WO2021238399A1 - 安全访问数据的方法及电子设备 - Google Patents

安全访问数据的方法及电子设备 Download PDF

Info

Publication number
WO2021238399A1
WO2021238399A1 PCT/CN2021/084452 CN2021084452W WO2021238399A1 WO 2021238399 A1 WO2021238399 A1 WO 2021238399A1 CN 2021084452 W CN2021084452 W CN 2021084452W WO 2021238399 A1 WO2021238399 A1 WO 2021238399A1
Authority
WO
WIPO (PCT)
Prior art keywords
electronic device
service
authority
stub
rights
Prior art date
Application number
PCT/CN2021/084452
Other languages
English (en)
French (fr)
Inventor
邱泽令
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2021238399A1 publication Critical patent/WO2021238399A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/102—Entity profiles
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general

Definitions

  • This application relates to the field of electronic technology, and in particular to a method and electronic equipment for securely accessing data.
  • a common data security access strategy is generally to authenticate communication devices and application users, and then encrypt content and communication channels.
  • the cloud authentication server In the near-field interaction scenario of multiple terminal devices in a distributed network system, although it is possible to use the cloud authentication server to complete the authentication of the terminal device and the user.
  • the cloud authentication server In a distributed network system, when communicating across devices, only relying on the authentication of terminal devices and users cannot meet the requirements for data security, and cannot meet the security requirements for accessing data in different scenarios.
  • This application provides a method and electronic device for securely accessing data.
  • the method can restrict the ability of the service requesting device to access the process of the service providing device, thereby restricting the remote electronic device process in the distributed network system to the service of the local electronic device Process access improves the security of the distributed network system at the process level, reduces the strength of the dependence of security requirements on the network, and makes the network configuration more flexible.
  • a method for securely accessing data is provided, which is applied to a distributed network system including a first electronic device and a second electronic device.
  • the method includes: the first electronic device sends the first electronic device to the second electronic device.
  • the request of the service process, the first service process is the process corresponding to the application with distributed capabilities on the second electronic device; the second electronic device determines that the access interface of the first service process corresponds to the request of the first service process The first rights stub object and the rights object policy of the first rights stub object;
  • the second electronic device sends the first rights stub object and the rights object policy of the first rights stub object to the first electronic device;
  • the first electronic device generates the first permission proxy object and the permission object policy of the first permission proxy object according to the first permission stub object and the permission object policy of the first permission stub object; the first electronic device generates the first permission proxy object and the permission object policy of the first permission proxy object according to the first permission
  • first electronic device and the second electronic device are any two different electronic devices in the distributed network system.
  • the first electronic device is the service application device in the embodiment of the present application
  • the second electronic device is the service providing device in the embodiment of the present application.
  • the same electronic device can be used as a service requesting device or as a service providing device.
  • the process provided by the service providing device can be referred to as the "service process”
  • the process provided by the service application device can be referred to as the "application process”.
  • an application process of the first electronic device needs to access the function of the first service process of the second electronic device, it needs to pass the check of the permission object bound to the process before it can normally access the function or resource of the first service process .
  • the user's mobile phone is the service providing device
  • the home TV is the service application device
  • the home TV can apply to access the video data of the video application of the user's mobile phone through a certain video application.
  • a permission proxy solution is provided.
  • the security management module of the service providing equipment when a service process declares that it can provide distributed access capabilities to the outside world, the security management module of the service providing equipment will first be configured by the permission data module Check whether the permission object of the service process is legal and whether it can provide external capabilities normally. The security management module of the service providing device will bind the permission object to the service process, and then the service requesting device will store a reference copy in the local permission management module according to the permission object, that is, create a stub object, which is called the "permission stub" Object".
  • This authority stub object has all the capability constraints provided for the distributed network system in the authority object of the service process.
  • the process of the electronic device is used as the permission object, and a permission management solution is designed to control the process invocation permission of other electronic devices through the security management module, thereby restricting the process security of other electronic devices.
  • a permission management solution is designed to control the process invocation permission of other electronic devices through the security management module, thereby restricting the process security of other electronic devices.
  • the embodiment of the present application can also convert the permission check of the application process of the remote electronic device into the permission check of the security management module in the near-end electronic device, which further saves network resources and realizes the flexible configuration of the distributed network system.
  • the overhead of cross-device process permission management is reduced, and the efficiency of security processing is improved.
  • the embodiment of the present application adopts an object-oriented authority management method, so that the checking process of the service process authority takes place on the side of the service application device.
  • the security management module ensures the consistency of the security access strategy, so that in the ubiquitous network In this case, the dependence of security checks on the network can be effectively reduced, the application time for accessing the service process can be reduced, and the user experience can be improved.
  • the method before the first electronic device sends the request for the first service process to the second electronic device, the method further includes: the first electronic device receives access to the first electronic device.
  • the request of the service process in response to the request of the first service process, the first electronic device determines the authority of the access interface of the first service process; the first electronic device determines that there is currently no authority of the access interface of the first service process.
  • the security management module will generate its permission proxy object in the service application device according to its work flow, and then use it later (for example, not for the first time). Apply for permission to the first service process).
  • the security management module can directly query the access interface corresponding to the first service process according to the description in the structure definition of the permission stub object list and the permission proxy object list The first authority stub object is further determined the first authority proxy object.
  • the service provider device In order to prevent network interaction from failing every time, when the service provider device denies the service requesting device's access to the first service process, it can generate an anonymous empty proxy object for the failed operation, and then when such proxy object accesses, it will It keeps returning failures, thereby reducing the number of network interactions and making the network configuration more flexible.
  • the second electronic device registers N service processes, and publishes the distributed capabilities of each of the N service processes.
  • the first service The process is any one of the N service processes, and N is a positive integer;
  • the second electronic device determines the authority object policy of each service process in the N service processes according to the registered N service processes;
  • the second electronic device The device generates a list of permission stub objects according to the N service processes and the permission object policies of the N service processes.
  • the list of permission stub objects includes the information of the N permission stub objects corresponding to each service process one-to-one and the N number of permission stub objects.
  • the rights object policy of the rights stub object includes the information of the N permission stub objects corresponding to each service process one-to-one and the N number of permission stub objects.
  • the method further includes: the second electronic device according to the The request of the first service process determines that the N permission stub objects do not include the first permission stub object; the second electronic device denies the first electronic device to access the data of the first service process.
  • the network authority proxy module of the service applying device does not generate the first authority proxy object.
  • the rights object policy of the first rights stub object includes at least one of the following information: the rights requirement information and service of the first rights stub object Identification information, access interface information, operation interface information, and resource identification information.
  • the rights object policy of the first rights stub object also includes scenario constraint information, and the scenario constraint information is used to indicate different application scenarios or different scenarios.
  • the distributed capabilities of the process can be used in a limited scenario.
  • the rights object strategy of the distributed capability of the process may also be different, or in other words, the distributed capability provided by the electronic device to the outside will change with the change of the application scenario.
  • a smart speaker or smart TV will be allowed to automatically connect to the user's mobile phone and obtain video data for playback.
  • shopping malls or other public places are not allowed to automatically connect and visit, regardless of whether the security authentication has been established before, it must be processed after the user's confirmation.
  • the electronic device where the application process is located can determine that the current scene is the home scene or the company scene through conditions such as GPS or other positioning methods, or the location of the base station to which the electronic device is connected.
  • the embodiment does not limit this.
  • different rights object policies can also be set for different electronic devices.
  • the user's smart watch can access any process of the user's mobile phone in any scenario, which will not be repeated in the embodiment of the present application.
  • the rights object strategy can also be a dynamic adjustment algorithm based on environment variables, or other constraints. Module.
  • the distributed network system when restricting the access of the service requesting device to the local service providing device, it can be adaptively adjusted following the changes of the application scenario, statically or dynamically configuring different rights object policies in different scenarios, restricting Sensitive applications can only perform security-sensitive operations in relatively safe scenarios, but are restricted to use in other environments, thereby improving the security of the system.
  • the process of dynamically configuring the rights object policy can occur on the security management module of the peer electronic device, which can effectively reduce the dependence of the security policy control on the network and improve the user experience.
  • the rights object strategy of the first rights stub object is a user-defined strategy; or a strategy defined in the cloud.
  • the permission object policy for the permission stub object can be customized by the user, or separately defined in the cloud. For example, actively configure the rights object policy and store it in the electronic device where the rights stub object is located.
  • the rights object policy for the rights proxy object can be automatically synchronized between the service requesting device and the service providing device, or synchronized in the cloud.
  • passive configuration policy data that relies on actively configuring the rights object policy can be stored in the electronic device where the rights proxy object is located.
  • the security management module can ensure the timely update and synchronization of the policy of the first service process, thereby shielding the original service requesting device and the first service of the service providing device The mutual dependence of the processes on the permission policy.
  • the embodiment of this application takes the process as the authority object, designs a distributed authority object management model, and proposes a method for securely accessing data in a distributed network system, and uses the authority object proxy solution to control the service Apply for the process access capability on the device, so as to achieve the ability to restrict the access of the service application device to the process of the service providing device, thereby restricting the access of the remote electronic device process in the distributed network system to the service process of the local electronic device, and improving the distribution
  • the security of the distributed network system at the process level reduces the intensity of the dependence of the security requirements on the network and makes the network configuration more flexible.
  • a method for securely accessing data is provided, which is applied to a distributed network system including a first electronic device and a second electronic device.
  • the first electronic device stores a list of authorized proxy objects and the list of authorized proxy objects.
  • the permission object policy of each permission proxy object in the method includes: the first electronic device receives a request to access the first service process, and the first service process is a process corresponding to an application with distributed capabilities on the second electronic device
  • the first electronic device determines the first authority proxy object and the authority object policy of the first authority proxy object; the first electronic device determines the authority object policy according to the first authority proxy object and the first authority
  • the authority object strategy of the proxy object accesses the data of the first service process.
  • the authority proxy object list and the authority object policy of each authority agent object in the authority agent object list are in a one-to-one correspondence with the authority stub object stored in the second electronic device The authorization object policy of each authorization stub object in the list and the authorization proxy object list.
  • the authority stub object list stored by the second electronic device includes N authority stub objects
  • the method further includes: the second electronic device registers for N services Process, publish the distributed capabilities of each of the N service processes, the first service process is any one of the N service processes, and N is a positive integer; the second electronic device is based on the registered N services Process, determine the authority object strategy of each of the N service processes; the second electronic device generates the authority stub object list and the authority stub object list according to the N service processes and the authority object strategy of the N service processes It includes the information of the N permission stub objects corresponding to each service process one-to-one and the permission object policy of the N permission stub objects.
  • the method introduced in the second aspect above can be applied to the first electronic device not to send a request for the first service process to the second electronic device.
  • the first electronic device and the second electronic device are updated in real time.
  • Interaction authority object For example, after the authorization stub object list generated by the second electronic device and the authorization object policy of each authorization stub object in the authorization stub object list, the authorization stub object list and authorization object policy are sent to the first electronic device in real time.
  • the device can update its stored right proxy object list and the right object policy of each right proxy object in the right proxy object list in real time. Therefore, after the first electronic device receives the request of the first service process, it only needs to query its own information and does not need to send a request to the second electronic device, which simplifies the process of accessing the second electronic device process.
  • a method for securely accessing data includes: the first electronic device sends a request for a first service process to a second electronic device, and the first electronic device and the second electronic device are distributed For two different electronic devices in the network system, the first service process is a process corresponding to an application with distributed capabilities on the second electronic device; the first electronic device receives the first service process sent by the second electronic device The first permission stub object corresponding to the access interface and the permission object policy of the first permission stub object, where the first permission stub object and the permission object policy of the first permission stub object are based on the second electronic device according to the first permission stub object Determined by the request of the service process, the first electronic device generates the first permission proxy object and the permission object policy of the first permission proxy object according to the first permission stub object and the permission object policy of the first permission stub object; The electronic device determines whether the access interface of the first service process is currently allowed to be accessed according to the first authority proxy object and the authority object
  • the method before the first electronic device sends the request for the first service process to the second electronic device, the method further includes: the first electronic device receives access to the second electronic device A request for a service process; in response to a request from the first service process, the first electronic device determines the authority of the access interface of the first service process; the first electronic device determines that there is currently no access interface for the first service process Permissions.
  • the rights object policy of the first rights stub object includes at least one of the following information: rights requirement information of the first rights stub object, Service identification information, access interface information, operation interface information, and resource identification information.
  • the rights object policy of the first rights stub object also includes scenario constraint information, and the scenario constraint information is used to indicate different application scenarios or different scenarios.
  • the rights object strategy of the first rights stub object is a user-defined strategy; or a strategy defined in the cloud.
  • a method for securely accessing data includes: a second electronic device receives a request for a first service process sent by the first electronic device, and the first service process is a The process corresponding to the application of the distributed capability; the second electronic device determines the first permission stub object corresponding to the access interface of the first service process and the permission object policy of the first permission stub object according to the request of the first service process; The second electronic device sends the first permission stub object and the permission object policy of the first permission stub object to the first electronic device; when the access interface of the first service process is allowed to access, the second electronic device allows the The second electronic device accesses the data of the first service process.
  • the method further includes: the second electronic device registers with N service processes, and publishes the distributed capabilities of each of the N service processes, and the first The service process is any one of the N service processes, and N is a positive integer; the second electronic device determines the authority object strategy of each of the N service processes according to the registered N service processes; the second electronic device The device generates a list of permission stub objects according to the N service processes and the permission object policies of the N service processes.
  • the list of permission stub objects includes the information of the N permission stub objects corresponding to each service process one-to-one and the N number of permission stub objects.
  • the rights object policy of the rights stub object includes: the second electronic device registers with N service processes, and publishes the distributed capabilities of each of the N service processes, and the first The service process is any one of the N service processes, and N is a positive integer; the second electronic device determines the authority object strategy of each of the N service processes according to the registered N service processes; the second electronic device The device generates
  • the method further includes: the second electronic device according to The request of the first service process determines that the N permission stub objects do not include the first permission stub object; the second electronic device denies the first electronic device to access the data of the first service process.
  • the rights object policy of the first rights stub object includes at least one of the following information: rights requirement information of the first rights stub object, Service identification information, access interface information, operation interface information, and resource identification information.
  • the rights object policy of the first rights stub object also includes scenario constraint information, and the scenario constraint information is used to indicate different application scenarios or different scenarios.
  • the rights object strategy of the first rights stub object is a user-defined strategy; or a strategy defined in the cloud.
  • the present application provides a device included in an electronic device, and the device has the function of realizing the foregoing aspects and the behavior of the electronic device in the possible implementation manners of the foregoing aspects.
  • the function can be realized by hardware, or the corresponding software can be executed by hardware.
  • the hardware or software includes one or more modules or units corresponding to the above-mentioned functions. For example, a display module or unit, a detection module or unit, a processing module or unit, and so on.
  • the present application provides an electronic device, including: a touch display screen, wherein the touch display screen includes a touch-sensitive surface and a display; a camera; one or more processors; a memory; a plurality of application programs; and one or Multiple computer programs.
  • one or more computer programs are stored in the memory, and the one or more computer programs include instructions.
  • the electronic device is caused to execute the method for securely accessing data in any possible implementation of any one of the foregoing aspects.
  • the present application provides an electronic device including one or more processors and one or more memories.
  • the one or more memories are coupled with one or more processors, and the one or more memories are used to store computer program codes.
  • the computer program codes include computer instructions.
  • the electronic device executes A method for securely accessing data in any possible implementation of any one of the above aspects.
  • the present application provides a computer-readable storage medium, including computer instructions, which, when the computer instructions run on an electronic device, cause the electronic device to execute any one of the above-mentioned methods for securely accessing data.
  • this application provides a computer program product that, when the computer program product runs on an electronic device, enables the electronic device to execute any one of the above-mentioned methods for securely accessing data.
  • Fig. 1 is a schematic diagram of an example of a distributed network system provided by an embodiment of the present application.
