WO2018171092A1 - Permission update method and terminal device - Google Patents

Abstract

Embodiments of the present invention relate to a permission update method and system. The method may comprise: a terminal device acquiring a first permission list from a server, the first permission list being a permission list obtained after the server has updated permissions of an application on an application distribution service, or the first permission list being a permission list obtained after permissions of an application currently installed on the terminal device have been updated, and the server being a server corresponding to the application distribution service of the terminal device; the terminal device updating, according to the first permission list, the permission list of the application currently installed on the terminal device, to generate a second permission list of the terminal device, such that the terminal device controls or manages the currently installed application according to the second permission list. This method employs granular control to specifically enable or disable an API permission, or to grant or reclaim one-time API permissions, and a user does not need to re-download and re-update an APK, thereby improving user experience and reducing conflicts of interest between two parties.

Description

Authority update method and terminal device Technical field

The embodiment of the present invention relates to the field of communications, and in particular, to a rights update method and a terminal device.

Background technique

Currently, the method for authorizing the Application Programming Interface (API) is to assign each APK to a specific permission, and then form an authorization file packaged with the Android package (Android Package, APK) (or application). Once the APK is installed and each time it is invoked during its use, the terminal checks its authorization file to see if it has access to the API.

However, the traditional certificate authorization scheme does not involve subsequent update issues. If the API permissions of the APK are changed (adding or revoking a permission), you need to package the new authorization file and reinstall the APK, or download it over the air. Over-the-Air Technology (OTA), the OTA method is equivalent to downloading and installing the APK. The update process is cumbersome. At the same time, by directly uninstalling the entire APK or directly canceling the entire certificate, the APK is affected. Continue to use, expanding the scope of the damage of the authorized APK manufacturers.

Summary of the invention

The embodiment of the invention provides a rights update method and a terminal device. By updating the API permissions process, the entire APK is not processed or the entire certificate is revoked, so that the user does not need to re-download the update APK, thereby improving the user experience and reducing the conflict of interest between the user and the authorized APK manufacturer.

In a first aspect, a method for updating a privilege is provided. The method may include: acquiring, by a terminal device, a first privilege list from a server, where the first privilege list is a privilege list after the server updates the privilege, and the server is corresponding to the application distribution service of the terminal device. server. The terminal device obtains the first permission list from the server. The terminal device updates the permission list of the application currently installed by the terminal device according to the first permission list, and obtains the second permission list of the terminal device, so that the terminal device controls or manages the currently installed application according to the second permission list. The method adopts refined control to specifically add or disable an API permission, or implements granting or reclaiming API permissions in one time, and the user does not need to re-download the update APK, thereby improving the user experience and reducing conflicts of interest between the two parties.

In an optional implementation, the first privilege list is a privilege list after the privilege is updated, and the terminal device obtains the first privilege list from the server, where the terminal device sends a trigger message to the server, where the trigger message includes The identification information of the terminal device, where the identification information may be the device number information of the terminal device or the user account information corresponding to the terminal device, such as the user identity information such as the user's mobile phone number and the user mailbox number. The identifier information is used to enable the server to determine, according to the identifier information, the application currently installed by the device, and send a response message to the terminal device, where the response message includes the first permission list.

In an optional implementation, the first privilege list is specifically a privilege list after the privilege is updated by the application provided by the application distribution service on the terminal device of the server service, and the terminal device obtains the first privilege list from the server, including: receiving by the terminal device The server broadcasts a system message sent, and the system message includes a first permission list.

In an optional implementation, the first permission list includes modified permissions for at least one application.

In an optional implementation, the first list of permissions includes permissions granted or revoked for at least one application.

In an optional implementation, the first permission list includes rights to reauthorize at least one application.

In an optional implementation, the terminal device updates the permission list of the currently installed application of the terminal device according to the first permission list, and obtains the second permission list of the terminal device, including: the terminal device according to the first permission list, to the terminal The permission of the permission list of the currently installed application of the device is updated, and the updated permission list is the second permission list of the terminal device.

In an optional implementation, after generating the second permission list of the terminal device, the method further includes: when the terminal device applies for a permission, the terminal device identifies the authorization certificate of the applied authority and the authority authorization file of the corresponding application of the permission. Legitimacy; if the authorization certificate of the authority and the authority authorization file of the corresponding application of the authority are legal, and the second permission list includes the permission of the application, the terminal device completes the application for the authority of the application.

In a second aspect, a terminal device is provided, the terminal device having a function of implementing the behavior of the terminal device in the actual method. This function can be implemented in hardware or in hardware by executing the corresponding software. The hardware or software includes one or more modules corresponding to the functions described above.

In a third aspect, another terminal device is provided, which can include a receiver and a processor.

The receiver is configured to obtain a first permission list from the server, where the first permission list is a permission list after the server updates the authority, and the server is a server corresponding to the application distribution service of the terminal device. The processor is configured to update the permission list of the currently installed application of the terminal device according to the first permission list, and generate a second permission list of the terminal device, so that the terminal device controls or manages the currently installed application according to the second permission list.

In an optional implementation, the terminal device includes a sender, the first permission list is an updated permission list of the application currently installed by the terminal device, and the sender is configured to send a trigger message to the server, where the trigger message includes the identifier information of the terminal device. The identifier information is used to enable the server to determine, according to the identifier information, the application currently installed by the terminal device, and send a response message to the terminal device, where the response message includes the first permission list.

