WO2023051355A1

WO2023051355A1 - Permission check method and electronic device

Info

Publication number: WO2023051355A1
Application number: PCT/CN2022/120260
Authority: WO
Inventors: 沈晴霓; 付鹏程; 冒晶晶; 李家欣; 陈涛; 汪硕; 吴闻博; 杨雅辉
Original assignee: 华为技术有限公司
Priority date: 2021-09-29
Filing date: 2022-09-21
Publication date: 2023-04-06
Also published as: CN115879088A

Abstract

Provided in the present application are a permission check method and an electronic device, wherein the method is applied to a first electronic device. The method comprises: a first electronic device receiving an access request message of a first file, which is sent by a second electronic device, wherein the access request message comprises an account of the second electronic device and identification information of an application program, the identification information is obtained by performing a first instance of calculation on an application program identifier, and the first file is located in the first electronic device; the first electronic device parsing the access request message, so as to obtain the account and the identification information; the first electronic device determining, according to the account and the identification information, whether a permission value corresponding to an access permission of the account and the application program for the first file matches a target permission value; and according to a matching result, the first electronic device sending, to the second electronic device, different results corresponding to the access request message. By means of the technical solution, the security of file sharing and data access can be improved.

Description

Method and electronic device for authority check

This application claims the priority of the Chinese patent application with the application number 202111150947.7 and the title of "Authority Checking Method and Electronic Device" filed with the China Patent Office on September 29, 2021, the entire contents of which are incorporated by reference in this application .

technical field

The present application relates to the field of electronic technology, and more specifically, relates to a method for checking authority and an electronic device.

Background technique

The distributed file system (distributed file system, DFS) expands the file systems distributed in different locations into a system network. The distributed file system in the point-to-point network mode has no concept of client or server, and different terminal devices are nodes at the same level. , when the user requests a file on his terminal device, if the local node owns the file, it will be directly obtained from the local file system, otherwise, the file will be requested from other nodes.

The data on the distributed file system needs to be protected according to the corresponding access control policy during its storage, use, and transmission from its generation. Therefore, how to improve the security of file sharing and data access in the distributed file system , becomes a problem to be solved.

Contents of the invention

The present application provides a method and an electronic device related to permission checking, in order to improve the security of file sharing and data access.

In a first aspect, a permission checking method is provided, the method is applied to a first electronic device, and the method includes:

The first electronic device receives an access request message for the first file sent by the second electronic device, where the access request message includes the account of the second electronic device and identification information of the application program, wherein the identification information is for the The application identifier is obtained by performing a first calculation, and the first file is located in the first electronic device;

The first electronic device parses the access request message to obtain the account and the identification information;

The first electronic device determines whether the permission value corresponding to the account and the access permission of the application program to the first file matches a target permission value according to the account and the identification information;

The first electronic device sends a different result corresponding to the access request message to the second electronic device according to the matching result.

Based on the embodiment of this application, after receiving an access request message from another electronic device, the first electronic device parses the access request message to obtain the identification information of the account and application of the second electronic device, and determines that the account and application Whether the permission value corresponding to the access permission of the file matches the target permission value, and different results are sent to another electronic device according to the matching result. The technical solution can prevent unauthorized accounts and applications from accessing files, thereby improving the security of cross-device access to data.

With reference to the first aspect, in some implementation manners of the first aspect, if the first electronic device receives the access request message for the first time, the method further includes:

The first electronic device reads the ACL of the first file from the disk;

The first electronic device acquires the target permission value from the access control list according to the account and the identification information.

Wherein, the account, the identification information and the authority value may be regarded as one record, or may be regarded as multiple records. For example, the ACL may include account, authority value; identification information, authority value; account, identification information, authority value.

With reference to the first aspect, in some implementation manners of the first aspect, the access request message further includes the path of the first file, and the first electronic device reads the access path of the first file from the disk. Control list ACL, including:

The first electronic device reads the ACL of the first file from the disk according to the path.

With reference to the first aspect, in some implementation manners of the first aspect, the method further includes:

The first electronic device stores the target authority value in a cache.

Based on the embodiment of the present application, the first electronic device stores the acquired target authority value in the cache, so that when the second electronic device sends the same access request message next time, the first electronic device does not need to obtain the target authority value from the disk value, which is conducive to improving the efficiency of data access.

With reference to the first aspect, in some implementations of the first aspect, if the first electronic device does not receive the access request message for the first time, the method further includes:

The first electronic device acquires the target authority value from a cache according to the account and the identification information.

Based on the embodiment of the present application, the first electronic device does not need to obtain the target permission value from the disk, which is beneficial to improve the efficiency of data access.

With reference to the first aspect, in some implementation manners of the first aspect, the identification information of the application program includes a package name of the application program.

Wherein, the identification information of the application program may be the package name of the application program, or the name of the application program.

With reference to the first aspect, in some implementation manners of the first aspect, the first calculation is a hash calculation, and the identification information of the application is obtained by performing the hash calculation on the package name of the application A message with a length of 32 bits.

It should be understood that the hash calculation in the embodiment of the present application may also be replaced by other algorithms, and the length of the calculated information may also be other lengths, such as 64 bits.

In a second aspect, a permission checking method is provided, the method is applied to a second electronic device, and the method includes:

The second electronic device detects the first operation of the application on the first file;

In response to the first operation, the second electronic device performs a first calculation on the identification of the application to obtain identification information of the application;

The second electronic device sends an access request message of the first file to the first electronic device, where the access request message includes the identification information and an account of the second electronic device.

Based on the embodiment of the present application, the access request message sent by the second electronic device to the first electronic device includes the identification information of the account and the application program of the second electronic device, so that the security of cross-device data access can be further improved.

According to a third aspect, there is provided an apparatus for permission checking, including: a transceiver unit, configured to receive an access request message of a first file sent by a second electronic device, where the access request message includes the account of the second electronic device and Identification information of an application program, wherein the identification information is obtained by performing a first calculation on the application program identification, and the first file is located in the device; a processing unit is configured to parse the access request message to obtain The account and the identification information; the processing unit is further configured to determine, according to the account and the identification information, whether the authority value corresponding to the account and the access authority of the application program to the first file matches the target authority value; the transceiving unit is further configured to send a different result corresponding to the access request message to the second electronic device according to the matching result.

