WO2023280009A1

WO2023280009A1 - Access control method and apparatus, device, and storage medium

Info

Publication number: WO2023280009A1
Application number: PCT/CN2022/101766
Authority: WO
Inventors: 陈刚
Original assignee: 华为技术有限公司
Priority date: 2021-07-09
Filing date: 2022-06-28
Publication date: 2023-01-12
Also published as: CN115600236A

Abstract

Embodiments of the present application provide an access control method and apparatus, a device, and a storage medium. The method comprises: when it is requested to access cross-device media data, if it is determined that a first device currently has exceeded the effectiveness of authentication, performing second authentication on the current user, and updating the effectiveness of authentication after second authentication is passed; and, after second authentication is passed, obtaining an access permission according to the authenticated account that has passed second authentication, and, on the basis of the access permission, accessing target media data of a target device across devices. According to the access occasion of accessing a user, a second authentication interface can be pulled up in real time based on need, and the user can access target media data only after second authentication is passed, thereby ensuring the privacy and security of media data stored on devices on which the same account is logged in, and improving user experience.

Description

Access control method and device, device, storage medium

technical field

The present application relates to the technical field of terminals, and in particular to an access control method, device, device, and storage medium.

Background technique

HyperTerminal supports functions such as distributed file search, distributed file browsing, and distributed file editing. Figure 1a is a schematic diagram of a distributed file global search performed by a hyper terminal in the prior art. As shown in Figure 1a, the user can enter the keyword "examination materials" in the file search box, and the search results can include the corresponding files of the machine and the same account Corresponding files stored in other devices under . In some application scenarios, the hyperterminal can be a shared device. The shared device can be a terminal that has no password or can be unlocked by multiple people, and the login account of the shared device is the same as the login account of another or more devices. If the same, the person using the shared device can view the media data stored on the private device logged in with the same account as the shared device through the shared device. The privacy and security of the data stored on the private device cannot be guaranteed, which reduces the user experience. .

application content

Embodiments of the present invention provide an access control method, device, device, and storage medium. Through this method, the secondary authentication interface can be pulled up in real time according to the access timing of the accessing user, and the user can only access the target after passing the secondary authentication. Media data, thereby ensuring the privacy and security of media data stored on devices logged in with the same account, and improving user experience.

In the first aspect, an embodiment of the present application provides a cross-device access control method, which is executed on the first device, and the method includes: when requesting to access cross-device media data, if it is determined that the first device has exceeded the authentication time limit, then The current user performs secondary authentication, and updates the authentication timeliness after the secondary authentication is passed; and sends cross-device access request information to the second device after the secondary authentication is passed, and the cross-device access request information includes the cross-device access request information passed through the The authentication account for the second authentication, so as to obtain the first access authority through the authentication account, and access the target media data stored in the second device across devices based on the first access authority.

Further, the determining that the first device has currently exceeded the authentication time limit includes: determining whether the first device is currently within the latest authentication time limit, wherein the latest authentication includes the first authentication or the second authentication, the First-time authentication includes screen unlock authentication.

Further, if it is determined that the first device is currently out of the authentication time limit, performing secondary authentication on the current user includes: if it is determined that the first device is currently out of the authentication time limit, and determining the second access based on the authentication identity When the authority access fails, perform secondary authentication on the current user, and update the authentication time limit after the secondary authentication is passed; and obtain the first access according to the authentication account that has passed the secondary authentication after the secondary authentication is passed permission, and based on the access permission, cross-device access to the target media data stored in the second device.

Further, before the determination that the access to the second access right corresponding to the authentication identity fails, after the determination that the first device has expired the authentication time limit, it further includes: sending cross-device access request information to the second device, the The cross-device access request information includes an authentication identity, so as to obtain a second access right through the authentication identity, and access the target media data stored in the second device across devices based on the second access right, and determine whether it is successful Target media data stored in the second device is accessed.

Further, before obtaining the second access right through the authentication identity, it also includes: marking the identity that has passed the latest authentication as the authentication identity.

Further, marking the authenticated identity as the authenticated identity includes: acquiring current user identity information during the authentication phase, and marking the authenticated identity as matching the current user identity information The authentication ID.

Further, after marking the identity that passed the latest authentication as the authentication identity, the method further includes: clearing the authentication time limit and the authentication identity if a lock screen event is detected.

Further, the determining whether to successfully access the target media data stored in the second device includes: obtaining an authentication result sent by the second device, and determining whether the access is successful according to the authentication result; wherein, if the access fails , the authentication result includes: access failure prompt information and access failure reasons.

In the second aspect, another embodiment of the present application provides an access control method executed on a second device. The method includes: acquiring cross-device access request information sent by the first device, if the cross-device access request information includes If the authentication account of the secondary authentication is used, then the authentication account is authenticated to determine the files or folders that the authentication account can access and the operation authority to the files or folders; wherein, in determining the first When the target file requested by the device exceeds the access authority of the account corresponding to the account information sent by the first device, the authentication fails, and the access result of the first device is fed back to the first device according to the authentication result. equipment.

Further, before the first device performs cross-device access to the second device, it also includes: configuring device accounts and user identities that can access the media data of the second device, so as to obtain one or more authorized accounts and One or more authorized identities; and configure the media data accessible by the authorized account and authorized identities, and configure the operation permissions of the authorized accounts and authorized identities on the accessible media data, the operation permissions include only Read permission or read and write permission.

Further, the configuring the media data accessible by the authorized account includes: configuring the access rights at the granularity of individual media data; or configuring the access rights at the granularity of media data groups; wherein, the single media data is A single file, the media data set is a single folder.