In an optional implementation, the first privilege list is a privilege list for updating the privilege of the application provided by the application distribution service on the terminal device of the server service, and the receiver is further configured to receive the system message sent by the server broadcast, where the system message includes A list of permissions.

In an optional implementation, the first permission list includes modified permissions for at least one application.

In an optional implementation, the first list of permissions includes permissions granted or revoked for at least one application.

In an optional implementation, the first permission list includes rights to reauthorize at least one application.

In an optional implementation, the terminal device is specifically configured to update, according to the first permission list, the permission of the currently installed application permission list, to obtain an updated permission list, where the updated permission list is the terminal. The second permission list for the device.

In an optional implementation, the processor is further configured to: when the terminal device applies for a permission, identify the authorization certificate of the applied authority and the legality of the authority authorization file of the corresponding application of the permission; The authority authorization file of the corresponding application of the certificate and the authority is legal, and the second permission list includes the permission of the application, and the application for the authority of the application is completed.

In a fourth aspect, a computer program product is provided which, when run on a computer, causes the computer to perform the method of any of the alternative implementations described above.

A fifth aspect, a computer readable storage medium having stored thereon a computer program, the computer program being executed to implement the method of any of the above alternative implementations.

DRAWINGS

1 is a schematic structural diagram of a rights update system;

2 is a schematic diagram of a permission update prompt information;

FIG. 3 is a schematic flowchart of a method for updating a rights according to an embodiment of the present disclosure;

FIG. 4 is a schematic diagram of a scenario in which a terminal device acquires a first permission list according to an embodiment of the present disclosure;

FIG. 5 is a schematic flowchart of a permission disabling method according to an embodiment of the present invention;

FIG. 6 is a schematic flowchart of a method for granting or revoking rights according to an embodiment of the present invention;

FIG. 7 is a schematic structural diagram of a terminal device according to an embodiment of the present disclosure;

FIG. 8 is a schematic structural diagram of another terminal device according to an embodiment of the present invention.

detailed description

The technical solutions of the present application are further described in detail below through the accompanying drawings and embodiments.

The authority update method of the present application can be applied to the authority update system shown in FIG. 1. As shown in FIG. 1, the system can include, but is not limited to, a server and a terminal device.

A server for at least one APK (such as WeChat, QQ, Tencent video, etc.) provided by an application distribution service (such as an application market, an application store, etc.) on an associated device (or service) For management (such as update, deletion, etc.), the server may be a server corresponding to the distribution service of the terminal device, or may be a server that provides a cloud service for the terminal device, or a server corresponding to the terminal device manufacturer. The server may include an API token platform for managing the update of the API permissions of each APK (assuming that the API permissions have been authorized for each APK), and collecting the violations of the user feedback or the violation of the APK. , generate permission update information.

The API token platform may update the API permissions, including but not limited to disabling permissions, adding permissions, or reclaiming (granting or revoking) permissions and reauthorizing permissions. The API permissions may include accessing location information permissions, using network interface permissions, and accessing. Address book permissions and SMS reminder permissions.

In one example, the API token platform can detect violations of all APKs. If the APK includes only three APKs, WeChat, QQ, and Weibo, the API token platform detects violations of WeChat, QQ, and Weibo. . WeChat authorized permissions can have full Internet access, read address book permissions, recording permissions, read SMS permissions; QQ authorized permissions can have access to precise location, use camera permissions, read contacts, and record Permissions and read SMS permissions; Weibo authorized permissions can have access to address book permissions, use of camera permissions, text messaging permissions, access to precise location permissions.

(1) The scenario of the API token platform for the violation of at least one APK.

For example, when the API token platform collects WeChat and QQ to read the SMS violation message sent by the user when not applying for the SMS permission (without the user's consent), WeChat obtains the user when not applying for the precise location permission. Violation of location information, QQ violation of the camera to work when not applying for camera permissions, and violations of microblogging to record users when not applying for recording permission. The API token platform can disable the corresponding API permissions for WeChat, QQ, and Weibo, as shown in Table 1.

Table 1

APK package name API authorization file Disable API WeChat NO.20151201XXX Read SMS permissions to get precise location permissions Weibo NO.20150815XXX Recording permission QQ NO.20150109XXX Read SMS permission to use camera permissions

In Table 1, the authorization file corresponding to WeChat is NO.20151201XXX. After the permission is changed, the read SMS permission is disabled and the precise location permission is obtained. The authorization file corresponding to Weibo is NO.20150815XXX, and the recording permission is disabled after the permission is changed; the corresponding authorization of QQ The file is NO.20150109XXX, and the permission to read SMS permission is disabled after the permission is changed.

(2) The scenario of the API token platform for an API privilege (such as Google's new development of a functional interface) or collective recovery of an API privilege (such as a related violation of an APK vendor, reclaiming a certain privilege of all APKs of the vendor), That is, the API token platform can adopt a scenario in which a single API authority is granted or revoked at one time.

For example, the API license platform will only add the change network status permission to WeChat and QQ, and will prevent the mobile phone sleep right from being granted to WeChat, QQ and Weibo (ie all APKs), and will read the address book permissions to WeChat, QQ and Weibo is disabled (ie all APKs) as shown in Table 2.

