structural diagram of an electronic device provided by an embodiment of the application.
  • FIG. 4 is a block diagram of the software structure of an electronic device provided by an embodiment of the application.
  • FIG. 5 is a flowchart of a permission multiplexing method provided by an embodiment of this application.
  • FIG. 6 is a schematic diagram of a virtual UID formed by an object device through mapping according to an embodiment of the application.
  • FIG. 7A is a flowchart of a permission multiplexing method provided by an embodiment of this application.
  • FIG. 7B is a schematic block diagram of a synchronization APP permission of an object device according to an embodiment of the application.
  • FIG. 7C is a schematic block diagram of a permission multiplexing method provided by an embodiment of this application.
  • FIG. 8 is a flowchart of a resource access method based on permission multiplexing provided by an embodiment of the application
  • FIG. 9 is a schematic block diagram of a first application on the main device to access the object device according to an embodiment of the application.
  • FIG. 10 is a schematic diagram of the most popular distributed system provided by an embodiment of this application.
  • first and second are only used for descriptive purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features. Thus, the features defined with “first” and “second” may explicitly or implicitly include one or more of these features. In the description of the present embodiment, unless otherwise specified, “plurality” means two or more.
  • Linux It is a multi-user, multi-task, multi-thread and multi-central processing unit (CPU) based on the Portable Operating System Interface (POSIX) and Unix (the name of an operating system) operating system.
  • POSIX Portable Operating System Interface
  • Unix the name of an operating system
  • Linux kernel It is the most basic part of the Linux operating system. Software support that can provide secure access to computer hardware resources for applications.
  • Security Enhanced Linux (SELinux): A security system with mandatory access control.
  • the applications in the system are all mandatory access control applications, that is, the application can access the corresponding object only if it has the permission to access the object.
  • Object Software or hardware resources on electronic devices, where software resources can be applications, drivers, etc., and hardware resources can be cameras, sensors, etc.
  • MAC Mandatory Access Control
  • DAC Discretionary Access Control
  • the authority of the application installed in the electronic device is the same as the authority of the user who controls the operation of the application. For example, if an application is started as a root user, and the application is running in an electronic device, then the application has the authority of the root user. In other words, if the application has root authority (root authority, that is, a system authority), the application can do anything on the Linux system.
  • root authority that is, a system authority
  • Sandboxie is a virtual system program.
  • a browser or other applications can be run in the sandbox, and after the browser or application has finished running, the sandbox can delete changes caused by the running of the browser or application.
  • the sandbox creates an independent operating environment for applications to run.
  • the programs running inside the sandbox cannot have a permanent impact on the hard drive.
  • a running activity of an application in an electronic device on a certain data set It is the basic unit of the system for resource allocation and scheduling, and the foundation of the operating system structure.
  • the program on the electronic device can be a description of instructions, data and its organization form, and the process is the entity of the program.
  • Security context It can also be called a security label. In Selinux, it is the label of the attachment on the object.
  • the security context can indicate the user ID of Selinux, SELinux role, type and security level, etc.
  • Android is a Linux-based operating system. Android can be applied to electronic devices, which can be mobile phones, tablets, computers, and so on. Among them, the security model of Android is that some applications (or called applications) can run in a sandbox, that is, each application runs in a corresponding sandbox. Android can use the MAC in SELinux to manage the operation of all applications in the electronic device. When the application runs in its own sandbox, the DAC and MAC in SELinux define the boundaries of the sandbox, that is, when the application runs in the sandbox, the DAC and MAC jointly determine the object resources that the application can access through the sandbox.
  • SEAndroid is a MAC security system based on security policies.
  • the security policy is based on the security context (security label) of the object, and the object includes the subject and the object.
  • the main body can be a process or an application.
  • the subject can include: UID (user ID of the application), package name (name of the application), signature (if the application is a system installed application, the signature of the application is the system application), The declared authority and the applied authority.
  • the object is the resource that the subject wants to access.
  • the object can include: public files (such as photo albums, audio and video files, etc.), system resources (address book, location, camera, microphone, etc.), applications (such as resource sharing between businesses, etc.) And private files (such as chat log files, etc.).
  • Operation is the process by which the subject calls the object.
  • the permission policy is the permission that the subject can call the object.
  • the main body can include application A, application B, service A, and process A.
  • Application A belongs to subject category A
  • application B belongs to subject category C
  • service A and process A belong to subject category B.
  • Example 1 When application A wants to call resource A in the object, operation A is executed after application A runs.
  • the permission policy queries the permission of application A and determines that application A can call resource A in the object. Then operation A is executed, and application A calls resource A in the object.
  • Example 2 When application B wants to call resource D in the object, application B executes operation C after running.
  • the permission policy queries the permission of application B and determines that application B can call resource D in the object. Then operation C is executed, and application B calls resource D in the object.
  • the access control model includes subject, object, and Android architecture. As shown in Figure 2, the electronic device receives the user's operation, and the subject wants to call the resource in the object.
  • the Android framework includes access control, authority management, and UID and authority correspondence tables.
  • the access control queries the authority management whether the UID of the user has the authority to call the resource of the object.
  • the authority management calls the UID and authority correspondence table to determine the authority of the UID. If the UID corresponding to the user has the authority, the subject can call the resource of the object.
  • FIG. 1 and Figure 2 show the application permission management in the existing Android system, which is applied to a single device.
  • the check Permission in this application permission management is checked by UID. That is, as mentioned above, the UID corresponding to the query subject has the authority to call the object.
  • a distributed system can be composed of a group of independent electronic devices as a whole, and this group of independent electronic devices is like a complete system.
  • a distributed operating system that manages computer resources in a global manner.
  • a layer of software middleware in a system composed of multiple electronic devices is responsible for implementing this model.
  • the World Wide Web is a distributed system. In the World Wide Web, everything looks like a document (or web page).
  • objects can be called across devices in the distributed system.
  • the application on the first device can call the object on the second device.
  • the application that calls the object on the second device comes from the first device.
  • the user ID on the first device and the user ID on the second device may be the same or different; assuming that the user IDs on the two devices are the same, the permission settings of the application on the first device and the second device may also be different of.
  • the checking authority on the second device cannot determine the authority of the application on the second device, which will make the application of the first device unable to directly call the object on the second device.
  • this modification involves the modification of a large number of applications and services on the entire distributed system, which is not easy to implement.
  • the embodiment of the present application provides a permission multiplexing method, which can solve the problem of synchronization of application permissions when objects are called across devices in a distributed system.
  • the first device may send control information to the second device.
  • the second control information may include the device identification of the first device, the UIDs of multiple applications, and the authority information of multiple applications.
  • the second device creates a virtual machine in response to the control information.
  • the virtual machine includes a device identifier and UIDs of multiple applications.
  • the second device stores the correspondence between the virtual machine and the permission information of the multiple applications in the first device.
  • the application on the first device accesses the object on the second device
  • the application on the first device accesses the virtual machine of the second device
  • the virtual machine executes the permission check to determine whether the application on the first device can call the second device.
  • the object of the device As a result, there is no need to adjust the method of checking permissions on each device, and there is no need to modify a large number of services on the distributed system.
  • the above-mentioned permission multiplexing method can be applied to a distributed system established by an operating system developed by the Linux kernel.
  • the operating system on the electronic device is the Android system as an example.
  • the system installed on the electronic device may be an Android system or a non-Android system.
  • the electronic device in the embodiment of the present application may be a mobile phone, a tablet computer, a desktop computer, a laptop, a handheld computer, a notebook computer, a vehicle-mounted device, an ultra-mobile personal computer (UMPC), and a netbook.
  • UMPC ultra-mobile personal computer
  • PDA personal digital assistants
  • AR augmented reality
  • VR virtual reality
  • the embodiments of this application do not impose special restrictions on the specific form of the electronic device .
  • FIG. 3 is a schematic structural diagram of an electronic device 200 according to an embodiment of this application.
  • the electronic device 200 may include a processor 210, an external memory interface 220, an internal memory 221, a universal serial bus (USB) interface 230, a charging management module 240, a power management module 241, and a battery 242, antenna 1, antenna 2, mobile communication module 250, wireless communication module 260, audio module 270, sensor module 280, camera 293, display screen 294, and so on.
  • USB universal serial bus
  • the structure illustrated in the embodiment of the present invention does not constitute a specific limitation on the electronic device 200.
  • the electronic device 200 may include more or fewer components than shown, or combine certain components, or split certain components, or arrange different components.
  • the illustrated components can be implemented in hardware, software, or a combination of software and hardware.
  • the processor 210 may include one or more processing units.
  • the processor 210 may include an application processor (AP), a modem processor, a graphics processing unit (GPU), and an image signal processor. (image signal processor, ISP), controller, memory, video codec, digital signal processor (digital signal processor, DSP), baseband processor, and/or neural-network processing unit (NPU) Wait.
  • AP application processor
  • modem processor modem processor
  • GPU graphics processing unit
  • image signal processor image signal processor
  • ISP image signal processor
  • controller memory
  • video codec digital signal processor
  • DSP digital signal processor
  • NPU neural-network processing unit
  • the different processing units may be independent devices or integrated in one or more processors.
  • the controller may be the nerve center and command center of the electronic device 200.
  • the controller can generate operation control signals according to the instruction operation code and timing signals to complete the control of fetching instructions and executing instructions.
  • a memory may also be provided in the processor 210 for storing instructions and data.
  • the memory in the processor 210 is a cache memory.
  • the memory can store instructions or data that have just been used or recycled by the processor 210. If the processor 210 needs to use the instruction or data again, it can be directly called from the memory. Repeated accesses are avoided, the waiting time of the processor 210 is reduced, and the efficiency of the system is improved.
  • the processor 210 may include one or more interfaces.
  • the interface can include an integrated circuit (inter-integrated circuit, I2C) interface, an integrated circuit built-in audio (inter-integrated circuit sound, I2S) interface, a pulse code modulation (pulse code modulation, PCM) interface, and a universal asynchronous transmitter (universal asynchronous) interface.
  • I2C integrated circuit
  • I2S integrated circuit built-in audio
  • PCM pulse code modulation
  • UART universal asynchronous transmitter
  • MIPI mobile industry processor interface
  • GPIO general-purpose input/output
  • SIM subscriber identity module
  • USB Universal Serial Bus
  • the interface connection relationship between the modules illustrated in the embodiment of the present invention is merely illustrative, and does not constitute a structural limitation of the electronic device 200.
  • the electronic device 200 may also adopt different interface connection modes in the foregoing embodiments, or a combination of multiple interface connection modes.
  • the external memory interface 220 may be used to connect an external memory card, such as a Micro SD card, so as to expand the storage capacity of the electronic device 200.
  • the external memory card communicates with the processor 210 through the external memory interface 220 to realize the data storage function. For example, save music, video and other files in an external memory card.
  • the internal memory 221 may be used to store computer executable program code, the executable program code including instructions.
  • the processor 210 executes various functional applications and data processing of the electronic device 200 by running instructions stored in the internal memory 221.
  • the internal memory 221 may include a storage program area and a storage data area.
  • the storage program area can store an operating system, an application program (such as a sound playback function, an image playback function, etc.) required by at least one function, and the like.
  • the data storage area can store data (such as audio data, phone book, etc.) created during the use of the electronic device 200.
  • the internal memory 221 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one magnetic disk storage device, a flash memory device, a universal flash storage (UFS), and the like.
  • UFS universal flash storage
  • the charging management module 240 is used to receive charging input from the charger.
  • the charger can be a wireless charger or a wired charger.
  • the power management module 241 is used to connect the battery 242, the charging management module 240 and the processor 210.
  • the power management module 241 receives input from the battery 242 and/or the charging management module 240, and supplies power to the processor 210, the internal memory 221, the external memory, the display screen 294, the wireless communication module 260, and the audio module 270.
  • the wireless communication function of the electronic device 200 can be implemented by the antenna 1, the antenna 2, the mobile communication module 250, the wireless communication module 260, the modem processor, and the baseband processor.
  • the mobile communication module 250 can provide a wireless communication solution including 2G/3G/4G/5G and the like applied to the electronic device 200.
  • the mobile communication module 250 may include at least one filter, a switch, a power amplifier, a low noise amplifier (LNA), and the like.
  • the mobile communication module 250 can receive electromagnetic waves from the antenna 1, filter and amplify the received electromagnetic waves, and transmit them to the modem processor for demodulation.
  • the mobile communication module 250 can also amplify the signal modulated by the modem processor, and convert it into electromagnetic wave radiation via the antenna 1.
  • the wireless communication module 260 can provide applications on the electronic device 200 including wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) networks), bluetooth (BT), and global navigation satellites. System (global navigation satellite system, GNSS), frequency modulation (FM), near field communication (NFC), infrared technology (infrared, IR) and other wireless communication solutions.
  • the wireless communication module 260 may be one or more devices integrating at least one communication processing module.
  • the wireless communication module 260 receives electromagnetic waves via the antenna 2, frequency modulates and filters the electromagnetic wave signals, and sends the processed signals to the processor 210.
  • the wireless communication module 260 may also receive the signal to be sent from the processor 210, perform frequency modulation, amplify, and convert it into electromagnetic waves and radiate it through the antenna 2.
  • the display screen 294 is used to display images, videos, and the like.
  • the display screen 294 includes a display panel.
  • the display panel can use liquid crystal display (LCD), organic light-emitting diode (OLED), active matrix organic light-emitting diode or active-matrix organic light-emitting diode (active-matrix organic light-emitting diode).
  • LCD liquid crystal display
  • OLED organic light-emitting diode
  • active-matrix organic light-emitting diode active-matrix organic light-emitting diode
  • AMOLED flexible light-emitting diode (FLED), Miniled, MicroLed, Micro-oLed, quantum dot light-emitting diode (QLED), etc.
  • the electronic device 200 may include one or N display screens 294, and N is a positive integer greater than one.
  • the camera 293 is used to capture still images or videos.
  • the object generates an optical image through the lens and is projected to the photosensitive element.
  • the photosensitive element may be a charge coupled device (CCD) or a complementary metal-oxide-semiconductor (CMOS) phototransistor.
  • CMOS complementary metal-oxide-semiconductor
  • the photosensitive element converts the light signal into an electrical signal, and then transfers the electrical signal to the ISP to convert it into a digital image signal.
  • ISP outputs digital image signals to DSP for processing.
  • DSP converts digital image signals into standard RGB, YUV and other formats of image signals.
  • the electronic device 200 may include 1 or N cameras 293, and N is a positive integer greater than 1.
  • Digital signal processors are used to process digital signals. In addition to digital image signals, they can also process other digital signals. For example, when the electronic device 200 selects the frequency point, the digital signal processor is used to perform Fourier transform on the energy of the frequency point.
  • Video codecs are used to compress or decompress digital video.
  • the electronic device 200 may support one or more video codecs. In this way, the electronic device 200 can play or record videos in multiple encoding formats, such as: moving picture experts group (MPEG) 1, MPEG2, MPEG3, MPEG4, and so on.
  • MPEG moving picture experts group
  • MPEG2 MPEG2, MPEG3, MPEG4, and so on.
  • the electronic device 200 can implement audio functions through an audio module 270, an application processor, and the like. For example, music playback, recording, etc.
  • the audio module 270 is used to convert digital audio information into an analog audio signal for output, and is also used to convert an analog audio input into a digital audio signal.
  • the audio module 270 can also be used to encode and decode audio signals.
  • the audio module 270 may be provided in the processor 210, or part of the functional modules of the audio module 270 may be provided in the processor 210.
  • the electronic device in the embodiment of the present application may adopt a layered architecture, an event-driven architecture, a microkernel architecture, a microservice architecture, or a cloud architecture.
  • the embodiment of the present invention takes an Android system with a layered architecture as an example. Please refer to FIG. 4, which is a software structure block diagram of the Android system.
  • the layered architecture divides the software into several layers, and each layer has a clear role and division of labor. Communication between layers through software interface.
  • the Android system is divided into four layers, from top to bottom, the application layer, the application framework layer, the Android runtime and system library, and the kernel layer.
  • the application layer can include a series of application packages.
