CN107391977B - Permission control, automatic switching method, device and equipment - Google Patents

Abstract

The embodiments of this specification provide a method, device, and device for controlling and automatically switching permissions. At least one access control policy for determining permissions is generated from predetermined environment information of the device. During the actual control or automatic switching process of permissions, it can be obtained by obtaining The environmental information of the device determines the access control policy of the device, thereby realizing the control or automatic switching of permissions.

Description

Permission control, automatic switching method, device and equipment

technical field

The embodiments of the present specification relate to the field of computer technology, and in particular, to a method, apparatus, and device for control and automatic switching of authority.

Background technique

With the development of society, smart devices are becoming more and more popular, especially mobile devices (such as mobile phones) have gradually become indispensable personal items for people. Many owners of smart devices do not want others to see some content on their devices in certain specific occasions (such as office), such as photo albums, transaction records, call records, short messages, circle of friends, etc.

In order to meet the requirements of the device owner to protect the content on the device in different occasions, it is necessary to provide a solution for accessing the content on the device.

SUMMARY OF THE INVENTION

In view of this, the embodiments of this specification provide a control, an automatic switching method, an apparatus, and a device for automatically switching authority.

According to a first aspect of the embodiments of the present specification, a method for controlling authority is provided, comprising the steps of:

Acquire context information of the device, where the context information carries the environment information of the device;

Acquire an access control policy corresponding to the acquired environmental information, wherein at least one access control policy is generated based on predetermined environmental information;

Based on the obtained access control policy, the target object that is allowed to be accessed is determined.

According to a second aspect of the embodiments of the present specification, an automatic switching method for authority is provided, comprising the steps of:

Acquire context information of the device, where the context information carries the environment information of the device;

After detecting that the environment information is updated, obtain an access control policy corresponding to the updated environment information, wherein at least one access control policy is generated based on predetermined environment information;

Based on the obtained access control policy, the target object that is allowed to be accessed is determined.

According to a third aspect of the embodiments of the present specification, an apparatus for controlling authority is provided, including:

a context acquisition module, configured to acquire context information of the device, where the context information carries the environment information of the device;

a control policy acquisition module, configured to acquire an access control policy corresponding to the acquired environmental information, wherein at least one access control policy is generated based on predetermined environmental information;

The target object determination module is configured to determine the target object that is allowed to be accessed based on the obtained access control policy.

According to a fourth aspect of the embodiments of this specification, there is provided an automatic switching device for authority, including:

a context acquisition module, configured to acquire context information of the device, where the context information carries the environment information of the device;

a control policy switching module, configured to acquire an access control policy corresponding to the updated environment information after detecting that the environment information is updated, wherein at least one access control policy is generated based on predetermined environment information;

The target object determination module is configured to determine the target object that is allowed to be accessed based on the obtained access control policy.

According to a fifth aspect of the embodiments of the present specification, an electronic device is provided, including:

processor;

a memory that stores processor-executable instructions;

The processor is coupled to the memory for reading program instructions stored in the memory, and in response, performs the following operations:

Acquire context information of the device, where the context information carries the environment information of the device;

Acquire an access control policy corresponding to the acquired environmental information, wherein at least one access control policy is generated based on predetermined environmental information;

Based on the obtained access control policy, the target object that is allowed to be accessed is determined.

According to a sixth aspect of the embodiments of the present specification, an electronic device is provided, including:

processor;

a memory that stores processor-executable instructions;

The processor is coupled to the memory for reading program instructions stored in the memory, and in response, performs the following operations:

Acquire context information of the device, where the context information carries the environment information of the device;

After detecting that the environment information is updated, obtain an access control policy corresponding to the updated environment information, wherein at least one access control policy is generated based on predetermined environment information;

Based on the obtained access control policy, the target object that is allowed to be accessed is determined.

By implementing the embodiments provided in this specification, at least one access control policy that can determine permissions for the device or applications in the device can be generated from the predetermined environment information of the device in advance. The environmental information of the device determines the access control policy of the device, and then determines the target objects that are allowed to access based on the obtained access control policy, so as to control the permissions, so that the content presented by the device to the device user can meet the requirements of the device owner in different occasions. The need to protect privacy without affecting others borrowing or viewing the device.

In addition, this solution can automatically detect the update of the environmental information, and then automatically switch the access control policy with the update of the environmental information, and then determine the target objects that are allowed to be accessed based on the switched access control policy. Therefore, there is no need for the device user to manually input gestures , fingerprint and other unlocking information, you can easily and flexibly switch different permissions automatically, which can further improve the access security of the device.

Description of drawings

FIG. 1 is a flowchart of a method for controlling authority shown in an exemplary embodiment of the present specification;

FIG. 2 is a flowchart of a method for controlling authority shown in another exemplary embodiment of this specification;

FIG. 3 is a flowchart of a method for automatically switching permissions according to an exemplary embodiment of the present specification;

FIG. 4 is a flowchart of a method for automatically switching permissions according to another exemplary embodiment of this specification;

FIG. 5 is a block diagram of an apparatus for controlling authority shown in an exemplary embodiment of the present specification;

FIG. 6 is a block diagram of an apparatus for automatic switching of authority shown in an exemplary embodiment of the present specification;

FIG. 7 is a hardware structure diagram of an electronic device shown in an exemplary embodiment of this specification.

Detailed ways

Exemplary embodiments will be described in detail herein, examples of which are illustrated in the accompanying drawings. Where the following description refers to the drawings, the same numerals in different drawings refer to the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the embodiments of this specification. Rather, they are merely examples of apparatus and methods consistent with some aspects of the embodiments of the present specification as recited in the appended claims.