Table 2

API permissions API authorization file Corresponding APK Change network status permissions NO.20151201XXX WeChat and QQ increase this permission Prevent mobile phone sleep permissions NO.20150815XXX WeChat, QQ and Weibo grant this permission Read address book permissions NO.20150109XXX WeChat, QQ and Weibo disable this permission

In Table 2, the authorization file corresponding to changing the network status authority is NO.20151201XXX, the authority is authorized to WeChat and QQ; the authorization file corresponding to the mobile phone dormancy permission is NO.20150815XXX, the authority is authorized to all APKs; read communication The authorization file corresponding to the recording permission is NO.20150109XXX, and this permission is disabled by all APKs.

(3) A scenario in which the API token platform re-authorizes API permissions for single or multiple APKs. The re-authorization process directly replaces the original API permissions and updates the permissions. That is to say, the rights of the updated single or multiple APKs are based on the re-authorized API permissions, and are independent of the original API permissions.

In one example, APK1 is WeChat, and the list of permissions of WeChat before re-authorization can be: prevent the phone from sleeping, calculate the application storage space, send stubborn broadcasts, change the Wi-Fi status, retrieve the running application, read Sync settings, Bluetooth management, display system level alerts, autostart at boot time, write sync settings, read system settings, view WLAN status, full Internet access, view network status, control vibrators, use cameras, read text messages, Read contacts, write contacts, a total of 19 permissions.

APK2 is QQ, and the list of permissions of QQ before re-authorization can be: prevent the phone from sleeping, disable the key lock, send the stubborn broadcast, read the system log file, retrieve the running application, read the synchronization settings, Bluetooth management, expand / Collapse status bar, display system level alerts, update UI settings, write sync settings to restart other applications, view WLAN status, full Internet access, control flash, control vibrator, 15 permissions.

APK3 is Weibo. The list of permissions of Weibo before re-authorization can be: prevent the phone from sleeping, disable key lock, read synchronization statistics, send stubborn broadcasts, retrieve running applications, read synchronization settings, Bluetooth management. , Display system level alerts, autostart at boot time, update UI settings, reorder running applications, write sync settings, view WLAN status, full internet access, view network status, control flash, control vibrator, total 17 permissions.

The API token platform reauthorizes the API permissions of at least one of WeChat, QQ or Weibo.

The list of permissions for the reauthorized WeChat is: Calculate application storage space, send stubborn broadcasts, change Wi-Fi status, Bluetooth management, create Bluetooth connection, display system level alarms, auto start at boot time, write sync settings, read system Set, view WLAN status, full Internet access, view network status, control vibrator, use camera, read text messages, read contacts, write contacts, write text messages, a total of 18 permissions.

The list of permissions for re-authorized QQ is: compute application storage space, disable key locks, change Wi-Fi status, send stubborn broadcasts, read system log files, retrieve running applications, create Bluetooth connections, read sync Settings, Bluetooth management, expand/collapse status bar, display system level alerts, update UI settings, write sync settings to restart other applications, view WLAN status, full internet access, control flash, control vibrator, get coarse location permissions , a total of 18 permissions.

The list of permissions for re-authorized QQ is: disable key locks, read synchronization statistics, change Wi-Fi status, send stubborn broadcasts, retrieve running applications, read sync settings, Bluetooth management, create Bluetooth connections, display System level alerts, autostart at boot time, update UI settings, reorder running applications, write sync settings, view WLAN status, full internet access, view network status, control flash, control vibrator, write Contact, recording, a total of 20 permissions.

In summary, the API privilege of at least one of WeChat, QQ or Weibo after the re-authorization is the same as the API privilege of the corresponding re-authorization, that is, the new API privilege of WeChat, QQ or Weibo is the API privilege of the re-authorization. Precise, regardless of the reauthorization (or original) API permissions.

It should be noted that the subject of the scene (1) is an APK, that is, certain rights are granted or disabled for an APK (such as WeChat), and the subject of the scene (2) is an API, that is, for an API (such as accessing communication). The permissions granted are granted to certain APKs or require certain APKs to disable this permission. The subject of the scene (3) is the APK. Unlike the scene (1), the re-authorized API will directly replace the API permissions of the original APK, that is, the scene (3) does not need to consider which permissions the APK is granted before, which can be directly Make a replacement for the API.

Further, the terminal device may be any mobile or portable mobile terminal, including but not limited to a mobile phone, a mobile computer, a tablet computer, a personal digital assistant (PDA), a media player, a smart TV, and the above two or Two or more combinations, etc.

The terminal device may include, but is not limited to, an input unit, a rights update unit, a rights check unit, an output unit, a communication unit, a storage unit, and the like. These components communicate over one or more buses. It will be understood by those skilled in the art that the structure of the terminal device shown in the figure does not constitute a limitation of the present application. It may be a bus-shaped structure or a star structure, and may include more or less than the illustration. Parts, or combine some parts, or different parts.

The communication unit is configured to establish a communication channel between the terminal device and the server, so as to obtain permission update information (such as a permission update list) from the server. The communication unit may include a wireless local area network (wireless LAN) module, a Bluetooth module, a baseband module, and the like, and a radio frequency (RF) circuit corresponding to the communication module. Wireless local area network communication, Bluetooth communication, infrared communication, and/or cellular communication system communication, such as wideband code division multiple access (Wideband Code) Division Multiple Access (W-CDMA) and/or High Speed Downlink Packet Access (HSDPA). The communication module is used to control communication of components in the terminal device, and can support Direct Memory Access.