  • the application package may include applications such as camera, gallery, calendar, call, map, navigation, WLAN, Bluetooth, music, video, short message, etc.
  • the object resource on the electronic device can be called.
  • the application program may include a camera application, and when the camera application is running, the camera on the electronic device may be called to obtain image information.
  • the application framework layer provides an application programming interface (application programming interface, API) and a programming framework for applications in the application layer.
  • the application framework layer includes some predefined functions.
  • the application framework layer can include a window manager, a content provider, a view system, a phone manager, a resource manager, and a notification manager.
  • the window manager is used to manage window programs.
  • the window manager can obtain the size of the display screen, determine whether there is a status bar, lock the screen, take a screenshot, etc.
  • the content provider is used to store and retrieve data and make these data accessible to applications.
  • the data may include videos, images, audios, phone calls made and received, browsing history and bookmarks, phone book, etc.
  • the view system includes visual controls, such as controls that display text, controls that display pictures, and so on.
  • the view system can be used to build applications.
  • the display interface can be composed of one or more views.
  • a display interface that includes a short message notification icon may include a view that displays text and a view that displays pictures.
  • the phone manager is used to provide communication functions for electronic devices. For example, the management of the call status (including connecting, hanging up, etc.).
  • the resource manager provides various resources for the application, such as localized strings, icons, pictures, layout files, video files, and so on.
  • the notification manager enables the application to display notification information in the status bar, which can be used to convey notification-type messages, and it can automatically disappear after a short stay without user interaction.
  • the notification manager is used to notify download completion, message reminders, and so on.
  • the notification manager can also be a notification that appears in the status bar at the top of the system in the form of a chart or a scroll bar text, such as a notification of an application running in the background, or a notification that appears on the screen in the form of a dialog window.
  • prompt text information in the status bar emit a prompt tone, vibrate, and blink the indicator light.
  • the application framework layer may also include a communication manager.
  • the electronic device can establish a connection with other devices through the communication manager.
  • the first device establishes a connection with the second device through the communication module, and the first device sends control information to the second device through the communication module.
  • the control information may include the device identification of the first device, the UIDs of multiple applications, and permission information of multiple applications.
  • Android Runtime includes core libraries and virtual machines. Android runtime is responsible for the scheduling and management of the Android system.
  • the core library consists of two parts: one part is the function functions that the java language needs to call, and the other part is the core library of Android.
  • the application layer and application framework layer run in a virtual machine.
  • the virtual machine executes the java files of the application layer and the application framework layer as binary files.
  • the virtual machine is used to perform functions such as object life cycle management, stack management, thread management, security and exception management, and garbage collection.
  • the system library can include multiple functional modules. For example: surface manager (surface manager), media library (Media Libraries), three-dimensional graphics processing library (for example: OpenGL ES), 2D graphics engine (for example: SGL), etc.
  • the surface manager is used to manage the display subsystem and provides a combination of 2D and 3D layers for multiple applications.
  • the media library supports playback and recording of a variety of commonly used audio and video formats, as well as still image files.
  • the media library can support multiple audio and video encoding formats, such as: MPEG4, H.264, MP3, AAC, AMR, JPG, PNG, etc.
  • the 3D graphics processing library is used to implement 3D graphics drawing, image rendering, synthesis, and layer processing.
  • the 2D graphics engine is a drawing engine for 2D drawing.
  • the kernel layer is the layer between hardware and software.
  • the kernel layer contains at least display driver, camera driver, audio driver, and sensor driver.
  • FIG. 5 is a flowchart of a permission multiplexing method provided by an embodiment of this application. This method is applied to a distributed system, and the embodiment of the present application takes a method for implementing permission multiplexing between the first device and the second device in the distributed system as an example. As shown in FIG. 5, the method includes step 501-step 504.
  • the main device can access the object of the object device.
  • the first device is the main device and the second device is the guest device as an example to illustrate the above-mentioned permission multiplexing method.
  • Step 501 The host device establishes a connection with the guest device.
  • the distributed system may include more than these two devices, and multiple devices in the distributed system are connected to each other.
  • Step 502 The main device sends control information to the object device.
  • the control information includes the first device identification of the main device, the UIDs of multiple applications in the main device, and the authority information of the multiple applications.
  • the permission information of an application is used to indicate which objects an application has the permission to access the main device.
  • the application in the main device includes a camera
  • the permission information of the camera includes the permission to access the camera in the main device and the permission to access the album in the main device.
  • the first device ID may not be the real device ID of the main device.
  • the main device can recognize that both the first device identification and the second device identification are used to identify itself, but the first device identification is different from the second device identification.
  • the main device may reserve a part of the device identification in advance for generating control information. If the host device sends control information to the first object device and the second object device, where the host device sends the first control information to the first object device, and the host device sends the second control information to the second object device.
  • the first control information includes the first device identification of the main device
  • the second control information includes the second device identification of the main device. Both the first device identification and the second device identification are used to identify the main device, but the first device identification and the second device identification are different.
  • the host device and the guest device form a distributed system.
  • the main device applies to the mapping module in the distributed system to reserve some device IDs, so that the main device can apply for the use of these device IDs when sending control information to the object device.
  • Step 503 The object device receives the control information, and creates a virtual UID according to the control information.
  • the virtual UID corresponds to the first device identification of the host device and the UID of the host device.
  • the object device does not directly use multiple application UIDs in the control information.
  • the object device can apply to the system for a UID and the first device identification of the host device to form a virtual UID.
  • the virtual UID of the guest device corresponds to the first device identification of the main device and the UID of the main device.
  • the host device sends control information to the guest device, and the guest device generates a virtual UID according to the control information.
  • the application on the main device wants to access the object on the object device, it can check the permissions through the virtual UID.
  • the virtual UID can be used to synchronize the permissions of the application on the main device to the object device.
  • the device identification of the main device included in the control information of the main device is only used for remote access permission mapping. That is, the virtual UID created according to the device ID and UID after the object device receives the control information is only used for remote access of the host device.
  • FIG. 6 it is a schematic diagram of a virtual UID formed by the object device through mapping. The host device sends control information to the object device, and the object device generates a local virtual UID after mapping according to the control information.
  • the mapping table of the object device includes the corresponding relationship between the UID and the permission information of the application. It can be understood that the local virtual UID includes the main device identifier and the UIDs of multiple applications.
  • FIG. 7A it is an implementation flow chart for the object device to establish a virtual UID according to the control information. Including step 503a-step 503d.
  • Step 503a The object device receives the control information from the host device.
  • the UID mapping module of the system reserves a UID for the host device.
  • the UID reserved for the host device is applied for by other guest devices, the UID applied for by the guest device corresponds to the first device identification and UID of the host device.
  • Step 503b After the object device receives the control information of the host device, it is determined whether there is a second virtual UID corresponding to the device identification and UID of the host device. If yes, go to step 503c; if no, go to step 503d.
  • the second virtual UID is the UID previously applied for by the guest device for the host device. If the object device has previously applied for a virtual UID for the main device, the virtual UID applied for by the object device corresponds to the first device identification and UID of the main device. If the guest device has not previously applied for a virtual UID for the host device, the UID mapping module of the system assigns a UID to the host device so that the virtual UID of the guest device corresponds to the first device identification and UID of the host device.
  • Step 503c The guest device updates the permission information of multiple applications corresponding to the second virtual UID.
  • the authority information corresponding to the second virtual UID needs to be updated.
  • the guest device can delete the second virtual UID and delete the application permission corresponding to the virtual UID.
  • Step 503d The object device applies for a UID from the UID mapping module in the system, and uses the UID as the first virtual UID.
  • the first virtual UID is the virtual UID created by the guest device.
  • the guest device has not previously applied for a UID for the host device from the UID mapping module of the system. Then the object device applies for a UID for the object device, and the object device corresponds the applied UID to the device identification and UID of the main device.
  • FIG. 7B is a schematic diagram of the mapping of the virtual UID.
  • steps 701-707 are included.
  • step 705 to step 706 can be executed after the distributed system is created.
  • Steps 701 to 702 are the process of creating a virtual UID by the object device, which is executed after the object device receives the control information.
  • step 701 to step 702 correspond to step 503b
  • step 705 and step 706 correspond to step 503a
  • step 703 corresponds to step 503c
  • step 707 corresponds to step 503d.
  • Step 504 The object device saves the authority information of multiple applications in the control information, and the virtual UID corresponds to the authority information of the multiple applications.
  • the object device creates a virtual UID, and synchronously saves the authority information of the application in the main device. In this way, when the application in the main device runs and accesses the object in the object device, the object device can check the authority according to the synchronized authority information to determine whether the application can access the corresponding object.
  • the first virtual UID corresponds to the device identification and UID of the main device.
  • the permission information of the application can be synchronized to the guest device.
  • the permission information of the application can be synchronized to other devices in the distributed system, so that the devices in the distributed system can call resources on the object device across devices.
  • FIG. 7B is a schematic block diagram of installing an application (APP) for the main device to synchronize APP permissions.
  • the main device includes a policy library, and the policy library may include permission information of all applications installed on the main device.
  • the object device may also include a policy library.
  • the policy library includes permission information of applications installed on the object device and permission information corresponding to the virtual UID.
  • the object device may also include a UID mapping module, and the virtual UID created on the object device corresponds to the host device.
  • the first device identification of the main device is represented as DeviceID.
  • the application on the main device wants to access the object on the main device, check the authority to query whether the application has the authority to access the subject for a UID. Check the permissions to determine that the application can access the object, then the application can access the object.
  • the object device establishes a virtual UID for the main device, and the virtual UID corresponds to the device identification of the main device and the UID in the main device.
  • the application on the main device accesses the object on the object device, check the permission to query the application permission corresponding to the virtual UID to determine that the application permission corresponding to the virtual UID can access the resource, then the application on the main device can access the object on the object device .
  • cross-device calling objects are realized.
  • the main device can directly access the object on the object device, and there is no need to modify the method of checking the authority, which realizes the authority synchronization in the distributed system.
  • FIG. 8 is a flowchart of a resource access method based on permission multiplexing provided by an embodiment of this application, and the method is applied to a distributed system. Among them, take the application on the main device in the distributed system calling the object on the object device as an example.
  • the method includes step 801-step 805.
  • Step 801 The main device sends an access request to the object device.
  • the access request is used to request the application in the main device to access the first object in the object device, and the access request includes the first device identification of the main device and the UID of the first application.
  • the first object is the software or hardware resource in the object device.
  • Step 802 The object device receives an access request from the main device.
  • a virtual UID is created in the guest device.
  • the virtual UID corresponds to the first device identification of the main device and the UIDs of multiple applications, and the permission check method on the main device can be directly applied to the object device. Realize that the authority of the subject device is reused in the object device.
  • Step 803 In response to the access request, the object device queries the stored virtual identity for the first virtual identity, where the first virtual identity corresponds to the first device identity of the subject device and the UID of the first application.
  • the checking authority in the object device queries the authority of the application according to the object accessed by the application and the UID of the application.
  • cross-device calling objects can be realized without a large number of methods of changing the inspection authority of devices and services.
  • Step 804 The object device queries the first permission information corresponding to the first virtual identity from the permission information.
  • the object device queries the first virtual identity, so that when the application in the main device calls the object in the object device, it can be implemented by checking the authority.
  • Step 805 The object device provides the first application with the access service of the first resource according to the permission of the first application indicated by the first permission information.
  • the host device is provided with an access service for accessing the first resource. If the permission of the first application indicates that the first application cannot access the first resource, the object device denies the first application to access the access service of the first resource.
  • FIG. 9 is a schematic block diagram of the first application on the host device to access the guest device.
  • the access is initiated when the first application in the main device runs, that is, the main device runs the first process.
  • the object responds to the access request of the main device, that is, the object device executes the second process.
  • the object device provides services for the second process, and sends the device identification in the main device and the UID of the application to the object device.
  • the object device executes the second process, so that the object device executes the permission check to query the permission information of the first application on the object device.
  • the embodiment of the present application provides a distributed system, as shown in FIG. 10.
  • the distributed platform includes multiple electronic devices, such as a host device 101 and a guest device 102. It is understandable that a distributed system may include multiple host devices 101 and multiple object devices 102. There is no limitation here.
  • the main device includes a memory and a processor.
  • the main device may include multiple processors, and the memory and the processors are coupled.
  • the memory is used to store computer program codes.
  • the computer program codes include computer instructions. When the processor executes the computer instructions in the main device, the main device can execute the method shown in the figure.
  • the object device includes: memory and processor.
  • the guest device may include multiple processors, and the memory and the processors are coupled.
  • the memory is used to store computer program codes.
  • the computer program codes include computer instructions.
  • the embodiment of the present application also provides a computer-readable storage medium, the computer-readable storage medium stores computer program code, and when the above-mentioned processor executes the computer program code, the electronic device executes the steps shown in FIG. 5, FIG. 7A, or FIG.
  • the relevant method steps in any figure implement the method in the foregoing embodiment.
  • the embodiment of the present application also provides a computer program product.
  • the computer program product When the computer program product is run on a computer, the computer can execute the relevant method steps in any one of the drawings in FIG. 5, FIG. 7A, or FIG. Methods.
  • the electronic equipment, computer storage media, or computer program products provided in the embodiments of the present application are all used to execute the corresponding methods provided above. Therefore, the beneficial effects that can be achieved can refer to the corresponding methods provided above The beneficial effects in the process will not be repeated here.
  • the embodiments of the present application may divide the above-mentioned devices and the like into functional modules according to the above-mentioned method examples.
  • each functional module may be divided corresponding to each function, or two or more functions may be integrated into one processing module.
  • the above-mentioned integrated modules can be implemented in the form of hardware or software functional modules. It should be noted that the division of modules in the embodiment of the present invention is illustrative, and is only a logical function division, and there may be other division methods in actual implementation.
  • the functional units in the various embodiments of the embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit can be implemented in the form of hardware or software functional unit.
  • the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium.
  • the technical solutions of the embodiments of the present application are essentially or the part that contributes to the prior art, or all or part of the technical solutions can be embodied in the form of software products, and the computer software products are stored in a storage
  • the medium includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) or a processor to execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage media include: flash memory, mobile hard disk, read-only memory, random access memory, magnetic disk or optical disk and other media that can store program codes.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Automation & Control Theory (AREA)
  • Stored Programmes (AREA)
  • Storage Device Security (AREA)

