WO2022170946A1 - 一种访问控制方法及相关装置 - Google Patents

一种访问控制方法及相关装置 Download PDF

Info

Publication number
WO2022170946A1
WO2022170946A1 PCT/CN2022/073357 CN2022073357W WO2022170946A1 WO 2022170946 A1 WO2022170946 A1 WO 2022170946A1 CN 2022073357 W CN2022073357 W CN 2022073357W WO 2022170946 A1 WO2022170946 A1 WO 2022170946A1
Authority
WO
WIPO (PCT)
Prior art keywords
descriptor
access
target
access request
request
Prior art date
Application number
PCT/CN2022/073357
Other languages
English (en)
French (fr)
Inventor
周逸徉
权钲杰
季杰
王众豪
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2022170946A1 publication Critical patent/WO2022170946A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/44—Program or device authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements

Definitions

  • the present application relates to the technical field of operating systems, and in particular, to an access control method and related apparatus.
  • Sandbox is an execution environment that restricts program behavior according to security policies, and has been widely used in various operating systems. Taking the Android operating system as an example, some malicious applications can obtain user private data, perform network access and other operations by applying for system permissions, which destroys the normal operation of the system. By deploying the application in the sandbox environment, the behavior of the application can be effectively monitored to protect the security of the system.
  • an untrusted application (hereinafter referred to as an untrusted application) in a sandbox and intercepting specific access requests initiated by the untrusted application, the untrusted application's access to local user data or operating system resources is restricted. access.
  • untrusted applications running in the sandbox may need to access system resources such as network or local files to provide specific services for the terminal.
  • system resources such as network or local files
  • the present application provides an access control method and related device.
  • a first process executes an access request from an untrusted application and obtains a target descriptor pointing to a system resource
  • the first process allocates a corresponding proxy descriptor to the target descriptor , and returns the proxy descriptor to the untrusted application via the second process.
  • the untrusted application in the second process can obtain the proxy descriptor corresponding to the target descriptor, and implement system resource access based on the proxy descriptor.
  • the proxy descriptor must be replaced by the target descriptor through the first process, so that the access to the system resource can be completed.
  • the first process ensures that the behavior of the untrusted application accessing the system resources can be effectively monitored, and the security of the system is ensured while realizing the untrusted application accessing the system resources.
  • a first aspect of the present application provides an access control method, and the access control method is applied in a terminal, such as a smart phone or a tablet computer running an Android system.
  • a terminal such as a smart phone or a tablet computer running an Android system.
  • a first process and a second process run in the terminal, and the first process and the second process can communicate with each other.
  • the first process has the right to access resources in the terminal (for example, system resources or user personal data), while the second process does not have the right to directly access system resources or part of system resources.
  • the access control method specifically includes: a first process receives a first access request sent by a second process, the first access request is from a target application running in the second process, and the first access request may be, for example, It is used to request access to system resources in the terminal.
  • the second process does not have the right to execute the access request, and the first process has the right to execute the access request.
  • the first process executes the first access request to obtain a target descriptor for accessing the system resource.
  • the target descriptor is an abstract concept pointing to system resources, which can be used to identify system resources.
  • the application program can access the corresponding system resources through the target descriptor.
  • the first process After obtaining the target descriptor, the first process allocates a proxy descriptor to the target descriptor, the target descriptor has a corresponding relationship with the proxy descriptor, and the first process can search for a unique corresponding proxy descriptor according to the proxy descriptor. target descriptor. Further, the first process may establish a mapping table, where the mapping table stores the corresponding relationship between the target descriptor and the agent descriptor. The first process sends the proxy descriptor to the second process, so that the second process can return the proxy descriptor to the target application, and the target application uses the proxy descriptor to access all the proxy descriptors. system resources.
  • the first process when the first process executes the access request from the untrusted application and obtains the target descriptor pointing to the system resource, the first process allocates the corresponding proxy descriptor to the target descriptor, and sends the untrusted application to the untrusted process through the second process.
  • the letter application returns the proxy descriptor.
  • the untrusted application in the second process can obtain the proxy descriptor corresponding to the target descriptor, and implement system resource access based on the proxy descriptor.