The storage unit is configured to store the acquisition authority update information, the software program (such as a sound player, an image player, and the like) and the data (such as audio data, phone book, etc.) created according to the use of the terminal device. In a specific embodiment of the present invention, the storage unit may include a volatile memory, such as non-volatile volatile random access memory (NVRAM), phase change random access memory (PRAM), magnetic Resistive random access memory (MRAM), etc., may also include non-volatile memory, such as at least one disk storage device, Electronically Erasable Programmable Read-Only Memory (EEPROM) , flash memory devices, such as NOR flash memory or NAND flash memory

The privilege updating unit is configured to send the first indication information to the input unit according to the privilege of the currently installed APK of the terminal device and the acquired privilege update information, where the first indication information is used to indicate whether the input unit (such as a display screen) displays whether to apply The updated prompt information is used to complete the permission update according to the input information of the user. As shown in FIG. 2, the display screen displays whether an APK (such as XXX) has a new version updated, and when the user selects Yes, the permission update unit pairs The permissions of the APK are updated, and vice versa. The input unit may be a touch panel or other human-computer interaction interface.

Optionally, the rights update unit may further send second indication information to the output unit according to the rights of the currently installed APK and the obtained rights update information, where the second indication information is used to indicate the voice of the output unit (such as a sound output unit) Prompt whether to perform the application update prompt information, so as to complete the permission update according to the user input information. The input unit may be an image output unit (such as a display panel) and a sound output unit.

Optionally, the rights update unit may further update the rights of the currently installed APK according to the obtained rights update information.

It can be understood that the touch panel used in the above input unit can also serve as a display panel of the output unit at the same time. For example, when the touch panel detects a touch or proximity gesture operation thereon, the touch panel is transmitted to the rights update unit to determine the type of the touch event, and then the rights update unit provides a corresponding visual output on the display panel according to the type of the touch event. . Although in FIG. 1, the input unit and the output unit are two independent components to implement the input and output functions of the terminal device, in some embodiments, the touch panel and the display panel may be integrated to implement the terminal device. Input and output functions.

The permission checking unit is configured to determine the legality of the APK's authorization certificate and determine the APK's API authorization file when the terminal device applies for an API permission (such as using the network interface authority) during the operation of the APK (such as WeChat). Legitimacy (that is, check whether the signature information of the authorization file is true). If it is legal, further query the second permission list, and confirm the API permission of the current application to determine whether the APK has the right to apply for the API permission, thereby determining whether The application for the API permission is completed, that is, the terminal device allows the APK to apply for the call only if the permission exists in the second permission list.

It should be understood that the above-mentioned terminal device is only an example provided by the embodiment of the present invention, and the terminal device may have more or less components than the illustrated components, may combine two or more components, or may have Different configurations of components are implemented.

It can be seen that the present application uses a more refined control to specifically disable at least one API permission of an APK, or uniformly grant or revoke an API permission for multiple APKs, or re-issue the API rights of the re-authorization. The update process does not involve processing the entire APK or revoking the entire certificate, that is, it does not affect the continued use of other permissions of the APK, which improves the user experience and does not expand the scope of the interests of the authorized APK vendors; at the same time, the user does not need to re-download the update APK. It ensures that the certificate and authorized API permissions can be updated or disabled in time, eliminating the abuse of certificates and API permissions, thus ensuring the security of the user terminal.

FIG. 3 is a schematic flowchart diagram of a method for updating a rights according to an embodiment of the present invention. The method can include:

Step 310: The terminal device acquires the first permission list.

After the terminal device is connected to the network, when it is detected that the current system version is low or the associated server has an application update, the terminal device needs to obtain the first permission list of the application to perform permission update on the currently installed application.

Optionally, the first permission list is a permission list after the server updates the permission to the application on the application distribution service, or the first permission list is a permission list after the permission is updated for the currently installed application of the terminal device, that is, the first permission list. It can include only the changed API permissions corresponding to all APKs, and can also include changed API permissions and unchanged API permissions for all APKs. Alternatively, the first privilege list may include only the changed API privilege corresponding to the APK currently installed by the terminal device, and may also include the changed API privilege corresponding to the currently installed APK of the terminal device and the unmodified API privilege. Among them, all APKs are applications provided by the application distribution service on the terminal device served by the server, that is, all APKs are applications that the server can control.

In an example, the APK in the API license platform of the server may include NetEase mailbox, Tencent video, Taobao, and Meituan, and the correspondence between the above APK and the corresponding API is as shown in Table 3.

table 3

APK package name API authorization file Corresponding API NetEase mailbox NO.20151xxx Read contact permissions, read calendar permissions Tencent video NO.20152xxx Get precise location permissions Taobao NO.20153xxx Read contact permissions, change Wi-Fi permissions Meituan NO.20154xxx Get precise location permissions

In Table 3, the authorization file corresponding to the NetEase mailbox is NO.20151xxx, the corresponding API is to read the contact authority and read the calendar permission; the authorization file corresponding to the Tencent video is NO.20152xxx, and the corresponding API is to obtain the precise location permission; The authorization file corresponding to Taobao is NO.20153xxx, the corresponding API is to read the contact authority and change the Wi-Fi permission; the authorization file corresponding to the US group is NO.20154xxx, and the corresponding API is to obtain the precise location permission.

Optionally, there are two ways for the terminal device to obtain the first permission list from the server, as shown in FIG. 4:

In a first mode, the terminal device may receive a system message sent by the server, and the system message includes a first permission list, so that the terminal device obtains the first permission list.