Further, if the cross-device access request information includes an authentication identity, access authentication is performed on the authentication account to determine the files or folders accessible by the authentication identity and the access to the files or folders. Operation authority; Wherein, when it is determined that the target file requested by the first device exceeds the access authority of the account corresponding to the account information sent by the first device, the authentication fails, and the second The access result of a device is fed back to the first device.

In the third aspect, another embodiment of the present application provides an access control device, including: a processor and a memory, the memory is used to store at least one instruction, and when the instruction is loaded and executed by the processor, the first The cross-device access control method provided by the aspect or the access control method provided by the second aspect. In an implementation manner, the access control device may be a component (such as a chip) of a device.

In a fourth aspect, another embodiment of the present application further provides a device, which may include a device body and the access control apparatus provided in the fourth aspect.

In the fifth aspect, another embodiment of the present application further provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the cross-device access control method provided in the first aspect or the second The access control method provided by the aspect.

Through the above technical solution, it is possible to determine whether secondary authentication is required when accessing cross-device media data, wherein the security risk of public devices accessing distributed device media resources is solved through secondary authentication.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description These are some embodiments of the present invention. For those skilled in the art, other drawings can also be obtained according to these drawings without any creative effort.

Fig. 1a is a schematic diagram of a global search of distributed files performed by a hyper terminal in the prior art;

Figure 1b is a schematic diagram of device data security risks in a home scenario in the prior art;

Figure 1c is a schematic diagram of sharing files through airdrop in the prior art;

FIG. 2 provides a schematic diagram of a distributed architecture according to an embodiment of the present application;

FIG. 3 is a flow chart of cross-device access to media data provided by an embodiment of the present application;

Fig. 4a is a flow chart of personal device authorization provided by another embodiment of the present application;

FIG. 4b is a flowchart of a cross-device access control method according to another embodiment of the present application;

Fig. 4c is a flow chart of secondary authentication provided by another embodiment of the present application;

Figure 4d is a schematic diagram of the authentication time limit provided by an embodiment of the present application;

FIG. 4e is a flowchart of a cross-device access control method according to another embodiment of the present application;

Figure 4f is a schematic diagram of the timeliness of the authentication identity mark provided by the present application in one embodiment;

Fig. 4g is a schematic diagram of secondary authentication provided by the present application in an embodiment after the authentication identity mark acquisition authorization fails;

Fig. 5 is a flow chart of an apparatus for cross-device access control provided by another embodiment of the present application.

detailed description

In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments It is a part of embodiments of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative efforts fall within the protection scope of the present invention.

In the prior art, terminal devices logged in with the same account can be used to form a hyperterminal, and the hyperterminal may include several shared devices and several personal devices. Personnel who can use the shared device (for example, can unlock the shared device) can perform operations such as distributed file search, distributed file browsing, and distributed file editing on other personal devices logged in with the same account through the shared device. The privacy and security of media data is violated.

Fig. 1b is a schematic diagram of device data security risks in a family scenario in the prior art. As shown in Fig. 1b, this scenario may include shared devices logged in with account A and personal devices logged in with account A (logged in with the same account). The shared device may be a large screen and/or a tablet computer (PAD), and the personal device may be a private terminal such as a mobile phone.

Currently, the media data stored in the personal device logged in with account A can be accessed through the media library of the shared device.

In some scenarios, family members may include: grandpa, grandma, dad, mom, kids. Devices such as tablets and large screens in the family usually log in with the account of a certain family member (such as dad), and the whole family members use them together, and the login accounts of devices such as tablets and large screens are rarely switched. When the non-account corresponding user (dad) is using the shared device, the non-account corresponding user may conduct distributed query files through the shared device and query important files in the personal device of the account corresponding user (dad), which may cause errors. The operation caused the problem that the data in the personal device (mobile phone) of the account corresponding to the user (dad) was damaged or lost.

Therefore, in a family scenario, family members can access personal devices logged in with the same account through shared devices, which poses potential data privacy and data security risks for devices under the same account.

In an office scene, a shared device and a private terminal that can be connected to the shared device may also be included. Wherein, the shared device can be a large conference screen, and the large conference screen is usually logged into the personal account of a certain secretary, and the personal device of the secretary is also logged in through the personal account, and the large conference screen is shared by all colleagues in the department , and the big screen of the meeting seldom switches the login account. Since the login account of the personal terminal of the secretary of the department is the same as that of the big screen of the meeting, the private terminal can be the mobile phone or personal computer of each member in the department. Therefore, when using During a departmental meeting on a shared device, if the employee who uses the shared device searches for files on the shared device, the relevant files stored in the private terminal of the department secretary who logged in with the same account can be found in the search results, which may cause the The private data stored in the private terminal of the department secretary was leaked.

Therefore, in office scenarios, there are also hidden dangers of data privacy and data security of devices under the same account.

It should be noted that, in the prior art, only terminal devices logged in with the same account are supported to form a hyper terminal (distributed), but two devices logged in through different accounts cannot access the media data of the other device across devices.

In the prior art, if you want to achieve cross-device access to data between devices logged in with different accounts or cross-device sharing of data between devices logged in with different accounts, the following non-distributed solutions are included:

1. Cloud solution

Since devices logged into different accounts cannot directly access across devices, that is, a shared device logged into account A cannot directly access media data of a personal device logged into account B. The shared device needs to enable cross-device access by enabling the cloud album function. Specifically, the shared device logs in to the cloud account before cross-device access, transfers through the cloud, and realizes cross-device access to media data. After the access, it can be closed. Cloud photo album function.