  • Fig. 2 is a schematic structural diagram of an example of an electronic device provided by an embodiment of the present application.
  • Fig. 3 is a software structure block diagram of an example of an electronic device provided by an embodiment of the present application.
  • Fig. 4 is a schematic diagram of an example of a security management module provided by an embodiment of the present application.
  • Fig. 5 is a schematic diagram of an example of the structure of a rights object provided by an embodiment of the present application.
  • Fig. 6 is a schematic diagram of an example of interaction between a service applying device and a service providing device provided by an embodiment of the present application.
  • FIG. 7 is a schematic diagram of a service process of a service application device provided by an embodiment of the present application accessing a service providing device.
  • FIG. 8 is a schematic diagram of an example of restriction of a rights object policy provided by an embodiment of the present application.
  • first and second are only used for descriptive purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features. Therefore, the features defined with “first” and “second” may explicitly or implicitly include one or more of these features.
  • Ubiquitous network can literally be understood as a widespread and ubiquitous network. That is to say, people are in the ubiquitous network, to realize the information exchange between people and any person and thing at any time and place, using any network, based on the needs of individuals and society, using existing network technology and new network technology for Individuals and society provide ubiquitous, all-encompassing information services and applications.
  • the modern Internet is a huge collection of multiple types of computer networks interconnected. The types of networks have been increasing and now include a variety of wireless communication technologies. The end result is that networking has become a ubiquitous resource, and devices can be connected at any time and anywhere.
  • M2M machine-to-machine wireless data transmission
  • sensor network sensor network
  • NFC wireless local area networks
  • WLAN wireless local area networks
  • Bluetooth blue, BT
  • GNSS global navigation satellite system
  • FM frequency modulation
  • infrared technology infrared, IR
  • a distributed network is also called a mesh network, which is formed by interconnecting computer systems distributed in different locations. There is no central node in the network, and each node can communicate with each other, and the communication control function is distributed on each node.
  • Distributed network has the characteristics of high reliability and easy resource sharing among nodes in the network, and is widely used in the fields of multimedia database management, audio and video transmission, and video on demand.
  • FIG. 1 is a schematic diagram of an example of a distributed network system 100 provided by an embodiment of the present application.
  • the distributed network system 100 may include multiple electronic devices, such as device A, device B, device C, and device D and equipment E, etc.
  • the distributed network system 100 may include a mobile phone, a tablet computer, a wearable device, a vehicle-mounted device, an augmented reality (AR)/virtual reality (VR) device, a notebook computer, and a super mobile personal computer Any one or more of electronic devices (ultra-mobile personal computer, UMPC), netbooks, personal digital assistants (personal digital assistants, PDAs), etc., it should be understood that the embodiments of this application are for electronic devices included in a distributed network system.
  • the number and form of equipment are not limited.
  • any two electronic devices of the distributed network system 100 may communicate with each other in a variety of different ways, for example, through a connection or by means of a future communication technology to communicate to transmit data.
  • the connection mode may include multiple different connection modes such as wired connection or wireless connection.
  • the two electronic devices may be connected by a USB data cable; the wireless connection between the two electronic devices may be by establishing a Wi-Fi connection, a proximity connection of near field communication, a Bluetooth scan code connection, and the like.
  • Two electronic devices can also use future communication technology, for example, by installing different or the same applications on mobile phones and tablets, and transmitting data by means of 5G communication networks. Or the communication method is not limited.
  • the current measures to ensure data security in the communication process can be listed as shown in Table 1. As shown in Table 1 below, for different communication entities, communication content or communication channels, different security measures can be corresponding to improve the security of data access in the distributed network system.
  • the cloud authentication server can be used to complete device authentication and user authentication.
  • the security access strategy is generally based on device authentication/account authentication. If the application passes the authentication, it can be considered that multiple electronic devices trust each other, and the application on one electronic device You can access the process on another electronic device and access the resources on the original device through this process.
  • the device authentication process it can be used in the authentication process of this device to other devices. For example, after the device receives the device name sent by the other device, the device can determine whether the device and the other device belong to the device under the same account according to the device name of the other device.
  • user 1 applies for a Huawei account
  • the cloud authentication server verifies that the account is logged in to the user’s mobile phone, tablet, and home TV, so that data sharing between the mobile phone, tablet, and home TV can be realized, such as through The home TV accesses the video resources on the mobile phone.
  • a gateway function is set in the service provider or routing node to check and filter the authority of the service applicant, thereby achieving the effect of restricting the service applicant's access to the service provider's resources.
  • the permission check is performed on the service provider, and in the ubiquitous network, multiple lightweight electronic devices will be added, which will slow down the impact of the routing node where the service provider is located and affect the user experience.
  • the embodiments of the present application provide a method for securely accessing data, which can be applied to electronic devices.
  • the method can be a separate application program.
  • the application program can be applied to any electronic device in a distributed network system to improve data access. Security Level.
  • the method for securely accessing data provided in the embodiments of the present application can be applied to electronic devices such as mobile phones, tablet computers, wearable devices, in-vehicle devices, laptop computers, and tablets listed above. There are no restrictions on the type.
  • FIG. 2 is a schematic structural diagram of an example of an electronic device 200 provided in an embodiment of the present application.
  • the electronic device 200 may include a processor 210, a memory 220, a communication module 230, a display screen 240, and the like.
  • the processor 210 may include one or more processing units, and the memory 220 is used to store program codes and data. In the embodiment of the present application, the processor 210 can execute computer-executable instructions stored in the memory 220 for controlling and managing the actions of the electronic device 200.
  • the communication module 230 may be used for communication between various internal modules of the electronic device 200, or communication between the electronic device 200 and other external electronic devices, or the like. Exemplarily, if the electronic device 200 communicates with other electronic devices through a wired connection, the communication module 230 may include an interface, such as a USB interface.
  • the USB interface may be an interface that complies with the USB standard specification, specifically, it may be a Mini USB interface, Micro USB interface, etc. USB interface, USB Type C interface, etc.
  • the USB interface can be used to connect a charger to charge the electronic device 200, and can also be used to transfer data between the electronic device 200 and peripheral devices. It can also be used to connect earphones and play audio through earphones.
  • the interface can also be used to connect other electronic devices, such as AR devices.
  • the communication module 230 may include an audio device, a radio frequency circuit, a Bluetooth chip, a wireless fidelity (Wi-Fi) chip, a near-field communication (NFC) module, etc., and may be implemented by various The interaction between the electronic device 200 and other electronic devices is realized in a manner.
  • Wi-Fi wireless fidelity
  • NFC near-field communication
  • the display screen 240 is used to display images, videos, and the like.
  • the electronic device 200 may also include a peripheral device 250, such as a mouse, a keyboard, a speaker, a microphone, and so on.
  • the embodiment of the present application does not specifically limit the structure of the electronic device 200.
  • the electronic device 200 may also include more or fewer components than shown, or combine certain components, or split certain components, or arrange different components.
  • the illustrated components can be implemented in hardware, software, or a combination of software and hardware.
  • the software system of the electronic device 200 may adopt a layered architecture, an event-driven architecture, a microkernel architecture, a microservice architecture, or a cloud architecture.
  • the embodiment of the present application takes an Android system with a layered architecture as an example to illustrate the software structure of the electronic device 200.
  • FIG. 3 is an example of a software structure block diagram of an electronic device 200 provided by an embodiment of the present application.
  • the layered architecture 300 divides the software into several layers, and each layer has a clear role and division of labor. Communication between layers through software interface.
  • the Android system is divided into four layers, from top to bottom, the application layer 310, the application framework layer 320, the kernel layer 330, and the network layer 340, respectively.
  • the application layer may include a series of application packages.
  • the application package can include applications such as camera, gallery, music, video, and settings.
  • the application framework layer 320 provides an application programming interface (application programming interface, API) and a programming framework for the application of the application layer 310.
  • the application framework layer includes some predefined functions.
  • the application framework layer 320 may include a security management module 10, a window manager, a resource manager, a notification manager, and the like.
  • the window manager is used to manage window programs.
  • the window manager can obtain the size of the display screen, determine whether there is a status bar, lock the screen, take a screenshot, etc.
  • the resource manager provides various resources for the application, such as localized strings, icons, pictures, layout files, video files, and so on.
  • the notification manager enables the application to display notification information in the status bar.
  • the message can disappear automatically after a short stay without user interaction.
  • the notification manager is used to notify download completion, message reminders, and so on.
  • the notification manager can also be a notification that appears in the status bar at the top of the system in the form of a chart or a scroll bar text, such as a notification of an application running in the background, or a notification that appears on the screen in the form of a dialog window.
  • a notification for example, prompt text information in the status bar, sound a prompt sound, electronic device vibration, flashing indicator light, etc.
  • the security management module 10 is a newly added functional module in the embodiment of this application, which can implement the method for securely accessing data introduced in the embodiment of this application, which will be described in detail in subsequent embodiments of this application.
  • the embodiment of the present application enumerates the case where the security management module 10 is set in the application framework layer 320, and the security management module 10 may also be set in the kernel layer 330, which is not limited in the embodiment of the present application. As long as the functions that are the same as the security management module 10 provided by the embodiment of the present application are within the protection scope of the present application.
  • the application program layer 310 and the application program framework layer 320 run in a virtual machine.
  • the virtual machine executes the java files of the application program layer 310 and the application program framework layer 320 as binary files.
  • the virtual machine is used to perform functions such as object life cycle management, stack management, thread management, security and exception management, and garbage collection.
  • the kernel layer 330 is a layer between hardware and software.
  • the kernel layer 330 includes at least a variety of device drivers, such as display drivers, camera drivers, audio drivers, sensor drivers, and so on.
  • the kernel layer 330 may also include a process scheduling module, a disk data module, etc., which are not limited in the embodiment of the present application.
  • FIG. 2 listed above is a structural diagram of a possible electronic device
  • FIG. 3 is a software architecture diagram of a possible electronic device.
  • the following embodiments of the present application will take the data access between two electronic devices (for example, the first electronic device and the second electronic device) in the distributed network system shown in FIG.
  • the first electronic device that applies for invoking the service is called the “service application device”
  • the second electronic device that provides the service is called the "service providing device”.
  • both the service requesting device and the service providing device can include the security management module 10 of the application framework layer 320 in FIG. As a service provider.
  • the device A in FIG. 1 can apply for the process permission of the device B, and the device B can also apply for the process permission of the device A in turn.
  • device A applies for the process permission of device B device A applies for the device for the service, and device B provides the device for the service;
  • this embodiment of the application does not limit this.
  • the resource access authority between two electronic devices is controlled from the perspective of the process.
  • a process is a running activity of a program with a certain independent function on a certain data set. It is the basic unit of the system for resource allocation and scheduling, and the basic execution unit of the operating system. Therefore, the embodiment of the present application will improve the security of data access by restricting the access rights of the service application device and the process on the service providing device.
  • FIG. 4 is a schematic diagram of an example of a security management module 10 provided by an embodiment of the present application.
  • the security management module 10 can also be called “security middleware", “security module”, etc., as long as it realizes the same functions as the security management module 10 introduced in the embodiments of this application, it will fall into the scope of this application. protected range.
  • the security management module 10 may include a rights configuration data module 11, a rights policy module 12, a local rights management module 13, and a network rights management module 14. Before introducing each module included in the security management module 10, a few basic concepts are introduced first.
  • permission objects can be understood as different processes, in other words, a process can be regarded as a rights object.
  • a permission object contains a description of a set of permissions, and the permission requirements related to each process are described as a permission object bound to a process.
  • Each authority object includes authority factors such as authority identification, authority effect objects, and authority restriction operations.
  • the permission object can be processed and checked by its binding process or the system kernel.
  • the process provided by the service providing device may be referred to as the "service process”, and the process provided by the service application device may be referred to as the "application process”.
  • the service process When other processes need to access the functions of the service process, they need to pass the check of the permission object bound to the process before they can normally access the functions or resources of the service process.
  • a permission delegation solution is provided.
  • the security management module 10 of the service providing device when a service process declares that it can provide distributed access capabilities to the outside world, the security management module 10 of the service providing device will first configure the data by the permission Module 11 checks whether the permission object of the service process is legal and whether it can provide external capabilities normally. The security management module 10 of the service providing device will bind the permission object to the service process, and then the service requesting device will store a reference copy in the local permission management module 13 according to the permission object, that is, create a stub object called " Authorization stub object". This authority stub object has all the capability constraints provided for the distributed network system in the authority object of the service process.
  • the service applicant device can access the information of the authority stub object of the service providing device through the network, and combine with the local security management module 10 to dynamically create a proxy object, which is the so-called "authority proxy” here. Object”.
  • the permission object of each service process provided by the service providing device will have one or more policies, and the user controls the behavior of the permission object in different scenarios, so as to achieve a solution that the same permission object can dynamically self-adjust as the scene changes.
  • the rights object policy may be a piece of specifically configured policy data, or may be a related policy control algorithm or policy control model.
  • the permission object strategy of the embodiment of this application focuses on controlling the access to the service process.
  • similar permission object policies can also be used to control the access of the local application process. This embodiment of the application does not do this. limited.
  • the authority configuration data module 11 of the security management module 10 is used to store authority configuration data.
  • the authority configuration data records locally allowed authority configuration conditions, such as a description of authority restrictions, and provides different electronic devices. Statutes of inter-authority objects.
  • the security management module 10 needs to resolve the conflict according to the conflict resolution conditions of the authority, for example, according to the current electronic device version conditions, etc., to ensure that the authority of the different electronic devices is consistent.
  • the permission policy module 12 mainly includes permission object policies, which are used to manage permission objects, and the policies for automatically synchronizing permission stub objects and permission proxy objects.
  • the rights policy module 12 can synchronize the rights objects among all electronic devices included in the distributed network system 100 according to the rights object policy, which mainly includes the forward synchronization of the rights stub objects and the reverse feedback of the rights proxy objects.
  • the permission policy module 12 can also automatically adjust the local or proxy permission object policy according to the requirements of the scene.
  • the local authority management module 13 is mainly responsible for managing local service processes. It should be understood that each service process corresponds to a authority object, and the local authority management module 13 can manage local authority objects.
  • the operating system of the electronic device will set the relevant authority object policy for each local application process, that is, the security management module 10 creates a stub object in the local authority management module 13, which is the “authority stub object” introduced above. ".
  • this authority stub object has all the capability constraints provided for the distributed network system among the authority objects of the service process.
  • the local permission management module 13 binds the resource or service to be operated by the process, the operation method, and the operation itself (such as the process's identity ID, etc.).
  • the network authority management module 14 is mainly responsible for querying the authority of accessing service processes of other electronic devices and managing authority proxy objects.
  • Fig. 5 is a schematic diagram of an example of the structure of a rights object provided by an embodiment of the present application.
  • the structure of the permission objects of the service applying device 20 and the service providing device 30 is shown in FIG. 5.
  • the local permission management module 13 saves a local permission stub object list, and the permission stub object list includes one or more The information of each permission stub object and the permission object policy of each permission stub object.
  • Each permission object policy includes one or more of the permission requirements, service ID, access interface, operation interface, resource ID and other information of the permission stub object. This embodiment of the application does not limit this.
  • the permission stub object list includes permission stub object 1-permission stub object N, where permission stub object 1 has a stub object tag 1, corresponding to permission requirements 1, service identification 1, and access interface 1.
  • the permission stub object 2 has a stub object label 1, and when it corresponds to a permission requirement 1, it has a resource ID 1 and an operation interface 1.
  • the permission stub object 2 corresponds to a permission requirement 2, it has a service ID 2 and an access interface 2.
  • the network authority management module 14 saves the authority proxy object list of the service application device 20, and the authority proxy object list includes information about one or more authority proxy objects. It should be understood that the authority proxy object of the service application device 20 saved by the service providing device 30 is the authority stub object of the local authority management module 13 of the service application device 20. Therefore, the authority proxy object list of the service providing device 30 and the service application device 20 The list of permission stub objects has a one-to-one correspondence.
  • the authority proxy object is generated when the access process of the service requesting device 20 accesses the service process of the service providing device 30 for the first time, and is stored in the network authority management module 14 of the service providing device 30.
  • the inspection module completes the authority inspection of the access process of the service application device 20, and determines whether it can continue to access the capability of the service providing device 30.
  • the "access process” mentioned in the embodiment of the present application is used for access between electronic devices, which is a way of realizing information interaction between the service application device 20 and the service providing device 30, which is different from the "service process” described above.
  • application process I won't repeat them here.
  • the network permission management module 14 of the service providing device 30 can determine the access based on the permission stored locally. Whether the process has the ability to access the service providing device 30, thereby reducing the requirement for network access and improving the efficiency of security processing.
  • the service application device 20 of the distributed network system When the service application device 20 of the distributed network system declares to register its distributed capabilities, it will register and store the permission object bound to its process in the security middleware. At this time, the security management module 10 of the service application device 20 will automatically generate permissions. The stub object label of the object, and the one-to-one mapping relationship between the stub object label and the permission object is bound.
  • a service application device 20 when a service application device 20 applies for the capabilities provided by the service process, it will first check whether the network authority agent of the current network authority management module 14 has the authority agent object of this access interface according to the access interface of the service application device 20. If so, it is directly judged through the authority proxy object whether the current access interface of the service application device 20 has the ability to access the service process. Otherwise, in the service providing device 30, the authority stub object corresponding to the access interface is queried, and the stub object tag of the authority stub object is transmitted to the service application device 20.