Wherein, the first permission list is an updated permission list of all the APKs, and before the terminal device obtains the first permission from the server, the API token platform of the server applies the application provided by the distribution service to the terminal device served by the server. The permissions are updated to generate a first permission list.

When the API license platform of the server checks that the NetEase mailbox has violations, it needs to disable its corresponding permissions. At the same time, when the Tencent video and the US group need to increase the retrieval of the running application permissions, the API token platform updates Table 3. Generate an updated list of permissions corresponding to all APKs, the permission update list may only include API permissions corresponding to the changed APK (such as Table 4) and API permissions corresponding to the changed APK and API permissions corresponding to the unchanged APK (eg table 5).

Table 4

APK package name API authorization file Corresponding API NetEase mailbox NO.20151xxx Read contact permissions, read calendar permissions Tencent video NO.20152xxx Get precise location permissions, retrieve running application permissions Meituan NO.20154xxx Get precise location permissions, retrieve running application permissions

table 5

APK package name API authorization file Corresponding API NetEase mailbox NO.20151xxx Read contact permissions, read calendar permissions Tencent video NO.20152xxx Get precise location permissions, retrieve running application permissions Taobao NO.20153xxx Read contact permissions, change Wi-Fi permissions Meituan NO.20154xxx Get precise location permissions, retrieve running application permissions

In the second mode, the terminal device may send a trigger message to the API license platform of the server, where the trigger message may include the identifier information of the terminal device.

The identification information may be device number information of the terminal device or user account information corresponding to the terminal device, such as user identity information such as the user's mobile phone number and user mailbox number.

Before the terminal device obtains the first permission from the server, the API token platform of the server obtains the APK currently installed by the terminal device according to the identifier information of the terminal device, and updates the permission of the currently installed application of the terminal device to generate the first A list of permissions.

Further, the API token platform of the server sends the response message of the trigger message to the terminal device, where the response message may include a first permission list, where the first permission list is an API update list corresponding to the APK currently installed by the terminal device.

Optionally, the trigger message may further include one or more of an APK list of the terminal device, an installation status of the corresponding APK, an APK list currently installed by the terminal device, and server account information of the terminal device.

For example, the API token platform queries whether the APK currently installed by the terminal device exists in the updated permission list of all the APKs. If not, the API token platform sends a response message to the terminal device, and the response message may include the indication information. To indicate that the terminal device does not have an API permission update. If the API token platform sends a response message to the terminal device, the response message may include a first permission list to indicate that the terminal device has an update of the API authority.

Step 320: The terminal device updates the permission list of the application currently installed by the terminal device according to the first permission list, and generates a second permission list of the terminal device, so that the terminal device controls the currently installed application according to the second permission list. management.

It can be understood that the update here refers to recording, waiting for the APK to check when applying for API permission during use.

A list of currently installed APKs and corresponding API permissions stored locally by the terminal device is shown in Table 6.

Table 6

APK package name API authorization file Corresponding API NetEase mailbox NO.20151xxx Read contact permissions, read calendar permissions Taobao NO.20153xxx Read contact permissions, change Wi-Fi permissions Meituan NO.20154xxx Get precise location permissions

In Table 6, the authorization file corresponding to the currently installed NetEase mailbox is NO.20151xxx, and the corresponding API is the read contact permission and the read calendar permission; the currently installed Taobao authorization file is NO.20153xxx, and the corresponding API is Read the contact rights and change the Wi-Fi rights; the currently installed US group's authorization file is NO.20154xxx, and the corresponding API is to obtain the precise location permission.

Optionally, after the terminal device obtains the first permission list in mode 1, the terminal device pops up a prompt box prompting the user whether to update, and when the user selects to perform the update, the terminal device uses the first permission list and the application information of the terminal device ( For example, the number of the installed APK, the category, and the like), determine the APK to be updated by the terminal device, and update the rights corresponding to the updated APK, and obtain the updated permission list, and the updated permission list is the terminal device. Two permission lists.

In other words, the terminal device determines, according to the obtained first permission list and the application information of the terminal device, a locally stored list of rights of the currently installed APK to be updated, and the currently installed updated APK has a permission list as shown in Table 7. .

Table 7

Optionally, after the terminal device acquires the first permission list (the currently installed permission list of the to-be-updated APK) in the second mode, the terminal device pops up a prompt box prompting the user whether to update, when the user selects to perform the update, the terminal device Directly receiving the first permission list sent by the API token platform, the terminal device updates the locally stored APK to be updated according to the first permission list, and obtains the updated permission list, where the updated permission list is the terminal device. The second permission list.

In the process of running an APK (such as WeChat), when the terminal device applies for an API permission (such as using the network interface permission), it is necessary to judge the legality of the authorization certificate of the APK, and determine the legality of the API authorization file of the APK (ie, check Whether the signature information of the authorization file is true or not. If it is legal, further query the second permission list to determine whether the APK has the right to apply for the API permission, thereby determining whether to complete the application for the API permission.

The method of the above embodiment of the present invention adopts refined control to specifically disable certain API permissions, by simply reclaiming or granting an API permission, or by separately binding the authorization file with an API permission to achieve a one-time operation. To grant or reclaim an API permission, the user does not need to re-download the update APK, so that the user has no perception, thereby improving the user experience and reducing conflicts of interest between the two parties.

The following is an example of obtaining the first permission list sent by the server through the terminal device. Use the process.