The terms used in the embodiments of the present specification are only for the purpose of describing specific embodiments, and are not intended to limit the embodiments of the present specification. As used in the embodiments of this specification and the appended claims, the singular forms "a," "the," and "the" are intended to include the plural forms as well, unless the context clearly dictates otherwise. It will also be understood that the term "and/or" as used herein refers to and includes any and all possible combinations of one or more of the associated listed items.

It should be understood that although the terms first, second, third, etc. may be used in the embodiments of the present specification to describe various information, the information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the embodiments of the present specification, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein can be interpreted as "at the time of" or "when" or "in response to determining."

Please refer to FIG. 1. FIG. 1 is a flowchart of a method for controlling permissions according to an exemplary embodiment of the present application. This embodiment can be applied to various devices that need to control permissions, and may include the following steps S101-S103:

Step S101: Acquire context information of the device, where the context information carries the environment information of the device.

Step S102: Acquire an access control policy corresponding to the acquired environment information, wherein at least one access control policy is generated based on predetermined environment information.

Step S103: Determine the target object that is allowed to be accessed based on the acquired access control policy.

The devices to which the embodiments of this specification apply may be personal computers, laptop computers, tablet computers, cellular phones, camera phones, smart phones, personal digital assistants, media players, navigation devices, e-mailing devices, game controls Devices that need to control permissions, such as consoles, wearable devices, etc., the context information of these devices refers to factors that may affect the permissions of the device or the content on the device. Considering that the context information needs to meet the device owner's privacy needs after different occasions, The contextual information may include contextual information of the device.

The environmental information can refer to the geographical location information of the environment where the device is located, and can also refer to the information that may be contacted in the environment where the device is located, such as at least one of magnetic field fingerprints, WIFI fingerprints, ambient audio and other information, which can be distinguished. different environments.

For different environmental information, in order to meet the requirements of device owners to protect privacy, the designer of this solution can provide predetermined environmental information, and generate corresponding access control policies for different predetermined environmental information. Through this function, the device owner can According to its own privacy protection requirements, access control policies corresponding to different predetermined environmental information can be generated. Different access control policies can describe different permissions and corresponding security levels. The access control policy mentioned here can not only describe the permissions (such as access, change, etc.) of the device user (user, referring to the device owner or other personnel) to the device, but also describe the device user's access to certain applications in the device. Authority can also describe the authority of the device user to some functional modules in the application, which is not limited in the embodiment of this specification.

The following describes how the device owner generates the access control policy for different predetermined environment information:

One: The predetermined environment information is geographic location information. The geographic location information may refer to the latitude and longitude of the location where the electronic device is located, the location name, or the location identifier customized by the device owner to distinguish different locations. For example, equipment owners define their place of residence as a "home", their office as a "company", a place where they eat out as a "restaurant", and a place where they work out as a "sports place" and many more. However, the name of the place may correspond to the latitude and longitude identifier of the place, and by detecting the latitude and longitude, the corresponding place name or the location identifier of the self-positioning can be determined.

In practical applications, generating access control policies needs to consider a variety of conditions, such as: different equipment owners, different equipment locations, different personnel in the sites, or different sites have different requirements for equipment owners. The privacy protection requirements of the device owner. The device owner may also have different geographical location information, access control policies, and the corresponding relationship between geographical location information and access control policies according to their own privacy protection requirements. The following lists a few kind of situation:

Situation 1. Most of the contacts of the device owner in the living place are family members, and there is no need to hide their privacy from the family; most of the contacts in the office are leaders or colleagues. Games, items purchased online, chats with family members or friends, etc.; the people who are in contact at a place to eat or exercise are complex, and there may be friends and strangers who are familiar with each other, and the owner of the device may neither want Let strangers know about their daily life, and don't let strangers know about their work.

In response to the above privacy protection requirements of the device owner, the device owner can generate an access control policy that describes the device user's rights to the device based on the geographic location information of the device owner, such as the manager policy and the access prohibition policy. The manager policy corresponds to The geographic location information is "home", the place name of "home" or the latitude and longitude of "home". This policy can allow device users to access all content in the device and change all settings of the device; prohibit access to the geographic location information corresponding to the policy. Not "home", the name of the place of "home", or the latitude and longitude of "home", this policy prohibits device users from accessing the device.

Furthermore, the device owner can also generate an access control policy that describes the device user's rights to the device content based on the geographic location information of the device owner, such as an administrator policy and a temporary access policy or an initial content access policy, mentioned here. Device content can refer to system software or application software in the device, system software such as operating system, database management system, etc., application software such as instant messaging software, e-commerce software, etc., or it can refer to functional modules in application software, such as e-commerce Transaction records in the software, historical communication records in instant messaging software, etc.

Among them, the geographic location information corresponding to the manager's policy is "home", the place name of "home", or the latitude and longitude of "home". This policy can allow device users to access all content in the device and change all settings of the device; temporary access The policy or initial content access policy corresponds to geographic location information, not the name of "home", the place name of "home", or the latitude and longitude of "home". The temporary access policy can allow device users to access content that is not related to private content, which is controlled by the device The owner pre-books, which can be photo albums in the gallery, transaction records in e-commerce software, historical communication records in instant messaging software, etc.; the initial content policy allows device users to access the initial state of the device without loading any content. In other examples, different access control policies may also describe content that the device user is not allowed to access, which is not limited in this embodiment of the present specification.

In addition, the device owner can also generate different access control policies based on the geographic location information of different places, such as administrator access policies, office access policies, and public access policies. different.