  • the security management module 10 on the service application device 20 can automatically generate the authority proxy object on the service application device 20 based on the information of the stub object tag and the authority configuration data module 11, and then determine the service application device through the authority proxy object Does 20 have the authority to continue to access the service process capability of the service providing device 30?
  • the service providing device 30 may first generate the authority proxy object list, and then update it to the authority stub object list on the service application device 20 side.
  • the two lists have a one-to-one correspondence.
  • each device may include the permission stub object list and the permission proxy object list shown in FIG. 5, but the permission stub object list of one service applying device 20 and one There is a one-to-one mapping relationship between the authority proxy object lists of the service providing device 30, and the authority stub object list of the same service application device 20 and the authority proxy object list stored by itself may be different.
  • Fig. 6 is a schematic diagram of an example of interaction between a service applying device and a service providing device provided by an embodiment of the present application.
  • the method for securely accessing data provided by the embodiment of the present application is applied to a distributed network system including a service application device 20 and a service providing device 30.
  • a service application device 20 and a service providing device 30.
  • the service applying device 20 can also be used as a service providing device.
  • the service providing device 30 implements the same function. The similar process in this embodiment of the present application will not be repeated.
  • the method 600 includes:
  • the service providing device 30 registers one or more service processes, that is, registers one or more service processes in the local authority management module 13, and publishes its distributed capabilities.
  • the distributed capability of the service process can be understood as the capability of a certain process on the service providing device 30 to be accessed and used by other electronic devices in the distributed network system.
  • the service process of the video application installed on the user's mobile phone can be accessed and used by the family's large-screen TV.
  • the service providing device 30 must first declare that one or more of its service processes provide external access capabilities, and register the authority object of each service process in the security management module 10, that is, the "authority stub object", such as REMOTE_X_ACCESS .
  • the authority stub object is the proxy model of the authority object in the security management module 10, that is, the implementation authority model related to the authority stub object, and is recorded in the authority configuration data module 11.
  • the service application device 20 and the service providing device 30 when they are connected (not limited to the first connection or each connection), they will synchronize the permission configuration data recorded in the permission configuration data module 11 with each other to achieve Consistency of the authority regulations of the devices at both ends.
  • the service application device 20 and the service providing device 30 may inform each other of processes (which may include service processes and application processes) that have external access capabilities in the form of a secure access list. For example, for the REMOTE_X_ACCESS of the service providing device 30, at this time, the related authority protocol declared by REMOTE_X_ACCESS will also be synchronized to the service requesting device 20.
  • the security access list may include information on the permission control list of the service providing device 30, such as remote Bluetooth permission, remote location permission, remote video playback permission, etc., where remote Bluetooth, remote location, and remote video playback each represent a service process .
  • the permission configuration data of each service process recorded in the permission configuration data module 11 may include one or more kinds of information such as the permission description, the permission control object, and the permission control operation of each service process.
  • the authority configuration data module 11 of the service providing device 30 performs verification according to the authority configuration data of one or more service processes registered by the local authority management module 13, and generates a corresponding authority stub object.
  • the local authority management module 13 of the service providing device 30 stores the authority stub object.
  • one service process corresponds to one authority stub object
  • the service providing device 30 generates a authority stub object list according to multiple service processes, and saves it in the local authority management module 13.
  • the list of rights stub objects reference may be made to the list of rights stub objects of the service application device 20 in FIG. 5, which will not be repeated here.
  • FIG. 7 is a schematic diagram of an example of a service process in which a service application device accesses a service providing device provided by an embodiment of the present application.
  • a process in which an application process 1 of the user 1 on the service application device 20 needs to access the service process 2 of the user 1 of the service providing device 30 is taken as an example to introduce a method of secure access.
  • the service application device 20 receives a request for accessing a first service process, which is a process corresponding to an application with distributed capabilities on the service providing device 30.
  • an application process 1 of the user 1 on the service application device 20 first applies to the network authority management module 14 for access rights to the service process 2 of the service providing device 30, that is, the "first service process request”.
  • the network authority checking module of the service application device 20 queries whether the network authority proxy module has the authority code of the access interface of the first service process currently applied for.
  • the service requesting device 20 sends a query request to the service providing device 30 to query the authority corresponding to the access interface of the first service process in the service providing device 30 Stub object.
  • the service providing device 30 receives the query request sent by the service requesting device 20, and determines the first permission stub object corresponding to the access interface of the first service process. And it is judged whether the first permission stub object has been registered in the local permission management module 13 of the own security management module 10.
  • the network authority proxy module of the service application device 20 If the local authority management module 13 of the service providing device 30 has been registered and the first authority stub object exists, the network authority proxy module of the service application device 20 generates the first authority proxy object according to the first authority stub object.
  • step 609 if the local authority management module 13 of the service providing device 30 is not registered and the first authority stub object does not exist, the network authority proxy module of the service application device 20 does not generate the first authority proxy object.
  • the security management module 10 will generate its authority proxy object in the service application device 20 according to its work flow, and then use it subsequently (for example, non- The first application for permission to the service process 2), when the permission proxy object is verified, the security management module 10 can directly query according to the description in the structure definition of the permission stub object list and the permission proxy object list listed in Figure 5 above The first authority stub object corresponding to the access interface of the first service process further determines the first authority proxy object.
  • the service providing device 30 denies the service requesting device 20's access to the service process 2, it can generate an anonymous empty proxy object for the failed operation, and then when such proxy object accesses, It will always return to failure, thereby reducing the number of network interactions and making the network configuration more flexible.
  • the network authority checking module of the service application device 20 checks whether the current access interface is allowed to be accessed according to the first authority proxy object.
  • the network authority checking module of the service application device 20 combines the first authority proxy object and related algorithms to determine whether the current access to the service process 2 meets the security requirements, and performs an allow or deny operation, and continues to perform the following step 611.
  • the service providing device 30 allows the service applying device 20 to access the service process 2; otherwise, the service providing device 30 rejects the service applying device 20 from accessing the service process 2.
  • step 604 to step 611 may correspond to the process of 12345 shown in FIG. 7, and will not be repeated here.
  • the security management module 10 can directly interrupt the request of the first service process of the service applying device 20.
  • the service providing device 30 may send a request for the first service process to the service providing device 30, and the service providing device 30 will process the access request of the service applying device 20.
  • the security management module 10 can first check whether the application process 1 of the service application device 20 has access to the service providing device 30. Permission of service process 2. Specifically, the security management module 10 of the service application device 20 can be used to query whether there is a proxy authority object that will access the interface of the service process 2. The authority proxy object and the authority object strategy judge the access authority and control the acceptance or denial of access to the interface of the service process 2.
  • the process of the electronic device is used as the permission object, and a permission management solution is designed to control the process invocation permission of other electronic devices through the security management module, thereby restricting the process security of other electronic devices.
  • a permission management solution is designed to control the process invocation permission of other electronic devices through the security management module, thereby restricting the process security of other electronic devices.
  • expand the permission management scheme of the native application process to other electronic devices in the distributed network system improve the granularity of cross-device permission management, and realize more fine-grained cross-device process permission security management operations.
  • the embodiment of the present application can also convert the permission check of the application process of the remote electronic device into the permission check of the security management module in the near-end electronic device, which further saves network resources and realizes the flexible configuration of the distributed network system.
  • the overhead of cross-device process permission management is reduced, and the efficiency of security processing is improved.
  • the embodiment of this application adopts an object-oriented authority management method, so that the process of checking the authority of the service process takes place on the side of the service application device.
  • the security management module ensures the consistency of the security access strategy. In this way, in the case of a ubiquitous network, It can effectively reduce the dependence of security checks on the network, reduce the application time for accessing the service process, and improve user experience.
  • the permission policy module 12 can also automatically adjust the local or proxy permission object policy according to the requirements of the scene.
  • the permission object policy for the permission stub object can be customized by the user, or separately defined in the cloud. For example, actively configure the rights object policy and store it in the electronic device where the rights stub object is located.
  • the rights object policy for the rights proxy object can be automatically synchronized between the service requesting device and the service providing device, or synchronized in the cloud.
  • passive configuration policy data that relies on actively configuring the rights object policy can be stored in the electronic device where the rights proxy object is located.
  • an authority proxy object can be automatically created in the security management module 10 of the service application device 20, At the same time, the related rights object policy of the rights stub object corresponding to this rights proxy object is synchronized to the rights policy module 12 of the security management module 10.
  • the security management module 10 can ensure that the policy of the service process 2 is updated and synchronized in time, thereby shielding the original service requesting device 20 from the service providing device 30 of the service process 2 depends on each other's authority policy.
  • the distributed capabilities of the process can be used in a limited scenario.
  • the rights object strategy of the distributed capability of the process may also be different, or in other words, the distributed capability provided by the electronic device to the outside will change with the change of the application scenario.
  • FIG. 8 is a schematic diagram of an example of restriction of a rights object policy provided by an embodiment of the present application.
  • the service process 1 and the service process 2 of the electronic device can provide distributed capabilities to the outside, but different rights object policies can be set for the service process 1 and the service process 2 to restrict them.
  • the application process in the remote electronic device can be allowed to access the service process 1 without any requirement;
  • the service process 1 may be a process corresponding to a video application on the user's mobile phone
  • the service process 2 may be a process corresponding to a call on the user's mobile phone.
  • a smart speaker or smart TV will be allowed to automatically connect to the user's mobile phone and obtain video data for playback.
  • shopping malls or other public places are not allowed to automatically connect and visit, regardless of whether the security authentication has been established before, it must be processed after the user's confirmation.
  • the electronic device where the application process is located can determine that the current scene is the home scene or the company scene through conditions such as GPS or other positioning methods, or the location of the base station to which the electronic device is connected.
  • the embodiment does not limit this.
  • different rights object policies can also be set for different electronic devices.
  • the user's smart watch can access any process of the user's mobile phone in any scenario, which will not be repeated in the embodiment of the present application.
  • the rights object strategy can also be a dynamic adjustment algorithm based on environment variables, or other constraints. Module.
  • the distributed network system when restricting the access of the service requesting device to the local service providing device, it can be adaptively adjusted following the changes of the application scenario, statically or dynamically configuring different rights object policies in different scenarios, restricting Sensitive applications can only perform security-sensitive operations in relatively safe scenarios, but are restricted to use in other environments, thereby improving the security of the system.
  • the process of dynamically configuring the rights object policy can occur on the security management module of the peer electronic device, which can effectively reduce the dependence of the security policy control on the network and improve the user experience.
  • the embodiment of this application takes the process as the authority object, designs a distributed authority object management model, and proposes a method for securely accessing data in a distributed network system, and uses the authority object proxy solution to control the service Apply for the process access capability on the device, so as to achieve the ability to restrict the access of the service application device to the process of the service providing device, thereby restricting the access of the remote electronic device process in the distributed network system to the service process of the local electronic device, and improving the distribution
  • the security of the distributed network system at the process level reduces the intensity of the dependence of the security requirements on the network and makes the network configuration more flexible.
  • the security management module is introduced into the electronic device, and each process of the electronic device is bound to a permission object.
  • a process of the service providing device provides external distributed capabilities
  • the The permission object of the process is distributed to the security management module of the service requesting device through the security management module, and the corresponding permission proxy object is generated, and then the security management module in the service requesting device will determine the correctness based on the permission proxy object of the process Whether the service requesting device of the current device can have access to the process.
  • a related permission object policy (or "security policy constraint") will be bound.
  • the rights object strategy can be a static configuration strategy or a dynamic adjustment algorithm based on environment variables.
  • the behavior of the rights proxy object can be changed in the service application device as the application scenario changes. Adaptive changes, thereby restricting the security operations performed by the service requesting device.
  • the rights object policy of the rights object will be automatically synchronized and changed following the policy of the rights stub object in the service providing device.
  • the authority proxy object with distributed capability may be dynamically generated for the first time. For example, when the process of the service providing device declares that it can provide distributed capability externally, the authority object corresponding to the process will first be mapped to the security one by one. In the management module, the authorization stub object is generated. When other remote electronic devices in the distributed network system call the permission object, the security management module of the service providing device will dynamically and automatically generate the permission stub corresponding to the access interface of the service application device according to the access interface of the service provider device. The authority proxy object of the object then combines the corresponding authority object strategy through the authority proxy object to control the access capability of the service-providing device's external interface; and the life cycle of the authority proxy object will adaptively change with the change of the authority stub object.
  • the electronic devices in the distributed network system include hardware and/or software modules corresponding to each function.
  • the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed by hardware or computer software-driven hardware depends on the specific application and design constraint conditions of the technical solution. Those skilled in the art can use different methods for each specific application in combination with the embodiments to implement the described functions, but such implementation should not be considered as going beyond the scope of the present application.
  • the electronic device can be divided into functional modules according to the foregoing method examples.
  • each functional module can be divided corresponding to each function, or two or more functions can be integrated into one processing module.
  • the above-mentioned integrated modules can be implemented in the form of hardware. It should be noted that the division of modules in this embodiment is illustrative, and is only a logical function division, and there may be other division methods in actual implementation.
  • the electronic device may include: a display unit, a detection unit, a processing unit, and the like. It should be noted that all relevant content of the steps involved in the foregoing method embodiments can be cited in the functional description of the corresponding functional module, and will not be repeated here.
  • the electronic device provided in this embodiment is used to execute the foregoing method for securely accessing data, and therefore can achieve the same effect as the foregoing implementation method.
  • the electronic device may include a processing module, a storage module, and a communication module.
  • the processing module can be used to control and manage the actions of the electronic device, for example, can be used to support the electronic device to execute the steps performed by the above-mentioned display unit, detection unit, and processing unit 1.
  • the storage module can be used to support the electronic device to execute the storage program code and data.
  • the communication module can be used to support the communication between electronic devices and other devices.
  • the processing module can be a processor or a controller. It can implement or execute various exemplary logical blocks, modules, and circuits described in conjunction with the disclosure of this application.
  • the processor may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of digital signal processing (DSP) and a microprocessor, and so on.
  • the storage module may be a memory.
  • the communication module may specifically be a radio frequency circuit, a Bluetooth chip, a Wi-Fi chip, and other devices that interact with other electronic devices.
  • the electronic device involved in this embodiment may be a device having the structure shown in FIG. 2 or FIG. 3.
  • This embodiment also provides a computer-readable storage medium, the computer-readable storage medium stores computer instructions, and when the computer instructions run on an electronic device, the electronic device executes the above-mentioned related method steps to implement the steps in the above-mentioned embodiment Methods of securely accessing data.
  • This embodiment also provides a computer program product, which when the computer program product runs on a computer, causes the computer to execute the above-mentioned related steps, so as to implement the method for securely accessing data in the above-mentioned embodiment.
  • the embodiments of the present application also provide a device.
  • the device may specifically be a chip, component, or module.
  • the device may include a processor and a memory connected to each other.
  • the memory is used to store computer execution instructions.
  • the processor can execute the computer-executable instructions stored in the memory, so that the chip executes the method for securely accessing data in the foregoing method embodiments.
  • the electronic device, computer storage medium, computer program product, or chip provided in this embodiment are all used to execute the corresponding method provided above. Therefore, the beneficial effects that can be achieved can refer to the corresponding method provided above. The beneficial effects of the method will not be repeated here.
  • the disclosed device and method can be implemented in other ways.
  • the device embodiments described above are merely illustrative.
  • the division of modules or units is only a logical function division.
  • there may be other division methods for example, multiple units or components can be combined or It can be integrated into another device, or some features can be ignored or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate parts may or may not be physically separate, and the parts displayed as a unit may be one physical unit or multiple physical units, that is, they may be located in one place or distributed to multiple different places. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.
  • the functional units in the various embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit can be implemented in the form of hardware or software functional unit.
  • the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium.
  • the technical solutions of the embodiments of the present application are essentially or the part that contributes to the prior art, or all or part of the technical solutions can be embodied in the form of a software product, and the software product is stored in a storage medium. It includes several instructions to make a device (which may be a single-chip microcomputer, a chip, etc.) or a processor (processor) execute all or part of the steps of the methods in the various embodiments of the present application.
  • the aforementioned storage media include: U disk, mobile hard disk, read only memory (read only memory, ROM), random access memory (random access memory, RAM), magnetic disk or optical disk and other media that can store program codes.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Storage Device Security (AREA)