FIG. 5 is a schematic flowchart of a permission disabling method according to an embodiment of the present invention. The method can include:

Step 500: The API token platform updates the API permissions of each APK according to the violation behavior of the vendor feedback or the violation of the APK, forms a first permission list, and broadcasts and issues the first permission list to the online terminal device, the first permission The list is a list of permissions for all APKs after the update.

Step 510: The terminal device receives the first permission list and stores it locally.

Step 520: The terminal device determines, according to the installation situation of the local APK and the first permission list, the APK of the terminal device to be updated with the API authority.

Step 530: The terminal device updates, according to the first permission list, a second permission list corresponding to the APK to which the API permission is to be updated, where the second permission list is a corresponding permission list of the currently installed APK locally stored by the terminal device.

Step 540: The APK applies for an API permission during the running process, and the terminal device first determines whether the authorization certificate of the APK is legal. If it is not legal, step 550 is performed. If it is legal, step 560 is performed.

Step 550, rejecting the application of the API permission of the current time.

Step 560: The end device determines the validity of the API authorization file of the APK (that is, checks whether the signature information of the authorization file or the public key is true). If it is legal, go to step 570. If not, go to step 550.

Step 570: The terminal device queries the updated second permission list to determine whether the APK has the right to apply for the API permission. If yes, go to step 480. If not, go to step 590.

Step 580: The API permission of the APK is disabled in the second permission list, and the terminal device rejects the application of the current API permission.

Step 590: The API permission of the APK is not in the second permission list, and the terminal device allows the application of the current API permission (not disabled).

Different from the prior art method of directly uninstalling the APK for the violation of the APK or directly canceling the certificate, the above method can specifically disable the API permission, and does not involve processing the entire APK or revoking the entire certificate. The method does not affect the continued use of the APK, and does not expand the scope of damage to the authorized APK vendors; the user does not need to re-download the update APK, so that the user has no perception, thereby improving the user experience and reducing the conflict of interest between the two parties.

It is to be understood that the foregoing method is not limited to the disabling of the API privilege, and is also applicable to the scenario of granting or revoking the API privilege, and replacing or re-authorizing the privilege of the API.

The following takes the first permission list delivered by the server in the terminal device mode 2 as an example to describe in detail the process of granting or revoking individual rights.

FIG. 6 is a schematic flowchart of a method for granting or revoking rights according to an embodiment of the present invention. The method can include:

Step 600: The API token platform updates the API permissions of each APK according to the violation behavior reported by the vendor or the violation event of the APK, and forms an updated permission list of all the APKs.

Step 610: The terminal device sends a trigger message to the API license platform of the server, where the trigger message may include the identifier information of the terminal device to request the first permission list, where the first permission list is an API update corresponding to the APK currently installed by the terminal device. List.

Step 620: The API token platform determines an APK currently installed by the terminal device according to the identifier information of the terminal device.

Step 630: The API token platform determines whether there is an APK currently installed by the terminal device in the updated permission list of all the APKs. If not, step 640 is performed; if yes, step 650 is performed.

Step 640: The API token platform sends a response message to the terminal device, where the response message may include indication information to indicate that the terminal device does not have an update of the API authority.

Step 650: The API token platform filters out the first permission list required by the terminal device, and sends a response message to the terminal device, where the response message may include the first permission list.

Step 660: The terminal device updates, according to the first permission list, a second permission list corresponding to the APK to which the API permission is to be updated, where the second permission list is a corresponding permission list of the currently installed APK locally stored by the terminal device.

Step 670: The APK applies for an API permission during the running process, and the terminal device first determines whether the authorization certificate of the APK is legal. If it is not legal, go to step 680. If it is legal, go to step 690.

In step 680, the application for the API permission of this time is rejected.

Step 690: The terminal device determines the validity of the API authorization file of the APK (that is, checks whether the signature information of the authorization file or the public key is true). If it is legal, go to step 700. If not, go to step 680.

Step 700: The terminal device queries the updated second permission list to determine whether the APK has the right to apply for the API permission. If yes, go to step 710. If not, go to step 720.

Step 710: The API permission of the APK is disabled in the second permission list, and the terminal device rejects the application of the current API permission.

Step 720: The API permission of the APK is not in the second permission list, and the terminal device allows the application of the current API permission (not disabled).

Different from the direct uninstallation of the APK in the prior art for the violation of the APK or the way the certificate is directly revoked, by binding the authorization file to the specific API authority one-to-one, one-time grant or revocation can be achieved. API permissions. In other words, an authorization file can control multiple APKs at the same time, and the management of the API is convenient and simple, thereby improving the user experience and reducing conflicts of interest between the two parties.

It is to be understood that the foregoing method is not limited to granting or revoking API rights, and is also applicable to the scenario of disabling API rights, replacing or re-authorizing API rights, and details are not described herein again.

The embodiment of the present invention corresponding to the foregoing method further provides a terminal device. As shown in FIG. 7, the terminal device may include a receiving unit 810 and a processing unit 820. The processing unit may include a rights update unit and a rights check unit.

The receiving unit 810 is configured to obtain a first permission list from an API token platform of the server, where the first permission list is a permission list after the server updates the permission on the application on the application distribution service, or the first permission list is the current installation of the terminal device. The application updates the permission list after the permission, and the server distributes the server corresponding to the application of the terminal device.

The processing unit (or the authority update unit) 820 is configured to update the permission list of the application currently installed by the terminal device according to the first permission list, and generate a second permission list of the terminal device, so that the terminal device is configured according to the second permission list. Control or manage the currently installed application.