The geographic location information corresponding to the administrator policy is "home", the place name of "home", or the latitude and longitude of "home", etc. The policy can allow device users to access all content in the device and change all settings of the device.

The geographic location information corresponding to the office access policy is "company", the place name of the "company", or the latitude and longitude of the "company", etc. This policy can allow device users to access work-related content in the device.

The geographic location information corresponding to the public access policy is "restaurant" and "sports place", the place names of "restaurant" and "sports place", or the latitude and longitude of "restaurant" and "sports place", etc. This policy can allow device users Access content not related to personal life and work.

Situation 2 is different from Situation 1 in that the company requires employees to keep their work confidential, and when generating an access control policy, if the geographic location information is "home", the name of the place of "home" or the latitude and longitude of "home", the geographic The policy corresponding to the location information may be a private access policy, and the policy may allow the device user to access the content unrelated to the work in the device, and to change the settings unrelated to the work content.

In other embodiments, for different conditions, the device owner may also pre-determine geographic location information, access control policies, and the corresponding relationship between geographic location information and access control policies that are different from the above conditions, which are not limited in the embodiments of this specification. .

2: The predetermined environment information is the WIFI fingerprint, which can refer to the signal strength of the wireless local area network where the device is located. For example, the WIFI of the living place is W1, the WIFI of the office place is W2, the WIFI of the dining place is W3, the place of fitness exercise WIFI is W4. When the device owner is in the residence, the WIFI is W1 and the signal strength is Q1, while the signal strengths of W2, W3 and W4 are all 0; when the device owner is in the office, the WIFI is W2 and the signal strength is Q2, while W1, The signal strengths of W3 and W4 are both 0; when the device owner is in the dining place, the WIFI is W3 and the signal strength is Q3, while the signal strengths of W1, W2 and W4 are all 0; when the device owner is in a fitness exercise place , WIFI is W4, the signal strength is Q4, and the signal strength of W1, W2 and W3 are all 0.

In practical applications, the generation of access control policies needs to consider a variety of conditions, such as: different device owners, different WIFI fingerprints in the place where the device is located, different personnel in the place, or different places have different requirements for the device owner, etc. In order to meet the privacy protection requirements of device owners, the device owners may have different WIFI fingerprints, access control policies, and the corresponding relationship between WIFI fingerprints and access control policies according to their own privacy protection requirements. Referring to the above situation 1 and situation 2, the difference is that the geographic location information of each location is replaced with the WIFI fingerprint of each location.

In addition to the above conditions 1 and 2, in other embodiments of this specification, for different conditions, the device owner can also pre-determine WIFI fingerprints, access control policies and the corresponding relationship between WIFI fingerprints and access control policies that are different from the above conditions, The embodiments of the present specification do not limit this.

Three: The predetermined environmental information is the magnetic field fingerprint, which can refer to the magnetic field data of some locations in the environment where the device is located, similar to RSSI fingerprints, which represent information such as the magnetic field strength of some locations. It can be acquired by a magnetometer built into the device.

For example, the magnetic field of the living place is C1, the magnetic field of the office place is C2, the magnetic field of the dining place is C3, and the magnetic field of the fitness exercise place is C4. When the device owner is in the residence, the magnetic field is C1, the signal strength is T1, and the signal strengths of C2, C3, and C4 are all 0; when the device owner is in the office, the magnetic field is C2, the signal strength is T2, and C1, C3, and C4 have a signal strength of 0. The signal strengths of C3 and C4 are both 0; when the device owner is in a dining place, the magnetic field is C3 and the signal strength is T3, while the signal strengths of C1, C2 and C4 are all 0; when the device owner is in a fitness exercise place , the magnetic field is C4, the signal strength is Q4, and the signal strengths of W1, W2, and W3 are all 0.

In practical applications, the generation of access control policies needs to consider a variety of conditions, such as: different device owners, different magnetic field fingerprints in the place where the device is located, different personnel in the place, or different places have different requirements for the device owner, etc. In order to meet the privacy protection requirements of the device owner, the predetermined magnetic fingerprint, access control strategy, and the corresponding relationship between the magnetic fingerprint and the access control strategy may be different for the device owner according to their own privacy protection requirements. Refer to Situation 1 and Situation 2 above, except that the geographic location information of each location is replaced with the magnetic field fingerprint of each location.

In addition to the above conditions 1 and 2, in other embodiments of this specification, for different conditions, the device owner can also pre-determine magnetic field fingerprints, access control policies and the corresponding relationship between magnetic field fingerprints and access control policies that are different from the above conditions, The embodiments of the present specification do not limit this.

Four: The predetermined environmental information is the environmental audio, and the environmental audio can be the audio of the sounds that often occur in the environment (the level of the sound).

For example, the sound of people talking often occurs in residential places, the audio is Y1, the sound of people tapping computer equipment often occurs in the office, the audio is Y2, the sound of tableware collision often occurs in the dining place, the audio is Y3, and the fitness exercise place often occurs. Noise occurs, audio is Y4.

In practical applications, generating access control policies needs to consider a variety of situations, such as: different device owners, different ambient audio in the place where the device is located, different personnel in the place, or different places have different requirements for the device owner, etc. In order to meet the privacy protection requirements of the device owner, the predetermined ambient audio, access control policies, and the corresponding relationship between ambient audio and access control policies may be different according to their own privacy protection requirements. See Case 1 and Case 2 above, except that the location information for each location is replaced with the location's ambient audio.

In addition to the above conditions 1 and 2, in other embodiments of this specification, for different conditions, the device owner can also pre-determine ambient audio, access control policies and the corresponding relationship between ambient audio and access control policies that are different from the above conditions, The embodiments of the present specification do not limit this.