Abstract

本申请提供了一种安全访问数据的方法和电子设备，该电子设备可以是分布式网络系统中的手机、平板、手表、车载设备等。该方法以进程作为权限对象，在电子设备中引入安全管理模块，设计了分布式的权限对象管理模型，使用权限对象代理的方案来控制在服务申请设备上面的进程访问能力，从而达到限制服务申请设备对服务提供设备的进程访问的能力，进而约束了分布式网络系统中的远端电子设备进程对本端电子设备的服务进程的访问；该权限对象管理模型还可以令权限代理对象的行为在服务申请设备中随着应用场景变化而自适应变化，从而提高分布式网络系统在进程级别的安全性，降低其中安全需求对网络的依赖强度，使得网络配置更加灵活。

Description

安全访问数据的方法及电子设备
本申请要求于2020年5月27日提交中国专利局、申请号为202010460456.1、发明名称为“安全访问数据的方法及电子设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及电子技术领域，尤其涉及一种安全访问数据的方法及电子设备。
背景技术
随着互联网的发展，尤其是一些关键趋势，包括泛在网络、移动计算以及分布式多媒体系统的不断发展，极大地推动了分布式网络系统的普及。一个分布式网络系统的度量取决于其性能、稳定和安全三个维度，因此分布式网络系统中数据的安全访问是分布式网络系统的一个重要度量维度。
目前，常见的数据的安全访问策略一般是针对通信设备与应用用户进行认证，然后针对内容和通信通道进行加密。在分布式网络系统的多终端设备近场交互的场景下，尽管可以借助云端认证服务器，完成终端设备和用户的认证。但是在分布式网络系统中，在跨设备通信时，仅仅依靠终端设备和用户的认证无法满足数据安全的要求，且无法满足不同场景中访问数据的安全要求。
发明内容
本申请提供一种安全访问数据的方法及电子设备，该方法能够限制服务申请设备对服务提供设备的进程访问的能力，进而约束分布式网络系统中的远端电子设备进程对本端电子设备的服务进程的访问，提高分布式网络系统在进程级别的安全性，降低其中安全需求对网络的依赖强度，使得网络配置更加灵活。
第一方面，提供了一种安全访问数据的方法，应用于包括第一电子设备和第二电子设备的分布式网络系统中，该方法包括：第一电子设备向该第二电子设备发送第一服务进程的请求，该第一服务进程是该第二电子设备上具有分布式能力的应用对应的进程；第二电子设备根据该第一服务进程的请求，确定该第一服务进程的访问接口对应的第一权限存根对象以及该第一权限存根对象的权限对象策略；第二电子设备向所述第一电子设备发送所述第一权限存根对象和所述第一权限存根对象的权限对象策略；第一电子设备根据该第一权限存根对象和该第一权限存根对象的权限对象策略，生成第一权限代理对象和该第一权限代理对象的权限对象策略；第一电子设备根据该第一权限代理对象和该第一权限代理对象的权限对象策略，确定当前该第一服务进程的访问接口是否被允许访问；当第一服务进程的访问接口被允许访问时，该第一电子设备访问该第二电子设备的该第一服务进程的数据。
应理解，第一电子设备和第二电子设备是分布式网络系统中任意的两个不同电子设 备。例如，第一电子设备是本申请实施例中的服务申请设备，第二电子设备是本申请实施例中的服务提供设备。还应理解，同一个电子设备即可以作为服务申请设备，还可以作为服务提供设备。
在本申请中，可以将服务提供设备提供(第二电子设备)的进程称为“服务进程”，将服务申请设备(第一电子设备)提供的进程称为“应用进程”。当第一电子设备的某个应用进程需要访问第二电子设备的第一服务进程的功能时，需要首先通过进程绑定的权限对象的检查，才可以正常访问该第一服务进程的功能或者资源。示例性的，用户的手机为服务提供设备，家庭电视为服务申请设备，家庭电视可以通过某款视频应用申请访问用户手机的视频应用的视频数据。
在分布式网络系统中，跨设备的进程服务之间是不能直接访问的。在本申请实施例中，提供一种权限代理方案，对于服务提供设备，当某个服务进程声明注册其可以对外提供分布式访问能力时，服务提供设备的安全管理模块会首先由权限配置数据模块检查该服务进程的权限对象是否合法，是否可以正常对外提供能力。服务提供设备的安全管理模块会将服务进程绑定的权限对象，然后服务申请设备根据该权限对象，在本地权限管理模块中存入一个引用副本，即创建一个存根对象，称之为“权限存根对象”。这个权限存根对象拥有服务进程的权限对象的中所有针对分布式网络系统提供的能力约束。
上述技术方案，在分布式网络系统中，以电子设备的进程作为权限对象，设计一种权限管理方案，通过安全管理模块控制其他电子设备的进程调用权限，从而约束其它电子设备的进程安全性。并将本机的应用进程的权限管理方案拓展到分布式网络系统中的其他电子设备，提升了跨设备的权限管理的粒度，可以实现更细粒度跨设备的进程权限安全管理操作。
此外，本申请实施例还可以将远端电子设备的应用进程的权限检查，转化近端电子设备内的安全管理模块的权限检查，进一步节省网络资源，且实现了分布式网络系统的灵活配置，降低了跨设备进程权限管理的开销，提升了安全处理的效率。
应理解，本申请实施例采用面向对象的权限管理方式，使服务进程权限的检查过程发生在服务申请设备侧，通过安全管理模块的形式，保证安全访问策略的一致性，这样在泛在网络的情况下，可以有效降低安全检查对网络的依赖性，降低访问服务进程的申请时长，提升用户体验。
结合第一方面，在第一方面的某些实现方式中，第一电子设备向该第二电子设备发送该第一服务进程的请求之前，该方法还包括：第一电子设备接收访问该第一服务进程的请求；响应于该第一服务进程的请求，第一电子设备确定该第一服务进程的访问接口的权限；第一电子设备确定当前没有针对该第一服务进程的访问接口的权限。
应理解，如果第一服务进程的请求是首次申请对该第一服务进程的权限，则安全管理模块会按其工作流程，在服务申请设备生成其权限代理对象，然后后续使用中(例如非首次申请对第一服务进程的权限)，权限代理对象进行校验时，安全管理模块可以按照权限存根对象列表和权限代理对象列表的结构定义中的说明，直接查询到第一服务进程的访问接口对应的第一权限存根对象，进一步确定第一权限代理对象。
为了防止每次都进行失败网络交互，当服务提供设备拒绝服务申请设备对第一服务进程的访问时，可以对失败的操作生成匿名的空的代理对象，之后当此类代理对象访问时， 会一直返回失败，从而减少网络交互次数，使得网络配置更加灵活。
结合第一方面和上述实现方式，在第一方面的某些实现方式中，第二电子设备注册N个服务进程，发布该N个服务进程中每个服务进程的分布式能力，该第一服务进程是该N个服务进程中的任意一个，N为正整数；该第二电子设备根据注册的该N个服务进程，确定该N个服务进程中每个服务进程的权限对象策略；第二电子设备根据该N个服务进程和N个服务进程的权限对象策略，生成权限存根对象列表，该权限存根对象列表包括与该每个服务进程一一对应的N个权限存根对象的信息和该N个权限存根对象的权限对象策略。
结合第一方面和上述实现方式，在第一方面的某些实现方式中，第一电子设备向该第二电子设备发送第一服务进程的请求之后，该方法还包括：第二电子设备根据该第一服务进程的请求，确定该N个权限存根对象中不包括该第一权限存根对象；第二电子设备拒绝该第一电子设备访问该第一服务进程的数据。
如果服务提供设备的本地权限管理模块中没有注册且不存在该第一权限存根对象，则服务申请设备的网络权限代理模块不生成第一权限代理对象。
结合第一方面和上述实现方式，在第一方面的某些实现方式中，第一权限存根对象的权限对象策略包括以下信息中的至少一种：该第一权限存根对象的权限要求信息、服务标识信息、访问接口信息、操作接口信息、资源标识信息。
结合第一方面和上述实现方式，在第一方面的某些实现方式中，第一权限存根对象的权限对象策略还包括场景约束信息，该场景约束信息用于指示针对不同的应用场景或者不同的地理位置或者该第一电子设备的设备信息，该第一服务进程被该第一电子设备访问的权限。
假设用户期望其设备的某进程可以对外提供分布式能力，但是为了提高访问该进程的安全性，可以在限定的场景下可以使用该进程的分布式能力。同时，针对不同的应用场景，该进程的分布式能力的权限对象策略也可以不同，或者说，电子设备对外提供的分布式能力会随着应用场景的变化而发生变化。
示例性的，针对用户进行访问手机视频数据，在家里，会允许智能音箱或者智能电视自动连接到用户手机上并获取视频数据进行播放。但是商场或者其它公共场所是不允许自动连接和访问，无论之前是否建立过安全认证，必须经过用户确认之后再处理。
可选地，应用进程所在的电子设备(即服务申请设备)可以通过GPS等定位方式、或者电子设备连接的基站所在位置等条件判断当前所处的场景为家的场景或者公司场景等，本申请实施例对此不做限定。
可选地，以上除了在不同的应用场景下设置不同的权限对象策略之外，还可以针对不同的电子设备，设置不同的权限对象策略。示例性的，设置用户的智能手表在任何场景下都可以访问用户的手机的任意进程，本申请实施例对此不再赘述定。
应理解，以上实施例只是列举了一种静态配置的在不同场景下动态调整权限对象策略的策略模型，实际实现过程中，权限对象策略也可以一种基于环境变量的动态调整算法，或者其它约束模块。
还应理解，权限代理对象的采用的权限对象策略的策略模型，需要与权限存储对象配置的线束策略模型一致。
通过上述方法，在分布式网络系统中，约束服务申请设备对本端服务提供设备的访问时，可以跟随应用场景的变化进行自适应调整，静态或者动态配置在不同场景下不同的权限对象策略，限制敏感应用只在相对安全的场景下，可以执行安全敏感操作，而其它环境中被限制使用，从而提高系统的安全性。同时，动态配置权限对象策略的过程可以发生在对端电子设备的安全管理模块上，可以有效降低安全策略控制对网络的依赖，提高用户的体验。
结合第一方面和上述实现方式，在第一方面的某些实现方式中，第一权限存根对象的权限对象策略是用户自定义的策略；或者在云端定义的策略。
可选地，针对权限存根对象的权限对象策略，可以由用户进行自定义，或者在云端进行分定义。例如，主动配置权限对象策略，并存储在权限存根对象所在的电子设备中。
可选地，针对权限代理对象的权限对象策略，可以自动在服务申请设备和服务提供设备之间进行同步，或者在云端进行同步。例如，依赖于主动配置权限对象策略的被动配置策略数据，可以存储在权限代理对象所在的电子设备中。示例性的，当前服务提供设备的第一服务进程的策略发生变化时，安全管理模块可以保障第一服务进程的策略的及时更新同步，从而屏蔽原来的服务申请设备与服务提供设备的第一服务进程的彼此对权限策略的依赖。
综上所述，本申请实施例以进程作为权限对象，设计了分布式的权限对象管理模型，提出一种在分布式网络系统中安全访问数据的方法，使用权限对象代理的方案来控制在服务申请设备上面的进程访问能力，从而达到限制服务申请设备对服务提供设备的进程访问的能力，进而约束了分布式网络系统中的远端电子设备进程对本端电子设备的服务进程的访问，提高分布式网络系统在进程级别的安全性，降低其中安全需求对网络的依赖强度，使得网络配置更加灵活。
第二方面，提供了一种安全访问数据的方法，应用于包括第一电子设备和第二电子设备的分布式网络系统中，该第一电子设备存储有权限代理对象列表和该权限代理对象列表中每个权限代理对象的权限对象策略，该方法包括：第一电子设备接收访问该第一服务进程的请求，该第一服务进程是该第二电子设备上具有分布式能力的应用对应的进程；响应于该第一服务进程的请求，该第一电子设备确定第一权限代理对象和该第一权限代理对象的权限对象策略；第一电子设备根据该第一权限代理对象和该第一权限代理对象的权限对象策略，访问该第一服务进程的数据。
结合第二方面，在第二方面的某些实现方式中，权限代理对象列表和该权限代理对象列表中每个权限代理对象的权限对象策略一一对应与该第二电子设备存储的权限存根对象列表和该权限代理对象列表中每个权限存根对象的权限对象策略。
结合第二方面和上述实现方式，在第二方面的某些实现方式中，第二电子设备存储的权限存根对象列表包括N个权限存根对象，该方法还包括：第二电子设备注册N个服务进程，发布该N个服务进程中每个服务进程的分布式能力，该第一服务进程是该N个服务进程中的任意一个，N为正整数；第二电子设备根据注册的该N个服务进程，确定该N个服务进程中每个服务进程的权限对象策略；第二电子设备根据该N个服务进程和N个服务进程的权限对象策略，生成该权限存根对象列表，该权限存根对象列表包括与该每个服务进程一一对应的N个权限存根对象的信息和该N个权限存根对象的权限对象策略。
应理解，以上第二方面介绍的方法可以应用于第一电子设备不向第二电子设备发送第一服务进程的请求，在该分布式网络系统中，第一电子设备和第二电子设备实时更新交互权限对象。例如，第二电子设备生成的权限存根对象列表和该权限存根对象列表中每个权限存根对象的权限对象策略之后，实时将权限存根对象列表和权限对象策略发送给第一电子设备，第一电子设备可以实时更新自身存储的权限代理对象列表和该权限代理对象列表中每个权限代理对象的权限对象策略。因此，第一电子设备接收到第一服务进程的请求之后，只需要查询自己的信息，不需要再向第二电子设备发送请求，简化了访问第二电子设备进程的流程。
第三方面，提供了一种安全访问数据的方法，该方法包括：该第一电子设备向第二电子设备发送第一服务进程的请求，该第一电子设备和该第二电子设备是分布式网络系统中的两个不同电子设备，该第一服务进程是该第二电子设备上具有分布式能力的应用对应的进程；第一电子设备接收根据该第二电子设备发送的该第一服务进程的访问接口对应的第一权限存根对象以及该第一权限存根对象的权限对象策略，其中，第一权限存根对象以及该第一权限存根对象的权限对象策略是该第二电子设备根据该第一服务进程的请求确定的，第一电子设备根据该第一权限存根对象和该第一权限存根对象的权限对象策略，生成第一权限代理对象和该第一权限代理对象的权限对象策略；第一电子设备根据该第一权限代理对象和该第一权限代理对象的权限对象策略，确定当前该第一服务进程的访问接口是否被允许访问；当该第一服务进程的访问接口被允许访问时，该第一电子设备访问该第二电子设备的该第一服务进程的数据。
结合第三方面，在第三方面的某些实现方式中，第一电子设备向该第二电子设备发送该第一服务进程的请求之前，该方法还包括：该第一电子设备接收访问该第一服务进程的请求；响应于该第一服务进程的请求，该第一电子设备确定该第一服务进程的访问接口的权限；第一电子设备确定当前没有针对该第一服务进程的访问接口的权限。