  • the proxy descriptor when the untrusted application accesses the system resource through the proxy descriptor, the proxy descriptor must be replaced by the target descriptor through the first process, so that the access to the system resource can be completed.
  • the first process ensures that the behavior of the untrusted application accessing the system resources can be effectively monitored, and the security of the system is ensured while realizing the untrusted application accessing the system resources.
  • the solution provided by this embodiment can run the target application in the second process in the form of an Android application package (Android application package, APK), without the need to obtain the highest authority of the terminal operating system, without changing the operating system.
  • the application framework layer does not need to modify the source files of the target application, and the operation efficiency is high.
  • the first access request may be, for example, a system call request, where the system call request is used to request to invoke an interface provided by the system to access system resources.
  • the system call refers to the interface between the application program and the system, such as a program interface or an application programming interface (Application Programming Interface, API) provided by the operating system to the application program.
  • the application program communicates with the operating system through system calls, and obtains the services of the operating system. That is to say, an application can request to execute a call to an interface provided by the operating system by initiating a system call request, thereby realizing access to system resources.
  • the target application may initiate a second access request based on the proxy descriptor, where the second access request includes the proxy description Descriptor to request access to the system resource corresponding to the proxy descriptor. Therefore, the method further includes: the first process receives a second access request sent by the second process, the second access request includes the proxy descriptor, and the second access request is used for requesting access to system resources. Since the first process has established a corresponding relationship between the proxy descriptor and the target descriptor, the first process can obtain the target descriptor corresponding to the proxy descriptor by searching for the corresponding relationship, and the target descriptor is used for the first process. The process subsequently executes the second access request. The first process executes the second access request according to the target descriptor to obtain a resource access result. The first process sends the resource access result to the second process.
  • the first access request is used to request to initiate network access.
  • the target descriptor obtained by the first process executing the first access request includes a socket descriptor.
  • the socket is the interface through which the application communicates through the network protocol.
  • the operating system returns a small integer as a descriptor to identify the socket, so that the application can use this socket descriptor to Refers to the socket, enabling network access. That is, when the first process executes the first access request for initiating network access, the operating system returns a socket descriptor for identifying the socket to the first process.
  • the target application may continue to initiate a second access request for requesting to establish a connection with the target network site. That is, the second access request includes the proxy descriptor and the address of the target network site, and the second access request is used to request access to the target network site.
  • the first process finds the corresponding socket descriptor according to the proxy descriptor in the second access request, the first process executes the second process according to the socket descriptor and the address of the target network site. The access request is obtained, and the access result of the target network site is obtained.
  • the first process assigns a proxy descriptor to the target descriptor, including: the first process is the The target descriptor allocates a channel identification pair, the channel identification pair includes a first channel identification and a second channel identification, the channel identification pair is used for data transmission between the first process and the target application, the The socket descriptor has a corresponding relationship with the channel identification pair.
  • the sending, by the first process, the proxy descriptor to the second process specifically includes: the first process sending the first channel identifier to the second process.
  • the second access request initiated by the target application may include the first channel identifier, and the second access request is used to request to establish a connection with the target network site.
  • the first process executes the second access request to establish a connection with the target network site.
  • the data that the target application program needs to send to the target network site can be transmitted to the first process based on the data transmission channel corresponding to the first channel identifier, and the first process can transmit the data to the first process based on the corresponding socket
  • the word descriptor forwards the data to the target network site.
  • the first process returns the network data to the target application based on the data transmission channel corresponding to the second channel identifier.
  • the first channel identifier and the second channel identifier correspond to the same data transmission channel, that is, the first process and the target application program transmit data to each other in the same data transmission channel based on two different channel identifiers.
  • the first process allocates a pair of channel identifiers and returns one channel identifier in the pair of channel identifiers to the target application, so that the first process and the target application can communicate with each other based on the channel corresponding to the pair of channel identifiers communication. It avoids the continuous forwarding of a large amount of network data between the first process and the target application by the second process, improves the efficiency of data transmission, and the data that the target application interacts with the network site is transmitted through an independent channel, ensuring that Reliability of data transmission.