With reference to the third aspect, in some implementation manners of the third aspect, if the access request message is received for the first time, the processing unit is further configured to: read the access control list ACL of the first file from the disk; The account and the identification information obtain the target permission value from the access control list.

With reference to the third aspect, in some implementation manners of the third aspect, the access request message further includes a path of the first file, and the processing unit is specifically configured to: read the path of the first file from the disk according to the path Specify the ACL of the first file.

With reference to the third aspect, in some implementation manners of the third aspect, the processing unit is further configured to: store the target permission value in a cache.

With reference to the third aspect, in some implementation manners of the third aspect, if the access request message is not received for the first time, the processing unit is further configured to: acquire the target authority from the cache according to the account and the identification information value.

With reference to the third aspect, in some implementation manners of the third aspect, the identification information of the application program includes a package name of the application program.

With reference to the third aspect, in some implementation manners of the third aspect, the first calculation is a hash calculation, and the identification information of the application is obtained by performing the hash calculation on the package name of the application A message with a length of 32 bits.

In a fourth aspect, an apparatus for checking permissions is provided, including: a processing unit configured to detect a first operation performed by an application program on a first file; the processing unit is also configured to respond to the first operation to the The identification information of the application program is obtained by performing a first calculation on the identification of the application program; the transceiver unit is configured to send an access request message of the first file to the first electronic device, and the access request message includes the identification information and account .

In a fifth aspect, an electronic device is provided, including one or more processors; one or more memories; the one or more memories store one or more computer programs, and the one or more computer programs include Instructions, when the instructions are executed by one or more processors, make the authority described in the first aspect and any possible implementation thereof or in the second aspect and any possible implementation thereof The checked method is executed.

According to a sixth aspect, a chip is provided, the chip includes a processor and a communication interface, the communication interface is used to receive a signal, and transmit the signal to the processor, and the processor processes the signal so that The permission checking method described in the above first aspect and any possible implementation thereof or in the second aspect and any possible implementation thereof is executed.

In a seventh aspect, a computer-readable storage medium is provided. Computer instructions are stored in the computer-readable storage medium. When the computer instructions are run on a computer, the above-mentioned first aspect and any possible The permission checking method described in the implementation manner or in the second aspect and any possible implementation manner thereof is executed.

In an eighth aspect, a computer program product is provided, including computer instructions. When the computer instructions are run on a computer, the above-mentioned first aspect and any possible implementation thereof or the second aspect and any one of the above-mentioned The permission checking method described in a possible implementation manner is executed.

Description of drawings

FIG. 1 is a schematic structural diagram of an electronic device provided by an embodiment of the present application.

FIG. 2 is a schematic diagram of a software structure of an electronic device provided by an embodiment of the present application.

Fig. 3 is a schematic flowchart of a cross-device permission check provided by an embodiment of the present application.

Fig. 4 is a schematic flowchart of a permission check provided by the embodiment of the present application.

Fig. 5 is a schematic flowchart of another permission check provided by the embodiment of the present application.

FIG. 6 is a schematic flowchart of another permission check provided by the embodiment of the present application.

Fig. 7 is a schematic block diagram of an electronic device provided by an embodiment of the present application.

Detailed ways

The technical solution in this application will be described below with reference to the accompanying drawings.

The method for establishing a connection in the embodiment of the present application can be applied to a smart phone, a tablet computer, a notebook computer, a personal computer (personal computer, PC), an ultra-mobile personal computer (ultra-mobile personal computer, UMPC), a netbook, a personal digital assistant (personal digital assistant, PDA), vehicle-mounted equipment, wearable equipment and other electronic equipment, the embodiments of the present application are not limited to this.

FIG. 1 shows a schematic structural diagram of an electronic device 100 . The electronic device 100 may include a processor 110, an external memory interface 120, an internal memory 121, a universal serial bus (universal serial bus, USB) interface 130, a charging management module 140, a power management module 141, a battery 142, an antenna 1, and an antenna 2 , mobile communication module 150, wireless communication module 160, audio module 170, speaker 170A, receiver 170B, microphone 170C, earphone jack 170D, sensor module 180, button 190, motor 191, indicator 192, camera 193, display screen 194, and A subscriber identification module (subscriber identification module, SIM) card interface 195 and the like. The sensor module 180 may include a pressure sensor 180A, a gyroscope sensor 180B, an air pressure sensor 180C, a magnetic sensor 180D, an acceleration sensor 180E, a distance sensor 180F, a proximity light sensor 180G, a fingerprint sensor 180H, a temperature sensor 180J, a touch sensor 180K, an ambient light sensor 180L, bone conduction sensor 180M, etc.

It can be understood that, the structure illustrated in the embodiment of the present application does not constitute a specific limitation on the electronic device 100 . In other embodiments of the present application, the electronic device 100 may include more or fewer components than shown in the figure, or combine certain components, or separate certain components, or arrange different components. The illustrated components can be realized in hardware, software or a combination of software and hardware.

The processor 110 may include one or more processing units, for example: the processor 110 may include an application processor (application processor, AP), a modem processor, a graphics processing unit (graphics processing unit, GPU), an image signal processor (image signal processor, ISP), controller, memory, video codec, digital signal processor (digital signal processor, DSP), baseband processor, and/or neural network processor (neural-network processing unit, NPU) wait. Wherein, different processing units may be independent devices, or may be integrated in one or more processors.

Wherein, the controller may be the nerve center and command center of the electronic device 100 . The controller can generate an operation control signal according to the instruction opcode and timing signal, and complete the control of fetching and executing the instruction.

A memory may also be provided in the processor 110 for storing instructions and data. In some embodiments, the memory in processor 110 is a cache memory. The memory may hold instructions or data that the processor 110 has just used or recycled. If the processor 110 needs to use the instruction or data again, it can be called directly from the memory. Repeated access is avoided, and the waiting time of the processor 110 is reduced, thereby improving the efficiency of the system.