结合第三方面和上述实现方式，在第三方面的某些实现方式中，该第一权限存根对象的权限对象策略包括以下信息中的至少一种：该第一权限存根对象的权限要求信息、服务标识信息、访问接口信息、操作接口信息、资源标识信息。
结合第三方面和上述实现方式，在第三方面的某些实现方式中，第一权限存根对象的权限对象策略还包括场景约束信息，该场景约束信息用于指示针对不同的应用场景或者不同的地理位置或者该第一电子设备的设备信息，该第一服务进程被该第一电子设备访问的权限。
结合第三方面和上述实现方式，在第三方面的某些实现方式中，第一权限存根对象的权限对象策略是用户自定义的策略；或者在云端定义的策略。
第四方面，提供了一种安全访问数据的方法，该方法包括：第二电子设备接收该第一电子设备发送的第一服务进程的请求，该第一服务进程是该第二电子设备上具有分布式能力的应用对应的进程；第二电子设备根据该第一服务进程的请求，确定该第一服务进程的访问接口对应的第一权限存根对象以及该第一权限存根对象的权限对象策略；第二电子设备向该第一电子设备发送该第一权限存根对象和该第一权限存根对象的权限对象策略；当该第一服务进程的访问接口被允许访问时，该第二电子设备允许该第二电子设备访问该第一服务进程的数据。
结合第四方面，在第四方面的某些实现方式中，该方法还包括：第二电子设备注册N个服务进程，发布该N个服务进程中每个服务进程的分布式能力，该第一服务进程是该N个服务进程中的任意一个，N为正整数；第二电子设备根据注册的该N个服务进程，确定该N个服务进程中每个服务进程的权限对象策略；第二电子设备根据该N个服务进程和N个服务进程的权限对象策略，生成权限存根对象列表，该权限存根对象列表包括与该每个服务进程一一对应的N个权限存根对象的信息和该N个权限存根对象的权限对象策略。
结合第四方面和上述实现方式，在第四方面的某些实现方式中，第二电子设备接收该第一电子设备发送的第一服务进程的请求之后，该方法还包括：第二电子设备根据该第一服务进程的请求，确定该N个权限存根对象中不包括该第一权限存根对象；第二电子设备拒绝该第一电子设备访问该第一服务进程的数据。
结合第四方面和上述实现方式，在第四方面的某些实现方式中，该第一权限存根对象的权限对象策略包括以下信息中的至少一种：该第一权限存根对象的权限要求信息、服务标识信息、访问接口信息、操作接口信息、资源标识信息。
结合第四方面和上述实现方式，在第四方面的某些实现方式中，第一权限存根对象的权限对象策略还包括场景约束信息，该场景约束信息用于指示针对不同的应用场景或者不同的地理位置或者该第一电子设备的设备信息，该第一服务进程被该第一电子设备访问的权限。
结合第四方面和上述实现方式，在第四方面的某些实现方式中，该第一权限存根对象的权限对象策略是用户自定义的策略；或者在云端定义的策略。
第五方面，本申请提供了一种装置，该装置包含在电子设备中，该装置具有实现上述方面及上述方面的可能实现方式中电子设备行为的功能。功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。硬件或软件包括一个或多个与上述功能相对应的模块或单元。例如，显示模块或单元、检测模块或单元、处理模块或单元等。
第六方面，本申请提供了一种电子设备，包括：触摸显示屏，其中，触摸显示屏包括触敏表面和显示器；摄像头；一个或多个处理器；存储器；多个应用程序；以及一个或多个计算机程序。其中，一个或多个计算机程序被存储在存储器中，一个或多个计算机程序包括指令。当指令被电子设备执行时，使得电子设备执行上述任一方面任一项可能的实现中的安全访问数据的方法。
第七方面，本申请提供了一种电子设备，包括一个或多个处理器和一个或多个存储器。该一个或多个存储器与一个或多个处理器耦合，一个或多个存储器用于存储计算机程序代码，计算机程序代码包括计算机指令，当一个或多个处理器执行计算机指令时，使得电子设备执行上述任一方面任一项可能的实现中的安全访问数据的方法。
第八方面，本申请提供了一种计算机可读存储介质，包括计算机指令，当计算机指令在电子设备上运行时，使得电子设备执行上述任一方面任一项可能的安全访问数据的方法。
第九方面，本申请提供了一种计算机程序产品，当计算机程序产品在电子设备上运行时，使得电子设备执行上述任一方面任一项可能的安全访问数据的方法。
附图说明
图1是本申请实施例提供的一例分布式网络系统的示意图。
图2是本申请实施例提供的一例电子设备的结构示意图。
图3是本申请实施例提供的一例电子设备的软件结构框图。
图4是本申请实施例提供的一例安全管理模块的示意图。
图5是本申请实施例提供的一例权限对象的结构示意图。
图6是本申请实施例提供的一例服务申请设备和服务提供设备的交互示意图。
图7是本申请实施例提供过的服务申请设备访问服务提供设备的服务进程的示意图。
图8是本申请实施例提供的一例权限对象策略的约束示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行描述。其中，在本申请实施例的描述中，除非另有说明，“/”表示或的意思，例如，A/B可以表示A或B；本文中的“和/或”仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，在本申请实施例的描述中，“多个”是指两个或多于两个。
以下，术语“第一”、“第二”仅用于描述目的，而不能理解为指示或暗示相对重要性或者隐含指明所指示的技术特征的数量。由此，限定有“第一”、“第二”的特征可以明示或者隐含地包括一个或者更多个该特征。
在介绍本申请实施例的方法之前，先介绍一下几个相关概念。
1、泛在网络
泛在网络从字面上可以理解为广泛存在、无所不在的网络。也就是人置身于无所不在的网络之中，实现人在任何时间、地点，使用任何网络与任何人与物的信息交换，基于个人和社会的需求，利用现有网络技术和新的网络技术，为个人和社会提供泛在的，无所不含的信息服务和应用。现代互联网是一个巨大的由多种类型计算机网络互连的集合，网络的类型一直在增加，现在包括多种多样的无线通信技术。最终结果是联网已成为一个泛在的资源，设备可以在任何时间、任何地方被连接。
应理解，机器到机器(machine to machine，M2M)的无线数据传输、传感器网络(sensor network)、近距离无线通信技术(near field communication，NFC)、无线局域网(wireless local area networks，WLAN)(如无线保真(wireless fidelity，Wi-Fi)网络)、蓝牙(bluetooth，BT)、全球导航卫星系统(global navigation satellite system，GNSS)、调频(frequency modulation，FM)、红外技术(infrared，IR)等无线通信技术的发展促进了泛在网络的应用。
2、分布式网络系统
分布式网络也叫网状网络，由分布在不同地点的计算机系统互连而成，网中无中心节点，各个节点之间可以相互通信，通信控制功能分布在各节点上。分布式网络具有可靠性高、网内节点共享资源容易的特点，广泛应用在多媒体数据库管理、音视频传输、视频点播等领域。
图1是本申请实施例提供的一例分布式网络系统100的示意图，如图1所示，在分布式网络系统100中，可以包括多个电子设备，例如设备A、设备B、设备C、设备D和设 备E等。示例性的，该分布式网络系统100可以包括手机、平板电脑、可穿戴设备、车载设备、增强现实(augmented reality，AR)/虚拟现实(virtual reality，VR)设备、笔记本电脑、超级移动个人计算机(ultra-mobile personal computer，UMPC)、上网本、个人数字助理(personal digital assistant，PDA)等电子设备中的任意一种或者多种，应理解，本申请实施例对分布式网络系统中包括的电子设备的数量和形态不做限定。
此外，该分布式网络系统100的任意两个电子设备相互通信可以有多种不同的方式，例如通过连接的方式或者借助于未来通信技术的方式进行通信以传输数据。其中，连接的方式可以包括有线连接或者无线连接等多种不同连接方式。示例性的，两个电子设备之间可以是通过USB数据线连接；两个电子设备之间的无线连接可以是通过建立Wi-Fi连接、近场通信的靠近连接、蓝牙扫码连接等。两个电子设备还可以借助于未来通信技术的方式，例如通过在手机和平板上安装不同或相同的应用，借助于5G通信网络传输数据，本申请实施例对两个电子设备之间的连接方式或者通信方式不做限定。
一种可能的实现方式中，目前对于通信过程中，保证数据安全的措施手段可以列举如表1所示。如下表1所示，对于不同的通信实体、通信内容或者通信通道，可以对应不同的安全措施，以提高分布式网络系统中数据访问的安全性。
表1
Figure PCTCN2021084452-appb-000001
在分布式网络系统的多个电子设备交互的场景下，可以借助云端认证服务器，完成设备认证和用户认证。示例性的，在多电子设备的分布式网络系统中，安全访问策略一般是基于设备认证/账号认证，如果应用通过认证，则可以认为多个电子设备之间互信，一台电子设备上面的应用可以访问另一台电子设备上面的进程，并通过此进程访问原设备上面的资源。示例性的，在设备认证过程中，可以用于本设备对其他设备的认证过程。例如本设备在收到其他设备发送的设备名称后，本设备可以根据其他设备的设备名称来确定本设备和其他设备是否属于同一账号下的设备。或者，在用户认证过程中，用户1申请一个华为账号，云端认证服务器认证该账号登录了该用户的手机、平板和家庭电视，从而可以实现手机、平板和家庭电视之间的数据共享，如通过家庭电视访问手机上的视频资源。
随着泛在网络的发展，账号可以作为串联多个电子设备的有效手段，但是账号被窃取、泄漏或者不当使用的情况也逐渐增加，因此仅靠设备认证/账号认证，不足以保护在泛在网络下分布式网络系统的通信安全。
另一种可能的实现方式中，在服务提供方或者路由节点中设置网关功能，来检查并过滤服务申请者的权限，从而达到限制服务申请者对服务提供者资源访问的作用。在该实现过程中，权限的检查是在服务提供方，而泛在网络中，由于会加入多个轻量级电子设备，这会导致服务提供者所在路由节点影响缓慢，影响用户体验。
此外，在分布式网络系统中，对于不同的应用进程，数据访问的安全需求不一样。例如，用户不希望平板、家庭电视等设备访问手机的聊天应用、工作应用等包含的私密数据。或者，在不同应用场景下的数据访问的安全需求不一样。例如，在家里，用户会期待家居智能设备(家庭电视)可以自动连接访问，比如自动地将手机来电通话投射到大屏电视上；但是在商场里，用户不会期望有其他电子设备自动访问手机数据的行为。因此，对于不同的应用，或者不同的场景，访问数据的安全要求不同，需要不同的安全访问策略来满足不同的用户需求。
本申请实施例提供一种安全访问数据的方法，可以应用于电子设备，该方法可以是单独的应用程序，该应用程序可以应用在分布式网络系统中的任意的电子设备，以提高数据访问的安全等级。
具体地，本申请实施例提供的安全访问数据的方法可以应用于上述列举的手机、平板电脑、可穿戴设备、车载设备、笔记本电脑、平板等电子设备上，本申请实施例对电子设备的具体类型不作任何限制。
示例性的，图2是本申请实施例提供的一例电子设备200的结构示意图。该电子设备200可以是包括处理器210、存储器220、通信模块230、显示屏240等。
其中，处理器210可以包括一个或多个处理单元，存储器220用于存储程序代码和数据。在本申请实施例中，处理器210可执行存储器220存储的计算机执行指令，用于对电子设备200的动作进行控制管理。
通信模块230可以用于电子设备200的各个内部模块之间的通信、或者电子设备200和其他外部电子设备之间的通信等。示例性的，如果电子设备200通过有线连接的方式和其他电子设备通信，通信模块230可以包括接口等，例如USB接口，USB接口可以是符合USB标准规范的接口，具体可以是Mini USB接口，Micro USB接口，USB Type C接口等。USB接口可以用于连接充电器为电子设备200充电，也可以用于电子设备200与外围设备之间传输数据。也可以用于连接耳机，通过耳机播放音频。该接口还可以用于连接其他电子设备，例如AR设备等。
或者，通信模块230可以包括音频器件、射频电路、蓝牙芯片、无线保真(wireless fidelity，Wi-Fi)芯片、近距离无线通讯技术(near-field communication，NFC)模块等，可以通过多种不同的方式实现电子设备200与其他电子设备之间的交互。
显示屏240用于显示图像、视频等。可选地，电子设备200还可以包括外设设备250，例如鼠标、键盘、扬声器、麦克风等。
应理解，除了图2中列举的各种部件或者模块之外，本申请实施例对电子设备200的结构不做具体限定。在本申请另一些实施例中，电子设备200还可以包括比图示更多或更少的部件，或者组合某些部件，或者拆分某些部件，或者不同的部件布置。图示的部件可以以硬件，软件或软件和硬件的组合实现。
电子设备200的软件系统可以采用分层架构，事件驱动架构，微核架构，微服务架构， 或云架构。本申请实施例以分层架构的Android系统为例，示例性说明电子设备200的软件结构。
图3是本申请实施例提供的一例电子设备200的软件结构框图。分层架构300将软件分成若干个层，每一层都有清晰的角色和分工。层与层之间通过软件接口通信。在一些实施例中，将Android系统分为四层，从上至下分别为应用程序层310、应用程序框架层320、内核层330以及网络层340。
其中，如图3所示，应用程序层可以包括一系列应用程序包。应用程序包可以包括相机、图库、音乐、视频、设置等应用程序。
应用程序框架层320为应用程序层310的应用程序提供应用编程接口(application programming interface，API)和编程框架。应用程序框架层包括一些预先定义的函数。
如图3所示，应用程序框架层320可以包括安全管理模块10、窗口管理器、资源管理器、通知管理器等。窗口管理器用于管理窗口程序。窗口管理器可以获取显示屏大小，判断是否有状态栏，锁定屏幕，截取屏幕等。资源管理器为应用程序提供各种资源，比如本地化字符串，图标，图片，布局文件，视频文件等等。通知管理器使应用程序可以在状态栏中显示通知信息，该消息可以短暂停留后自动消失，无需用户交互。比如通知管理器被用于告知下载完成，消息提醒等。通知管理器还可以是以图表或者滚动条文本形式出现在系统顶部状态栏的通知，例如后台运行的应用程序的通知，还可以是以对话窗口形式出现在屏幕上的通知。例如在状态栏提示文本信息，发出提示音，电子设备振动，指示灯闪烁等。