  • the first access request initiated by the target application is used to request to open a target file, and the target descriptor obtained by the first process after executing the first access request includes the target file descriptor. Then, after the target application receives the proxy descriptor returned by the first process, the target application initiates the second access request, and the second access request includes the proxy descriptor for requesting access to the target document.
  • the first process executes the second access request according to the target descriptor, and obtains a resource access result, including: the first process executes the second access request according to the target file descriptor, and obtains the target The access result of the file.
  • the method further includes: the first process establishes a listener for the proxy descriptor.
  • the first process obtains a message sent by the listener, where the message is used to indicate that the proxy descriptor is closed.
  • the first process closes the target descriptor corresponding to the proxy descriptor according to the message.
  • the listener in the system is used to monitor the occurrence of an event (program).
  • the event generator ie the event source
  • the listener can also obtain an event object. According to this object, it can obtain related properties and perform related operations. For example, the listener sends callback information to the process that registered the listener.
  • the first process can monitor the behavior of the target application program to close the proxy file descriptor in time, and then close the target descriptor corresponding to the proxy file descriptor in time, so as to realize the system resource Recycle in time.
  • the first process when the first access request is for requesting access to the network, the first process establishes a listener for the socket descriptor. The first process obtains a message sent by the listener, where the message is used to indicate that the socket descriptor is closed. The first process closes the proxy descriptor corresponding to the socket descriptor according to the message.
  • the first process can monitor the socket descriptor through the listener. When the socket descriptor is closed, it can be considered that the network is interrupted, so the first process is triggered to close and connect to the socket.
  • the proxy descriptor corresponding to the word descriptor is used to reclaim system resources in time.
  • the access request includes information of the target application.
  • the method further includes: the first process performs permission verification on the access request according to the information of the target application.
  • the purpose of performing permission verification on the access request by the first process is to determine whether the target application in the second process has the permission to request to execute the access request.
  • the first process executes the access request to obtain an access result.
  • the access request initiated by the target application includes a system call number and information of the target application.
  • the system call number is used to represent the system call requested by the target application to be executed.
  • the information of the target application may be, for example, an identifier of the target application, and the identifier of the target application is used to identify the identity information of the target application or the type to which the target application belongs.
  • the first process may query the access permission information of the application program configured in the terminal based on the system call number and the information of the target application program. If the query result is that the target application has the right to access the system call corresponding to the system call number, it can be determined that the verification result is that the target application has the access right; if the query result is that the target application has no access to the system call number The corresponding system call permissions, it can be determined that the verification result is that the target application does not have access permissions.
  • the untrusted target application is run in a second process that does not have permission to access the external environment, and the access request initiated by the target application is intercepted by the second process.
  • the second process forwards the intercepted access request to an external first process with access rights, and the first process executes the access request after confirming the rights of the target application, thereby monitoring the access behavior of the target application. Since there is no access permission by default in the second process, the access request will be executed only when the access request of the target application is intercepted and the target application has the access permission. In this way, the malicious program running in the second process cannot obtain the right to access the system resources through the anti-interception technology, which ensures the security of the system.
  • the second process may create a channel identifier pair according to the access request, where the channel identifier pair includes a third channel identifier and a fourth channel identifier. Then, the second process adds the third channel identifier to the access request from the target application, and sends the access request added with the third channel identifier to the first process. That is, the access request further includes a third channel identifier, where the third channel identifier is used to indicate a data transmission channel.
  • the sending, by the first process, the access result to the second process includes: the first process identifying the corresponding data transmission channel through the third channel, and sending the access result to the second process.
  • the second process in order to ensure independent data transmission among the multiple threads, creates an independent data transmission channel for each thread, and each independent data transmission channel is Data transmission channels are identified by a channel identification pair.
  • the second process can carry the channel identifier corresponding to the thread in the access request, so that the first process can transfer data from the data transmission channel corresponding to the thread.
  • the data is returned to the second process in the middle, which ensures the isolation of data between different threads, effectively avoids data confusion, and ensures the reliability of data transmission.