In some embodiments, processor 110 may include one or more interfaces. The interface may include an integrated circuit (inter-integrated circuit, I2C) interface, an integrated circuit built-in audio (inter-integrated circuit sound, I2S) interface, a pulse code modulation (pulse code modulation, PCM) interface, a universal asynchronous transmitter (universal asynchronous receiver/transmitter, UART) interface, mobile industry processor interface (mobile industry processor interface, MIPI), general-purpose input and output (general-purpose input/output, GPIO) interface, subscriber identity module (subscriber identity module, SIM) interface, and /or universal serial bus (universal serial bus, USB) interface, etc.

The I2C interface is a bidirectional synchronous serial bus, including a serial data line (serial data line, SDA) and a serial clock line (derail clock line, SCL).

The I2S interface can be used for audio communication. In some embodiments, processor 110 may include multiple sets of I2S buses. The processor 110 may be coupled to the audio module 170 through an I2S bus to implement communication between the processor 110 and the audio module 170 .

The PCM interface can also be used for audio communication, sampling, quantizing and encoding the analog signal. In some embodiments, the audio module 170 and the wireless communication module 160 may be coupled through a PCM bus interface.

The UART interface is a universal serial data bus used for asynchronous communication. The bus can be a bidirectional communication bus. It converts the data to be transmitted between serial communication and parallel communication. In some embodiments, a UART interface is generally used to connect the processor 110 and the wireless communication module 160 .

The MIPI interface can be used to connect the processor 110 with peripheral devices such as the display screen 194 and the camera 193 .

The GPIO interface can be configured by software. The GPIO interface can be configured as a control signal or as a data signal. In some embodiments, the GPIO interface can be used to connect the processor 110 with the camera 193 , the display screen 194 , the wireless communication module 160 , the audio module 170 , the sensor module 180 and so on.

The USB interface 130 is an interface conforming to the USB standard specification, specifically, it can be a Mini USB interface, a Micro USB interface, a USB Type C interface, and the like. The USB interface 130 can be used to connect a charger to charge the electronic device 100 , and can also be used to transmit data between the electronic device 100 and peripheral devices.

It can be understood that the interface connection relationship between the modules shown in the embodiment of the present application is only a schematic illustration, and does not constitute a structural limitation of the electronic device 100 . In other embodiments of the present application, the electronic device 100 may also adopt different interface connection manners in the foregoing embodiments, or a combination of multiple interface connection manners.

The charging management module 140 is configured to receive a charging input from a charger. Wherein, the charger may be a wireless charger or a wired charger. In some wired charging embodiments, the charging management module 140 can receive charging input from the wired charger through the USB interface 130 . In some wireless charging embodiments, the charging management module 140 may receive a wireless charging input through a wireless charging coil of the electronic device 100 . While the charging management module 140 is charging the battery 142 , it can also provide power for electronic devices through the power management module 141 .

The power management module 141 is used for connecting the battery 142 , the charging management module 140 and the processor 110 .

The wireless communication function of the electronic device 100 can be realized by the antenna 1 , the antenna 2 , the mobile communication module 150 , the wireless communication module 160 , a modem processor, a baseband processor, and the like.

The mobile communication module 150 can provide wireless communication solutions including 2G/3G/4G/5G applied on the electronic device 100 .

A modem processor may include a modulator and a demodulator. Wherein, the modulator is used for modulating the low-frequency baseband signal to be transmitted into a medium-high frequency signal. The demodulator is used to demodulate the received electromagnetic wave signal into a low frequency baseband signal. Then the demodulator sends the demodulated low-frequency baseband signal to the baseband processor for processing. The low-frequency baseband signal is passed to the application processor after being processed by the baseband processor. The application processor outputs sound signals through audio equipment (not limited to speaker 170A, receiver 170B, etc.), or displays images or videos through display screen 194 . In some embodiments, the modem processor may be a stand-alone device. In some other embodiments, the modem processor may be independent from the processor 110, and be set in the same device as the mobile communication module 150 or other functional modules.

The wireless communication module 160 can provide wireless local area networks (wireless local area networks, WLAN) (such as wireless fidelity (Wireless Fidelity, Wi-Fi) network), bluetooth (bluetooth, BT), global navigation satellite, etc. applied on the electronic device 100. System (global navigation satellite system, GNSS), frequency modulation (frequency modulation, FM), near field communication technology (near field communication, NFC), infrared technology (infrared, IR) and other wireless communication solutions.

In some embodiments, the antenna 1 of the electronic device 100 is coupled to the mobile communication module 150, and the antenna 2 is coupled to the wireless communication module 160, so that the electronic device 100 can communicate with the network and other devices through wireless communication technology.

The electronic device 100 realizes the display function through the GPU, the display screen 194 , and the application processor. The GPU is a microprocessor for image processing, and is connected to the display screen 194 and the application processor. GPUs are used to perform mathematical and geometric calculations for graphics rendering. Processor 110 may include one or more GPUs that execute program instructions to generate or change display information.

The display screen 194 is used to display images, videos and the like. The display screen 194 includes a display panel. The display panel can be a liquid crystal display (LCD), or an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode, or an active-matrix organic light-emitting diode (active-matrix organic light-emitting diode). Matrix organic light emitting diode (AMOLED), flexible light-emitting diode (flex light-emitting diode, FLED), Miniled, MicroLed, Micro-oLed or quantum dot light emitting diodes (quantum dot light emitting diodes, QLED) and other materials. Fabricated display panels. In some embodiments, the electronic device 100 may include 1 or N display screens 194 , where N is a positive integer greater than 1.

The electronic device 100 can realize the shooting function through the ISP, the camera 193 , the video codec, the GPU, the display screen 194 and the application processor.

The ISP is used for processing the data fed back by the camera 193 . Camera 193 is used to capture still images or video.

Digital signal processors are used to process digital signals. In addition to digital image signals, they can also process other digital signals.

Video codecs are used to compress or decompress digital video. The electronic device 100 may support one or more video codecs.

The external memory interface 120 can be used to connect an external memory card, such as a Micro SD card, so as to expand the storage capacity of the electronic device 100.

The internal memory 121 may be used to store computer-executable program codes including instructions. The processor 110 executes various functional applications and data processing of the electronic device 100 by executing instructions stored in the internal memory 121 .