2. Projection scheme

The screen of the user's personal device can be projected to the public device by scanning the code or entering the verification code, etc. After the sharing is completed, the connection is disconnected and the connection relationship is clear. If you need to share again, you need to scan the code again or enter the verification code to cast the screen.

3. Airdrop

Figure 1c is a schematic diagram of sharing files through airdrop in the prior art. As shown in Figure 1c, after opening the file A to be sent, the user can click the "Share" button; or press and hold the "control" button in "Access". "Select the file A to be shared for a certain period of time (such as long press for 2s), and then select "Share" from the shortcut keys. Then you can select "AirDrop" from the sharing options listed in , and select the corresponding recipient (target user) in the "AirDrop" list to complete cross-device data sharing.

In each of the above non-distributed solutions, relying on the cloud for transit, and the user's operation steps are complicated, resulting in a poor user experience.

Based on the above problems, an embodiment of the present application provides an access control method. Before the user accesses the media data in the personal device logged in with the same account or logged in with the authorized account through the shared device, it is determined that the current state information satisfies the trigger authentication condition , perform secondary authentication on the current user of the shared device to ensure the privacy and security of the media data in the accessed personal device.

FIG. 2 is a schematic diagram of a distributed architecture according to an embodiment of the present application. As shown in FIG. 2 , the distributed architecture may include a shared device 21 and a personal device group 22 . Wherein, the personal device group may include personal devices logged in through the same account and personal devices logged in through different accounts, wherein the shared device may log in to the corresponding account of any personal device in the personal device group, and the shared device may be a or multiple devices that do not have a password or that can be unlocked by multiple people. For example, as shown in FIG. 2 , the shared device 21 may be a large-screen device, and the personal device group 22 may include a mobile phone, a tablet computer, and a notebook computer. The mobile phone and tablet computer use account A to log in, the laptop computer uses account B to log in, and the large-screen device and the mobile phone and tablet computer use the same account (account A) to log in. The distributed architecture of the embodiment shown in FIG. 2 is an implementation manner in this application, and is not limited thereto. There can also be other implementations, for example, both the large screen and the tablet computer are used as the shared device 21, multiple mobile phones can be included in the personal device group 22, and the login account of each mobile phone is not the same, and the large screen or tablet computer can log in to multiple mobile phones. The account of one of the mobile phones, or the corresponding account for logging in to devices other than the personal device group 22. That is, the number of shared devices and login accounts are not limited, and the number of personal devices and login accounts are not limited either. In other words, terminal devices that support logging in with different accounts form a HyperTerminal.

FIG. 3 is a flow chart of cross-device access to media data provided by another embodiment of the present application. As shown in FIG. 3 , authorized media data in a device logged in with an authorized account can be accessed through a shared device. Wherein, the authorized account may include an account that is the same as and/or different from the account logged into the shared device, that is, a device that the accessed device (target device) can discover (compared with the login account of the device, the login account of the same device and/or a device logged in with a different account) to perform authorization, and the authorized device can access the authorized media data in the accessed device (target device) across devices. The authorized media data may include media data of different granularities authorized and accessible in the target device (accessed device), and the media data may include document data, image data, video data, and the like.

As shown in Figure 3, when the HyperTerminal (the first device) currently serving as the accessing device performs cross-device access to the HyperTerminal (the second device) currently serving as the accessed device, an access request needs to be sent through the media library of the accessing device, and The media library of the accessed device can authenticate the cross-device access request of the accessing device, so the media library (Media Library) is the only global access control point of the HyperTerminal. Specifically, the media library of the personal device can perform access authorization to the devices in the distributed architecture, that is, the device authorized to log in to the set account can access the authorized media data stored locally (in the personal device). When a user uses other devices (such as a shared device) to access a personal device across devices, the user first unlocks the shared device (unlock the screen) to complete the first authentication. Further, the user operates on the cross-device access interface of the shared device to request access to the media data of the target personal device, and the media library of the shared device undergoes secondary authentication, and the target personal device can only be authorized for access after the secondary authentication is passed. Media data for access operations.

The above specific operation of sending the cross-device access request includes: the application in the shared device that logs in account A sends cross-device access request information to the media library of the shared device, and the cross-device access request information may include target device information and target media data information, For example, the target device information is a personal device logged in account B, and the target media data information is a photo album in the personal device. Wherein, if there are multiple personal devices logged into the account B, the identification information of the target device may be carried in the cross-device access request information to accurately indicate the target device that the user wants to access.

After receiving the cross-device access request information sent by the application, the media library of the shared device can determine whether secondary authentication is currently required. If secondary authentication is not required, the media library of the shared device initiates a connection to the target device through the communication bus. And after the connection is successful, the cross-device access request information is sent to the target device through the communication bus, wherein the cross-device access request information may carry the authentication result of the latest authentication. If secondary authentication is required, the media library of the shared device starts secondary authentication, and after the authentication is successful, the media library of the shared device initiates a connection to the target device through the communication bus, and after the connection is successful, the cross-device The access request information is sent to the target device, wherein the cross-device access request information may carry the current secondary authentication authentication result.

Wherein, the authentication result carried in the above cross-device access request information may include authentication account information.

After the target device receives the cross-device access request information sent by the shared device through the communication bus, the media library of the target device can determine whether the corresponding account has access rights according to the authentication account information in the cross-device access request information. Determine the specific permissions of the account corresponding to the authentication account information. Furthermore, the media library of the target device can send the obtained authentication account information corresponding to the specific authority of the account to the distributed file system of the target device, and the distributed file system of the target device provides corresponding access services for the shared device according to the specific authority.