此外，安全管理模块10为本申请实施例新增的功能模块，可以实现本申请实施例中介绍的安全访问数据的方法，本申请将在后续实施例中详细描述。
应理解，本申请实施例列举了将安全管理模块10设置在应用程序框架层320的情况，该安全管理模块10还可以设置在内核层330中，本申请实施例对此不作限定。只要与本申请实施例提供的安全管理模块10相同的功能，均在本申请的保护范围之内。
应用程序层310和应用程序框架层320运行在虚拟机中。虚拟机将应用程序层310和应用程序框架层320的java文件执行为二进制文件。虚拟机用于执行对象生命周期的管理，堆栈管理，线程管理，安全和异常的管理，以及垃圾回收等功能。
内核层330是硬件和软件之间的层。内核层330至少包含多种设备驱动，例如显示驱动、摄像头驱动、音频驱动、传感器驱动等。此外，内核层330还可以包括进程调度模块、磁盘数据模块等，本申请实施例对此不做限定。
应理解，以上列举的图2为可能的一种电子设备的结构图，图3为可能的一种电子设备的软件架构图。为了便于理解，本申请以下实施例将以图1所示的分布式网络系统中两个电子设备(例如第一电子设备和第二电子设备)之间的数据访问为例，电子设备可以具有图2所述的结构、图3所示的软件结构。其中，将申请调用服务的第一电子设备称为“服务申请设备”，将提供服务的第二电子设备称为“服务提供设备”。
应理解，服务申请设备和服务提供设备都可以包括图3应用程序框架层320的安全管理模块10，且同一个电子设备即可以作为服务申请设备(或者称为“服务调用设备”)，还可以作为服务提供设备。例如，图1中的设备A可以申请设备B的进程权限，同时设备B还可以反过来申请设备A的进程权限。当设备A申请设备B的进程权限时，设备A为服 务申请设备，设备B为服务提供设备；当设备B反过来申请设备A的进程权限时，设备B为服务申请设备，设备A为服务提供设备，本申请实施例对此不做限定。
还应理解，本申请的分布式网络系统中，从进程的角度，控制两个电子设备(服务申请设备和服务提供设备)之间的资源访问权限。进程(process)是一个具有一定独立功能的程序关于某个数据集合的一次运行活动，是系统进行资源分配和调度的基本单位，是操作系统基本的执行单元。因此，本申请实施例将通过限制服务申请设备和服务提供设备上进程的访问权限来提高数据访问的安全性。
图4是本申请实施例提供的一例安全管理模块10的示意图。在本申请实施例中，安全管理模块10还可以称为“安全中间件”、“安全模块”等，只要实现和本申请实施例介绍的安全管理模块10相同的功能，都落入本申请的保护范围。
如图4所示，该安全管理模块10可以包括权限配置数据模块11、权限策略模块12、本地权限管理模块13和网络权限管理模块14。在介绍安全管理模块10包括的各个模块之前，先引入几个基本概念。
1、权限对象
在本申请实施例中，以进程为例，“权限对象”可以理解为不同的进程，换言之，一个进程可以作为一个权限对象。在面向对象的方式中，一个权限对象包含一组权限的描述，将每个进程相关的权限要求描述为一个进程绑定的权限对象。每条权限对象包含权限标识、权限作用对象、权限限制操作等权限作用因素。一般地，在同一电子设备内，权限对象可以由其绑定进程，或者系统内核进行处理检查。
此外，在本申请实施例中，可以将服务提供设备提供的进程称为“服务进程”，将服务申请设备提供的进程称为“应用进程”。当有其它进程需要访问服务进程的功能时，需要首先通过进程绑定的权限对象的检查，才可以正常访问服务进程的功能或者资源。
2、权限存根对象
在分布式网络系统中，跨设备的进程服务之间是不能直接访问的。在本申请实施例中，提供一种权限代理方案，对于服务提供设备，当某个服务进程声明注册其可以对外提供分布式访问能力时，服务提供设备的安全管理模块10会首先由权限配置数据模块11检查该服务进程的权限对象是否合法，是否可以正常对外提供能力。服务提供设备的安全管理模块10会将服务进程绑定的权限对象，然后服务申请设备根据该权限对象，在本地权限管理模块13中存入一个引用副本，即创建一个存根对象，称之为“权限存根对象”。这个权限存根对象拥有服务进程的权限对象的中所有针对分布式网络系统提供的能力约束。
3、权限代理对象
在本申请实施例中，对于服务申请者设备，其可以通过网络访问服务提供设备的权限存根对象的信息，结合本地的安全管理模块10中动态创建一个代理对象，即这里所说的“权限代理对象”。
4、权限对象策略
服务提供设备提供的每个服务进程的权限对象都会有一条或者多条策略，用户控制该权限对象在不同场景下面的行为，从而达到同一权限对象可以随着场景变化而动态自调整的方案。
在本申请实施例中，权限对象策略可以是一条具体配置的策略数据，也可以是相关策 略控制算法或者策略控制模型。
这里需要补充说明的是，本申请实施例的权限对象策略着重于控制对服务进程的访问能力，当然类似的权限对象策略也可以用于控制本地的应用进程的访问，本申请实施例对此不作限定。
基于上述概念和定义，该安全管理模块10的权限配置数据模块11用于保存权限配置数据，该权限配置数据记录了本地允许的权限配置情况，例如包含权限限制的描述，同时提供了不同电子设备间权限对象的规约。当不同设备权限配置数据有冲突时，该安全管理模块10需要按着权限的冲突解决条件进行冲突解决，例如根据当前电子设备的版本条件等保障不同电子设备间权限是一致的。
权限策略模块12，主要包含权限对象策略，用于管理权限对象，以及自动同步权限存根对象和权限代理对象的策略。一种可能的实现方式中，权限策略模块12可以按权限对象策略同步分布式网络系统100包括的所有电子设备间的权限对象，主要包括权限存根对象的正向同步以及权限代理对象的逆向反馈。另一种可能的实现方式中，权限策略模块12还可以根据场景要求，自动调整本地或者代理权限对象策略。
本地权限管理模块13，主要负责管理本地的服务进程，应理解，每个服务进程对应一个权限对象，本地权限管理模块13可以管理本地的权限对象。
应理解，一般地，电子设备操作系统对每个本地的应用进程都会设置相关的权限对象策略，即安全管理模块10在本地权限管理模块13中创建一个存根对象，即前述介绍的“权限存根对象”。当该电子设备作为服务提供设备时，这个权限存根对象拥有服务进程的权限对象的中所有针对分布式网络系统提供的能力约束。示例性的，Android系统中的内核模块SeLinux权限管理方案，本地权限管理模块13绑定进程要操作的资源或者服务、操作方法以及操作本身(如进程的身份标识ID等)。
网络权限管理模块14，主要负责对访问其他电子设备的服务进程的权限查询，以及对权限代理对象的管理。
图5是本申请实施例提供的一例权限对象的结构示意图。服务申请设备20和服务提供设备30的权限对象的结构如图5所示，对于服务申请设备20，本地权限管理模块13保存了本地的权限存根对象列表，该权限存根对象列表中包括一个或者多个权限存根对象的信息和每个权限存根对象的权限对象策略，每个权限对象策略包括该权限存根对象的权限要求、服务标识、访问接口、操作接口、资源标识等信息的一种或者多种，本申请实施例对此不做限定。
示例性的，该权限存根对象列表中包括权限存根对象1-权限存根对象N，其中权限存根对象1具有存根对象标签1，对应权限要求1、服务标识1和访问接口1。权限存根对象2具有存根对象标签1，对应为权限要求1时，具有资源标识1和操作接口1；当权限存根对象2对应为权限要求2时，具有服务标识2和访问接口2。
对于服务提供设备30，网络权限管理模块14保存了服务申请设备20的权限代理对象列表，该权限代理对象列表中包括一个或者多个权限代理对象的信息。应理解，该服务提供设备30保存的服务申请设备20的权限代理对象就是服务申请设备20的本地权限管理模块13的权限存根对象，因此，服务提供设备30的权限代理对象列表和服务申请设备20的权限存根对象列表具有一一对应关系。
应理解，在本申请实施例中，权限代理对象在服务申请设备20的访问进程首次访问服务提供设备30服务进程时生成，并存入服务提供设备30的网络权限管理模块14，同时由网络权限检查模块完成对服务申请设备20的访问进程的权限检查，判断其是否可以继续访问服务提供设备30的能力。其中，本申请实施例所说的“访问进程”用于电子设备之间的访问，是实现服务申请设备20和服务提供设备30之间的信息交互的方式，区别于前述介绍的“服务进程”和“应用进程”，此处不再赘述。
之后，当服务申请设备20的同一访问进程或者其它访问再次访问服务提供设备30的同一服务进程的服务能力时，服务提供设备30的网络权限管理模块14即可基于存储于本地的权限判断该访问进程是否拥有访问服务提供设备30的能力，从而降低了对网络访问要求，提高安全处理的效率。
对于图5中列举的权限存根对象列表和权限代理对象列表，这里需要说明的是，权限存根对象以及权限代理对象的结构以及生命周期情况。
当分布式网络系统的服务申请设备20声明注册其分布式能力时，会将其进程绑定的权限对象注册存入安全中间件中，此时服务申请设备20的安全管理模块10会自动生成权限对象的存根对象标签，并绑定存根对象标签与权限对象之间的一一映射关系。
之后，当有服务申请设备20申请该服务进程提供的能力时，会首先根据服务申请设备20的访问接口，查看当前网络权限管理模块14的网络权限代理是否有此访问接口的权限代理对象。如果有的话，则直接通过该权限代理对象判断目前服务申请设备20的访问接口是否拥有访问服进程的能力。否则，在服务提供设备30，查询该访问接口对应的权限存根对象，并将权限存根对象的存根对象标签传输到服务申请设备20上。服务申请设备20上的安全管理模块10，可以根据存根对象标签的信息以及权限配置数据模块11的信息，自动生成服务申请设备20上面的权限代理对象，然后再通过权限代理对象来判断服务申请设备20是否有权限继续访问服务提供设备30的服务进程的能力。可选地，图5中可以先由服务提供设备30生成权限代理对象列表，再更新到服务申请设备20侧的权限存根对象列表，两个列表具有一一对应的关系。
应理解，本申请实施例以采用面向对象的方法来举例介绍，实际过程中，可以采用面向对象方法，也可以采用面向过程方法，还可以由系统绑定相关服务进程来实现，本申请实施例对此不做限定。
还应理解，对于服务申请设备20和服务提供设备30，每一个设备都可以包括图5中所示的权限存根对象列表和权限代理对象列表，但是一个服务申请设备20的权限存根对象列表和一个服务提供设备30的权限代理对象列表之间具有一一映射关系，同一个服务申请设备20的权限存根对象列表和自身保存的权限代理对象列表之间可以不同。
图6是本申请实施例提供的一例服务申请设备和服务提供设备的交互示意图。如图6所示，本申请实施例提供的安全访问数据的方法应用于包括服务申请设备20和服务提供设备30的分布式网络系统中。应理解，为了简便，图6中只示出了服务申请设备20和服务提供设备30的部分模块，例如参与该过程的安全管理模块10。此外，该服务申请设备20也可以作为服务提供设备，同理，该服务提供设备30，实现同样的功能，本申请实施例对此类似的过程不再赘述。该方法600包括：
601，服务提供设备30注册一个或多个服务进程，即在本地权限管理模块13注册一 个或多个服务进程，并发布其分布式能力。
应理解，服务进程的分布式能力可以理解为服务提供设备30上的某个进程被分布式网络系统中的其他电子设备访问并使用的能力。例如用户手机安装的视频应用的服务进程可以被家庭的大屏电视访问并使用。
还应理解，服务提供设备30首先要对外声明自己的一个或多个服务进程提供对外访问能力，并在安全管理模块10注册其每个服务进程的权限对象，即“权限存根对象”，例如REMOTE_X_ACCESS。这里需要说明的是，权限存根对象的本质是权限对象在安全管理模块10中的代理模型，即权限存根对象相关对应的实现权限模型，并在权限配置数据模块11中记录。
一种可能的实现方式中，服务申请设备20与服务提供设备30进行连接(不限于首次连接或者每次连接)时，彼此之间会同步彼此权限配置数据模块11中记录的权限配置数据，达到两端设备的权限规约的一致性。此时，服务申请设备20与服务提供设备30可以以安全访问列表的方式告知彼此具有对外访问能力的进程(可以包括服务进程和应用进程)。例如对于服务提供设备30的REMOTE_X_ACCESS，此时REMOTE_X_ACCESS声明的相关权限规约也会同步到服务申请设备20上面。
可选地，安全访问列表可以包括服务提供设备30的权限控制列表的信息，比如远程蓝牙权限、远程定位权限、远程视频播放权限等，其中远程蓝牙、远程定位、远程视频播放分别代表一个服务进程。
可选地，权限配置数据模块11中记录的每个服务进程的权限配置数据可以包括每个服务进程的权限描述、权限控制对象、权限控制操作等的一种或者多种信息。
602，服务提供设备30的权限配置数据模块11根据本地权限管理模块13注册的一个或多个服务进程的权限配置数据进行校验，生成对应的权限存根对象。
603，服务提供设备30的本地权限管理模块13存储权限存根对象。
应理解，一个服务进程对应一个权限存根对象，服务提供设备30根据多个服务进程生成权限存根对象列表，并保存在本地权限管理模块13。该权限存根对象列表可以参照图5中的服务申请设备20的权限存根对象列表，此处不再赘述。
图7是本申请实施例提供过的一例服务申请设备访问服务提供设备的服务进程的示意图。示例性的，以服务申请设备20上的用户1的一个应用进程1需要访问服务提供设备30的用户1的服务进程2的过程为例，介绍安全访问的方法。
604，服务申请设备20接收访问第一服务进程的请求，该第一服务进程是服务提供设备30上具有分布式能力的应用对应的进程。
结合图7，服务申请设备20上的用户1的一个应用进程1首先向网络权限管理模块14申请对服务提供设备30的服务进程2的访问权限，即“第一服务进程的请求”。
605，服务申请设备20的网络权限检查模块查询网络权限代理模块是否拥有当前申请第一服务进程的访问接口的权限代码。
606-607，如果网络权限代理模块没有第一服务进程的访问接口的权限代码，服务申请设备20向服务提供设备30发送查询请求，查询服务提供设备30中第一服务进程的访问接口对应的权限存根对象。