The electronic device 100 can implement audio functions through the audio module 170 , the speaker 170A, the receiver 170B, the microphone 170C, the earphone interface 170D, and the application processor. Such as music playback, recording, etc.

The audio module 170 is used to convert digital audio information into analog audio signal output, and is also used to convert analog audio input into digital audio signal.

Speaker 170A, also referred to as a "horn", is used to convert audio electrical signals into sound signals.

Receiver 170B, also called "earpiece", is used to convert audio electrical signals into sound signals.

The microphone 170C, also called "microphone" or "microphone", is used to convert sound signals into electrical signals.

The earphone interface 170D is used for connecting wired earphones.

The pressure sensor 180A is used to sense the pressure signal and convert the pressure signal into an electrical signal. In some embodiments, pressure sensor 180A may be disposed on display screen 194 .

The gyro sensor 180B can be used to determine the motion posture of the electronic device 100 .

The air pressure sensor 180C is used to measure air pressure. In some embodiments, the electronic device 100 calculates the altitude based on the air pressure value measured by the air pressure sensor 180C to assist positioning and navigation.

The acceleration sensor 180E can detect the acceleration of the electronic device 100 in various directions (generally three axes).

The distance sensor 180F is used to measure the distance.

The fingerprint sensor 180H is used to collect fingerprints.

Touch sensor 180K, also known as "touch panel". The touch sensor 180K can be disposed on the display screen 194, and the touch sensor 180K and the display screen 194 form a touch screen, also called a “touch screen”.

The bone conduction sensor 180M can acquire vibration signals. In some embodiments, the bone conduction sensor 180M can acquire the vibration signal of the vibrating bone mass of the human voice. The bone conduction sensor 180M can also contact the human pulse and receive the blood pressure beating signal.

The keys 190 include a power key, a volume key and the like.

The motor 191 can generate a vibrating reminder.

The indicator 192 can be an indicator light, and can be used to indicate charging status, power change, and can also be used to indicate messages, missed calls, notifications, and the like.

The SIM card interface 195 is used for connecting a SIM card.

The software system of the electronic device 100 may adopt a layered architecture, an event-driven architecture, a micro-kernel architecture, a micro-service architecture, or a cloud architecture. The embodiment of the present application takes the Android system with a layered architecture as an example to illustrate the software structure of the electronic device 100 .

FIG. 2 is a block diagram of the software structure of the electronic device 100 according to the embodiment of the present application. The layered architecture divides the software into several layers, and each layer has a clear role and division of labor. Layers communicate through software interfaces. In some embodiments, the Android system is divided into four layers, which are respectively the application program layer, the application program framework layer, the Android runtime (Android runtime) and the system library, and the kernel layer from top to bottom. The application layer can consist of a series of application packages.

As shown in Figure 2, the application package may include applications such as camera, gallery, calendar, call, map, navigation, WLAN, Bluetooth, music, video, and short message.

The application framework layer provides an application programming interface (application programming interface, API) and a programming framework for applications in the application layer. The application framework layer includes some predefined functions.

As shown in Figure 2, the application framework layer can include window managers, content providers, view systems, phone managers, resource managers, notification managers, and so on.

A window manager is used to manage window programs. The window manager can get the size of the display screen, determine whether there is a status bar, lock the screen, capture the screen, etc.

Content providers are used to store and retrieve data and make it accessible to applications. Said data may include video, images, audio, calls made and received, browsing history and bookmarks, phonebook, etc.

The view system includes visual controls, such as controls for displaying text, controls for displaying pictures, and so on. The view system can be used to build applications. A display interface can consist of one or more views. For example, a display interface including a text message notification icon may include a view for displaying text and a view for displaying pictures.

The phone manager is used to provide communication functions of the electronic device 100 . For example, the management of call status (including connected, hung up, etc.).

The resource manager provides various resources for the application, such as localized strings, icons, pictures, layout files, video files, and so on.

The notification manager enables the application to display notification information in the status bar, which can be used to convey notification-type messages, and can automatically disappear after a short stay without user interaction. For example, the notification manager is used to notify the download completion, message reminder, etc. The notification manager can also be a notification that appears on the top status bar of the system in the form of a chart or scroll bar text, such as a notification of an application running in the background, or a notification that appears on the screen in the form of a dialog window. For example, prompting text information in the status bar, issuing a prompt sound, vibrating the electronic device, and flashing the indicator light, etc.

Android runtime includes core library and virtual machine. The Android runtime is responsible for the scheduling and management of the Android system.

The core library consists of two parts: one part is the function function that the java language needs to call, and the other part is the core library of Android.

The application layer and the application framework layer run in virtual machines. The virtual machine executes the java files of the application program layer and the application program framework layer as binary files. The virtual machine is used to perform functions such as object life cycle management, stack management, thread management, security and exception management, and garbage collection.

A system library can include multiple function modules. For example: surface manager (surface manager), media library (media libraries), 3D graphics processing library (eg: OpenGL ES), 2D graphics engine (eg: SGL), etc.

The surface manager is used to manage the display subsystem and provides the fusion of 2D and 3D layers for multiple applications.

The media library supports playback and recording of various commonly used audio and video formats, as well as still image files, etc. The media library can support a variety of audio and video encoding formats, such as: MPEG4, H.264, MP3, AAC, AMR, JPG, PNG, etc.

The 3D graphics processing library is used to implement 3D graphics drawing, image rendering, synthesis and layer processing, etc.

2D graphics engine is a drawing engine for 2D drawing.

The kernel layer is the layer between hardware and software. The kernel layer includes at least a display driver, a camera driver, an audio driver, and a sensor driver.

It should be understood that the electronic device in the embodiment of the present application may also be an electronic device installed with operating systems such as Hongmeng and Apple.

The distributed file system arbitrarily expands different types of files distributed in different places into a system network, allowing many device nodes to connect and transmit information through the network between nodes, so that users can access data at any time in places with a network. Without being limited by equipment and location.

The traditional distributed file system is based on the client/server model. This model uses a centralized multi-machine server. The server uses load balancing, hash sharding and other technologies to store the client's data, and then the client sends a file request through the network. retrieve data.