In some cases, in order to further enhance the protection of privacy, the device owner can also add other control factors to the context information, such as an unlock password, which can be used to unlock the device, and can also be used to unlock the system software or system software in the device. The software application can also be used to unlock the functional modules in the software application, which is not limited in the embodiment of this specification.

In practical applications, in order to further strengthen the privacy protection of device owners, in addition to generating corresponding access control policies based on different predetermined environmental information, device owners can also generate corresponding access control policies based on predetermined passwords alone. There can be more than two passwords, and the access control policies generated based on different predetermined passwords can be different, and the predetermined password mentioned here can be used to match the unlocking instruction.

The access control policy generated based on the predetermined password alone can be included in the access policy generated based on some predetermined environmental information, which is a further subdivision of the access control policy generated based on some predetermined environmental information; The access control policies generated by the predetermined environment information are completely different policies.

In addition, device owners can generate access control policies based on predetermined passwords and predetermined contextual information at the same time. However, whether the access control policy is generated based on the predetermined environment information or the predetermined password alone, or the access control policy is generated based on the predetermined environment information and the predetermined password at the same time, if the acquired context information carries the environmental information, it is necessary to obtain the The access control policy corresponding to the information, and based on the obtained access control policy, the target object that is allowed to be accessed is determined. The target object here may refer to the device itself, or may refer to software in the device or functional modules in the software.

In practical applications, when the context information is different, the way to obtain the context information can be different. When the context information is geographic location information, it can be obtained through GPS positioning; when the context information is the unlock password, the unlock password can be obtained through user instructions. When the specific form is different, the user instructions can also be different, such as: when the unlock password is a character or gesture, the unlock password can be obtained through the touch command; when the unlock password is a user fingerprint, the unlock password can be obtained through the touch fingerprint command; When the password is audio, the unlocking password may be obtained through an audio command. In other examples, the unlocking password may also be other passwords implemented such as face, which is not limited in the embodiment of this specification.

When acquiring the corresponding access control policy, if the context information only carries environmental information, the acquired environmental information is directly matched with the predetermined environmental information. If the matching is successful (for example, the two are the same or approximately the same), the corresponding environmental information For the access control policy generated based on the matched predetermined environment information, if the matching is unsuccessful, the corresponding environment information is the default access control policy, or an access control policy other than the access control policy generated based on the predetermined environment information.

If the context information carries the environment information and the unlocking password, the predetermined information (the predetermined environment information or the predetermined password) corresponding to the corresponding context information (the environment information or the unlocking password) can be obtained in sequence according to the order of obtaining the environment information and the unlocking password, And determine the corresponding access control policy and the target objects that are allowed to be accessed in sequence. In a certain example, the environment information is obtained first, and then the unlock password is obtained, the predetermined environment information that matches the environment information is obtained first, and the corresponding access control policy and the target objects that are allowed to be accessed are determined in sequence, and then the match with the unlock password is obtained. The predetermined password is searched for the corresponding access control policy in order and the target objects that are allowed to be accessed are determined. The access control policy found later may belong to the previously determined access control policy, which is a further refinement of the previously determined access control policy, or it may be completely different from the previously determined access policy. The aforementioned process of generating an access control policy is related.

In other examples, if the environmental information and the unlocking password are obtained at the same time, the predetermined environmental information that matches the environmental information can be obtained preferentially, and the corresponding access control policy and the target objects allowed to be accessed can be determined in sequence, and then the predetermined environmental information matching the unlocking password can be obtained. password, and search for the corresponding access control policy in order and determine the target objects that are allowed to access.

After the target objects that are allowed to be accessed are determined, the embodiment of this specification may display the entry identifiers of all the target objects on the interface of the device, and after receiving the access request sent by the user (device user) through the displayed entry identifier, and the request When the accessed target object is a target object that is not allowed to be accessed, the access request is rejected. If the target object requested to be accessed is the target object permitted to be accessed by the access control policy, the operation of accessing the target object is performed.

In order to prevent the device user from knowing that there is content on the device that the device is not allowed to access, in the embodiment of this specification, after the target object that is allowed to be accessed is determined, the entry identifier of the target object that is not allowed to be accessed can be hidden on the interface of the device, so that The device user cannot see the private content that the device owner needs to protect, which can further improve the security of privacy.

In some scenarios, the environment where the device is located is an office, and the pre-generated access control policy based on the office is an office access policy, which does not allow device users to access content related to daily life in the device. However, because the device owner needs to provide his life photos to the company's event organizers, he needs to access the content related to daily life in the device. In response to this situation, this solution can initiate compulsory access to the content related to daily life. The specific implementation process Referring to FIG. 2 , FIG. 2 is a flowchart of a method for controlling authority shown in another exemplary embodiment of this specification, and this embodiment may include the following steps S201-S204:

Step S201: Acquire context information of the device, where the context information carries the environment information of the device.

Step S202: Acquire an access control policy corresponding to the acquired environment information, wherein at least one access control policy is generated based on predetermined environment information.

Step S203: Determine the target object that is allowed to be accessed based on the acquired access control policy.

Step S204: When receiving a mandatory access request from a user to a target object that is not allowed to be accessed, determine whether to allow access to the target object based on the authentication information carried in the mandatory access request.

Steps S201 to S203 in this embodiment correspond to steps S101 to S103 in the embodiment involved in FIG. 1 , and details are not repeated here.