  • the second process may also add a thread identifier to the access request, where the thread identifier is used to identify the thread that initiates the access request, that is, the first thread
  • the second process adds a thread identifier and a channel identifier to the access request.
  • the first access request and the second access request sent by the second process further include a thread identifier corresponding to the target application.
  • the method further includes: the first process establishes a corresponding relationship between the third channel identifier and the thread identifier according to the first access request; the first process sends the information to the second process.
  • the resource access result includes: the first process determines the third channel identifier according to the thread identifier in the second access request; the first process transmits data corresponding to the third channel identifier through the first process a channel, and send the resource access result to the second process. That is, when the first process subsequently receives other access requests including the same thread identifier, the first process can determine the corresponding channel identifier according to the thread identifier, and send subsequent access results based on the channel identifier.
  • a second aspect of the present application provides an access control method, including: a second process obtains an access request from a target application, the target application runs in the second process, and the second process does not have execution access the requested permission; the second process sends the access request to the first process, and the first process has the permission to execute the access request; the second process receives the proxy descriptor sent by the first process, The proxy descriptor is used to access system resources; the second process sends the proxy descriptor to the target application.
  • the method further includes: acquiring, by the second process, a second access request from the target application, where the second access request includes the proxy descriptor, and the first access request includes the proxy descriptor.
  • the second access request is used to request access to system resources; the second process sends the second access request to the first process; the second process receives the resource access result sent by the first process; the second process The process sends the resource access result to the target application.
  • the first access request is used to request to initiate network access
  • the second access request further includes an address of a target network site
  • the second access request is used to request access to the target network site
  • the resource access result includes the access result of the target network site
  • the proxy descriptor includes a first channel identifier, where the first channel identifier is used for data transmission between the first process and the target application.
  • the first access request is used to request to open a target file
  • the target descriptor includes a target file descriptor
  • the second access request is used to request access to the target file
  • the The resource access result includes the access result of the target file
  • the method further includes: the second process creates a channel identifier pair according to the access request, where the channel identifier pair includes a third channel identifier and a fourth channel identifier, and the channel identifier The pair is used for data transmission between the first process and the second process; the second process adds the third channel identifier to the access request; the second process sends to the first process the access request identified by the third channel.
  • the method further includes: the second process adds the information of the target application in the access request; the second process sends the first process that the target application is added Access requests for application information.
  • a third aspect of the present application provides a terminal, where the terminal includes a transceiver unit and a processing unit.
  • the transceiver unit is configured to receive an access request sent by a second process, where the access request comes from a target application running in the second process, and the second process does not have the authority to execute the access request;
  • the The processing unit is configured to execute the first access request to obtain a target descriptor for accessing system resources;
  • the processing unit is further configured to allocate a proxy descriptor to the target descriptor, and the target descriptor is associated with the target descriptor.
  • the proxy descriptors have a corresponding relationship; the transceiver unit is further configured to send the proxy descriptors to the second process.
  • the transceiver unit is further configured to receive a second access request sent by a second process, where the second access request includes the proxy descriptor, and the second access request is used to request access system resources; the processing unit is further configured to obtain the target descriptor corresponding to the proxy descriptor; the processing unit is further configured to execute the second access request according to the target descriptor to obtain a resource access result ; the transceiver unit is further configured to send the resource access result to the second process.
  • the first access request is used to request to initiate network access
  • the target descriptor includes a socket descriptor
  • the second access request further includes an address of a target network site
  • the The second access request is used to request access to the target network site
  • the processing unit is further configured to execute the second access request according to the socket descriptor to obtain an access result of the target network site.
  • the processing unit is further configured to allocate a channel identifier pair to the target descriptor, where the channel identifier pair includes a first channel identifier and a second channel identifier, and the channel identifier pair is used for For data transmission between the first process and the target application, the socket descriptor has a corresponding relationship with the channel identifier pair; the transceiver unit is further configured to send the second process the First channel ID.
  • the first access request is used for requesting to open a target file
  • the target descriptor includes a target file descriptor
  • the second access request is used for requesting access to the target file
  • the processing unit is further configured to execute the second access request according to the target file descriptor to obtain an access result of the target file.