There is no concept of client/server in the distributed file system under the peer-to-peer (P2P) network mode. Different terminal devices are equal peer nodes, and this node can serve as client/server at the same time, without a center Server, all terminal devices are connected to a file system, when the user requests a file on the terminal device where the user is located, if the local node owns the file, it will be obtained directly from the local file system, if the file does not exist in the local node, then Request the file from other nodes.

In the above file access process, in order to improve data security, the terminal device may set some access permissions for other users who access files on the terminal device.

The access control list (ACL) is a mechanism under autonomous access control, and the file owner can freely grant the permissions of the objects he owns to other users. ACL is a fine-grained access control mechanism. Users can configure multiple access control rules for specific files, allowing or denying specified applications to access specific files, so that even if the application obtains storage permissions, it cannot read and write protected files. Operation, which realizes the granularity of access control on the file system from the entire file system to a single file. By adding ACL_USER and ACL_GROUP types, ACL can implement authorization to specified users or user groups. An ACL policy can be represented by a <tag, perm, id>, where tag represents the user type; perm represents the granted permission; id represents the user identification (user identification, uid) or gid of the application. The ACL access control rule perm includes three types of access rights: read (read, r), write (write, w) and execute (execute, x), so the permission information of an object can be expressed as a combination of these three types. For example, the permission information "rwxr--r--" of the file means that the owner of the file is allowed to read, write and execute the file, the users of the same group of the file are allowed to read the file, and other users or groups have read permission for the file. For the storage of access control information, the ACL access control rules of a file are stored in the extended attribute "system.posix_acl_access" of the file inode. In the Linux system, the ACL access control rule of the file is configured by calling the setacl() method, which finally converts the ACL access control rule into an extended attribute by calling the setxattr() method and saves it in the extended attribute "system.posix_acl_access" of the file middle. When performing the ACL permission check of a file, the system will call the getacl() method to obtain the access control rules of the file. This method converts the extended attributes stored in the file into specific ACL access control rules by calling the getxattr() method. The functions and methods related to ACL access control rules are defined in the inode_operations structure of the file system.

The Linux Security Module (LSM) is a lightweight general-purpose access control framework for the Linux kernel. It enables various security access control models to be implemented in the form of Linux loadable kernel modules, and users can choose appropriate security modules to load into the Linux kernel according to their needs, thus greatly improving the flexibility of Linux security access control mechanisms and ease of use. At the beginning of the design, LSM followed the following principles: decoupling, detachability and high efficiency. This enables the module to do: minimal impact on the operation and replacement of existing modules under the condition of providing a security mechanism; when the user or developer does not need the security mechanism, the module can be uninstalled without causing other negative effects on the system ; Minimal negative impact on performance when running in-kernel. These features make it possible to use LSM to develop a wider range of usage scenarios and higher efficiency when the system has new security requirements for the kernel.

With the development of Internet of Things technology, the demand for data sharing in cross-device scenarios increases. The distributed file system used on the operating systems of mobile phones, tablets, smart TVs, routers, cars, watches and other devices relies on upper-layer services to realize user and distributed management of application data. The requirement of a distributed system is to use user/application data no longer bound to the device, and to separate data storage and business logic on devices scattered in the cluster. While performing unified management of these device data to achieve fast connection, mutual assistance and resource sharing between different terminal devices, the data on the distributed file system starts from generation and is stored, used and transmitted. The whole process needs to provide security protection according to the corresponding access control policy.

In view of this, the embodiment of the present application provides a permission checking method, and the technical solution can improve the security of file sharing and data access.

The following will introduce the permission checking method in the embodiment of the present application with reference to FIGS. 3-5 .

Fig. 3 is a schematic flowchart of a method for cross-device permission checking provided by an embodiment of the present application.

As shown in FIG. 3 , the method may be applied to the first electronic device and the second electronic device, and the method may include steps 601 to 608 .

601. An application program in a second electronic device triggers a first operation on a first file.

It should be understood that the first file may exist in the second electronic device; the first operation may be the reading, writing or execution mentioned above.

Exemplarily, the application program A in the second electronic device accesses the file B located in the first electronic device, eg, performs a read operation on the file B.

The trigger here may be that the user clicks a certain function control during the use of the application program B, or it may be that the application program B needs to access the file B during the running process, etc., which is not limited in this embodiment of the present application.

Optionally, the upper-level account triggers the first operation on the first file. It should be understood that the account is an account after passing cloud authentication, such as a Huawei account.

602. Call the second DFS.

Through the system call, that is, through the system interface, the second DFS located in the kernel virtual file system (virtual file system, VFS) layer is called.

Exemplarily, if the first operation is a read operation, the dfs_read_remote function in the second DFS may be called; if the first operation is a write operation, the dfs_write_remote function in the second DFS may be called.

603. The second DFS calculates the identifier of the application program to obtain the identifier information.

It should be understood that the identifier of the application program may be an App ID such as an identifier of an application program source (sourceid), an application program package name (packagename), an application name (appname) and the like.

Exemplarily, the identifier is an application package name, and a first calculation, such as a hash calculation, may be performed on the application package name to convert the application package name into identification information with a length of 32 bits. It should be understood that the package name of the application program may also have other lengths.

It should be understood that other calculations may also be performed on the application package name to obtain the identification information.

604. The second DFS sends an access request message to the first DFS, where the access request message includes identification information.

Optionally, the access request message may also include an account logged in on the second electronic device. It should be understood that the account is an account that has passed cloud authentication, such as a Huawei account.

Optionally, the access request message may also include the path where the first file is located, and the access request message may also include the above-mentioned first operation.

605. The first DFS of the first electronic device receives the access request message, and parses the access request message.

Wherein, after receiving the access request message, the first DFS may parse the access request message to obtain identification information in the access request message, such as a 32-bit application package name. 606. The first DFS sends the identification information to the security module (secDFS) in the kernel.

Exemplarily, the security module can be called through a hook function. This security module belongs to the LSM.

Optionally, the first DFS parses the access request message and obtains account information, such as a Huawei account authenticated by the cloud.