For step S204, the mandatory access request may be sent by the user through the access interface of the target object that is not allowed to be accessed displayed on the device interface, or may be sent by the user through a predetermined mandatory access interface in the device, and the sent mandatory access request may include There are authentication information such as mandatory unlock password and prompt question answer to determine whether to allow access to the target object. The mandatory unlock password can be a string of gestures, numbers, letters, etc., or a fingerprint, face, etc., and the prompt question answer can be predetermined The identity authentication information such as the picture, the person's name, the mobile phone number, etc., may also be other information used to determine whether to allow compulsory access to the target object, which is not limited in the embodiment of this specification.

To sum up, in the process of actually using the device, the access control policy of the device can be determined by obtaining the environmental information of the device, and then the target objects allowed to be accessed can be determined based on the obtained access control policy, so as to realize the control of the permissions, so that the The content presented by the device to the device user can not only meet the device owner's need to protect privacy in different occasions, but also does not affect others' borrowing or viewing the device.

In addition, after the environment where the device is located changes, for example, from a residential place to an office place, this solution can automatically switch the access control strategy with the change of the environment. For details, please refer to FIG. 3, which is an example of this specification. The flowchart of the method for automatic switching of permissions shown in the embodiment may include the following steps S301-S303:

Step S301: Acquire context information of the device, where the context information carries the environment information of the device.

Step S302: After detecting that the environment information is updated, obtain an access control policy corresponding to the updated environment information, wherein at least one access control policy is generated based on predetermined environment information.

Step S303: Determine the target object that is allowed to be accessed based on the acquired access control policy.

The technical features involved in the embodiments of the present application correspond to the technical features involved in FIG. 1 , which will not be repeated here. The difference is that after obtaining the context information of the device, it is necessary to compare the currently obtained environment information with the previously obtained environment information. Whether the environmental information matches (same or approximately the same), if it matches, it is determined that the update of the environmental information is not detected, and if it does not match, it is determined that the matching of the environmental information is detected.

For example, if the currently obtained environmental information is the latitude and longitude of the office, and the previously obtained environmental information is the latitude and longitude of the residential place, then the two do not match, and it is determined that the environmental information is updated, based on the updated environmental information (the currently obtained latitude and longitude of the office) to obtain the access control policy corresponding to the updated environment information.

In some examples, the environmental information includes at least one of the following:

Geolocation information, magnetic field fingerprint, WIFI fingerprint, ambient audio.

In other examples, if the acquired context information carries an unlock password, the method for automatically switching permissions in the embodiment of this specification may further include the following steps:

Find the access control policy corresponding to the unlocking password, where the unlocking password is used to unlock the device or unlock the application;

The target objects that are allowed access are determined based on the access control policy that is looked up.

As an example, the access control policy further includes:

an access control policy generated based on a predetermined password, where the predetermined password is used to match the unlocking instruction;

and / or,

An access control policy is generated based on a predetermined password and predetermined context information.

As an example, when there is more than one predetermined password, the access control policies generated based on different predetermined passwords are different.

As an example, the unlocking password is obtained through any of the following user instructions:

Touch command, touch fingerprint command, audio command.

In other examples, the method for automatically switching permissions in the embodiments of this specification may further include the following steps:

Hide the entry identification of the target object that does not allow access on the interface of the device; or

Display the entry identifiers of all target objects on the interface of the device;

When receiving an access request sent by the user through the displayed entry identifier, if the target object requested for access is a target object that is not allowed to be accessed, the access request is rejected.

In some scenarios, the environment where the device is located is switched to an office, and the access control policy generated in advance based on the office is an office access policy, which does not allow device users to access content related to daily life in the device. However, because the device owner needs to provide his life photos to the company's event organizers, he needs to access the content related to daily life in the device. In response to this situation, this solution can initiate compulsory access to the content related to daily life. The specific implementation process Referring to FIG. 4 , FIG. 4 is a flowchart of a method for automatically switching permissions according to another exemplary embodiment of this specification. This embodiment may include the following steps S401-S404:

Step S401: Acquire context information of the device, where the context information carries the environment information of the device.

Step S402: Acquire an access control policy corresponding to the acquired environment information, wherein at least one access control policy is generated based on predetermined environment information.

Step S403: After detecting that the environment information is updated, obtain an access control policy corresponding to the updated environment information, wherein at least one access control policy is generated based on predetermined environment information.

Step S404: When a mandatory access request from a user to a target object that is not allowed to be accessed is received, determine whether to allow access to the target object based on the authentication information carried in the mandatory access request.

Steps S401 to S404 in this embodiment correspond to steps S201 to S203 in the embodiment involved in FIG. 2 , and details are not repeated here. The difference is that after acquiring the context information of the device, it is necessary to compare whether the currently acquired environmental information matches (same or approximately the same) the previously acquired environmental information. Update, if there is no match, determine that a match for the context information was detected.

As an example, the authentication information includes any of the following:

Force unlock password, prompt question answer.

Corresponding to the foregoing method embodiments, the present application also provides device embodiments.

Referring to FIG. 5 , FIG. 5 is a block diagram of an apparatus for controlling permissions according to an exemplary embodiment of the present application. The apparatus may include: a context acquisition module 510 , a control policy acquisition module 520 and a target object determination module 530 .

The context acquisition module 510 is configured to acquire context information of the device, where the context information carries the environment information of the device.

The control policy acquiring module 520 is configured to acquire an access control policy corresponding to the acquired environment information, wherein at least one access control policy is generated based on predetermined environment information.

The target object determination module 530 is configured to determine the target object that is allowed to be accessed based on the obtained access control policy.

In some examples, the environmental information includes at least one of the following:

Geolocation information, magnetic field fingerprint, WIFI fingerprint, ambient audio.