Abstract

一种权限复用方法，应用于分布式系统，所述分布式系统包括第一设备和第二设备，所述第一设备中包括多个应用，所述方法包括：所述第一设备向所述第二设备发送控制信息；其中，所述控制信息包括所述第一设备的第一设备标识、所述多个应用的用户标识和所述多个应用的权限信息；一个应用的权限信息用于指示所述一个应用具备访问所述第一设备中哪些客体的权限，所述第一设备中的客体包括所述第一设备中的软件或硬件资源；所述第二设备接收所述控制信息，并根据所述控制信息创建所述第一虚拟身份标识，所述第一虚拟身份标识包括所述第一设备的第一设备标识和所述多个应用的用户标识；所述第二设备保存所述第一虚拟身份标识、所述多个应用的权限信息，以及所述第一虚拟身份标识与所述多个应用的权限信息的对应关系。

Description

权限复用方法、基于权限复用的资源访问方法及相关设备
本申请要求于2020年02月28日提交国家知识产权局、申请号为202010131670.2、发明名称为“权限复用方法、基于权限复用的资源访问方法及相关设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请实施例涉及计算机系统及计算机网络领域，尤其涉及一种权限复用方法、基于权限复用的资源访问方法及相关设备。
背景技术
分布式系统(distributed system)是建立在网络之上的软件系统。正是因为软件的特性，所以分布式系统具有高度的内聚性和透明性。内聚性是指每一个数据库分布节点高度自治，有本地的数据库管理系统。透明性是指每一个数据库分布节点对用户的应用来说都是透明的，看不出是本地还是远程。也就是说，在分布式数据库系统中，用户不必知道数据存储于哪个数据库分布节点，以及应用在哪个数据库分布节点上运行等。
当前安卓(Android)操作系统中的应用权限管理模型是基于单设备的。例如，安装有安卓系统的电子设备在安装应用时，仅在该电子设备上设置该应用的权限。其中，即使不同电子设备上安装相同的应用，但是不同电子设备上设置的该应用的权限也可以是不同的。具体来说，Android系统在安装应用时，需要在该应用的Manifest文件中定义好该应用的用户标识(User Identification，UID)和权限(如，拨打电话的权限或发送短信的权限)。当电子设备运行应用，访问某个客体(如电子设备中的软件或硬件资源)时，一般都是通过检查权限(check Permission)实现访问控制。具体的，应用访问客体时，可通过电子设备的UID，获取该应用在该电子设备上被设置的权限，从而决策该客体是否允许被访问。
一个分布式系统中的多个计算机展现给用户的是一个统一的整体，就好像是一个系统似的。这个系统拥有多种通用的物理和逻辑资源，这些物理和逻辑资源可以分布在不同的计算机中，可以通过上述多个计算机之间的计算机网络实现信息交换。如此，该系统可以为上述多个计算机动态的分配任务，使上述多个计算机可以通过上述计算机网络实现信息交换，共同完成上述任务。
如果安卓系统的电子设备被应用于分布式系统中，由于每个电子设备上的应用的权限管理是针对单个设备而言的；因此分布式系统中不能实现跨设备的远程服务上应用权限的控制。其中，代表应用主体的UID只在本地的电子设备上有效，标准的检查权限(check Permission)是根据UID检查该应用的权限。
在安卓设备的分布式系统中，跨设备调用应用时，一个应用安装在分布式系统中不同的电子设备上，该应用在访问客体时，即使是同样的UID，该应用可能被设置不同的权限，导致该应用不能被远程调用。
发明内容
本申请提供一种权限复用方法、基于权限复用的资源访问方法及相关设备，以解决分布式系统中跨设备调用客体时，应用权限的同步问题。
为实现上述技术目的，本申请采用如下技术方案：
第一方面，本申请提供一种权限复用方法，该方法可以应用于分布式系统，分布式系统包括第一设备和第二设备，第一设备中包括多个应用。其中，分布式系统中第一设备中的应用可以调用第二设备中的客体，则第一设备也就是主体设备，第二设备也就是客体设备。该权限复用方法可以包括：主体设备向客体设备发送控制信息，其中，控制信息中包括主体设备的第一设备标识，主体设备上多个应用的用户标识和多个应用的权限信息。一个应用的权限信息用于指示一个应用具备访问主体设备中哪些客体的权限，主体设备中的客体包括主体设备中的软件或硬件资源，同理，客体设备上的客体是客体设备中的软件或硬件资源。客体设备接收到主体设备发送的控制信息，并根据控制信息创建第一虚拟身份标识，第一虚拟身份标识对应于主体设备中的第一设备标识和多个应用的UID。客体设备保存第一虚拟身份标识、多个应用的权限信息，以及第一虚拟身份标识与多个应用的权限信息的对应关系。
可以理解的，客体设备接收到控制信息，并根据控制信息创建第一虚拟身份标识。第一虚拟身份标识对应于主体设备中的第一设备标识和多个应用的UID，而且第一虚拟身份标识对应于主体设备中多个应用的权限信息。也就是说，客体设备保存有主体设备上的权限信息，且客体设备上的第一虚拟身份标识对应于主体设备上的权限信息，从而实现了主体设备上的权限复用至客体设备。这样，当主体设备上的应用访问客体设备上的客体，使得主体设备上的应用访问至客体设备上的第一虚拟身份标识，客体设备上的检查权限可以使用第一虚拟身份标识确认该应用在客体设备上的权限，以确定客体设备上的客体是否被主体设备上的应用调用。从而解决了分布式系统中跨设备调用客体时，应用权限的同步问题。
在一种可能的实施方式中，主体设备上包括第一应用。主体设备运行第一应用时，可以向客体设备发送访问请求。其中，访问请求用于请求由第一应用访问客体设备中的第一客体，第一客体是客体设备中的软件或硬件资源。由于访问请求是主体设备上的应用发出的，访问请求中包括主体设备的第一设备标识和第一应用的UID。客体设备接收上述的访问请求，客体设备响应于访问请求，客体设备确定出与主体设备对应的第一虚拟身份标识。客体设备从保存的权限信息中，查询出第一虚拟身份标识对应的第一权限信息。客体设备根据第一权限信息所指示的权限，为第一应用提供第一资源的访问服务。
其中，上述第一权限信息是主体设备中的全部的应用权限的信息，客体设备可以根据第一权限信息确定出主体设备上的第一应用是否有权限访问客体设备的第一资源。以便客体资源为主体设备上的第一应用提供第一资源的访问服务。
另一种可能的实施方式中，主体设备还包括第二设备标识，第一设备标识与第二设备标识均用于标识第一设备，但第一设备标识与第二设备标识可以不同。
其中，第一设备标识和第二设备标识均用于指示主体设备。也就是说，即使第一设备标识与主体设备真正的设备标识不同，只要第一设备标识与主体设备之间存在对 应关系，第一设备标识就可以映射到主体设备。这种方式既满足了客体设备上的虚拟UID映射到主体设备，实现主体设备的权限复用，也避免了主体设备的设备标识被泄露，保护主体设备的设备安全。
另一种可能的实施方式中，主体设备向客体设备发送控制信息之前，主体设备与客体设备建立连接。
另一种可能的实施方式中，如果主体设备与客体设备断开连接，客体设备删除第一虚拟身份标识和第一虚拟身份标识对应的多个应用的权限信息。
可以理解的，客体设备与主体设备断开连接之后，客体设备就删除第一虚拟身份标识，则可以提高客体设备的使用效率。
另一种可能的实施方式中，客体设备接收到控制信息之后，客体设备可以判断是否保存有第二虚拟身份标识，第二虚拟身份标识中的设备标识对应于控制信息中的第一设备标识。根据控制信息创建第一虚拟身份标识，包括：若客体设备中未保存第二虚拟身份标识，客体设备根据控制信息创建第一虚拟身份标识；若客体设备中保运有第二虚拟身份标识，客体设备根据控制信息中的多个应用的权限信息，更新第二虚拟身份标识对应的多个应用的权限信息。
另一种可能的实施方式中，主体设备和客体设备中使用的操作系统都是基于Linux内核开发的。
另一种可能的实施方式中，客体设备根据控制信息创建第一虚拟身份标识，包括：客体设备根据控制信息创建虚拟机，虚拟机对应于主体设备。其中，虚拟机的设备标识为主体设备的第一设备标识虚拟机的UID为主体设备中多个用户的UID。
第二方面，本申请还提供一种权限复用方法，应用于分布式系统中的客体设备，该方法可以包括：客体设备接收到来自主体设备的控制信息，其中，控制信息中包括主体设备的第一设备标识，主体设备上多个应用的用户标识和多个应用的权限信息。一个应用的权限信息用于指示一个应用具备访问主体设备中哪些客体的权限，主体设备中的客体包括主体设备中的软件或硬件资源，同理，客体设备上的客体是客体设备中的软件或硬件资源。客体设备根据控制信息创建第一虚拟身份标识，第一虚拟身份标识对应于主体设备中的第一设备标识和多个应用的UID。客体设备保存第一虚拟身份标识、多个应用的权限信息，以及第一虚拟身份标识与多个应用的权限信息的对应关系。
可以理解的，该方法是应用于分布式系统中客体设备的，与上述第一方面中的权限复用方法对应。因此，第一方面及其任一种可能的实施方式中的效果对应于本方面提供的权限复用方法，此处不与赘述。
在一种可能的实施方式中，客体设备接收到来自主体设备的访问请求。其中，访问请求用于请求由第一应用访问客体设备中的第一客体，第一客体是客体设备中的软件或硬件资源。由于访问请求是主体设备上的应用发出的，访问请求中包括主体设备的第一设备标识和第一应用的UID。客体设备响应于访问请求，客体设备确定出与主体设备对应的第一虚拟身份标识。客体设备从保存的权限信息中，查询出第一虚拟身份标识对应的第一权限信息。客体设备根据第一权限信息所指示的权限，为第一应用提供第一资源的访问服务。
另一种可能的实施方式中，主体设备向客体设备发送控制信息之前，主体设备与客体设备建立连接。
另一种可能的实施方式中，如果主体设备与客体设备断开连接，客体设备删除第一虚拟身份标识和第一虚拟身份标识对应的多个应用的权限信息。
另一种可能的实施方式中，客体设备接收到控制信息之后，客体设备可以判断是否保存有第二虚拟身份标识，第二虚拟身份标识中的设备标识对应于控制信息中的第一设备标识。根据控制信息创建第一虚拟身份标识，包括：若客体设备中未保存第二虚拟身份标识，客体设备根据控制信息创建第一虚拟身份标识；若客体设备中保运有第二虚拟身份标识，客体设备根据控制信息中的多个应用的权限信息，更新第二虚拟身份标识对应的多个应用的权限信息。
另一种可能的实施方式中，客体设备中使用的操作系统是基于Linux内核开发的。
另一种可能的实施方式中，客体设备根据控制信息创建第一虚拟身份标识，包括：客体设备根据控制信息创建虚拟机，虚拟机对应于主体设备。其中，虚拟机的设备标识为主体设备的第一设备标识虚拟机的UID为主体设备中多个用户的UID。
第三方面，本申请还提供一种基于权限复用的资源访问方法，该方法应用于分布式系统，该分布式系统中包括主体设备和客体设备。主体设备中可以包括多个应用，该方法可以包括：客体设备接收来自主体设备的访问请求，其中，访问请求用于请求由第一应用访问客体设备中的第一客体，第一客体是客体设备中的软件或硬件资源，访问请求中包括主体设备的主体设备标识和第一应用的UID。客体设备响应于访问请求，从客体设备保存的虚拟身份标识中，查询第一虚拟身份标识，第一虚拟身份标识与访问请求中包括的主体设备标识和第一应用的用户标识对应。客体设备从客体设备保存的权限信息中，查询与第一虚拟身份标识对应的第一权限信息；客体设备根据第一权限信息所指示的权限，为第一应用提供第一资源的访问服务。
其中，客体设备中保存有基于多个设备创建的虚拟身份标识和每个设备中各个应用的权限信息，多个设备包括主体设备，基于主体设备创建的虚拟身份标识包括主体设备标识和多个应用的用户标识，主体设备中一个应用的权限信息用于指示一个应用具备访问主体设备中哪些客体的权限。
可以理解的，在分布式系统中，主体设备上应用的权限复用至客体设备上之后，当主体设备上的应用运行。如果主体设备上的应用需要调用客体设备上的客体资源，检查权限可以根据客体设备上的虚拟UID以及虚拟UID对应的应用权限，确定该应用是否可以调用客体设备上的客体资源。实现了在分布式系统中跨设备调用客体的目的。