  • the processing unit is further configured to establish a listener for the proxy descriptor; the transceiver unit is further configured to acquire a message sent by the listener, where the message is used to indicate the The proxy descriptor is closed; the processing unit is further configured to close the target descriptor corresponding to the proxy descriptor according to the message.
  • the processing unit is further configured to establish a listener for the socket descriptor; the transceiver unit is further configured to acquire a message sent by the listener, where the message is used to indicate The socket descriptor is closed; the processing unit is further configured to close the proxy descriptor corresponding to the socket descriptor according to the message.
  • the access request includes information of the target application; the processing unit is further configured to perform permission verification on the access request according to the information of the target application.
  • the access request further includes a third channel identifier, where the third channel identifier is used to indicate a data transmission channel; the transceiver unit is further configured to identify corresponding data through the third channel a transmission channel, for sending the access result to the second process.
  • the first access request and the second access request further include a thread identifier corresponding to the target application; the processing unit is further configured to, according to the first access request, establish the corresponding relationship between the third channel identifier and the thread identifier; the processing unit is further configured to determine the third channel identifier according to the thread identifier in the second access request; the transceiver unit It is further configured to identify the corresponding data transmission channel through the third channel, and send the resource access result to the second process.
  • a fourth aspect of the present application provides a terminal, including: a transceiver unit and a processing unit.
  • the transceiver unit is configured to acquire an access request from a target application, the target application runs in a second process, and the second process does not have the authority to execute the access request;
  • the processing unit is configured to send the first The process sends the access request, and the first process has the right to execute the access request;
  • the transceiver unit is further configured to receive a proxy descriptor sent by the first process, where the proxy descriptor is used to access system resources ;
  • the transceiver unit is further configured to send the proxy descriptor to the target application.
  • the transceiver unit is further configured to: obtain a second access request from the target application, where the second access request includes the proxy descriptor, and the second access request used to request access to system resources; send the second access request to the first process; the second process receives the resource access result sent by the first process; the second process sends the target application the resource access result.
  • the first access request is used to request to initiate network access
  • the second access request further includes an address of a target network site
  • the second access request is used to request access to the target network site
  • the resource access result includes the access result of the target network site
  • the proxy descriptor includes a first channel identifier, where the first channel identifier is used for data transmission between the first process and the target application.
  • the first access request is used to request to open a target file
  • the target descriptor includes a target file descriptor
  • the second access request is used to request access to the target file
  • the The resource access result includes the access result of the target file
  • the processing unit is further configured to create a channel identifier pair according to the access request, where the channel identifier pair includes a third channel identifier and a fourth channel identifier, and the channel identifier pair is used for the first channel identifier pair.
  • the processing unit is further configured to add the third channel identifier to the access request;
  • the transceiver unit is further configured to send the added data to the first process the access request identified by the third channel.
  • the processing unit is further configured to add the information of the target application in the access request; the transceiver unit is further configured to send the target application added to the first process request for access to information.
  • a fifth aspect of the present application provides a terminal, the terminal includes: a processor, a non-volatile memory, and a volatile memory; wherein, computer-readable instructions are stored in the non-volatile memory or the volatile memory; the processor Computer readable instructions are read to cause the terminal to implement the method as any one of the first aspect or the second aspect.
  • a sixth aspect of the present application provides a computer-readable storage medium, where a computer program is stored in the computer-readable storage medium, and when it runs on a computer, causes the computer to execute any one of the first aspect or the second aspect. way method.
  • a seventh aspect of the present application provides a computer program product, which, when run on a computer, causes the computer to perform the method of any one of the implementations of the first aspect or the second aspect.
  • An eighth aspect of the present application provides a chip, including one or more processors. Part or all of the processor is used to read and execute the computer program stored in the memory to execute the method in any possible implementation of any of the above aspects.
  • the chip includes a memory, and the memory and the processor are connected to the memory through a circuit or a wire.
  • the chip further includes a communication interface, and the processor is connected to the communication interface.
  • the communication interface is used for receiving data and/or information to be processed, the processor obtains the data and/or information from the communication interface, processes the data and/or information, and outputs the processing result through the communication interface.
  • the communication interface may be an input-output interface.