In other examples, the apparatus for controlling the authority of the embodiments of this specification may further include:

The control policy search module is configured to search for an access control policy corresponding to the unlock password when the acquired context information also carries an unlock password, and the unlock password is used to unlock the device or unlock the application.

The access object determination module is used for determining the target object that is allowed to be accessed based on the searched access control policy.

As an example, the access control policy further includes:

An access control policy is generated based on a predetermined password, which is used to match the unlocking instruction.

and / or,

An access control policy is generated based on a predetermined password and predetermined context information.

As an example, when there is more than one predetermined password, the access control policies generated based on different predetermined passwords are different.

As an example, the unlocking password is obtained through any of the following user instructions:

Touch command, touch fingerprint command, audio command.

In other examples, the apparatus for controlling the authority of the embodiments of this specification may further include:

The object hiding module is used to hide the entry identifier of the target object that is not allowed to be accessed on the interface of the device. or,

The object display module is used to display the entry identifiers of all target objects on the interface of the device.

The access denial module is configured to deny the access request when an access request is received from the user through the displayed entry identifier, and the target object requested for access is a target object that is not allowed to be accessed.

In other examples, the apparatus for controlling the authority of the embodiments of this specification may further include:

The mandatory access module is configured to determine whether to allow access to the target object based on the authentication information carried in the mandatory access request when receiving a mandatory access request from a user for a target object that is not allowed to be accessed.

As an example, the authentication information includes any of the following:

Force unlock password, prompt question answer.

Referring to FIG. 6 , FIG. 6 is a block diagram of an apparatus for automatically switching permissions according to an exemplary embodiment of the present application. The apparatus may include: a context acquisition module 610 , a control strategy switching module 620 and a target object determination module 630 .

Wherein, the context acquisition module 610 is used to acquire the context information of the device, and the context information carries the environment information of the device.

The control policy switching module 620 is configured to acquire an access control policy corresponding to the updated environment information after detecting that the environment information is updated, wherein at least one access control policy is generated based on predetermined environment information.

The target object determination module 630 is configured to determine the target object that is allowed to be accessed based on the obtained access control policy.

In some examples, the environmental information includes at least one of the following:

Geolocation information, magnetic field fingerprint, WIFI fingerprint, ambient audio.

In other examples, the apparatus for automatically switching permissions in the embodiments of this specification may further include:

The control policy search module is configured to search for an access control policy corresponding to the unlock password when the acquired context information also carries an unlock password, and the unlock password is used to unlock the device or unlock the application.

The access object determination module is used for determining the target object that is allowed to be accessed based on the searched access control policy.

As an example, the access control policy further includes:

An access control policy is generated based on a predetermined password, which is used to match the unlocking instruction.

and / or,

An access control policy is generated based on a predetermined password and predetermined context information.

As an example, when there is more than one predetermined password, the access control policies generated based on different predetermined passwords are different.

As an example, the unlocking password is obtained through any of the following user instructions:

Touch command, touch fingerprint command, audio command.

In other examples, the apparatus for automatically switching permissions in the embodiments of this specification may further include:

The object hiding module is used to hide the entry identifier of the target object that is not allowed to be accessed on the interface of the device. or,

The object display module is used to display the entry identifiers of all target objects on the interface of the device.

The access denial module is configured to deny the access request when an access request is received from the user through the displayed entry identifier, and the target object requested for access is a target object that is not allowed to be accessed.

In other examples, the apparatus for automatically switching permissions in the embodiments of this specification may further include:

The mandatory access module is configured to determine whether to allow access to the target object based on the authentication information carried in the mandatory access request when receiving a mandatory access request from a user for a target object that is not allowed to be accessed.

As an example, the authentication information includes any of the following:

Force unlock password, prompt question answer.

For details of the implementation process of the functions and functions of each unit (or module) in the above-mentioned apparatus, please refer to the implementation process of the corresponding steps in the above-mentioned method, which will not be repeated here.

As for the installation embodiment, since it basically corresponds to the method embodiment, it is sufficient to refer to the partial description of the method embodiment for related parts. The embodiments of the mail client described above are only illustrative, wherein the units or modules described as separate components may or may not be physically separated, and the components displayed as units or modules may or may not be A physical unit or module can be located in one place, or it can be distributed over multiple network units or modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solutions of the embodiments of this specification. Those of ordinary skill in the art can understand and implement it without creative effort.

The authority control apparatus/authority automatic switching apparatus of the embodiments of this specification can be applied to electronic equipment. Specifically, it can be implemented by a computer chip or an entity, or by a product with a certain function. In a typical implementation, the electronic device is a computer, which may be in the form of a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email sending and receiving device , game consoles, tablets, wearables, Internet TVs, smart locomotives, driverless cars, smart refrigerators, other smart home devices, or a combination of any of these devices.

The apparatus embodiment may be implemented by software, or may be implemented by hardware or a combination of software and hardware. Taking software implementation as an example, a client in a logical sense is formed by reading the corresponding computer program instructions in a readable medium such as a non-volatile memory into the memory through the processor of the electronic device where it is located. From the perspective of hardware, as shown in FIG. 7 , it is a hardware structure diagram of the electronic equipment where the authority control or automatic switching device according to the embodiment of this specification is located, except for the processor, memory, network interface, and non- In addition to the volatile memory, the electronic device in the embodiment may also include other hardware generally according to the actual function of the electronic device, which will not be repeated here.

In some examples, the memory of the electronic device may store processor-executable program instructions; the processor may be coupled to the memory for reading the program instructions stored in the memory, and in response, perform the following operations: obtain context information of the device, so The context information carries the environment information of the device; obtains an access control policy corresponding to the obtained environment information, wherein at least one access control policy is generated based on predetermined environment information; determines the target object that is allowed to be accessed based on the obtained access control policy .