第四方面，本申请还提供一种电子设备，电子设备是主体设备，主体设备包括：存储器和一个或多个处理器；存储器和处理器耦合；其中，存储器用于存储计算机程序代码，计算机程序代码包括计算机指令，当所述处理器执行所述计算机指令时，使电子设备执行如第一方面、第二方面及其任一种可能的实施方式中的方法。
第五方面，本申请还提供一种电子设备，电子设备是客体设备，客体设备包括：存储器和一个或多个处理器；存储器和处理器耦合；其中，存储器用于存储计算机程序代码，计算机程序代码包括计算机指令，当处理器执行所述计算机指令时，使电子设备执行如第一方面、第二方面及其任一种可能的实施方式中的方法。
第六方面，本申请还提供一种分布式系统，包括上述第四方面中的主体设备和上述第五方面中的客体设备。
第七方面，本申请还提供一种计算机可读存储介质，包括计算机指令，当计算机指令在电子设备上运行时，使得电子设备执行上述第一方面及其任一种可能的实施方式、第二方面及其任一种可能的实施方式、第三方面中的方法。
附图说明
图1为本申请实施例提供的电子设备上的应用权限框图；
图2为本申请实施例提供的一种Android系统的电子设备的应用权限管理框图；
图3为本申请实施例提供的一种电子设备的结构示意图；
图4为本申请实施例提供的一种电子设备的软件结构框图；
图5为本申请实施例提供的一种权限复用方法流程图；
图6为本申请实施例提供的一种客体设备通过映射形成虚拟UID示意图；
图7A为本申请实施例提供的一种权限复用方法流程图；
图7B为本申请实施例提供的一种客体设备同步APP权限的示意框图；
图7C为本申请实施例提供的一种权限复用方法的示意框图；
图8为本申请实施例提供的一种基于权限复用的资源访问方法流程图；
图9为本申请实施例提供的一种主体设备上的第一应用访问客体设备的访问示意框图；
图10为本申请实施例提供的最红分布式系统示意图。
具体实施方式
以下，术语“第一”、“第二”仅用于描述目的，而不能理解为指示或暗示相对重要性或者隐含指明所指示的技术特征的数量。由此，限定有“第一”、“第二”的特征可以明示或者隐含地包括一个或者更多个该特征。在本实施例的描述中，除非另有说明，“多个”的含义是两个或两个以上。
以下将对本申请提到的术语进行解释。
Linux：是一个基于可移植操作系统接口(Portable Operating System Interface，POSIX)和Unix(一个操作系统的名称)的多用户、多任务、支持多线程和多中央处理器(central processing unit，CPU)的操作系统。
Linux内核：是Linux操作系统最基本的部分。可以为应用程序提供对计算机硬件资源的安全访问的软件支持。
安全增强型Linux(SELinux)：一种强制访问控制的安全系统。其中，在该系统的中的应用都是强制访问控制的应用，即应用具有访问客体的权限才可以访问对应的客体。
客体：电子设备上的软件或硬件资源，其中，软件资源可以为应用、驱动等，硬件资源可以为摄像头、传感器等。
强制访问控制(Mandatory Access Control，MAC)：电子设备中安装的应用程序在系统(如SELinux系统)中运行时，都必须在该应用的安全策略配置文件(即应用权限管理文件)中配置对应权限。也就是说，在应用权限管理文件中配置了对应的权限，则该应用程序运行时拥有对应的访问权限；否则应用程序运行时不具有对应的访 问权限。
自主访问控制(Discretionary Access Control，DAC)：电子设备中安装的应用程序的权限与控制应用程序运行的用户拥有的权限相同。例如，以root用户启动一个应用程序，该应用程序在电子设备中运行，那么这个应用程序就有root用户的权限。也就是说，该应用程序拥有root权限(根权限，即一种系统权限)，则应用在Linux系统上能干任何事情。
沙箱(Sandboxie)：是一个虚拟系统程序。在沙箱中可以运行浏览器或其他应用程序，并且在浏览器或应用程序运行完成后，沙箱可以删除因为浏览器或应用程序运行产生的变化。也就是说，沙箱创造了一个独立的作业环境，可供应用程序运行。在沙箱内部运行的程序并不能对硬盘产生永久性的影响。
进程：电子设备中的应用程序关于某数据集合的一次运行活动。是系统进行资源分配和调度的基本单位，是操作系统结构的基础。其中，电子设备上的程序可以是指令、数据及其组织形式的描述，进程是程序的实体。
安全上下文：也可以称为安全标签。在Selinux中，是附件在对象上的标签。安全上下文可以标明Selinux的用户标识，SELinux角色，类型和安全级别等。
Android是一种基于Linux的操作系统。Android可以应用于电子设备上，该电子设备可以是手机、平板电脑和计算机等。其中，Android的安全模型是一部分应用程序(或称为应用)可以运行在沙箱中，即每个应用程序都运行在对应的沙箱中。Android可以使用SELinux中的MAC管理电子设备中所有的应用程序的运行。应用自己的沙箱中运行时，SELinux中的DAC和MAC定义了沙箱的界限，也就是说，应用在沙箱运行时DAC和MAC共同确定了应用可以穿透沙箱访问的客体资源。
可以理解的，SEAndroid是一种基于安全策略的MAC安全系统。安全策略是建立在对象的安全上下文(安全标签)的，对象包括主体和客体。
一般而言，应用权限管理如图1所示，包括主体、客体、操作和权限控制。其中，主体可以是进程，也可以是应用。以主体是应用为例，主体的属性可以包括：UID(该应用的用户标识)，包名(应用的名字)，签名(如果应用是系统安装的应用，该应用的签名即为系统应用)，声明的权限和申请的权限。客体就是主体要访问的资源，客体可以包括：公共文件(如：相册、音视频文件等)，系统资源(通信录、位置、相机、麦克风等)，应用(如业务之间的资源共享等)以及私有文件(如聊天记录文件等)。操作是主体调用客体的过程。权限策略是主体可以调用客体的权限。
如图1中，主体中可以包括应用A、应用B、服务A和进程A。应用A属于主体分类A，应用B属于主体分类C，服务A和进程A属于主体分类B。
示例一：当应用A想要调用客体中的资源A时，应用A运行后执行操作A。权限策略查询应用A的权限，并确定应用A可以调用客体中的资源A。则操作A被执行，应用A调用客体中的资源A。
示例二：当应用B想要调用客体中的资源D，应用B运行后执行操作C。权限策略查询应用B的权限，并确定应用B可以调用客体中的资源D。则操作C被执行，应用B调用客体中的资源D。
电子设备如果是Android系统，其应用权限管理如图2所示。该访问控制模型包 括主体、客体和安卓架构。如图2中，电子设备接收到用户的操作，主体想要调用客体中的资源。安卓框架中包括访问控制、权限管理以及UID和权限对应表。电子设备在执行主体调用客体中的资源时，访问控制向权限管理查询该用户的UID是否具有调用客体资源的权限。权限管理调用UID和权限对应表以确定该UID的权限，如果该用户对应的UID具有该权限，则主体可以调用客体的资源。
上述图1和图2所示的为现有的Android系统中的应用权限管理，都是应用于单设备的。以图2中Android系统的应用权限管理为例，这种应用权限管理中的检查权限(check Permission)是通过UID进行检查的。即上述的，查询主体对应的UID是否具有调用客体的权限。
可以理解的，分布式系统可以由一组独立的电子设备组成一个整体，这组独立的电子设备组成的像是一个完整的系统。而且，系统中存在一个以全局的方式管理计算机资源的分布式操作系统。通常，对于用户而言，在分布式系统中只有一个模型(或称为范型)。有多个电子设备组成的系统中有一层软件中间件(middleware)负责实现这个模型。例如，万维网(World Wide Web，WWW)就是分布式系统，在万维网中，所有的一切看起来就好像是一个文档(或网页页面)一样。
如果多个电子设备组成分布式系统，分布式系统中可以跨设备调用客体。也就是说，第一设备上的应用可以调用第二设备上的客体。在这种跨设备调用的过程中，调用第二设备上的客体的应用是来自第一设备的。其中，第一设备上的用户标识与第二设备上的用户标识可能相同也可能不同；假设两个设备上的用户标识相同，第一设备和第二设备上该应用的权限设置也可能是不同的。由于应用没有安装在第二设备上，第二设备上的检查权限不能确定该应用在第二设备上的权限，会使得第一设备的应用无法直接调用第二设备上的客体。在这种情况下，为了避免这种无法调用的情况出现，可以修改分布式系统中检查权限的使用方法。但是，这种修改涉及整个分布式系统上大量的应用和服务都要修改，不易实现。
本申请实施例提供一种权限复用方法，可以解决分布式系统中跨设备调用客体时，应用权限的同步问题。本申请实施例中，在分布式系统中，第一设备与第二设备建立连接之后，第一设备可以向第二设备发送控制信息。第二控制信息中可以包括第一设备的设备标识、多个应用的UID和多个应用的权限信息。第二设备响应于该控制信息，创建一个虚拟机。这个虚拟机包括设备标识和多个应用的UID，第二设备中保存虚拟机与第一设备中多个应用的权限信息的对应关系。如此，当第一设备上的应用访问第二设备上的客体时，第一设备的应用访问第二设备的虚拟机，通过虚拟机执行检查权限以确定第一设备上的应用是否可以调用第二设备的客体。由此一来，就不需要调整每个设备上的检查权限的方法，也不需要对分布式系统上的大量服务进行修改。
其中，上述权限复用的方法可以应用于Linux内核开发出的操作系统建立的分布式系统。本申请实施例中，以电子设备上的操作系统是Android系统为例。也就是说，该电子设备上安装的系统可以是Android系统也可以是非Android系统。
示例性的，本申请实施例中的电子设备可以是手机、平板电脑、桌面型、膝上型、手持计算机、笔记本电脑、车载设备、超级移动个人计算机(ultra-mobile personal computer，UMPC)、上网本，以及蜂窝电话、个人数字助理(personal digital assistant， PDA)、增强现实(augmented reality，AR)\虚拟现实(virtual reality，VR)设备等，本申请实施例对该电子设备的具体形态不作特殊限制。
需要说明的，本申请实施例以电子设备中安装Android系统为例，对本申请实施例中的技术方案进行说明。以下将结合附图，对本申请实施例中的技术方案进行说明。
请参考图3，为本申请实施例提供的一种电子设备200的结构示意图。如图3所示，该电子设备200可以包括处理器210，外部存储器接口220，内部存储器221，通用串行总线(universal serial bus，USB)接口230，充电管理模块240，电源管理模块241，电池242，天线1，天线2，移动通信模块250，无线通信模块260，音频模块270，传感器模块280，摄像头293和显示屏294等。
可以理解的是，本发明实施例示意的结构并不构成对电子设备200的具体限定。在本申请另一些实施例中，电子设备200可以包括比图示更多或更少的部件，或者组合某些部件，或者拆分某些部件，或者不同的部件布置。图示的部件可以以硬件，软件或软件和硬件的组合实现。
处理器210可以包括一个或多个处理单元，例如：处理器210可以包括应用处理器(application processor，AP)，调制解调处理器，图形处理器(graphics processing unit，GPU)，图像信号处理器(image signal processor，ISP)，控制器，存储器，视频编解码器，数字信号处理器(digital signal processor，DSP)，基带处理器，和/或神经网络处理器(neural-network processing unit，NPU)等。其中，不同的处理单元可以是独立的器件，也可以集成在一个或多个处理器中。
其中，控制器可以是电子设备200的神经中枢和指挥中心。控制器可以根据指令操作码和时序信号，产生操作控制信号，完成取指令和执行指令的控制。