Wherein, if the media library of the target device can determine that the corresponding account does not have access rights according to the authentication account information in the cross-device access request information, the media library of the target device can feed back the authentication result to the sharing device through the communication bus. Specifically, the corresponding account does not have access rights may include that the account does not have access rights to any media data of the target device, or the account does not have access rights to the target media data information to be accessed this time.

In one embodiment, if the media library of the target device determines that the shared device has access rights, it can also transmit the target media data that the shared device wants to access this time to the shared device through the communication bus, so that the shared device can transfer the target media to the shared device. The data is cached in the distributed file system of the shared device. If the shared device accesses the target media data again within the effective cache time period, there is no need to perform cross-device access again, and the target cached in the distributed file system of the shared device can be directly accessed media data.

Personal devices can pre-authorize access to devices in the distributed architecture, where the authorization operation can include authorizing a login account that can access local media data (that is, the account logged in by the authorized device), authorizing the corresponding device (the device that logs in to the authorized account) ) can be accessed by local applications (system applications, third-party applications), and authorize the corresponding device (the device that logs in to the authorized account) to operate the local media data (read-only, read-write).

FIG. 4a is a flow chart of personal device authorization provided by another embodiment of the present application. As shown in FIG. 3 , the media data sharing permission can be configured through the media library of the personal device, wherein. The configuration mode of the media sharing authority may include batch configuration and individual configuration.

In the mode of batch configuration, one or more groups of media data can be configured for sharing rights, wherein the group of media data can be the data stored in the target folder. That is, you can configure sharing permissions for a folder.

In the way of single configuration, the sharing permission configuration can be performed at the granularity of a single media data, where the granularity of a single media data can be a certain picture, a current segment of video, or a certain text file. That is, you can configure sharing permissions for a picture, a video or a text file.

In the mode of batch configuration or individual configuration, in one embodiment, at least an account that can access the target media data (folder or single-grained file) is configured. For example, the login accounts included in the device group under the distributed architecture include account A, account B, account C . . . The account that can access the local media data among the above-mentioned multiple accounts can be configured through the media library of the personal device. Specifically, for the above-mentioned multiple accounts, the target account (such as account A and account B) can be used as the authorized account, and the login account A Or the corresponding device logged in account B can access the device across devices.

In one embodiment, some users (such as the elderly and children at home) do not have their own accounts, but such users can use the shared device to access other devices across devices. In order to implement cross-device access authorization for this type of user, you can configure the access rights of the identity of this type of user through the media library of the personal device to obtain the corresponding authorization identity. For example, you can configure The user of , can only access the shareable data in the local media data, and the shareable data can be a shared album in an album, a shared video in a video application, and a shared contact in an address book. It should be noted that the sharing authority of the shared data can be pre-configured.

For example, in a family scenario, account A of the tablet computer is logged in as an account registered by "dad" in the family member, and both "mother" and "child" in the family member can unlock the tablet computer. If the tablet computer recognizes the current user information "child" in the unlocking stage, and marks the "child" identity) as the authentication identity ("child" identity) after the user passes the unlock authentication.

In other implementation manners, it is also possible to configure the applications that can be accessed by devices that log in to the authorized account. Among them, several system applications (such as photo album, memo, etc.) and several third-party applications (such as video APP, music APP, online class APP, WPS, etc.) are installed in the personal device. You can configure the apps that can be accessed by devices that log in to the authorized account through the media library of the personal device.

In other implementation manners, it is also possible to configure the operation authority of the device that logs in the authorized account to the accessible media data. Wherein, the operation authority includes read-only and read-write.

In some implementations, different permissions can be configured for different accounts. That is, when devices logged in with different accounts access a certain personal device, the media data that can be accessed may be different, and the operation rights to the media data may be different. For example, in a distributed architecture, when a device logged in with account A and a device logged in with account B access a device logged in with account C, the account The device logged in by A can access the data in the system application in the login account C, and the device in the login account B can access the data in the system application in the login account C and the data of some third-party applications.

In some implementations, different permissions can be configured for different users who log in to the device with the same account. That is, when a user using a device logged in with the same account accesses a personal device logged in with the same account, the accessible media data may be different. For example, user x (the elderly or a child) can use the shared device (large screen or tablet) logged in with account A to access the personal device (the mobile phone of the child's father) logged in with account A. To ensure that the personal device logged in with account A The privacy and security of data in (the mobile phone of the child’s father) can be configured by users (each family member) of the shared device (big screen or tablet) logged in with account A to the personal device (the child’s father’s) logged in with account A mobile phone) access. Among them, the current user identity can be identified when the user of the shared device logged in with account A unlocks the device, and then the corresponding cross-device access permission can be determined according to the user identity obtained during unlocking when the user performs cross-device access.

Fig. 4b is a flowchart of a cross-device access control method provided by an embodiment of the present application. As shown in Fig. 4b, the cross-device access control method may include the following steps:

Step 301: When device A requests to access cross-device media data, the media library of device A can determine whether device A is currently within the authentication time limit. If it is within the authentication time limit, perform step 302; if it exceeds the authentication time limit, perform step 303 .

Step 302: The media library of device A obtains access rights through the authentication account, and accesses target cross-device media data based on the access rights.

Step 303: The media library of device A performs secondary authentication, updates the authentication time limit after the secondary authentication is passed, and executes step 302 after the secondary authentication is passed.

Fig. 4c is a flow chart of secondary authentication provided by another embodiment of the present application. As shown in Fig. 4c, in the device group under the distributed architecture, device A serves as the accessing device, and device B serves as the accessed device. Wherein, the device A and the device B may be devices logged in with the same account, or devices logged in with different accounts. In this case (device A and B are devices logged in with the same account or devices logged in with different accounts), the device A can be a shared device or a personal device, and device B is pre-configured with local media data sharing permissions.