607. The security module performs a permission check on the access request.

In a possible implementation, if the second electronic device accesses the first file in the first electronic device for the first time, the first electronic device may obtain the ACL of the first file from the disk file, and according to the identification information Obtain the permission value corresponding to the application.

Optionally, the second electronic device stores the permission value of the application program on the first file in the cache. In this case, when the application program A of the second electronic device accesses the first file again, the first electronic device can obtain its corresponding permission value from the cache instead of from the disk, thereby reducing the need for the second electronic device. The communication overhead of the device accessing the first file multiple times in a short period of time improves the efficiency of file access in distributed scenarios.

The ACL may include information such as the user who accesses the first file, the authority of the application program, for example, the authority value of the corresponding authority may be stored in the ACL, such as, the authority value corresponding to the read authority is 4, and the authority value corresponding to the write authority is 4. The permission value is 2, and the permission value corresponding to the execution permission is 1.

It should be understood that the ACL may include the identification information of the application program A, and the authority corresponding to the identification information, which can be used to characterize the authority of the application program A, for example, the identification information of the application program A is a 32-bit application package name, the ACL may include the 32-bit application package name and permission value.

Exemplarily, in the ACL, the application program A of the second electronic device may have a permission value of 4 for the first file, and the application program A has read permission for the first file.

Optionally, the ACL may also include the account, the identification information of the application A and the corresponding permissions, so as to further ensure data security.

It should be understood that the ACL may be an extended attribute of the first file. Each file can have an ACL.

In another possible implementation, if it is not the first time for the second electronic device to access the first file in the first electronic device, the first electronic device may obtain the permission of the application program A to access the first file from the cache value.

Exemplarily, the application program A stored in the cache has a permission value of 2 for accessing the first file, and the application program has a write permission for the first file.

608. Return the result to the second electronic device.

In an example, if the access request message indicates that the application A requests to read the first file, and the permission value of the application A for the first file acquired by the second electronic device is 4, then the second The first file in the second electronic device allows the application program A to read it, and then the read first file can be returned to the second electronic device.

Specifically, the read first file may be sent from the first DFS to the second DFS, and the second DFS sends the read first file to the application program A.

In another example, if the access request message indicates that the application A requests to perform a write operation on the first file, and the permission value of the application A on the first file acquired by the second electronic device is 4, then The first file in the second electronic device only allows the application program A to read it, but cannot write or execute the first file. At this time, it means that the first file in the second electronic device does not allow the application program When A writes it, the first electronic device can return the error value to the second electronic device, thereby ensuring the data security of the first file.

Based on the embodiment of this application, when the application program A in the second electronic device wishes to access the first file in the first electronic device, the identification information of the application program A can be carried in the access request message, so that the first electronic device receives After receiving the access request message, the security module can be invoked to obtain its corresponding permission value according to the identification information, so as to determine whether the application program A has the corresponding permission to access the first file. This improves the security of cross-device data access.

The above describes the cross-device access of the second electronic device to the file on the first electronic device. The following will introduce the technical solution for the application program in the electronic device to access the local second file in conjunction with FIG. 4 .

Fig. 4 is a schematic flowchart of a method for checking permissions provided by an embodiment of the present application.

As shown in FIG. 4 , the method may be applied to an electronic device, and the method may include steps 701 to 706 .

701. An application program B in an electronic device triggers a second operation on a second file.

It should be understood that the second file is stored locally in the electronic device, such as in a memory of the electronic device. The first operation may be the above-mentioned read, write, or execute, etc.

Exemplarily, the application program B in the electronic device accesses the file B locally stored in the electronic device, such as performing a write operation on the file B.

Optionally, the upper-level account triggers the second operation on the second file. It should be understood that the account is an account after passing cloud authentication, such as a Huawei account.

702. Call DFS.

Through the system call, that is, through the system interface to call the DFS located in the kernel VFS layer.

Exemplarily, if the second operation is a read operation, the dfs_read_local function in DFS may be called; if the second operation is a write operation, the dfs_write_local function in DFS may be called.

703. The DFS calculates the identifier of the application program B to obtain identifier information.

It should be understood that the identifier of the application program B may be an App ID such as an identifier of an application program source (sourceid), an application program package name (packagename), an application name (appname) and the like.

Exemplarily, the identifier is an application package name, and a first calculation, such as a hash calculation, may be performed on the application package name to convert the application package name into identification information with a length of 32 bits.

It should be understood that the package name of the application program may also have other lengths.

704. Call the security module.

705. The security module performs permission check on the second operation.

In a possible implementation, if the application B accesses the second file for the first time, the electronic device may obtain the ACL of the second file from the disk file, and obtain the corresponding authority of the application B according to the identification information value.

The ACL may include information such as the user who accesses the second file, the authority of the application program, for example, the authority value of the corresponding authority may be stored in the ACL, such as, the authority value corresponding to the read authority is 4, and the authority value corresponding to the write authority is 4. The permission value is 2, and the permission value corresponding to the execution permission is 1.

It should be understood that the ACL may include the identification information of application B and the authority corresponding to the identification information, which may be used to characterize the authority of the application B. For example, the identification information of application B is a 32-bit application package name, the ACL may include the 32-bit application package name and permission value.

Exemplarily, the application B in the ACL has a permission value of 4 for the second file, which means that the application B has read permission for the second file.

Optionally, the electronic device stores the permission value of the application program B on the second file in the cache. In this case, when application B accesses the second file again, the electronic device can obtain its corresponding permission value from the cache instead of from the disk, thereby reducing the number of times application B accesses the second file communication overhead, improving the efficiency of file access in distributed scenarios.

In another possible implementation manner, if it is not the first time for the application program B to access the second file, the electronic device may acquire the permission value for the application program B to access the second file from the cache.

Exemplarily, the application program B stored in the cache has a permission value of 2 for accessing the second file, and the application program B has the write permission for the second file.

706. Return the result to the application program B.

In a possible implementation, if the second operation is that the application program B requests to perform a read operation on the second file, and the electronic device obtains a permission value of 4 for the application program B on the second file, then The second file in the electronic device allows the application program B to read it, and then the read second file can be returned to the application program B.