Optionally, the terminal device may further include a sending unit 830. The first permission list is a permission list after the permission is updated for the application currently installed by the terminal device, and the sending unit 830 is configured to send a trigger message to the server, where the trigger message includes the identification information of the terminal device, where the identifier information is used to enable the server to identify the identifier according to the identifier. After determining the application currently installed by the terminal device, the information is sent to the terminal device, and the response message includes a first permission list.

Optionally, the first privilege list is a privilege list after the server updates the privilege to the application on the application distribution service, and the receiving unit 810 is further configured to receive the system message sent by the server broadcast, where the system message includes the first privilege List.

Optionally, the first permission list includes the modified rights to the at least one application.

Optionally, the first permission list includes rights granted or revoked to the at least one application.

Optionally, the first permission list includes rights after reauthorizing the at least one application.

Optionally, the processing unit (or the rights update unit) 820 is specifically configured to: according to the first permission list, update the permission of the currently installed application permission list, and obtain an updated permission list, where the updated permission list is The second permission list of the terminal device.

Optionally, the processing unit (or the permission checking unit) 820 is further configured to: when applying for a permission, identify the authorization certificate of the applied authority and the legality of the authority authorization file of the corresponding application of the permission; And the permission authorization file of the corresponding application of the permission is legal, and the second permission list includes the permission of the application, and the application for the permission of the application is completed.

The embodiment of the present invention corresponding to the foregoing method further provides another terminal device. As shown in FIG. 8, the terminal device may include a receiver 910, a processor 920, a transmitter 930, and a storage 940.

Receiver 910 and transmitter 930 can be antennas. Processor 920 can be a central processing unit (CPU), or a combination of a CPU and a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a general array logic (GAL), or any combination thereof.

The memory 940 may include a volatile memory such as a random-access memory (RAM); the memory 940 may also include a non-volatile memory such as a read-only memory (read) -only memory, ROM), flash memory, hard disk drive (HDD) or solid-state drive (SSD). Memory 940 can also include a combination of the above types of memory. The memory 940 stores the program code and can transfer the stored program code to the processor 920.

The receiver 910 is configured to obtain a first permission list from an API token platform of the server. The first permission list is a permission list after the server updates the permission to the application on the application distribution service, or the first permission list is a permission list after the permission is updated by the currently installed application of the terminal device. The server is a server corresponding to the application distribution service of the terminal device.

The processor 920 is configured to update the permission list of the currently installed application of the terminal device according to the first permission list, and generate a second permission list of the terminal device, so that the terminal device controls the currently installed application according to the second permission list or management.

Optionally, the first privilege list is an updated privilege list of the application currently installed by the terminal device, and the sender 930 is configured to send a trigger message to the server, where the trigger message includes the identifier information of the device. The identifier information is used to enable the server to determine, according to the identifier information, the application currently installed by the device, and send a response message to the device, where the response message may include the first permission list.

Optionally, the first privilege list is a privilege list after the server updates the privilege to the application on the application distribution service, and the receiver is further configured to receive the system message sent by the server broadcast, where the system message includes the first privilege list.

Optionally, the first permission list includes the modified rights to the at least one application.

Optionally, the first permission list includes rights granted or revoked to the at least one application.

Optionally, the first permission list includes rights after reauthorizing the at least one application.

Optionally, the processor 920 is configured to: update the permission list of the currently installed application of the terminal device according to the first permission list and the application currently installed by the device, and obtain the second permission list of the terminal device.

Optionally, the processor 920 is further configured to: when the device applies for a permission, identify an authorization certificate of the applied authority and a legal authorization file of the corresponding application of the permission; if the authorization certificate and the authority of the authority The permission authorization file of the corresponding application is legal, and the second permission list includes the permission of the application, and the application for the permission of the application is completed.

A person skilled in the art should further appreciate that the elements and algorithm steps of the various examples described in connection with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both, in order to clearly illustrate hardware and software. Interchangeability, the composition and steps of the various examples have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the solution. A person skilled in the art can use different methods to implement the described functions for each particular application, but such implementation should not be considered to be beyond the scope of the present application.

It will be understood by those skilled in the art that all or part of the steps of implementing the above embodiments may be performed by a program, and the program may be stored in a computer readable storage medium, which is non-transitory ( Non-transitory medium, such as random access memory, read only memory, flash memory, hard disk, solid state disk, magnetic tape, floppy disk, optical disc, and any combination thereof.

The above description is only a preferred embodiment of the present application, but the scope of protection of the present application is not limited thereto, and any person skilled in the art can easily think of changes or within the technical scope disclosed in the present application. Replacement should be covered by the scope of this application. Therefore, the scope of protection of the present application should be determined by the scope of protection of the claims.