The user first unlocks device A (unlock the screen) to complete the first authentication. The authentication methods of the first authentication may include but not limited to scan code, password, face, fingerprint, voice and other authentication methods. Wherein, the identity information of the user who unlocks the device A can be determined through the first authentication operation. After the user passes the first authentication (unlocking the screen), obtain and save the authentication account information.

In order to ensure the privacy and security of the media data of the accessed device (device B), the embodiment of the present application provides an authentication operation of secondary authentication. Specifically, the application of device A calls the media library interface to access the cross-device media data ( media data of device B), the media library can determine whether a second authentication is currently required, and cross-device access can only be performed after the current authentication is valid or passed.

In the embodiment shown in FIG. 4 b , determining whether to perform secondary authentication may specifically include the above step 301 . In the specific implementation of step 301, it may be determined whether it is still within the authentication time limit. Figure 4d is a schematic diagram of the authentication time limit provided by an embodiment of the present application. As shown in Figure 4d, in one of the scenarios, device A is successfully unlocked at time t ₀ , that is, the user's first authentication operation is completed at time t ₀ , and the first time During authentication, the user confirmed to be used is the owner of the machine (that is, the dad in the family). Time t ₀ to time t _e is the authentication valid period (t ₀ ~ t _e ) for the user's first authentication. Further, it can be determined whether the moment when device A requests cross-device access to device B’s media data is within the above authentication valid period (t ₀ ~ t _e ); in another scenario, device A has performed one or more secondary For authentication, further, it may be determined whether the moment when device A requests cross-device access to device B's media data is within the validity period (t ₀ -t _e ) of the above-mentioned secondary authentication. It should be noted that, the duration of the authentication validity period of the first authentication and the authentication validity period of the second authentication may be the same or different. According to the determination result of whether it is within the above authentication valid period (t ₀ ~t _e ), if it is within the above authentication valid period (t ₀ ~t _e ), it is determined that it is currently within the authentication time limit, and there is no need for secondary authentication. Device A The media data authorized by device B to device A can be accessed within the validity period of the authentication.

In the specific implementation of step 302, as shown in Figure 3, the media library of device A can initiate a connection to device B through the communication bus within the authentication time limit, and send a cross-device access request (distributed access request) to device B, wherein , the cross-device access request (distributed access request) may include authentication account information that can prove that device A is currently within the authentication time limit. After receiving the cross-device access request (distributed access request) sent by device A, the media library of device B can query the corresponding account according to the authentication account information in the cross-device access request (distributed access request) (identify the current user as device owner, the corresponding account information is the access authority of device A’s login account) in device B, and the media library of device B feeds back the queried access authority information to the distributed file system of device B, and then the distribution of device B The file system can provide corresponding cross-device access services for the device A to access the corresponding authorized media data in the device B according to the access rights of the login account of the device A in the device B.

For example, as shown in Figure 3, Figure 4c and Figure 4d, device A requests cross-device access to device B's media data at time t ₁ , and the media library of device A determines that time t ₁ is in the authentication valid period (t ₀ ~ t In _e ), it is determined that no secondary authentication is required, and device A initiates a connection to device B through the communication bus, and after the connection is successful, sends access request information to device B to access the photo album of device B, and the access request information may include Authentication account information of device A. The media library of device B can perform access authentication according to the authentication account corresponding to the authentication account information in the distributed file access information sent by device A, and feed back the authentication result to the distributed file system of device B. Among them, the authentication process of the media library of device B includes: confirming whether the media data that device A requests to access is within the access authority of the authentication account corresponding to the authentication account information in the distributed file access information sent by device A, if it is within the access authority If the access authority is exceeded, the authentication fails. Specifically, if the authentication account of device A can access the photo album and memo of device B, and the authentication account of device A only has read-only operation permission for the photo album and memo of device B, and the target media file to be accessed by device A If it is an album, the authentication is passed, and the media library of device B will feed back the authentication result to the distributed file system of device B, where the authentication result may include the authentication account information corresponding to the authentication account information in the distributed file access information sent by device A The account authentication is passed, and the access rights of the authentication account include that the authentication account of device A can access the photo album and memo of device B, and the authentication account of device A only has read-only operation permission for the photo album and memo of device B. The distributed file system of device B can allow device A to read only device B's photo album.

In the specific implementation of step 303, if the media library of device A determines that the time when device A requests cross-device access to the media data of device B exceeds the above authentication valid period (t ₀ ~t _e ), it is determined that the previous authentication (first time authentication or secondary authentication), the media library of device A can perform secondary authentication. Wherein, the authentication method of the secondary authentication may include but not limited to code scanning, password, facial recognition, fingerprint, voice and other authentication methods. After the user passes the secondary authentication, the media library of device A can update the authentication time limit, and the media library of device A can initiate a connection to device B through the communication bus, and send a cross-device access request (distributed access request) to device B, Wherein, the cross-device access request (distributed access request) may include an authentication result that can prove that the device A has passed the secondary authentication, and the authentication result includes the account information of the device A that has passed the authentication this time. Wherein, the account information that has passed the authentication this time may be the identity account information of the user currently using the device A. After the second authentication is passed, the validity period of the authentication account can be updated, and step 302 is executed after the second authentication is passed, that is, the access right is obtained through the authentication account, and the target media data of the device B is accessed based on the access right.

After receiving the cross-device access request (distributed access request) sent by device A, the media library of device B can perform access authentication according to the authentication result in the cross-device access request (distributed access request) to query the corresponding account (The account information that has passed the authentication this time) access rights in device B, the media library of device B will feed back the queried access rights information to the distributed file system of device B, and then the distributed file system of device B can be based on this The access authority of the account information that passes the authentication for the second time in the device B authorizes the device A to access the corresponding authorized media data in the device B.