In another possible implementation, if the second operation is that the application program B requests to perform a write operation on the second file, and the electronic device acquires the application program B's permission value for the second file as 4, then It means that the second file in the electronic device only allows application B to read it, but cannot write or execute the second file. At this time, it means that the second file in the electronic device does not allow application B If it is written, the error value can be returned to the application program B, so that the data security of the second file can be guaranteed.

Based on the embodiment of the present application, when the application program B in the electronic device needs to access the second local file, the electronic device can call the security module to perform permission check, so as to improve the security of data access.

Fig. 5 is a schematic flowchart of a permission check provided by the embodiment of the present application.

As shown in FIG. 5 , the method may be applied to the first electronic device, and the method may include steps 810 to 840 .

810. The first electronic device receives an access request message for the first file sent by the second electronic device, where the access request message includes an account of the second electronic device and identification information of an application program, where the identification information The first file is obtained by performing the first calculation on the application identifier, and the first file is located in the first electronic device.

Wherein, the account may be an account logged in on the second electronic device, and the account may be an account authenticated by the cloud, such as a Huawei account. The account may also be an account registered on an application program, etc., which is not limited in this embodiment of the present application.

The application program identifier may be a package name of the application program. In this case, the identification information may be information with a length of 32 bits obtained by hashing the package name of the application program.

It should be understood that the application identifier may also include an application name, an identifier of an application source, and the like. The length of the identification information may also be other values.

820. The first electronic device parses the access request message to obtain the account and the identification information.

The first electronic device parses the received access request message to obtain the above account and identification information.

830. The first electronic device determines whether the permission value corresponding to the account and the access permission of the application program to the first file matches a target permission value according to the account and the identification information.

The target authority value is the authority value stored in the first electronic device.

Exemplarily, the ACL of the first file is stored in the first electronic device, and the ACL includes accounts and application programs that can access the first file, and their corresponding authority values. For example, the ACL may include accounts and permission values; application identification information and permission values; or account and application identification information and permission values. In this case, the account and application are bound together and share The permission value indicates the access permission of the application under the account.

840. The first electronic device sends a different result corresponding to the access request message to the second electronic device according to the matching result.

In a possible implementation manner, when the first electronic device determines that the permission value corresponding to the account and the application program's access permission to the first file matches the target permission value, it means that the first file allows the above account and When the application program makes corresponding access to it, a corresponding result can be returned to the second electronic device.

Exemplarily, the access request message indicates that account A and application A request to read the first file, and the first electronic device checks the permissions of account A and application A and finds that the account A and application A If the authority value is 4, then the first electronic device can send the read first file to the second electronic device at this time.

In another possible implementation manner, when the first electronic device determines that the permission value corresponding to the account and the access permission of the application program to the first file does not match the target permission value, it means that the first file does not allow If the above-mentioned account and/or application programs access it accordingly, an error may be returned to the second electronic device.

Exemplarily, the access request message indicates that account A and application A request to perform a write operation on the first file. At this time, the first electronic device checks the permission values of account A and application A, and finds that account A or the permission value of application A is 4, or the permission value of account A and application A as a whole is 4, then it can be determined that account A and/or application A only have read permission for the first file , does not have the write permission, then the first electronic device may send an error to the second electronic device at this time.

Based on the embodiment of the present application, after receiving the access request message from the second electronic device, the first electronic device parses the access request message to obtain the identification information of the account and application program of the second electronic device, and determines that the account and application program are relevant to the second electronic device. Whether the permission value corresponding to the access permission of the file matches the target permission value, and different results are sent to the second electronic device according to the matching result. The technical solution can prevent unauthorized accounts and application programs from accessing files, thereby improving the security of cross-device access to data.

In this technical solution, the access request message received by the first electronic device carries the identification information of the application program, so that the first electronic device can uniquely determine the application program according to the identification information, and the identification information is also stored in the first electronic device The permission value corresponding to the information, so that when the second electronic device accesses data across devices, other electronic devices (such as the first electronic device) identify the same identification information of the application program.

Optionally, if the first electronic device receives the access request message for the first time, the method further includes: the first electronic device reads the ACL of the first file from a disk; An electronic device acquires the target permission value from the access control list ACL according to the account and the identification information.

Optionally, the access request message further includes the path of the first file, and the first electronic device reads the ACL of the first file from the disk, including: the first electronic device Reading the ACL of the first file from the disk according to the path.

Optionally, the method further includes: storing the target authority value in a cache by the first electronic device.

It should be understood that, when the first electronic device receives the access request message for the first time, the first electronic device may store the target authority value corresponding to the account and the application program in the buffer, so that when the first electronic device receives the access request message next time For the same access request message, the target permission value can be obtained from the cache, instead of obtaining from the location of the first file in the disk file every time, which is beneficial to improve the efficiency of data access.

Optionally, if it is not the first time for the first electronic device to receive the access request message, the method further includes: the first electronic device acquires the target authority value from cache according to the account and the identification information .

Optionally, the first calculation is a hash calculation, and the identification information of the application is 32-bit information obtained through the hash calculation on the package name of the application.

Fig. 6 is a schematic flowchart of a permission check provided by the embodiment of the present application.

As shown in FIG. 6 , the method may be applied to the second electronic device, and the method may include steps 910 to 930 .

910. The second electronic device detects a first operation performed by an application program on a first file, where the first file is located in the first electronic device.

The first operation may be the above-mentioned reading, writing, or executing.

920. In response to the first operation, the second electronic device performs a first calculation on the identification of the application program to obtain identification information of the application program.

The identifier of the application program may be a package name of the application program. In this case, the identification information may be information with a length of 32 bits obtained by performing hash calculation on the package name of the application program.

It should be understood that the identifier of the application program may also include the name of the application program, the identifier of the source of the application program, and the like. The length of the identification information may also be other values.

930. The second electronic device sends an access request message of the first file to the first electronic device, where the access request message includes the identification information and an account of the second electronic device.

Based on the embodiment of the present application, based on the embodiment of the present application, the access request message sent by the second electronic device to the first electronic device includes the identification information of the account and the application program of the second electronic device, so that the cross-device data can be further improved. Security of Access.