608，服务提供设备30的接收服务申请设备20发送的查询请求，确定第一服务进程 的访问接口对应的第一权限存根对象。以及判断自身安全管理模块10的本地权限管理模块13中是否已经注册了该第一权限存根对象。
609，如果服务提供设备30的本地权限管理模块13中已经注册且存在该第一权限存根对象，服务申请设备20的网络权限代理模块根据第一权限存根对象生成第一权限代理对象。
还应理解，步骤609中，如果服务提供设备30的本地权限管理模块13中没有注册且不存在该第一权限存根对象，则服务申请设备20的网络权限代理模块不生成第一权限代理对象。
还应理解，如果第一服务进程的请求是首次申请对服务进程2的权限，则安全管理模块10会按其工作流程，在服务申请设备20生成其权限代理对象，然后后续使用中(例如非首次申请对服务进程2的权限)，权限代理对象进行校验时，安全管理模块10可以按上文图5中列举的权限存根对象列表和权限代理对象列表的结构定义中的说明，直接查询到第一服务进程的访问接口对应的第一权限存根对象，进一步确定第一权限代理对象。
为了防止每次都进行失败网络交互，当服务提供设备30拒绝服务申请设备20对服务进程2的访问时，可以对失败的操作生成匿名的空的代理对象，之后当此类代理对象访问时，会一直返回失败，从而减少网络交互次数，使得网络配置更加灵活。
610，服务申请设备20的网络权限检查模块根据第一权限代理对象，检查当前的访问接口是否被允许访问。
具体地，服务申请设备20的网络权限检查模块结合第一权限代理对象和相关算法判断当前对服务进程2的访问是否满足安全要求，并做出允许或者拒绝的操作，继续执行以下步骤611。
611，如果满足安全要求，则服务提供设备30允许服务申请设备20对服务进程2的访问；否则，服务提供设备30拒绝服务申请设备20对服务进程2的访问。
以上步骤604-步骤611的过程可以对应如图7所示的①②③④⑤的过程，此处不再赘述。
如果服务提供设备30拒绝服务申请设备20对服务进程2的访问，则可以在安全管理模块10中直接中断服务申请设备20的第一服务进程的请求。
如果服务提供设备30允许服务申请设备20对服务进程2的访问，则可以向服务提供设备30发送第一服务进程的请求，并由服务提供设备30处理服务申请设备20的访问请求。
通过上述过程，当服务申请设备20上面的某个应用进程1希望访问服务提供设备30的服务进程2时，可以通过安全管理模块10首先检查服务申请设备20应用进程1是否具有访问服务提供设备30服务进程2的权限。具体地，可以通过服务申请设备20的安全管理模块10查询是否有将要访问服务进程2的接口的代理权限对象，如果没有，则按上文步骤604-步骤611的过程生成权限代理对象，然后结合权限代理对象以及权限对象策略，对访问权限进行判断，控制接收或者拒绝服务进程2的接口的访问。
上述技术方案，在分布式网络系统中，以电子设备的进程作为权限对象，设计一种权限管理方案，通过安全管理模块控制其他电子设备的进程调用权限，从而约束其它电子设备的进程安全性。并将本机的应用进程的权限管理方案拓展到分布式网络系统中的其他电 子设备，提升了跨设备的权限管理的粒度，可以实现更细粒度跨设备的进程权限安全管理操作。
此外，本申请实施例还可以将远端电子设备的应用进程的权限检查，转化近端电子设备内的安全管理模块的权限检查，进一步节省网络资源，且实现了分布式网络系统的灵活配置，降低了跨设备进程权限管理的开销，提升了安全处理的效率。
本申请实施例采用面向对象的权限管理方式，使服务进程权限的检查过程发生在服务申请设备侧，通过安全管理模块的形式，保证安全访问策略的一致性，这样在泛在网络的情况下，可以有效降低安全检查对网络的依赖性，降低访问服务进程的申请时长，提升用户体验。
另一种可能的实现方式中，权限策略模块12还可以根据场景要求，自动调整本地或者代理的权限对象策略。
可选地，针对权限存根对象的权限对象策略，可以由用户进行自定义，或者在云端进行分定义。例如，主动配置权限对象策略，并存储在权限存根对象所在的电子设备中。
可选地，针对权限代理对象的权限对象策略，可以自动在服务申请设备和服务提供设备之间进行同步，或者在云端进行同步。例如，依赖于主动配置权限对象策略的被动配置策略数据，可以存储在权限代理对象所在的电子设备中。
示例性的，结合图7，当服务申请设备20中的应用进程1首次去访问服务提供设备30的服务进程2时，可以在服务申请设备20的安全管理模块10中自动创建一个权限代理对象，与此同时会将这个权限代理对象对应的权限存根对象的相关权限对象策略同步到安全管理模块10的权限策略模块12中。之后，当服务申请设备20去访问服务提供设备30的服务进程2时，会首先通过本地安全管理模块10中权限策略模块12的处理，可以按照服务提供设备30的策略要求，动态调整本地对远端电子设备的接口调用方法。
一种可能的情况中，当前服务提供设备30的服务进程2的策略发生变化时，安全管理模块10可以保障服务进程2的策略的及时更新同步，从而屏蔽原来的服务申请设备20与服务提供设备30的服务进程2的彼此对权限策略的依赖。
假设用户期望其设备的某进程可以对外提供分布式能力，但是为了提高访问该进程的安全性，可以在限定的场景下可以使用该进程的分布式能力。同时，针对不同的应用场景，该进程的分布式能力的权限对象策略也可以不同，或者说，电子设备对外提供的分布式能力会随着应用场景的变化而发生变化。
图8是本申请实施例提供的一例权限对象策略的约束示意图。如图8所示，电子设备的服务进程1和服务进程2可以对外提供分布式能力，但是可以针对服务进程1和服务进程2，设置不同的权限对象策略进行约束。
示例性的，如图8的箭头所示，针对服务进程1设置以下约束条件：
(1)在家的场景中，可以无要求允许远端电子设备中的应用进程访问该服务进程1；
(2)在公司场景中，只能在某个特定区域内，允许远端电子设备中的应用进程访问该服务进程1；
(3)但是在其它区域采用默认行为，不允许远端电子设备的应用进程访问该服务进程1。
针对服务进程2设置以下约束条件：
(1)只允许在驾车场景中，允许远端电子设备的应用进程访问该服务进程2。
示例性的，以手机为例，服务进程1可以是用户手机上视频应用对应的进程，服务进程2可以是用户手机上拨打电话对应的进程。
示例性的，针对用户进行访问手机视频数据，在家里，会允许智能音箱或者智能电视自动连接到用户手机上并获取视频数据进行播放。但是商场或者其它公共场所是不允许自动连接和访问，无论之前是否建立过安全认证，必须经过用户确认之后再处理。
可选地，应用进程所在的电子设备(即服务申请设备)可以通过GPS等定位方式、或者电子设备连接的基站所在位置等条件判断当前所处的场景为家的场景或者公司场景等，本申请实施例对此不做限定。
可选地，以上除了在不同的应用场景下设置不同的权限对象策略之外，还可以针对不同的电子设备，设置不同的权限对象策略。示例性的，设置用户的智能手表在任何场景下都可以访问用户的手机的任意进程，本申请实施例对此不再赘述定。
应理解，以上实施例只是列举了一种静态配置的在不同场景下动态调整权限对象策略的策略模型，实际实现过程中，权限对象策略也可以一种基于环境变量的动态调整算法，或者其它约束模块。
还应理解，权限代理对象的采用的权限对象策略的策略模型，需要与权限存储对象配置的线束策略模型一致。
通过上述方法，在分布式网络系统中，约束服务申请设备对本端服务提供设备的访问时，可以跟随应用场景的变化进行自适应调整，静态或者动态配置在不同场景下不同的权限对象策略，限制敏感应用只在相对安全的场景下，可以执行安全敏感操作，而其它环境中被限制使用，从而提高系统的安全性。同时，动态配置权限对象策略的过程可以发生在对端电子设备的安全管理模块上，可以有效降低安全策略控制对网络的依赖，提高用户的体验。
综上所述，本申请实施例以进程作为权限对象，设计了分布式的权限对象管理模型，提出一种在分布式网络系统中安全访问数据的方法，使用权限对象代理的方案来控制在服务申请设备上面的进程访问能力，从而达到限制服务申请设备对服务提供设备的进程访问的能力，进而约束了分布式网络系统中的远端电子设备进程对本端电子设备的服务进程的访问，提高分布式网络系统在进程级别的安全性，降低其中安全需求对网络的依赖强度，使得网络配置更加灵活。
具体地，在电子设备中引入安全管理模块，为电子设备的每个进程绑定一个权限对象，在分布式网络系统中，当服务提供设备的某个进程对外提供分布式能力时，可以将该进程的权限对象通过安全管理模块中分发到服务申请设备的安全管理模块中，并生成与之对应的权限代理对象，然后服务申请设备中的安全管理模块会基于该进程的权限代理对象，判断对当前设备的服务申请设备是否可以拥有对该进程的访问能力。
对于安全管理模块中每一条权限对象，会绑定相关的权限对象策略(或者称为“安全策略约束”)。在具体实现过程中，该权限对象策略可以是静态配置策略，也可以是基于环境变量的动态调整算法，根据权限对象策略，可以令权限代理对象的行为在服务申请设备中随着应用场景变化而自适应变化，从而限制服务申请设备执行的安全操作。此外，该权限对象的权限对象策略会跟随服务提供设备中的权限存根对象的策略进行自动同步变 化。
可选地，具有分布式能力的权限代理对象可以是首次动态生成的，例如当服务提供设备的该进程声明可以对外提供分布式能力时，会首先将该进程对应的权限对象一一映射到安全管理模块中，并生成权限存根对象。当分布式网络系统中的其他远程电子设备调用该权限对象时，服务提供设备的安全管理模块，会根据其将要访问该权限对象的访问接口，动态自动生成服务申请设备的访问接口对应的权限存根对象的权限代理对象，然后通过权限代理对象结合其相应的权限对象策略，控制服务提供设备对外接口的访问能力；并且权限代理对象的生命周期会跟随着权限存根对象的变化而自适应变化。
可以理解的是，分布式网络系统中的电子设备为了实现上述功能，其包含了执行各个功能相应的硬件和/或软件模块。结合本文中所公开的实施例描述的各示例的算法步骤，本申请能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。本领域技术人员可以结合实施例对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
本实施例可以根据上述方法示例对电子设备进行功能模块的划分，例如，可以对应各个功能划分各个功能模块，也可以将两个或两个以上的功能集成在一个处理模块中。上述集成的模块可以采用硬件的形式实现。需要说明的是，本实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
在采用对应各个功能划分各个功能模块的情况下，该电子设备可以包括：显示单元、检测单元和处理单元等。需要说明的是，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
本实施例提供的电子设备，用于执行上述安全访问数据的方法，因此可以达到与上述实现方法相同的效果。
在采用集成的单元的情况下，电子设备可以包括处理模块、存储模块和通信模块。其中，处理模块可以用于对电子设备的动作进行控制管理，例如，可以用于支持电子设备执行上述显示单元、检测单元和处理单元1执行的步骤。存储模块可以用于支持电子设备执行存储程序代码和数据等。通信模块，可以用于支持电子设备与其他设备的通信。
其中，处理模块可以是处理器或控制器。其可以实现或执行结合本申请公开内容所描述的各种示例性的逻辑方框，模块和电路。处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，数字信号处理(digital signal processing，DSP)和微处理器的组合等等。存储模块可以是存储器。通信模块具体可以为射频电路、蓝牙芯片、Wi-Fi芯片等与其他电子设备交互的设备。
在一个实施例中，当处理模块为处理器，存储模块为存储器时，本实施例所涉及的电子设备可以为具有图2或者图3所示结构的设备。
本实施例还提供一种计算机可读存储介质，该计算机可读存储介质中存储有计算机指令，当该计算机指令在电子设备上运行时，使得电子设备执行上述相关方法步骤实现上述实施例中的安全访问数据的方法。
本实施例还提供了一种计算机程序产品，当该计算机程序产品在计算机上运行时，使得计算机执行上述相关步骤，以实现上述实施例中的安全访问数据的方法。
另外，本申请的实施例还提供一种装置，这个装置具体可以是芯片，组件或模块，该装置可包括相连的处理器和存储器；其中，存储器用于存储计算机执行指令，当装置运行时，处理器可执行存储器存储的计算机执行指令，以使芯片执行上述各方法实施例中的安全访问数据的方法。
其中，本实施例提供的电子设备、计算机存储介质、计算机程序产品或芯片均用于执行上文所提供的对应的方法，因此，其所能达到的有益效果可参考上文所提供的对应的方法中的有益效果，此处不再赘述。
通过以上实施方式的描述，所属领域的技术人员可以了解到，为描述的方便和简洁，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将装置的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。
在本申请所提供的几个实施例中，应该理解到，所揭露的装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，模块或单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个装置，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是一个物理单元或多个物理单元，即可以位于一个地方，或者也可以分布到多个不同地方。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个可读取存储介质中。基于这样的理解，本申请实施例的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该软件产品存储在一个存储介质中，包括若干指令用以使得一个设备(可以是单片机，芯片等)或处理器(processor)执行本申请各个实施例方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上内容，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以权利要求的保护范围为准。