处理器210中还可以设置存储器，用于存储指令和数据。在一些实施例中，处理器210中的存储器为高速缓冲存储器。该存储器可以保存处理器210刚用过或循环使用的指令或数据。如果处理器210需要再次使用该指令或数据，可从所述存储器中直接调用。避免了重复存取，减少了处理器210的等待时间，因而提高了系统的效率。
在一些实施例中，处理器210可以包括一个或多个接口。接口可以包括集成电路(inter-integrated circuit，I2C)接口，集成电路内置音频(inter-integrated circuit sound，I2S)接口，脉冲编码调制(pulse code modulation，PCM)接口，通用异步收发传输器(universal asynchronous receiver/transmitter，UART)接口，移动产业处理器接口(mobile industry processor interface，MIPI)，通用输入输出(general-purpose input/output，GPIO)接口，用户标识模块(subscriber identity module，SIM)接口，和/或通用串行总线(universal serial bus，USB)接口等。
可以理解的是，本发明实施例示意的各模块间的接口连接关系，只是示意性说明，并不构成对电子设备200的结构限定。在本申请另一些实施例中，电子设备200也可以采用上述实施例中不同的接口连接方式，或多种接口连接方式的组合。
外部存储器接口220可以用于连接外部存储卡，例如Micro SD卡，实现扩展电子设备200的存储能力。外部存储卡通过外部存储器接口220与处理器210通信，实现数据存储功能。例如将音乐，视频等文件保存在外部存储卡中。
内部存储器221可以用于存储计算机可执行程序代码，所述可执行程序代码包括 指令。处理器210通过运行存储在内部存储器221的指令，从而执行电子设备200的各种功能应用以及数据处理。内部存储器221可以包括存储程序区和存储数据区。其中，存储程序区可存储操作系统，至少一个功能所需的应用程序(比如声音播放功能，图像播放功能等)等。存储数据区可存储电子设备200使用过程中所创建的数据(比如音频数据，电话本等)等。此外，内部存储器221可以包括高速随机存取存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件，闪存器件，通用闪存存储器(universal flash storage，UFS)等。
充电管理模块240用于从充电器接收充电输入。其中，充电器可以是无线充电器，也可以是有线充电器。电源管理模块241用于连接电池242，充电管理模块240与处理器210。电源管理模块241接收电池242和/或充电管理模块240的输入，为处理器210，内部存储器221，外部存储器，显示屏294，无线通信模块260和音频模块270等供电。
电子设备200的无线通信功能可以通过天线1，天线2，移动通信模块250，无线通信模块260，调制解调处理器以及基带处理器等实现。
移动通信模块250可以提供应用在电子设备200上的包括2G/3G/4G/5G等无线通信的解决方案。移动通信模块250可以包括至少一个滤波器，开关，功率放大器，低噪声放大器(low noise amplifier，LNA)等。移动通信模块250可以由天线1接收电磁波，并对接收的电磁波进行滤波，放大等处理，传送至调制解调处理器进行解调。移动通信模块250还可以对经调制解调处理器调制后的信号放大，经天线1转为电磁波辐射出去。
无线通信模块260可以提供应用在电子设备200上的包括无线局域网(wireless local area networks，WLAN)(如无线保真(wireless fidelity，Wi-Fi)网络)，蓝牙(bluetooth，BT)，全球导航卫星系统(global navigation satellite system，GNSS)，调频(frequency modulation，FM)，近距离无线通信技术(near field communication，NFC)，红外技术(infrared，IR)等无线通信的解决方案。其中，无线通信模块260可以是集成至少一个通信处理模块的一个或多个器件。无线通信模块260经由天线2接收电磁波，将电磁波信号调频以及滤波处理，将处理后的信号发送到处理器210。无线通信模块260还可以从处理器210接收待发送的信号，对其进行调频，放大，经天线2转为电磁波辐射出去。
显示屏294用于显示图像，视频等。显示屏294包括显示面板。显示面板可以采用液晶显示屏(liquid crystal display，LCD)，有机发光二极管(organic light-emitting diode，OLED)，有源矩阵有机发光二极体或主动矩阵有机发光二极体(active-matrix organic light emitting diode的，AMOLED)，柔性发光二极管(flex light-emitting diode，FLED)，Miniled，MicroLed，Micro-oLed，量子点发光二极管(quantum dot light emitting diodes，QLED)等。在一些实施例中，电子设备200可以包括1个或N个显示屏294，N为大于1的正整数。
摄像头293用于捕获静态图像或视频。物体通过镜头生成光学图像投射到感光元件。感光元件可以是电荷耦合器件(charge coupled device，CCD)或互补金属氧化物半导体(complementary metal-oxide-semiconductor，CMOS)光电晶体管。感光元件把 光信号转换成电信号，之后将电信号传递给ISP转换成数字图像信号。ISP将数字图像信号输出到DSP加工处理。DSP将数字图像信号转换成标准的RGB，YUV等格式的图像信号。在一些实施例中，电子设备200可以包括1个或N个摄像头293，N为大于1的正整数。
数字信号处理器用于处理数字信号，除了可以处理数字图像信号，还可以处理其他数字信号。例如，当电子设备200在频点选择时，数字信号处理器用于对频点能量进行傅里叶变换等。
视频编解码器用于对数字视频压缩或解压缩。电子设备200可以支持一种或多种视频编解码器。这样，电子设备200可以播放或录制多种编码格式的视频，例如：动态图像专家组(moving picture experts group，MPEG)1，MPEG2，MPEG3，MPEG4等。
电子设备200可以通过音频模块270，以及应用处理器等实现音频功能。例如音乐播放，录音等。
音频模块270用于将数字音频信息转换成模拟音频信号输出，也用于将模拟音频输入转换为数字音频信号。音频模块270还可以用于对音频信号编码和解码。在一些实施例中，音频模块270可以设置于处理器210中，或将音频模块270的部分功能模块设置于处理器210中。
以下实施例中的方法均可以在具备上述硬件结构的电子设备中实现。
本申请实施例中的电子设备可以采用分层架构，事件驱动架构，微核架构，微服务架构，或云架构。本发明实施例以分层架构的Android系统为例，请参考图4，为Android系统的软件结构框图。
分层架构将软件分成若干个层，每一层都有清晰的角色和分工。层与层之间通过软件接口通信。在一些实施例中，将Android系统分为四层，从上至下分别为应用程序层，应用程序框架层，安卓运行时(Android runtime)和系统库，以及内核层。应用程序层可以包括一系列应用程序包。
如图4所示，应用程序包可以包括相机，图库，日历，通话，地图，导航，WLAN，蓝牙，音乐，视频，短信息等应用程序。
在一些实施例中，应用程序包中的应用运行时，可以调用电子设备上的客体资源。例如，应用程序中可以包括相机应用，当相机应用运行时，可以调用电子设备上的摄像头以获取图像信息。
应用程序框架层为应用程序层的应用程序提供应用编程接口(application programming interface，API)和编程框架。应用程序框架层包括一些预先定义的函数。
如图4所示，应用程序框架层可以包括窗口管理器，内容提供器，视图系统，电话管理器，资源管理器，通知管理器等。
窗口管理器用于管理窗口程序。窗口管理器可以获取显示屏大小，判断是否有状态栏，锁定屏幕，截取屏幕等。
内容提供器用来存放和获取数据，并使这些数据可以被应用程序访问。所述数据可以包括视频，图像，音频，拨打和接听的电话，浏览历史和书签，电话簿等。视图系统包括可视控件，例如显示文字的控件，显示图片的控件等。
视图系统可用于构建应用程序。显示界面可以由一个或多个视图组成的。例如， 包括短信通知图标的显示界面，可以包括显示文字的视图以及显示图片的视图。
电话管理器用于为电子设备提供通信功能。例如通话状态的管理(包括接通，挂断等)。资源管理器为应用程序提供各种资源，比如本地化字符串，图标，图片，布局文件，视频文件等等。
通知管理器使应用程序可以在状态栏中显示通知信息，可以用于传达告知类型的消息，可以短暂停留后自动消失，无需用户交互。比如通知管理器被用于告知下载完成，消息提醒等。通知管理器还可以是以图表或者滚动条文本形式出现在系统顶部状态栏的通知，例如后台运行的应用程序的通知，还可以是以对话窗口形式出现在屏幕上的通知。例如在状态栏提示文本信息，发出提示音，振动，指示灯闪烁等。
在本申请实施例中，应用程序框架层还可以包括通信管理器。电子设备可以通过通信管理器与其他设备建立连接。例如，第一设备通过通信模块与第二设备建立连接，第一设备通过通信模块向第二设备发送控制信息。控制信息可以包括第一设备的设备标识，多个应用的UID和多个应用的权限信息。
Android Runtime包括核心库和虚拟机。Android runtime负责安卓系统的调度和管理。核心库包含两部分：一部分是java语言需要调用的功能函数，另一部分是安卓的核心库。应用程序层和应用程序框架层运行在虚拟机中。虚拟机将应用程序层和应用程序框架层的java文件执行为二进制文件。虚拟机用于执行对象生命周期的管理，堆栈管理，线程管理，安全和异常的管理，以及垃圾回收等功能。
系统库可以包括多个功能模块。例如：表面管理器(surface manager)，媒体库(Media Libraries)，三维图形处理库(例如：OpenGL ES)，2D图形引擎(例如：SGL)等。表面管理器用于对显示子系统进行管理，并且为多个应用程序提供了2D和3D图层的融合。媒体库支持多种常用的音频，视频格式回放和录制，以及静态图像文件等。媒体库可以支持多种音视频编码格式，例如：MPEG4，H.264，MP3，AAC，AMR，JPG，PNG等。三维图形处理库用于实现三维图形绘图，图像渲染，合成，和图层处理等。2D图形引擎是2D绘图的绘图引擎。
内核层是硬件和软件之间的层。内核层至少包含显示驱动，摄像头驱动，音频驱动，传感器驱动。
请参考图5，为本申请实施例提供的一种权限复用的方法的流程图。该方法应用于分布式系统，本申请实施例以分布式系统中第一设备和第二设备实现权限复用方法为例。如图5所示，该方法包括步骤501-步骤504。
其中，分布式系统中，主体设备可以访问客体设备的客体。本申请实施例中以第一设备是主体设备，第二设备是客体设备为例说明上述权限复用的方法。
步骤501：主体设备与客体设备建立连接。
可以理解的，在该分布式系统中可以包括不止这两个设备，且分布式系统中的多个设备是互相连接的。
步骤502：主体设备向客体设备发送控制信息。
控制信息包括主体设备的第一设备标识，主体设备中多个应用的UID以及多个应用的权限信息。其中，一个应用的权限信息用于指示一个应用具备访问主体设备中哪些客体的权限。例如，主体设备中的应用包括相机，相机的权限信息包括访问主体设 备中的摄像头的权限，访问主体设备中相册的权限。