As shown in FIG. 7 , the electronic device 1000 may include one or more memories 1010, one or more processors 1020, one or more computer programs are stored in the one or more memories 1010, and the one or more computers The program includes instructions, and when the instructions are executed by one or more processors 1020, the permission checking method described in any possible implementation manner in the foregoing embodiments is executed.

An embodiment of the present application also provides an apparatus for checking permissions, including: a transceiver unit configured to receive an access request message for a first file sent by a second electronic device, where the access request message includes the account and the account number of the second electronic device Identification information of an application program, wherein the identification information is obtained by performing a first calculation on the application program identification, and the first file is located in the device; a processing unit is configured to parse the access request message to obtain The account and the identification information; the processing unit is further configured to determine, according to the account and the identification information, whether the authority value corresponding to the account and the access authority of the application program to the first file matches the target authority value; the transceiving unit is further configured to send a different result corresponding to the access request message to the second electronic device according to the matching result.

Optionally, if the access request message is received for the first time, the processing unit is further configured to: read the ACL of the first file from the disk; Obtain the target permission value in the control list.

Optionally, the access request message further includes the path of the first file, and the processing unit is specifically configured to: read the access control list ACL of the first file from the disk according to the path

Optionally, the processing unit is further configured to: store the target authority value in a cache.

Optionally, if the access request message is not received for the first time, the processing unit is further configured to: obtain the target authority value from cache according to the account and the identification information.

Optionally, the identification information of the application program includes a package name of the application program.

The embodiment of the present application also provides a permission checking device, including: a processing unit, configured to detect a first operation performed by an application program on a first file; the processing unit is also configured to, in response to the first operation, The identification information of the application program is obtained by performing a first calculation on the identification of the application program; the transceiver unit is configured to send an access request message of the first file to the first electronic device, and the access request message includes the identification information and account.

The embodiment of the present application also provides a chip, the chip includes a processor and a communication interface, the communication interface is used to receive a signal, and transmit the signal to the processor, and the processor processes the signal, The permission checking method described in any possible implementation manner in the foregoing embodiments is executed.

This embodiment also provides a computer-readable storage medium, where computer instructions are stored in the computer-readable storage medium. When the computer instructions are run on a computer, the The method of permission checking described above is executed.

This embodiment also provides a computer program product, which, when running on a computer, causes the computer to execute the above-mentioned related steps, so as to realize the method for checking the authority in the above-mentioned embodiment.

In addition, an embodiment of the present application also provides a device, which may specifically be a chip, a component or a module, and the device may include a connected processor and a memory; wherein the memory is used to store computer-executable instructions, and when the device is running, The processor can execute the computer-executable instructions stored in the memory, so that the chip executes the permission checking method in the above method embodiments.

Wherein, the electronic device, computer-readable storage medium, computer program product or chip provided in this embodiment is all used to execute the corresponding method provided above, therefore, the beneficial effects it can achieve can refer to the above-mentioned The beneficial effects of the corresponding method will not be repeated here.

Those skilled in the art can appreciate that the units and algorithm steps of the examples described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are executed by hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but such implementation should not be regarded as exceeding the scope of the present application.

Those skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the above-described system, device and unit can refer to the corresponding process in the foregoing method embodiment, which will not be repeated here.

In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods may be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit.

If the functions described above are realized in the form of software function units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disk or optical disc and other media that can store program codes. .

The above is only a specific implementation of the application, but the scope of protection of the application is not limited thereto. Anyone familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the application. Should be covered within the protection scope of this application. Therefore, the protection scope of the present application should be determined by the protection scope of the claims.

Claims

A method for permission checking, characterized in that the method is applied to a first electronic device, and the method includes:

The first electronic device receives an access request message for the first file sent by the second electronic device, where the access request message includes the account of the second electronic device and identification information of the application program, wherein the identification information is for the The application identifier is obtained by performing a first calculation, and the first file is located in the first electronic device;

The first electronic device parses the access request message to obtain the account and the identification information;

The first electronic device determines whether the permission value corresponding to the account and the access permission of the application program to the first file matches a target permission value according to the account and the identification information;

The first electronic device sends a different result corresponding to the access request message to the second electronic device according to the matching result.
The method according to claim 1, wherein if the first electronic device receives the access request message for the first time, the method further comprises:

The first electronic device reads the ACL of the first file from the disk;

The first electronic device acquires the target permission value from the access control list according to the account and the identification information.
The method according to claim 2, wherein the access request message further includes the path of the first file, and the first electronic device reads the access control list (ACL) of the first file from the disk ,include:

The first electronic device reads the ACL of the first file from the disk according to the path.
The method according to claim 2 or 3, characterized in that the method further comprises:

The first electronic device stores the target authority value in a cache.
The method according to claim 1, wherein if the first electronic device does not receive the access request message for the first time, the method further comprises:

The first electronic device acquires the target authority value from a cache according to the account and the identification information.
The method according to any one of claims 1-5, wherein the identification information of the application program includes a package name of the application program.
The method according to claim 6, wherein the first calculation is a hash calculation, and the identification information of the application program is a package name of the application program obtained through the hash calculation and has a length of 32 bits of information.
A method for permission checking, characterized in that the method is applied to a second electronic device, and the method includes:

The second electronic device detects the first operation of the application on the first file;

In response to the first operation, the second electronic device performs a first calculation on the identification of the application to obtain identification information of the application;

The second electronic device sends an access request message of the first file to the first electronic device, where the access request message includes the identification information and an account of the second electronic device.
An electronic device, characterized in that it includes one or more processors; one or more memories; the one or more memories store one or more computer programs, and the one or more computer programs include instructions, When the instructions are executed by one or more processors, the permission checking method according to any one of claims 1-7 or 8 is executed.
A kind of chip, it is characterized in that, described chip comprises processor and communication interface, and described communication interface is used for receiving signal, and described signal is transmitted to described processor, and described processor processes described signal, makes as follows The permission checking method described in any one of claims 1-7 or 8 is executed.
A computer-readable storage medium, characterized in that, computer instructions are stored in the computer-readable storage medium, and when the computer instructions are run on a computer, any one of claims 1-7 or 8 The method of permission checking described above is executed.