For example, as shown in Figure 3, Figure 4c and Figure 4d, device A requests cross-device access to device B's media data at time _t2 , and the media library of device A determines that time _t2 has exceeded the authentication valid period (t ₀ ~ t _e ), the media library of device A determines that the user needs to perform secondary authentication, and cross-device access can only be performed after the authentication is passed. Specifically, device A can perform fingerprint identification and authentication on the current user. After the user passes fingerprint identification and authentication, device A initiates a connection to device B through the communication bus, and after the connection is successful, sends a request to device B to access the distribution of device B's album. Type file access information, and the distributed file access information includes an authentication result that can prove that device A has passed the secondary authentication (fingerprint identification authentication), and the authentication result includes the account information that has passed the authentication this time. According to the authentication result information in the distributed file access information sent by device A, the media library of device B finds that the account that has passed the authentication can access device B's photo album and memo, and device A only has exclusive rights to device B's photo album and memo. Read operation permission, and then device B can authorize device A to read only device B's photo album.

Fig. 4e is a flowchart of a cross-device access control method provided by another embodiment of the present application. As shown in Fig. 4e, the cross-device access control method may include the following steps:

Step 411: When the media library of the access device requests access to cross-device media data, the media library of the access device can determine whether the access device is currently within the authentication time limit, if it is within the authentication time limit, then execute step 412, if it exceeds the authentication time limit, then Execute step 413.

Step 412: The media library of the access device obtains the first access authority through the authentication account, and accesses the target cross-device media data based on the first access authority.

Step 413: The media library of the access device obtains the second access right through the authentication identity, and accesses the target media data based on the second access right.

Step 414: Determine whether the target media data is successfully accessed across devices based on the second access authority corresponding to the authentication identity. If the access is not successful, perform step 415, and if the access is successful, perform step 416.

Step 415: Perform secondary authentication, and update the authentication time limit after the authentication is passed.

Step 416: Update the authentication time limit of the authentication ID.

In the embodiment shown in FIG. 4e, after the user passes the first authentication (unlocks the screen), the user obtains an identity, and can mark the authenticated identity as an authentication identity.

In the specific implementation of step 411, when device A requests to access cross-device media data, the media library of device A can determine whether device A is currently within the authentication time limit, and if it is within the authentication time limit, perform step 412.

The specific implementation of step 412 is similar to the specific implementation of step 302 in the above-mentioned embodiment shown in FIG. 4 b , and will not be repeated here.

In the specific implementation of step 413, if the media library of device A determines that the time when device A requests cross-device access to the media data of device B exceeds the authentication validity period (t ₀ ~t _e ) of the previous authentication, it is determined that the current authentication time limit has expired , the media library of device A can obtain the authorization of device B for the authentication identity through the authentication identity. Specifically, the file system media library of device A can initiate a connection to device B through the communication bus, and send a cross-device access request (distributed access request) to device B, wherein, in the cross-device access request (distributed access request) The above-mentioned authentication identity can be included. For example, if the user currently using device A is a child in a family member, the identity of the user currently using device A can be determined in the authentication stage (such as fingerprint identification), and after the user passes this authentication, the authentication result contains The identity information of the device A that has passed the authentication this time is the authentication identity of the "child". After receiving the cross-device access request (distributed access request) sent by device A, the media library of device B can perform access authentication according to the authentication identity in the cross-device access request (distributed access request) to query the To authenticate the access rights of the ID in device B, the media library of device B feeds back the access rights information of the queried authentication ID in device B to the distributed file system of device B, and then the distributed file system of device B can The device A is authorized to access the corresponding authorized media data in the device B according to the access right identified in the device B according to the current authentication identity. Wherein, after the distributed file system of device B determines that the target media data to be accessed by device A exceeds the access authority of the authentication identity, it feeds back the authentication result (access failure) to the media library of device A through the communication bus.

In the specific implementation of step 414, after the media library of device B determines whether the authentication identity sent by device A has access rights, it can feed back the authentication result to device A through the communication bus, and the media library of device A can The authentication result fed back by the media library determines whether the access is successful. If the access fails (that is, the authority corresponding to the authentication ID has no right to access), the secondary authentication is performed. If the access is successful, the time limit of the authentication ID is updated.

The specific implementation of step 415 is similar to the specific implementation of step 303 in the embodiment shown in FIG. 4b , and will not be repeated here.

In the specific implementation of step 416, if the access based on the authority corresponding to the authentication identity is successful, then update the timeliness of the authentication identity, that is, start counting after confirming that the access is successful. The time limit for authentication after the second authentication is the same.

For example, as shown in Figure 3, Figure 4c and Figure 4f, device A requests cross-device access to device B's media data at time _t3 , and the media library of device A determines that time _t3 has exceeded the valid authentication period, and device A's The media library can obtain the authorization of the device B for the authentication identity through the authentication identity. Device A initiates a connection to device B through the communication bus, and after the connection is successful, sends a cross-device access request message to device B requesting access to the photo album of device B, and the cross-device access request message includes the authentication identity of the current user of device A .