In other examples, the memory of the electronic device may store program instructions executable by the processor; the processor may be coupled to the memory for reading the program instructions stored in the memory, and in response, perform the following operations: obtaining context information of the device, The context information carries the environment information of the device; when it is detected that the environment information is updated, an access control policy corresponding to the updated environment information is obtained, wherein at least one access control policy is generated based on predetermined environment information; The obtained access control policy determines the target objects to which access is permitted.

In other embodiments, for the operations performed by the processor, reference may be made to the relevant descriptions in the foregoing method embodiments, which are not repeated here.

The foregoing describes specific embodiments of the present specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that in the embodiments and still achieve desirable results. Additionally, the processes depicted in the figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

The above descriptions are only preferred embodiments of the embodiments of the present specification, and are not intended to limit the embodiments of the present specification. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the embodiments of the present specification, All should be included within the protection scope of the embodiments of this specification.

Claims (38)

1. A control method of authority, comprising the steps: Acquire context information of the device, where the context information carries the environment information of the device; Acquire an access control policy corresponding to the acquired environment information, wherein at least one access control policy is generated based on predetermined environment information; the access control policy is used to indicate that the device user has a Permissions of function modules within the application; Determine the target object that the device owner allows the device user to access based on the obtained access control policy; The access control policy further includes an access control policy generated based on a predetermined password, the predetermined password is used to match the unlock instruction, and the access control policy generated based on the predetermined password alone is included in the access policy generated based on the predetermined environment information, It is a further subdivision of the access control policy generated based on the predetermined environment information. 2. The method of claim 1, wherein the environmental information comprises at least one of the following: Geolocation information, magnetic field fingerprint, WIFI fingerprint, ambient audio. 3. The method according to claim 1, if the acquired context information also carries an unlocking password, the method further comprises the steps: Find the access control policy corresponding to the unlocking password, where the unlocking password is used to unlock the device or unlock the application; The target objects that are allowed access are determined based on the access control policy that is looked up. 4. The method of claim 3, the access control policy further comprising: An access control policy is generated based on a predetermined password and predetermined context information. 5. The method according to claim 4, when there is more than one predetermined password, the access control policies generated based on different predetermined passwords are different. 6. The method according to claim 3, the unlocking password is obtained by any of the following user instructions: Touch command, touch fingerprint command, audio command. 7. The method of claim 1, further comprising: hide the entry identification of the target object that is not allowed to be accessed on the interface of the device; or, Display the entry identifiers of all target objects on the interface of the device; When receiving an access request sent by the user through the displayed entry identifier, if the target object requested for access is a target object that is not allowed to be accessed, the access request is rejected. 8. The method of claim 1, further comprising: When a mandatory access request from a user to a target object that is not allowed to be accessed is received, whether to allow access to the target object is determined based on the authentication information carried in the mandatory access request. 9. The method according to claim 8, wherein the authentication information comprises any of the following: Force unlock password, prompt question answer. 10. A method for automatic switching of permissions, comprising the steps: Acquire context information of the device, where the context information carries the environment information of the device; When it is detected that the environment information is updated, an access control policy corresponding to the updated environment information is obtained, wherein at least one access control policy is generated based on predetermined environment information; the access control policy is used to indicate that the device user has the permissions of the device, the application within the device and/or the functional modules within the application; Determine the target object that the device owner allows the device user to access based on the obtained access control policy; The access control policy further includes an access control policy generated based on a predetermined password, the predetermined password is used to match the unlock instruction, and the access control policy generated based on the predetermined password alone is included in the access policy generated based on the predetermined environment information, It is a further subdivision of the access control policy generated based on the predetermined environment information. 11. The method of claim 10, the environmental information comprising at least one of the following: Geolocation information, magnetic field fingerprint, WIFI fingerprint, ambient audio. 12. The method according to claim 10, if the acquired context information carries an unlocking password, the method further comprises the steps: Find the access control policy corresponding to the unlocking password, where the unlocking password is used to unlock the device or unlock the application; The target objects that are allowed access are determined based on the access control policy that is looked up. 13. The method of claim 12, the access control policy further comprising: An access control policy is generated based on a predetermined password and predetermined context information. 14. The method according to claim 13, when there is more than one predetermined password, the access control policies generated based on different predetermined passwords are different. 15. The method according to claim 12, wherein the unlocking password is obtained by any of the following user instructions: Touch command, touch fingerprint command, audio command. 16. The method of claim 10, further comprising: hide the entry identification of the target object that is not allowed to be accessed on the interface of the device; or, Display the entry identifiers of all target objects on the interface of the device; When receiving an access request sent by the user through the displayed entry identifier, if the target object requested for access is a target object that is not allowed to be accessed, the access request is rejected. 17. The method of claim 10, further comprising: When a mandatory access request from a user to a target object that is not allowed to be accessed is received, whether to allow access to the target object is determined based on the authentication information carried in the mandatory access request. 18. The method of claim 17, the authentication information comprising any of the following: Force unlock password, prompt question answer. 19. An authority control device, comprising: a context acquisition module, configured to acquire context information of the device, where the context information carries the environment information of the device; A control policy acquisition module is used to acquire an access control policy corresponding to the acquired environmental information, wherein at least one access control policy is generated based on predetermined environmental information; the access control policy is used to indicate that the device user has a the permissions of the application and/or functional modules within the application; A target object determination module, used for determining the target object that the device owner allows the device user to access based on the obtained access control policy; The access control policy further includes an access control policy generated based on a predetermined password, the predetermined password is used to match the unlock instruction, and the access control policy generated based on the predetermined password alone is included in the access policy generated based on the predetermined environment information, It is a further subdivision of the access control policy generated based on the predetermined environment information. 