本申请实施例中，主体设备的控制信息中第一设备标识与主体设备之间存在对应关系。也就是说，主体设备访问客体设备时，主体设备可以根据第一设备识别出与主体设备对应的设备标识。为了保护主体设备的信息，第一设备标识可以不是主体设备真正的设备标识。示例性的，主体设备中有第一设备标识和第二设备标识，第一设备标识和第二设备标识均用于标识主体设备。也就是说，主体设备可以识别出第一设备标识和第二设备标识都用于标识自身，但第一设备标识与第二设备标识不同。
在一些实施例中，主体设备可以预先保留一部分的设备标识用于生成控制信息。假如主体设备向第一客体设备和第二客体设备发送控制信息，其中，主体设备向第一客体设备发送第一控制信息，主体设备向第二客体设备发送第二控制信息。第一控制信息包括主体设备的第一设备标识，第二控制信息包括主体设备的第二设备标识。第一设备标识和第二设备标识都用于标识主体设备，但第一设备标识和第二设备标识不同。
另一些实施例中，主体设备与客体设备建立连接之后，主体设备与客体设备形成分布式系统。主体设备向分布式系统中的映射模块申请保留一些设备标识，以便主体设备向客体设备发送控制信息时申请使用这些设备标识。
步骤503：客体设备接收该控制信息，并根据该控制信息创建虚拟UID，虚拟UID对应于主体设备的第一设备标识和主体设备的UID。
需要说明的是，客体设备接收到控制信息之后，并不是直接使用控制信息中的多个应用额UID，客体设备可以向系统申请一个UID与主体设备的第一设备标识形成虚拟UID。其中，客体设备虚拟UID对应于主体设备的第一设备标识和主体设备的UID。
可以理解的，主体设备与客体设备建立连接之后，主体设备向客体设备发送控制信息，客体设备根据该控制信息生成虚拟UID。这样一来，当主体设备上的应用想要访问客体设备上的客体，可以通过虚拟UID进行检查权限。也就是说，通过虚拟UID可以实现将主体设备上应用的权限同步到客体设备。
在一些实施例中，主体设备的控制信息中包括的主体设备的设备标识仅用于做远程访问的权限映射。即客体设备接收到控制信息之后根据设备标识和UID创建的虚拟UID，仅用于主体设备的远程访问。如图6所示，为客体设备通过映射形成虚拟UID示意图，主体设备将控制信息发送到客体设备，客体设备根据控制信息映射后生成本地虚拟UID。并且，在客体设备中虚拟UID和应用的权限信息存在对应关系。图示6中，以客体设备的映射表中包括UID和应用的权限信息对应关系。可以理解的，本地虚拟UID中包括主体设备标识和多个应用的UID。
如图7A所示，为客体设备根据控制信息建立虚拟UID的实施流程图。包括步骤503a-步骤503d。
步骤503a：客体设备接收到来自主体设备的控制信息。
示例性的，系统的UID映射模块为主体设备预留UID，当为主体设备预留的UID被其他客体设备申请后，客体设备申请到的UID对应于主体设备的第一设备标识和UID。
步骤503b：当客体设备接收到主体设备的控制信息之后，判断是否有第二虚拟UID对应于主体设备的设备标识和UID。若为是，执行步骤503c；若为否，执行步骤503d。
可以理解的，第二虚拟UID是客体设备之前为主体设备申请的UID。如果客体设备之前为主体设备申请过虚拟UID，则客体设备申请的虚拟UID对应于主体设备第一设备标识和UID。如果客体设备之前没有为主体设备申请过虚拟UID，则系统的UID映射模块为主体设备分配一个UID，以便客体设备的虚拟UID对应于主体设备的第一设备标识和UID。
步骤503c：客体设备更新第二虚拟UID对应的多个应用的权限信息。
其中，由于第二虚拟UID是之前申请的，为了保证主体设备权限信息与第二虚拟UID对应的权限信息一致，则需要更新第二虚拟UID对应的权限信息。
值得一提的是，客体设备如果与主体设备断开连接，则客体设备可以删除第二虚拟UID，以及删除该虚拟UID对应的应用权限。
步骤503d：客体设备向系统中的UID映射模块申请一个UID，将该UID作为第一虚拟UID。
其中，第一虚拟UID就是客体设备创建的虚拟UID。
可以理解的，客体设备中不存在第二虚拟UID，也就是说，客体设备之前没有向系统的UID映射模块为主体设备申请过UID。则客体设备为客体设备申请一个UID，客体设备将申请的UID对应于主体设备的设备标识和UID。
请参考图7B，为虚拟UID的映射框图示意。如图7B中，包括步骤701-步骤707。其中，步骤705-步骤706是分布式系统创建之后就可以执行的。步骤701-步骤702是客体设备创建虚拟UID的过程，在客体设备接收到控制信息之后执行的。
其中，步骤701-步骤702对应于上述步骤503b，上述步骤705和步骤706对应于上述步骤503a，步骤703对应于步骤503c，步骤707对应于步骤503d。为了避免重复，不予赘述。
步骤504：客体设备保存控制信息中多个应用的权限信息，以及虚拟UID对应于多个应用的权限信息。
其中，客体设备创建虚拟UID，并同步保存主体设备中应用的权限信息。这样，当主体设备中的应用运行，访问客体设备中的客体，客体设备可以根据同步的权限信息进行检查权限，以便确定该应用是否可以访问对应客体。
其中，第一虚拟UID对应于主体设备的设备标识和UID。由此一来，当主体设备中的应用想要访问客体设备中的客体时，可以通过第一虚拟UID访问客体设备，从而实现主体设备的检查权限复用至客体设备的目的。而且，客体设备不需要改变检查权限的方法。
在一些实施例中，主体设备在于客体设备建立连接之后，每当主体设备上安装了应用，都可以将该应用的权限信息同步至客体设备。示例性的，当分布式系统的一个设备安装应用时，可以将该应用的权限信息同步至分布式系统中其他设备上，以便分布式系统中的设备可以跨设备调用客体设备上的资源。
请参考图7B，为主体设备安装应用(application，APP)同步APP权限的示意框图。其中，主体设备中包括策略库，策略库中可以包括主体设备上安装的全部应用的权限信息。客体设备中也可以包括策略库，策略库中包括有客体设备上安装的应用的权限信息，以及与虚拟UID对应的权限信息。如图7B所示，客体设备中还可以包括 UID映射模块，客体设备上创建的虚拟UID对应于主体设备。其中，主体设备的第一设备标识表示为DeviceID。
如果主体设备上的应用要访问主体设备上的客体，检查权限查询该应用对一个的UID是否具有访问该课题的权限。检查权限确定该应用可以访问该客体，则应用可以访问该客体。通过上述权限复用方法，客体设备为主体设备建立虚拟UID，虚拟UID对应于主体设备的设备标识和主体设备中的UID。当主体设备上的应用访问客体设备上的客体时，检查权限查询虚拟UID对应的应用权限，以确定虚拟UID对应的应用权限可以访问该资源，则主体设备上的应用可以访问客体设备上的客体。也就是说，在分布式系统中，实现了跨设备调用客体。主体设备可以直接访问客体设备上的客体，并且不需要修改检查权限的方法，实现了分布式系统中的权限同步。
请参考图8，为本申请实施例提供的基于权限复用的资源访问方法流程图，该方法应用于分布式系统。其中，以分布式系统中主体设备上的应用调用客体设备上的客体为例。该方法包括步骤801-步骤805。
步骤801：主体设备向客体设备发送访问请求。
其中，该访问请求用于请求由主体设备中的应用访问客体设备中的第一客体，访问请求中包括主体设备的第一设备标识和第一应用的UID。也就是说，第一客体是客体设备中的软件或硬件资源。
步骤802：客体设备接收到来自主体设备的访问请求。
可以理解的，客体设备在与主体设备建立连接之后，客体设备中创建虚拟UID。虚拟UID对应于主体设备的第一设备标识和多个应用的UID，则主体设备上的检查权限方法可以直接应用于客体设备。实现主体设备权限复用在客体设备。
步骤803：客体设备响应于访问请求，从保存的虚拟身份标识中查询第一虚拟身份标识，第一虚拟身份标识对应于主体设备的第一设备标识和第一应用的UID。
可以理解的，客体设备中的检查权限根据应用的访问的客体，以及该应用的UID查询该应用的权限。则在分布式系统中，不需要大量改变设备和服务的检查权限的方法就可以实现跨设备调用客体。
步骤804：客体设备从权限信息中查询该第一虚拟身份标识对应的第一权限信息。
客体设备查询第一虚拟身份标识，使得主体设备中的应用调用客体设备中的客体时，可以通过检查权限实现。
步骤805：客体设备根据第一权限信息所指示第一应用的权限，为第一应用提供第一资源的访问服务。
具体地说，客体设备的检查权限在查询第一应用的权限之后，如果第一应用的权限指示第一应用可以访问第一资源，则为主体设备提供访问第一资源的访问服务。如果第一应用的权限指示第一应用不可以访问第一资源，则客体设备拒绝第一应用访问第一资源的访问服务。
请参考图9，为主体设备上的第一应用访问客体设备的访问示意框图。如图9中，主体设备中的第一应用运行时发起访问，即主体设备运行第一进程。客体响应于主体设备的访问请求，即客体设备执行第二进程。客体设备为第二进程提供服务，将主体设备中的设备标识和该应用的UID发送至客体设备。客体设备执行第二进程，使得客 体设备执行检查权限，以查询第一应用在客体设备的权限信息。
本申请实施例提供一种分布式系统，如图10所示。如图10中，分布式平台包括多个电子设备，如主体设备101和客体设备102。可以理解的，分布式系统中可以包括多个主体设备101和多个客体设备102。此处不做限定。
主体设备包括：存储器和处理器。主体设备中可以包括多个处理器，存储器和处理器耦合。存储器用于存储计算机程序代码，计算机程序代码包括计算机指令，当处理器执行主体设备中的计算机指令时，使主体设备可以执行图所示的方法。
客体设备包括：存储器和处理器。客体设备中可以包括多个处理器，存储器和处理器耦合。存储器用于存储计算机程序代码，计算机程序代码包括计算机指令，当处理器执行客体设备中的计算机指令时，使客体设备可以执行图所示的方法。
本申请实施例还提供一种计算机可读存储介质，该计算机可读存储介质中存储有计算机程序代码，当上述处理器执行该计算机程序代码时，电子设备执行图5、图7A或图8中任一附图中的相关方法步骤实现上述实施例中的方法。
本申请实施例还提供了一种计算机程序产品，当该计算机程序产品在计算机上运行时，使得计算机执行图5、图7A或图8中任一附图中的相关方法步骤实现上述实施例中的方法。
其中，本申请实施例提供的电子设备、计算机存储介质或者计算机程序产品均用于执行上文所提供的对应的方法，因此，其所能达到的有益效果可参考上文所提供的对应的方法中的有益效果，此处不再赘述。
本申请实施例可以根据上述方法示例对上述设备等进行功能模块的划分，例如，可以对应各个功能划分各个功能模块，也可以将两个或两个以上的功能集成在一个处理模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。需要说明的是，本发明实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
通过以上的实施方式的描述，所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将装置的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。上述描述的系统，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请实施例各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请实施例的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)或处理器执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：快闪存储器、移动硬盘、只读存储器、随机存取存储器、磁碟或者光盘等各种可以存储程序代码的 介质。
以上内容，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何在本申请揭露的技术范围内的变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (20)