The media library of device B performs access authentication according to the authentication identity in the cross-device access request information sent by device A to query the access authorization corresponding to the authentication identity, and according to the authentication identity in the cross-device access request information sent by device A The identification performs access authentication, and the authentication result is fed back to the distributed file system of device B. Wherein, the authentication process of device B's media library includes: confirming whether the media data that device A requests to access is within the access authority (second access authority) of the authentication identity identifier in the distributed file access information sent by device A, if If it is within the second access authority, the authentication will pass, and if it exceeds the second access authority, the authentication will fail. Specifically, if the authentication identity of device A can access the photo album of device B, and device A only has read-only operation permission for the photo album of device B, and the target media file to be accessed by device A is the photo album, then the authentication is passed. The media library of device B feeds back the authentication result to the distributed file system of device B, where the authentication result may include that the authentication identity in the distributed file access information sent by device A passes the authentication, and the access of the authentication identity Permissions include that the current user of device A can access device B's photo album, and device A only has read-only operation permission for device B's photo album. After the distributed file system of device B determines the access rights of device A to device B, it releases corresponding media data to device A according to the access rights, so that device A can perform cross-device access.

If the media library of device A determines that the time when device A requests cross-device access to the media data of device B exceeds the authentication validity period of the previous authentication (t ₀ ~t _e ), and the access fails through the authentication identity of device A ( The media library of device A obtains the authentication failure message sent by the media library of device B, that is, the target media data cannot be accessed based on the authority corresponding to the authentication identity), and the media library of device A can perform secondary authentication. Wherein, the authentication method of the secondary authentication may include but not limited to code scanning, password, facial recognition, fingerprint, voice and other authentication methods. After the user passes the secondary authentication, the media library of device A can update the authentication time limit, and the media library of device A can initiate a connection to device B through the communication bus, and send a cross-device access request (distributed access request) to device B, Wherein, the cross-device access request (distributed access request) may include an authentication result that can prove that device A has passed the secondary authentication, and the authentication result includes account information that has passed the authentication this time. The media library of device B receives the cross-device access request (distributed access request) sent by device A, and then the media library of device B can perform access authentication according to the authentication result in the cross-device access request (distributed access request) , to query the access rights of the corresponding account (the current user's authentication identity after the second authentication) in device B, and feed back the queried access rights information to the distributed file system of device B, and then the distributed file system of device B The file system can authorize device A to access the corresponding authorized media data in device B according to the current authentication ID's access rights in device B.

Among them, it should be noted that when the accessed device (device B) configures the access rights of the access device (device A), the first access right of the authentication account of device A and the second access right of the authentication identity of device B can be configured respectively. access rights, and the first access rights and the second access rights may be different. In some implementations, the first access rights of the authentication account are higher than the second access rights of the authentication ID. Therefore, when device A obtains the second access authority through the authentication identity and accesses device B after the expiration of the authentication time limit, there may be a possibility of failure to access the target file, and then after the access fails, the media library of device A can perform Second authentication, and after the user passes the second authentication, obtain the first access authority of the authentication account authorized by device B through the authentication result, and access the authorized media data of device B after obtaining the first access authority of the authentication account.

For example, as shown in Figure 3, Figure 4c and Figure 4g, device A requests cross-device access to device B's media data at time _t3 , the media library of device A determines that time _t3 has exceeded the authentication valid period, and device A The media library obtained the second access authority through the authentication identity, but failed to access the target file through the second access authority. In the case of the failure of the above access, the media library of device A may perform secondary authentication to obtain the first access authority with higher authority. Specifically, device A can perform facial recognition authentication on the current user. After the user passes facial recognition authentication, device A initiates a connection to device B through the communication bus, and after the connection is successful, sends a third-party request to device B to access device B. The distributed file access information of the video is cached in the video APP, and the distributed file access information includes the authentication result that can prove that device A has passed the second authentication (facial recognition authentication), and the authentication result includes the account that passed the authentication this time information. According to the authentication result information in the distributed file access information sent by device A, the media library of device B finds that device A can access device B's photo album, memo, all third-party video apps and all third-party online class apps, and device A The above-mentioned authorized media data in device B has read and write operation permissions, and then device B can authorize device A to access the cached video in the target video APP of device B.

In any embodiment of the present application, after device A monitors the lock screen event, the media library of device A may clear the authentication account. After the user unlocks device A again, he passes the authentication and updates the authentication time limit. Furthermore, in order to avoid frequently pulling up the secondary authentication interface, within the authentication time limit of device A, the authentication result triggered by any application is valid for other applications, and there is no need for repeated authentication to ensure a good user experience. For example, when using the instant messaging APP in device A, the user requests cross-device access to the media data of device B, and device A is within the authentication time limit (within the first authentication time limit or the second authentication time limit), and in the social APP Complete cross-device access. When the user switches to the calendar program of device A and requests cross-device access to the media data of device B again, if device A is still within the authentication time limit at this time, there is no need to re-authenticate because device A switches applications.

Fig. 5 is a flow chart of an apparatus for cross-device access control provided by another embodiment of the present application. As shown in Fig. 5, the apparatus may include a processor 501 and a memory 502, and the memory 502 is used to store at least one instruction, which is determined by When loaded and executed by the processor 501, the cross-device access control method provided by the embodiment shown in FIG. 4b or 4e is implemented.

Another embodiment of the present application also provides a device, which may include a device body and the cross-device access control apparatus provided in the embodiment shown in FIG. 5 .

The purpose of the present application is to provide an embodiment of a system, the system may include at least two devices described above, and in an implementation manner, the at least two devices may use the same account to log in. In another implementation manner, the accounts logged in by the at least two devices may be different. The architecture diagram of the system may be as shown in FIG. 2 , but is not limited to the structure shown in FIG. 2 .

Another embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the cross-device access control method provided by the embodiment shown in FIG. 4b or 4e is implemented.

It should be noted that the terminals involved in the embodiments of the present invention may include, but are not limited to, personal computers (Personal Computer, PC), personal digital assistants (Personal Digital Assistant, PDA), wireless handheld devices, tablet computers (Tablet Computer), Mobile phones, MP3 players, MP4 players, etc.