Claims (26)

A method for updating rights, characterized in that the method comprises: The terminal device obtains a first privilege list from the server, where the first privilege list is a privilege list after the server updates the privilege, and the server is a server corresponding to the application distribution service of the terminal device; The terminal device updates the permission list of the application currently installed by the terminal device according to the first permission list, and obtains a second permission list of the terminal device, so that the terminal device according to the second permission The list controls or manages the currently installed application. The method of claim 1 wherein: The first permission list is a permission list after the permission is updated by the currently installed application of the terminal device; Obtaining, by the terminal device, the first permission list from the server, including: The terminal device sends a trigger message to the server, where the trigger message includes the identifier information of the terminal device, where the identifier information is used to enable the server to determine, according to the identifier information, that the terminal device is currently installed. After the application, the response message is sent to the terminal device, where the response message includes the first permission list. The method of claim 1 wherein: The first permission list is a permission list after the server updates the authority to the application on the application distribution service; Obtaining, by the terminal device, the first permission list from the server, including: The terminal device receives a system message that is sent by the server, and the system message includes the first permission list. The method according to any one of claims 1 to 3, wherein the first permission list comprises a modified authority for at least one of the applications. The method according to any one of claims 1 to 3, wherein the first permission list comprises rights granted or revoked to at least one of the applications. The method according to any one of claims 1 to 3, wherein the first permission list comprises rights after reauthorizing at least one of the applications. The method according to any one of claims 3-6, wherein the terminal device updates the permission list of the application currently installed by the terminal device according to the first permission list, and obtains the terminal device. The second list of permissions, including: The terminal device updates the permission of the permission list of the application currently installed by the terminal device according to the first permission list, and obtains the updated permission list as the second permission list of the terminal device. The method according to any one of claims 1 to 7, wherein after the generating the second permission list of the terminal device, the method further comprises: When the terminal device applies for a permission, the terminal device identifies the authorization certificate of the applied authority and the legality of the authority authorization file of the corresponding application of the permission; if the authorization certificate and the permission of the authority The permission authorization file of the corresponding application is legal, and the second permission list includes the permission of the application, and the terminal device completes the application for the authority of the application. A terminal device, comprising: a receiving unit and a processing unit, The receiving unit is configured to obtain a first privilege list from a server, where the first privilege list is a privilege list after the server updates the privilege, and the server is a server corresponding to the application distribution service of the terminal device; The processing unit is configured to update, according to the first permission list, a permission list of an application currently installed by the terminal device, and generate a second permission list of the terminal device, so that the terminal device is configured according to the The second permission list controls or manages the currently installed application. The device according to claim 9, wherein: The device also includes a transmitting unit; The first permission list is an updated permission list of an application currently installed by the device; The sending unit is configured to send a trigger message to the server, where the trigger message includes identifier information of the device, where the identifier information is used to enable the server to determine, according to the identifier information, that the terminal device is currently After the installed application, the response message is sent to the terminal device, and the response message includes the first permission list. The device according to claim 9, wherein the first permission list is a permission list after the server updates the authority to the application on the application distribution service; The receiving unit is further configured to receive a system message that is sent by the server, where the system message includes the first permission list. The device according to any one of claims 9-11, wherein the first permission list comprises a modified authority for at least one of the applications. The device according to any one of claims 9-11, wherein the first permission list comprises rights granted or revoked to at least one of the applications. The device according to any one of claims 9-11, wherein the first rights list comprises rights after reauthorizing at least one of the applications. The device according to any one of claims 11 to 14, wherein the processing unit is configured to update the permission of the currently installed application permission list according to the first permission list, and obtain the updated permission. a list, the updated permission list is a second permission list of the terminal device. The device according to any one of claims 9 to 15, wherein the processing unit is further configured to: when the terminal device applies for a permission, identify an authorization certificate of the application authority and the The validity of the authority authorization file of the corresponding application of the permission; if the authorization certificate of the authority and the authority authorization file of the corresponding application of the authority are legal, and the second permission list includes the permission of the application, the completion of the The application for the authority of the application. A terminal device, the device comprising: a receiver and a processor, The receiver is configured to obtain a first permission list from a server, where the first permission list is a permission list after the server updates the authority, and the server is a server corresponding to the application distribution service of the terminal device; The processor is configured to update, according to the first permission list, a permission list of an application currently installed by the terminal device, and generate a second permission list of the terminal device, so that the terminal device is configured according to the The second permission list controls or manages the currently installed application. The device of claim 17 wherein: The device also includes a transmitter; The first permission list is an updated permission list of an application currently installed by the device; The transmitter is configured to send a trigger message to the server, where the trigger message includes identifier information of the device, where the identifier information is used to enable the server to determine, according to the identifier information, the current status of the terminal device. After the installed application, the response message is sent to the terminal device, and the response message includes the first permission list. The device of claim 17 wherein: When the first permission list is an updated permission list of an application currently installed by the device; The receiver is further configured to receive a system message that is sent by the server, where the system message includes the first permission list. The device according to any one of claims 17 to 19, wherein the first permission list comprises a modified authority for at least one of the applications. The device according to any one of claims 17 to 19, wherein the first permission list comprises rights granted or revoked to at least one of the applications. The device according to any one of claims 17 to 19, wherein the first rights list comprises rights after reauthorizing at least one of the applications. The device according to any one of claims 19 to 22, wherein the processor is specifically configured to update the permission of the currently installed application permission list according to the first permission list, and obtain the updated permission. a list, the updated permission list is a second permission list of the terminal device. The device according to any one of claims 17 to 23, wherein the processor is further configured to: when the terminal device applies for a permission, identify an authorization certificate of the application authority and the The validity of the authority authorization file of the corresponding application of the permission; if the authorization certificate of the authority and the authority authorization file of the corresponding application of the authority are legal, and the second permission list includes the permission of the application, the completion of the The application for the authority of the application. A computer program product comprising instructions, wherein the computer program product, when run on a computer, causes the computer to perform the method of any of claims 1-8. A computer readable storage medium, characterized in that the computer readable storage medium stores a computer program, the computer program being executed to implement the method of any one of claims 1-8.

Images