  1. 一种权限复用方法，其特征在于，应用于分布式系统，所述分布式系统包括第一设备和第二设备，所述第一设备中包括多个应用，所述方法包括：
    所述第一设备向所述第二设备发送控制信息；其中，所述控制信息包括所述第一设备的第一设备标识、所述多个应用的用户标识和所述多个应用的权限信息；一个应用的权限信息用于指示所述一个应用具备访问所述第一设备中哪些客体的权限，所述第一设备中的客体包括所述第一设备中的软件或硬件资源；
    所述第二设备接收所述控制信息，并根据所述控制信息创建所述第一虚拟身份标识，所述第一虚拟身份标识包括所述第一设备的第一设备标识和所述多个应用的用户标识；
    所述第二设备保存所述第一虚拟身份标识、所述多个应用的权限信息，以及所述第一虚拟身份标识与所述多个应用的权限信息的对应关系。
  2. 根据权利要求1所述的方法，其特征在于，所述多个应用包括第一应用；所述方法还包括：
    所述第一设备运行所述第一应用时，向所述第二设备发送访问请求；其中，所述访问请求用于请求由所述第一应用访问所述第二设备中的第一客体，所述第一客体是所述第二设备中的软件或硬件资源；所述访问请求中包括所述第一设备的第一设备标识和所述第一应用的用户标识；
    所述第二设备接收所述访问请求；
    响应于所述访问请求，所述第二设备从所述第二设备保存的虚拟身份标识中，查询第一虚拟身份标识，所述第一虚拟身份标识与所述访问请求中包括的所述第一设备的第一设备标识和所述第一应用的用户标识对应；
    所述第二设备从所述第二设备保存的权限信息中，查询与所述第一虚拟身份标识对应的第一权限信息；
    所述第二设备根据所述第一权限信息所指示的权限，为所述第一应用提供所述第一资源的访问服务。
  3. 根据权利要求1或2所述的方法，其特征在于，所述第一设备还包括第二设备标识，所述第一设备标识与所述第二设备标识均用于标识所述第一设备，但所述第一设备标识与所述第二设备标识不同。
  4. 根据权利要求1-3中任一项所述的方法，其特征在于，在所述第一设备向所述第二设备发送控制信息之前，所述方法还包括：
    所述第一设备与所述第二设备建立连接。
  5. 根据权利要求4所述的方法，其特征在于，所述方法还包括：
    如果所述第一设备与所述第二设备断开连接，所述第二设备删除所述第一虚拟身份标识和所述第一虚拟身份标识对应的所述多个应用的权限信息。
  6. 根据权利要求1-5中任一项所述的方法，其特征在于，在所述第二设备接收所述控制信息之后，所述根据所述控制信息创建所述第一虚拟身份标识之前，所述方法还包括：
    所述第二设备判断所述第二设备中是否保存有第二虚拟身份标识，所述第二虚拟 身份标识中的设备标识与所述控制信息包括的所述第一设备标识对应；
    其中，所述根据所述控制信息创建所述第一虚拟身份标识，包括：
    若所述第二设备中未保存所述第二虚拟身份标识，所述第二设备根据所述控制信息创建所述第一虚拟身份标识；
    若所述第二设备中保存所述第二虚拟身份标识，所述第二设备根据所述控制信息中的多个应用的权限信息，更新所述第二虚拟身份标识对应的所述多个应用的权限信息。
  7. 根据权利要求1-6中任一项所述的方法，其特征在于，所述第一设备和所述第二设备的操作系统是基于Linux内核开发的。
  8. 根据权利要求1-7中任一项所述的方法，其特征在于，所述第二设备根据所述控制信息创建所述第一虚拟身份标识，包括：
    所述第二设备根据所述控制信息创建虚拟机，所述虚拟机对应于所述第一设备，其中，所述虚拟机的设备标识为所述第一设备的设备标识，所述虚拟机的用户标识为所述第一设备中多个应用的用户标识。
  9. 一种权限复用方法，其特征在于，应用于分布式系统，所述方法包括：
    第二设备接收来自第一设备的控制信息，其中，所述控制信息中包括第一设备的第一设备标识、多个应用的用户设备和多个应用的权限信息；一个应用的权限信息用于指示一个应用具备访问第一设备中哪些客体的权限，所述第一设备中的客体包括所述第一设备中的软件或硬件资源；
    所述第二电子设备根据所述控制信息创建所述第一设备的虚拟身份标识，所述虚拟身份标识包括第一设备的第一设备标识和所述多个应用的用户标识；
    所述第二设备保存所述虚拟身份标识、所述多个应用的权限信息，以及虚拟身份标识与所述多个应用的权限信息的对应关系。
  10. 根据权利要求9所述的方法，其特征在于，所述方法还包括：
    所述第二设备接收来自第一设备的访问请求，其中，所述访问请求用于请求由第一应用访问所述第二设备中的第一客体，所述第一客体是所述第二设备中的软件或硬件资源；所述访问请求中包括第一设备的第一设备标识和所述第一应用的用户标识；
    响应于所述请求访问，所述第二设备从所述第二设备保存的所述虚拟身份标识中，查询第一虚拟身份标识，所述第一虚拟身份标识与所述访问请求中包括所述第一设备的第一设备标识和所述第一应用的用户标识对应；
    所述第二设备从所述第二设备保存的权限信息中，查询与所述第一虚拟身份标识对应的第一权限信息；
    所述第二设备根据所述第一权限信息所指示的权限，为所述第一应用提供所述第一资源的访问服务。
  11. 根据权利要求9或10所述的方法，其特征在于，所述第二设备接收来自第一设备的控制信息之前，所述方法还包括：
    所述第二设备和所述第一设备建立连接。
  12. 根据权利要求11所述的方法，其特征在于，所述方法还包括：
    如果所述第一设备与所述第二设备断开连接，所述第二设备删除所述第一虚拟身 份标识和所述第一虚拟身份标识对应的所述多个应用的权限信息。
  13. 根据权利要求9-12任一项所述的方法，其特征在于，所述第二设备接收来自第一设备的控制信息之后，所述第二电子设备根据所述控制信息创建所述第一设备的虚拟身份标识之前，所述方法还包括：
    所述第二设备判断所述第二设备中是否保存有第二虚拟身份标识，所述第二虚拟身份标识中的设备标识与所述控制信息包括的第一设备标识对应；
    其中，所述根据所述控制信息创建所述第一虚拟身份标识，包括：
    若所述第二设备中未保存所述第二虚拟身份标识，所述第二设备根据所述控制信息创建所述第一虚拟身份标识；
    若所述第二设备中保存所述第二虚拟身份标识，所述第二设备根据所述控制信息中的多个应用的权限信息，更新所述第二虚拟身份标识对应的所述多个应用的权限信息。
  14. 根据权利要求9-13任一项所述的方法，其特征在于，所述第二设备根据所述控制信息创建所述第一虚拟身份标识，包括：
    所述第二设备根据所述控制信息创建虚拟机，所述虚拟机对应于所述第一设备，其中，所述虚拟机的设备标识为所述第一设备的设备标识，所述虚拟机的用户标识为所述第一设备中多个应用的用户标识。
  15. 根据权利要求9-14中任一项所述的方法，其特征在于，所述第二设备的操作系统是基于Linux内核开发的。
  16. 一种基于权限复用的资源访问方法，其特征在于，应用于分布式系统，所述分布式系统包括第一设备和第二设备，所述第一设备中包括多个应用，所述多个应用包括第一应用所述方法包括：
    所述第二设备接收来自第一设备的访问请求；其中，所述访问请求用于请求由所述第一应用访问所述第二设备中的第一客体，所述第一客体是所述第二设备中的软件或硬件资源；所述访问请求中包括所述第一设备的第一设备标识和所述第一应用的用户标识；
    响应于所述访问请求，所述第二设备从所述第二设备保存的虚拟身份标识中，查询第一虚拟身份标识，所述第一虚拟身份标识与所述访问请求中包括的所述第一设备标识和所述第一应用的用户标识对应；
    所述第二设备从所述第二设备保存的权限信息中，查询与所述第一虚拟身份标识对应的第一权限信息；
    所述第二设备根据所述第一权限信息所指示的权限，为所述第一应用提供所述第一资源的访问服务；
    其中，所述第二设备中保存有基于多个设备创建的虚拟身份标识和每个设备中各个应用的权限信息，所述多个设备包括所述第一设备，基于所述第一设备创建的虚拟身份标识包括所述第一设备标识和所述多个应用的用户标识，所述第一设备中一个应用的权限信息用于指示所述一个应用具备访问所述第一设备中哪些客体的权限。
  17. 一种电子设备，其特征在于，所述电子设备是第一设备，所述第一设备包括：存储器和一个或多个处理器；所述存储器和所述处理器耦合；
    其中，所述存储器用于存储计算机程序代码，所述计算机程序代码包括计算机指令，当所述处理器执行所述计算机指令时，使所述电子设备执行如权利要求1-8中任一项所述的方法。
  18. 一种电子设备，其特征在于，所述电子设备是第二设备，所述第二设备包括：存储器和一个或多个处理器；所述存储器和所述处理器耦合；
    其中，所述存储器用于存储计算机程序代码，所述计算机程序代码包括计算机指令，当所述处理器执行所述计算机指令时，使所述电子设备执行如权利要求9-16中任一项所述的方法。
  19. 一种分布式系统，其特征在于，包括：如权利要求17所述的第一设备，以及和如权利要求18所述的第二设备。
  20. 一种计算机可读存储介质，其特征在于，包括计算机指令，当所述计算机指令在电子设备上运行时，使得所述电子设备执行如权利要求1-16任一项所述的方法。
PCT/CN2020/125970 2020-02-28 2020-11-02 权限复用方法、基于权限复用的资源访问方法及相关设备 WO2021169379A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP20922437.7A EP4095723B1 (en) 2020-02-28 2020-11-02 Permission reuse method, permission reuse-based resource access method, and related device
US17/802,748 US20230082375A1 (en) 2020-02-28 2020-11-02 Permission Reuse Method, Permission Reuse-Based Resource Access Method, and Related Device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010131670.2 2020-02-28
CN202010131670.2A CN113326498B (zh) 2020-02-28 2020-02-28 权限复用方法、基于权限复用的资源访问方法及相关设备