It can be understood that the application may be an application program (nativeApp) installed on the terminal, or may also be a webpage program (webApp) of a browser on the terminal, which is not limited in this embodiment of the present invention.

Those skilled in the art can clearly understand that for the convenience and brevity of description, the specific working process of the above-described system, device and unit can refer to the corresponding process in the foregoing method embodiment, which will not be repeated here.

In the several embodiments provided by the present invention, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined Or it can be integrated into another system, or some features can be ignored, or not implemented. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit. The above-mentioned integrated units can be implemented in the form of hardware, or in the form of hardware plus software functional units.

The above-mentioned integrated units implemented in the form of software functional units may be stored in a computer-readable storage medium. The above-mentioned software functional units are stored in a storage medium, and include several instructions to make a computer device (which may be a personal computer, server, or network device, etc.) or a processor (Processor) execute the methods described in various embodiments of the present invention. partial steps. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disc and other media that can store program codes. .

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included in the present invention. within the scope of protection.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, rather than limiting them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: It is still possible to modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the technical solutions of the various embodiments of the present invention. scope.

Claims

A method for cross-device access control, executed on a first device, characterized in that the method includes:

When requesting access to cross-device media data, if it is determined that the first device has exceeded the authentication expiration date, then perform secondary authentication on the current user, and update the authentication expiration date after the second authentication is passed; and

Send cross-device access request information to the second device after the second authentication is passed, the cross-device access request information includes an authentication account that has passed the second authentication, so as to obtain the first access right through the authentication account, and The target media data stored in the second device is accessed across devices based on the first access right.
The method according to claim 1, wherein the determining that the first device has exceeded the authentication time limit currently comprises:

Determine whether the first device is currently within the authentication time limit of the latest authentication, where the latest authentication includes first authentication or the second authentication, and the first authentication includes screen unlock authentication.
The cross-device access control method according to claim 2, wherein if it is determined that the first device has exceeded the authentication time limit, performing secondary authentication on the current user includes:

If it is determined that the first device is currently out of the authentication time limit, and it is determined that the second access right based on the authentication identity fails to access, perform secondary authentication on the current user, and update the authentication time limit after the secondary authentication is passed ;as well as

After the second authentication is passed, the first access right is obtained according to the authentication account that has passed the second authentication, and the target media data stored in the second device is accessed across devices based on the first access right.
The method according to claim 3, characterized in that before the determination is based on the failure of the access right corresponding to the authentication identity, after the determination that the first device is currently out of the authentication time limit, further comprising:

Send cross-device access request information to the second device, where the cross-device access request information includes an authentication identity, so as to obtain a second access right through the authentication identity, and access the second access across devices based on the second access right. target media data stored in the second device, and determine whether the target media data stored in the second device is accessed successfully.
The method according to claim 3, characterized in that before obtaining the second access right through the authentication identity, further comprising:

Mark the identity that has passed the latest authentication as the authenticated identity.
The method according to claim 5, wherein marking the identity that has passed the latest authentication as the authentication identity includes:

In the authentication phase, the current user identity information is obtained, and the identity that passed the latest authentication is marked as the authentication identity that matches the current user identity information.
The method according to claim 5, further comprising: after marking the identity that passed the latest authentication as the authentication identity:

If the lock screen event is monitored, then clear the authentication time limit and the authentication identity.
The method according to claim 4, wherein the determining whether to successfully access the target media data stored in the second device comprises:

Obtain the authentication result sent by the second device, and determine whether the access is successful according to the authentication result;

Wherein, if the access fails, the authentication result includes: prompt information of the access failure and reasons for the access failure.
An access control method, executed on a second device, characterized in that the method includes:

Obtain cross-device access request information sent by the first device, and if the cross-device access request information includes an authentication account that has passed the secondary authentication, perform access authentication on the authentication account to determine that the authentication account can access files or folders and the operation permissions on said files or folders;

Wherein, when it is determined that the target file that the first device requests to access exceeds the access authority of the account corresponding to the account information sent by the first device, the authentication fails, and the first device's The access result is fed back to the first device.
The method according to claim 9, further comprising: before the first device performs cross-device access to the second device:

Configuring device accounts and user identities that can access the media data of the second device to obtain one or more authorized accounts and one or more authorized identities; and

Configure the media data accessible by the authorized account and the authorized identity, and configure the operation authority of the authorized account and the authorized identity on the accessible media data, the operation authority includes read-only authority or read-write authority.
The method according to claim 10, wherein the configuring the media data accessible to the authorized account comprises:

Configure access rights at the granularity of individual media data; or

Configure access rights at the granularity of media data groups;

Wherein, the single media data is a single file, and the media data group is a single folder.
The method according to claim 11, wherein if the cross-device access request information includes an authentication identity, access authentication is performed on the authentication account to determine the files or files accessible by the authentication identity folders and the operating permissions on said files or folders;

Wherein, when it is determined that the target file that the first device requests to access exceeds the access authority of the account corresponding to the account information sent by the first device, the authentication fails, and the first device's The access result is fed back to the first device.
An access control device, characterized in that the device comprises:

A processor and a memory, the memory is used to store at least one instruction, and when the instruction is loaded and executed by the processor, the cross-device access control method or claim according to any one of claims 1-8 can be realized The access control method described in any one of 9-12.
A device, characterized in that the device comprises the access control device according to claim 13.
A computer-readable storage medium on which a computer program is stored, wherein when the computer program is executed by a processor, the cross-device access control method or claim according to any one of claims 1-8 is implemented The access control method described in any one of 9-12.