Claims (21)

  1. 一种安全访问数据的方法，其特征在于，应用于包括第一电子设备和第二电子设备的分布式网络系统中，所述方法包括：
    所述第一电子设备向所述第二电子设备发送第一服务进程的请求，所述第一服务进程是所述第二电子设备上具有分布式能力的应用对应的进程；
    所述第二电子设备根据所述第一服务进程的请求，确定所述第一服务进程的访问接口对应的第一权限存根对象以及所述第一权限存根对象的权限对象策略；
    所述第二电子设备向所述第一电子设备发送所述第一权限存根对象和所述第一权限存根对象的权限对象策略；
    所述第一电子设备根据所述第一权限存根对象和所述第一权限存根对象的权限对象策略，生成第一权限代理对象和所述第一权限代理对象的权限对象策略；
    所述第一电子设备根据所述第一权限代理对象和所述第一权限代理对象的权限对象策略，确定当前所述第一服务进程的访问接口是否被允许访问；
    当所述第一服务进程的访问接口被允许访问时，所述第一电子设备访问所述第二电子设备的所述第一服务进程的数据。
  2. 根据权利要求1所述的方法，其特征在于，所述第一电子设备向所述第二电子设备发送所述第一服务进程的请求之前，所述方法还包括：
    所述第一电子设备接收访问所述第一服务进程的请求；
    响应于所述第一服务进程的请求，所述第一电子设备确定所述第一服务进程的访问接口的权限；
    所述第一电子设备确定当前没有针对所述第一服务进程的访问接口的权限。
  3. 根据权利要求1或2所述的方法，其特征在于，所述方法还包括：
    所述第二电子设备注册N个服务进程，发布所述N个服务进程中每个服务进程的分布式能力，所述第一服务进程是所述N个服务进程中的任意一个，N为正整数；
    所述第二电子设备根据注册的所述N个服务进程，确定所述N个服务进程中每个服务进程的权限对象策略；
    所述第二电子设备根据所述N个服务进程和N个服务进程的权限对象策略，生成权限存根对象列表，所述权限存根对象列表包括与所述每个服务进程一一对应的N个权限存根对象的信息和所述N个权限存根对象的权限对象策略。
  4. 根据权利要求3所述的方法，其特征在于，所述第一电子设备向所述第二电子设备发送第一服务进程的请求之后，所述方法还包括：
    所述第二电子设备根据所述第一服务进程的请求，确定所述N个权限存根对象中不包括所述第一权限存根对象；
    所述第二电子设备拒绝所述第一电子设备访问所述第一服务进程的数据。
  5. 根据权利要求1至4中任一项所述的方法，其特征在于，所述第一权限存根对象的权限对象策略包括以下信息中的至少一种：
    所述第一权限存根对象的权限要求信息、服务标识信息、访问接口信息、操作接口信 息、资源标识信息。
  6. 根据权利要求1至5中任一项所述的方法，其特征在于，所述第一权限存根对象的权限对象策略还包括场景约束信息，所述场景约束信息用于指示针对不同的应用场景或者不同的地理位置或者所述第一电子设备的设备信息，所述第一服务进程被所述第一电子设备访问的权限。
  7. 根据权利要求1至6中任一项所述的方法，其特征在于，所述第一权限存根对象的权限对象策略是用户自定义的策略；或者在云端定义的策略。
  8. 一种安全访问数据的方法，其特征在于，应用于包括第一电子设备和第二电子设备的分布式网络系统中，所述第一电子设备存储有权限代理对象列表和所述权限代理对象列表中每个权限代理对象的权限对象策略，所述方法包括：
    所述第一电子设备接收访问所述第一服务进程的请求，所述第一服务进程是所述第二电子设备上具有分布式能力的应用对应的进程；
    响应于所述第一服务进程的请求，所述第一电子设备确定第一权限代理对象和所述第一权限代理对象的权限对象策略；
    所述第一电子设备根据所述第一权限代理对象和所述第一权限代理对象的权限对象策略，访问所述第一服务进程的数据。
  9. 根据权利要求8所述的方法，其特征在于，所述权限代理对象列表和所述权限代理对象列表中每个权限代理对象的权限对象策略与所述第二电子设备存储的权限存根对象列表和所述权限代理对象列表中每个权限存根对象的权限对象策略是一一对应的。
  10. 根据权利要求8或9所述的方法，其特征在于，所述第二电子设备存储的权限存根对象列表包括N个权限存根对象，所述方法还包括：
    所述第二电子设备注册N个服务进程，发布所述N个服务进程中每个服务进程的分布式能力，所述第一服务进程是所述N个服务进程中的任意一个，N为正整数；
    所述第二电子设备根据注册的所述N个服务进程，确定所述N个服务进程中每个服务进程的权限对象策略；
    所述第二电子设备根据所述N个服务进程和N个服务进程的权限对象策略，生成所述权限存根对象列表，所述权限存根对象列表包括与所述每个服务进程一一对应的N个权限存根对象的信息和所述N个权限存根对象的权限对象策略。
  11. 一种安全访问数据的方法，其特征在于，所述方法包括：
    所述第一电子设备向第二电子设备发送第一服务进程的请求，所述第一电子设备和所述第二电子设备是分布式网络系统中的两个不同电子设备，所述第一服务进程是所述第二电子设备上具有分布式能力的应用对应的进程；
    所述第一电子设备接收根据所述第二电子设备发送的所述第一服务进程的访问接口对应的第一权限存根对象以及所述第一权限存根对象的权限对象策略，其中，第一权限存根对象以及所述第一权限存根对象的权限对象策略是所述第二电子设备根据所述第一服务进程的请求确定的；
    所述第一电子设备根据所述第一权限存根对象和所述第一权限存根对象的权限对象策略，生成第一权限代理对象和所述第一权限代理对象的权限对象策略；
    所述第一电子设备根据所述第一权限代理对象和所述第一权限代理对象的权限对象 策略，确定当前所述第一服务进程的访问接口是否被允许访问；
    当所述第一服务进程的访问接口被允许访问时，所述第一电子设备访问所述第二电子设备的所述第一服务进程的数据。
  12. 根据权利要求11所述的方法，其特征在于，所述第一电子设备向所述第二电子设备发送所述第一服务进程的请求之前，所述方法还包括：
    所述第一电子设备接收访问所述第一服务进程的请求；
    响应于所述第一服务进程的请求，所述第一电子设备确定所述第一服务进程的访问接口的权限；
    所述第一电子设备确定当前没有针对所述第一服务进程的访问接口的权限。
  13. 一种安全访问数据的方法，其特征在于，所述方法包括：
    所述第二电子设备接收所述第一电子设备发送的第一服务进程的请求，所述第一服务进程是所述第二电子设备上具有分布式能力的应用对应的进程；
    所述第二电子设备根据所述第一服务进程的请求，确定所述第一服务进程的访问接口对应的第一权限存根对象以及所述第一权限存根对象的权限对象策略；
    所述第二电子设备向所述第一电子设备发送所述第一权限存根对象和所述第一权限存根对象的权限对象策略；
    当所述第一服务进程的访问接口被允许访问时，所述第二电子设备允许所述第二电子设备访问所述第一服务进程的数据。
  14. 根据权利要求13所述的方法，其特征在于，所述方法还包括：
    所述第二电子设备注册N个服务进程，发布所述N个服务进程中每个服务进程的分布式能力，所述第一服务进程是所述N个服务进程中的任意一个，N为正整数；
    所述第二电子设备根据注册的所述N个服务进程，确定所述N个服务进程中每个服务进程的权限对象策略；
    所述第二电子设备根据所述N个服务进程和N个服务进程的权限对象策略，生成权限存根对象列表，所述权限存根对象列表包括与所述每个服务进程一一对应的N个权限存根对象的信息和所述N个权限存根对象的权限对象策略。
  15. 根据权利要求14所述的方法，其特征在于，所述第二电子设备接收所述第一电子设备发送的第一服务进程的请求之后，所述方法还包括：
    所述第二电子设备根据所述第一服务进程的请求，确定所述N个权限存根对象中不包括所述第一权限存根对象；
    所述第二电子设备拒绝所述第一电子设备访问所述第一服务进程的数据。
  16. 根据权利要求11至15中任一项所述的方法，其特征在于，所述第一权限存根对象的权限对象策略包括以下信息中的至少一种：
    所述第一权限存根对象的权限要求信息、服务标识信息、访问接口信息、操作接口信息、资源标识信息。
  17. 根据权利要求11至16中任一项所述的方法，其特征在于，所述第一权限存根对象的权限对象策略还包括场景约束信息，所述场景约束信息用于指示针对不同的应用场景或者不同的地理位置或者所述第一电子设备的设备信息，所述第一服务进程被所述第一电子设备访问的权限。
  18. 根据权利要求11至16中任一项所述的方法，其特征在于，所述第一权限存根对象的权限对象策略是用户自定义的策略；或者在云端定义的策略。
  19. 一种电子设备，其特征在于，包括：一个或多个处理器；存储器；安装有多个应用程序的模块；以及一个或多个程序，其中所述一个或多个程序被存储在所述存储器中，当所述一个或者多个程序被所述处理器执行时，使得所述电子设备执行如权利要求1至18中任一项所述的方法。
  20. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有计算机指令，当所述计算机指令在电子设备上运行时，使得所述电子设备执行如权利要求1至18中任一项所述的方法。
  21. 一种计算机程序产品，其特征在于，当所述计算机程序产品在计算机上运行时，使得所述计算机执行如权利要求1至18中任一项所述的方法。
PCT/CN2021/084452 2020-05-27 2021-03-31 安全访问数据的方法及电子设备 WO2021238399A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010460456.1 2020-05-27
CN202010460456.1A CN113746777B (zh) 2020-05-27 2020-05-27 安全访问数据的方法及电子设备

Publications (1)

Publication Number Publication Date
WO2021238399A1 true WO2021238399A1 (zh) 2021-12-02

Family

ID=78723704

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/084452 WO2021238399A1 (zh) 2020-05-27 2021-03-31 安全访问数据的方法及电子设备

Country Status (2)

Country Link
CN (1) CN113746777B (zh)
WO (1) WO2021238399A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114285845A (zh) * 2021-12-08 2022-04-05 北京安天网络安全技术有限公司 云环境下的联网认证方法、计算机设备及存储介质

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114285607B (zh) * 2021-12-08 2023-09-22 北京安天网络安全技术有限公司 云环境下的联网认证方法、系统、计算机设备及存储介质
CN116663042B (zh) * 2023-08-01 2023-10-13 北京长扬软件有限公司 多用户级目录的访问控制方法、装置、设备及存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7519596B2 (en) * 2004-03-30 2009-04-14 Microsoft Corporation Globally trusted credentials leveraged for server access control
CN106682494A (zh) * 2016-11-16 2017-05-17 腾讯科技（深圳）有限公司 一种信息访问方法、装置和设备
CN107784221A (zh) * 2016-08-30 2018-03-09 阿里巴巴集团控股有限公司 权限控制方法、服务提供方法、装置、系统及电子设备
CN110140124A (zh) * 2017-12-29 2019-08-16 华为技术有限公司 分组应用使用同一密钥共享数据

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20140229732A1 (en) * 2013-02-12 2014-08-14 Amazon Technologies, Inc. Data security service
CN103200196B (zh) * 2013-04-01 2016-08-03 天脉聚源(北京)传媒科技有限公司 一种用户设备及访问目标间的接入访问方法、系统及装置
US20170103231A1 (en) * 2013-07-20 2017-04-13 Keith Lipman System and method for distributed, policy-based confidentiality management
CN107766717B (zh) * 2016-08-17 2020-04-14 中国移动通信有限公司研究院 一种访问控制方法、装置及系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7519596B2 (en) * 2004-03-30 2009-04-14 Microsoft Corporation Globally trusted credentials leveraged for server access control
CN107784221A (zh) * 2016-08-30 2018-03-09 阿里巴巴集团控股有限公司 权限控制方法、服务提供方法、装置、系统及电子设备
CN106682494A (zh) * 2016-11-16 2017-05-17 腾讯科技（深圳）有限公司 一种信息访问方法、装置和设备
CN110140124A (zh) * 2017-12-29 2019-08-16 华为技术有限公司 分组应用使用同一密钥共享数据

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114285845A (zh) * 2021-12-08 2022-04-05 北京安天网络安全技术有限公司 云环境下的联网认证方法、计算机设备及存储介质
CN114285845B (zh) * 2021-12-08 2023-09-22 北京安天网络安全技术有限公司 云环境下的联网认证方法、系统、计算机设备及存储介质

Also Published As

Publication number Publication date
CN113746777A (zh) 2021-12-03
CN113746777B (zh) 2023-01-06

Similar Documents

Publication Publication Date Title
WO2021238399A1 (zh) 安全访问数据的方法及电子设备
US10762204B2 (en) Managing containerized applications
CN109617896B (zh) 一种基于智能合约的物联网访问控制方法和系统
US10891383B2 (en) Validating computer resource usage
EP3074867B1 (en) Managing containerized applications
US10244001B2 (en) System, apparatus and method for access control list processing in a constrained environment
US8341715B2 (en) System and method for shared resource owner based access control
EP2486509B1 (en) Platform security
WO2021036706A1 (zh) 可信应用的运行方法、信息处理和内存分配方法及装置
US10623410B2 (en) Multi-level, distributed access control between services and applications
JP2005502128A (ja) アプリケーションにデバイスリソースを割り当てるための許可の使用
US20140006598A1 (en) Methods, apparatuses and computer program products for facilitating dynamic origin-based domain allocation
JP6266588B2 (ja) ローカル・データーおよびリモート・データーの同期
WO2017118330A1 (zh) 一种应用程序数据访问隔离方法及装置
WO2023051355A1 (zh) 权限检查的方法和电子设备
CN113032766A (zh) 应用权限管理的方法和装置
CN111970162B (zh) 一种超融合架构下的异构gis平台服务中控系统
US10560462B2 (en) Context-based resource access mediation
CN108140095B (zh) 分布式大数据安全体系架构
WO1999044138A2 (en) Stack-based security requirements
US11720507B2 (en) Event-level granular control in an event bus using event-level policies
CN115981576B (zh) 共享数据的方法、电子设备及存储介质
CN116828588B (zh) 通信方法、可读介质和电子设备
US8875300B1 (en) Method and apparatus for authenticating a request between tasks in an operating system
CN117201133A (zh) 多应用权限管理方法、装置、存储介质及处理器

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21814473

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21814473

Country of ref document: EP

Kind code of ref document: A1