Publications (1)

Publication Number Publication Date
WO2021169379A1 true WO2021169379A1 (zh) 2021-09-02

Family

ID=77412891

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/125970 WO2021169379A1 (zh) 2020-02-28 2020-11-02 权限复用方法、基于权限复用的资源访问方法及相关设备

Country Status (4)

Country Link
US (1) US20230082375A1 (zh)
EP (1) EP4095723B1 (zh)
CN (1) CN113326498B (zh)
WO (1) WO2021169379A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114578937B (zh) * 2022-05-05 2022-08-02 北京远特科技股份有限公司 电源管理方法、嵌入式系统及电子设备
CN116049911B (zh) * 2023-04-03 2023-06-30 上海钐昆网络科技有限公司 设备标识的生成方法、装置、设备及计算机存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106022128A (zh) * 2016-05-13 2016-10-12 北京奇虎科技有限公司 用于检测进程访问权限的方法、装置及移动终端
CN106156605A (zh) * 2016-06-14 2016-11-23 百度在线网络技术（北京）有限公司 应用权限的处理方法及装置
CN108319496A (zh) * 2017-01-18 2018-07-24 阿里巴巴集团控股有限公司 资源访问方法、业务服务器、分布式系统及存储介质
US20180343111A1 (en) * 2017-05-24 2018-11-29 Red Hat, Inc. Supporting distributed ledgers in a micro-services environment

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8051459B2 (en) * 2007-01-26 2011-11-01 Samsung Electronics Co. Ltd. Method and system for extending SELinux policy models and their enforcement
CN103001982B (zh) * 2011-09-09 2017-04-26 华为技术有限公司 一种实时共享方法、装置及系统
US8885827B2 (en) * 2012-10-16 2014-11-11 Cambridge Silicon Radio Limited System and method for enabling a host device to securely connect to a peripheral device

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106022128A (zh) * 2016-05-13 2016-10-12 北京奇虎科技有限公司 用于检测进程访问权限的方法、装置及移动终端
CN106156605A (zh) * 2016-06-14 2016-11-23 百度在线网络技术（北京）有限公司 应用权限的处理方法及装置
CN108319496A (zh) * 2017-01-18 2018-07-24 阿里巴巴集团控股有限公司 资源访问方法、业务服务器、分布式系统及存储介质
US20180343111A1 (en) * 2017-05-24 2018-11-29 Red Hat, Inc. Supporting distributed ledgers in a micro-services environment

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4095723A4

Also Published As

Publication number Publication date
CN113326498B (zh) 2023-11-17
EP4095723B1 (en) 2024-04-24
EP4095723A4 (en) 2023-07-19
EP4095723A1 (en) 2022-11-30
CN113326498A (zh) 2021-08-31
US20230082375A1 (en) 2023-03-16

Similar Documents

Publication Publication Date Title
US11853820B2 (en) Cross-process communication method, apparatus, and device
WO2021013019A1 (zh) 一种图片处理方法及装置
WO2022199509A1 (zh) 应用执行绘制操作的方法及电子设备
WO2021169379A1 (zh) 权限复用方法、基于权限复用的资源访问方法及相关设备
CN113032766B (zh) 应用权限管理的方法和装置
WO2023051355A1 (zh) 权限检查的方法和电子设备
WO2019015491A1 (zh) 应用程序的分身方法、装置、设备和介质
CN116257262A (zh) 内核升级方法、芯片、电子设备及计算机可读存储介质
WO2022121445A1 (zh) 添加widget的方法、装置及计算机可读存储介质
CN116048771B (zh) 一种资源调度方法及相关设备
WO2023005751A1 (zh) 渲染方法及电子设备
WO2020062192A1 (zh) 一种操作控制方法及电子设备
US20230350738A1 (en) Method for Reusing Shared Library and Electronic Device
WO2021238376A1 (zh) 功能包的加载方法、装置、服务器和电子设备
CN116136826A (zh) 内存访问方法、芯片、电子设备及计算机可读存储介质
WO2020147859A1 (zh) 分散式重锁降级
CN115981576B (zh) 共享数据的方法、电子设备及存储介质
CN116662270B (zh) 文件解析方法及相关装置
WO2024067053A1 (zh) 一种应用程序安装方法及电子设备
WO2022155848A1 (zh) 虚拟机性能优化的方法及相关装置
WO2023185684A1 (zh) 一种应用程序的进程查杀方法及电子设备
WO2023077975A1 (zh) 文件迁移方法、电子设备及存储介质
WO2023284625A1 (zh) 应用的跨平台显示方法、可读介质和电子设备
WO2024083114A1 (zh) 一种软件分发方法、电子设备及系统
CN116795557A (zh) 通信方法、电子设备及可读存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20922437

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2020922437

Country of ref document: EP

Effective date: 20220825

NENP Non-entry into the national phase

Ref country code: DE