20. The apparatus of claim 19, the environmental information comprising at least one of the following: Geolocation information, magnetic field fingerprint, WIFI fingerprint, ambient audio. 21. The apparatus of claim 19, further comprising: a control policy search module, configured to search for an access control policy corresponding to the unlock password when the acquired context information also carries an unlock password, and the unlock password is used to unlock the device or unlock the application; The access object determination module is used for determining the target object that is allowed to be accessed based on the searched access control policy. 22. The apparatus of claim 21, the access control policy further comprising: An access control policy is generated based on a predetermined password and predetermined context information. 23. The apparatus according to claim 22, when there is more than one predetermined password, the access control policies generated based on different predetermined passwords are different. 24. The device according to claim 21, wherein the unlocking password is obtained by any of the following user instructions: Touch command, touch fingerprint command, audio command. 25. The apparatus of claim 19, further comprising: The object hiding module is used to hide the entry identification of the target object that is not allowed to be accessed on the interface of the device; or, The object display module is used to display the entry identifiers of all target objects on the interface of the device; The access denial module is configured to deny the access request when an access request is received from the user through the displayed entry identifier, and the target object requested for access is a target object that is not allowed to be accessed. 26. The apparatus of claim 19, further comprising: The mandatory access module is configured to determine whether to allow access to the target object based on the authentication information carried in the mandatory access request when receiving a mandatory access request from a user for a target object that is not allowed to be accessed. 27. The apparatus of claim 26, the authentication information comprising any of the following: Force unlock password, prompt question answer. 28. An automatic switching device for authority, comprising: a context acquisition module, configured to acquire context information of the device, where the context information carries the environment information of the device; a control policy switching module, configured to acquire an access control policy corresponding to the updated environment information after detecting that the environment information is updated, wherein at least one access control policy is generated based on predetermined environment information; the access control policy It is used to represent the authority of the device user to the device, the application in the device and/or the functional module in the application; A target object determination module, used for determining the target object that the device owner allows the device user to access based on the obtained access control policy; The access control policy further includes an access control policy generated based on a predetermined password, the predetermined password is used to match the unlock instruction, and the access control policy generated based on the predetermined password alone is included in the access policy generated based on the predetermined environment information, It is a further subdivision of the access control policy generated based on the predetermined environment information. 29. The apparatus of claim 28, the environmental information comprising at least one of the following: Geolocation information, magnetic field fingerprint, WIFI fingerprint, ambient audio. 30. The apparatus of claim 28, further comprising: A control strategy search module, configured to search for an access control strategy corresponding to the unlock password when the acquired context information also carries an unlock password, where the unlock password is used to unlock the device, unlock the application or the function of unlocking the application module; The access object determination module is used for determining the target object that is allowed to be accessed based on the searched access control policy. 31. The apparatus of claim 30, the access control policy further comprising: An access control policy is generated based on a predetermined password and predetermined context information. 32. The device according to claim 31, when there is more than one predetermined password, the access control policies generated based on different predetermined passwords are different. 33. The device according to claim 30, wherein the unlocking password is obtained by any of the following user instructions: Touch command, touch fingerprint command, audio command. 34. The apparatus of claim 28, further comprising: The object hiding module is used to hide the entry identification of the target object that is not allowed to be accessed on the interface of the device; or, The object display module is used to display the entry identifiers of all target objects on the interface of the device; The access denial module is configured to deny the access request when an access request is received from the user through the displayed entry identifier, and the target object requested for access is a target object that is not allowed to be accessed. 35. The apparatus of claim 28, further comprising: The mandatory access module is configured to determine whether to allow access to the target object based on the authentication information carried in the mandatory access request when receiving a mandatory access request from a user for a target object that is not allowed to be accessed. 36. The apparatus of claim 35, the authentication information comprising any of the following: Force unlock password, prompt question answer. 37. An electronic device comprising: processor; a memory that stores processor-executable instructions; The processor is coupled to the memory for reading program instructions stored in the memory, and in response, performs the following operations: Acquire context information of the device, where the context information carries the environment information of the device; Acquire an access control policy corresponding to the acquired environment information, wherein at least one access control policy is generated based on predetermined environment information; the access control policy is used to indicate that the device user has a Permissions of function modules within the application; Determine the target object that the device owner allows the device user to access based on the obtained access control policy; The access control policy further includes an access control policy generated based on a predetermined password, the predetermined password is used to match the unlock instruction, and the access control policy generated based on the predetermined password alone is included in the access policy generated based on the predetermined environment information, It is a further subdivision of the access control policy generated based on the predetermined environment information. 38. An electronic device comprising: processor; a memory that stores processor-executable instructions; The processor is coupled to the memory for reading program instructions stored in the memory, and in response, performs the following operations: Acquire context information of the device, where the context information carries the environment information of the device; When it is detected that the environment information is updated, an access control policy corresponding to the updated environment information is obtained, wherein at least one access control policy is generated based on predetermined environment information; the access control policy is used to indicate that the device user has the permissions of the device, the application within the device and/or the functional modules within the application; Determine the target object that the device owner allows the device user to access based on the obtained access control policy; The access control policy further includes an access control policy generated based on a predetermined password, the predetermined password is used to match the unlock instruction, and the access control policy generated based on the predetermined password alone is included in the access policy generated based on the predetermined environment information, It is a further subdivision of the access control policy generated based on the predetermined environment information.

Images