  • the method provided by the present application may be implemented by one chip, or may be implemented by multiple chips cooperatively.
  • FIG. 1 is a schematic structural diagram of a terminal 101 according to an embodiment of the present application.
  • FIG. 2 is a schematic diagram of an application scenario provided by an embodiment of the present application.
  • FIG. 3 is a schematic flowchart of an access control method 300 provided by an embodiment of the present application.
  • FIG. 4 is a schematic flowchart of an access control method 400 provided by an embodiment of the present application.
  • FIG. 5a is a schematic flowchart of an access control method 500 provided by an embodiment of the present application.
  • FIG. 5b is another schematic flowchart of an access control method 500 provided by an embodiment of the present application.
  • FIG. 6a is a schematic flowchart of an access control method 600 provided by an embodiment of the present application.
  • FIG. 6b is another schematic flowchart of an access control method 600 provided by an embodiment of the present application.
  • FIG. 7 is a schematic flowchart of an access control method 700 provided by an embodiment of the present application.
  • FIG. 8 is a schematic flowchart of an access control method 800 provided by an embodiment of the present application.
  • FIG. 9 is a schematic flowchart of an inter-process execution access control provided by an embodiment of the present application.
  • FIG. 10 is a schematic structural diagram of a terminal 1000 according to an embodiment of the present application.
  • FIG. 11 is a schematic structural diagram of a computer program product 1100 provided by an embodiment of the present application.
  • a sandbox is an execution environment that restricts program behavior according to security policies, and can provide an isolated environment for running applications. Sandbox environments are often used to execute code from untested or untrusted third-party applications without compromising the operating system.
  • the related art by running the untrusted application in the sandbox and intercepting the specific access request initiated by the untrusted application, the access of the untrusted application to the local user data or operating system resources is restricted.
  • the related technologies completely rely on the interception technology to ensure the security of the sandbox environment. For some malicious programs that use anti-interception technology, it may be difficult to intercept the access request initiated by the malicious program in the relevant technology, resulting in the system security not being guaranteed.
  • the embodiments of the present application provide an access control method, which can be applied to a terminal.
  • the isolation process intercepts the access request initiated by the untrusted application.
  • the isolation process forwards the intercepted access request to the external process, and the external process confirms the permissions of the untrusted application before executing the access request. Since there is no access permission by default in the isolation process, the access request is executed only when the access request of the untrusted application is intercepted and the untrusted application has the access permission.
  • malicious programs cannot obtain access rights through anti-interception technology, which ensures system security.
  • the terminal involved in this embodiment of the present application may be a terminal capable of running an isolated process.
  • the terminal may be, for example, a personal computer (personal computer, PC), a notebook computer, a server, a mobile phone (mobile phone), a tablet computer, a mobile internet device (mobile internet device, MID), a wearable device, a virtual reality ( virtual reality (VR) equipment, augmented reality (AR) equipment, wireless terminals in industrial control, wireless terminals in self driving, wireless terminals in remote medical surgery Terminal, wireless terminal in smart grid, wireless terminal in transportation safety, wireless terminal in smart city, wireless terminal in smart home, etc.
  • the terminal may be a device running an Android system, an IOS system, a windows system, and other systems.
  • the access control method provided by the embodiment of the present application by taking the terminal as a smart phone running the Android system as an example.
  • FIG. 1 is a schematic structural diagram of a terminal 101 according to an embodiment of the present application.
  • the terminal 101 includes a processor 103 , and the processor 103 is coupled to a system bus 105 .
  • the processor 103 may be one or more processors, each of which may include one or more processor cores.
  • a video adapter 107 which can drive a display 109, is coupled to the system bus 105.
  • the system bus 105 is coupled to an input-output (I/O) bus through a bus bridge 111 .
  • I/O interface 115 is coupled to the I/O bus.
  • the I/O interface 115 communicates with various I/O devices, such as an input device 117 (eg, a touch screen, etc.), a media tray 121, (eg, a compact disc read-only memory, CD- ROM), multimedia interface, etc.).
  • Transceiver 123 which can transmit and/or receive radio communication signals
  • camera 155 which can capture still and moving digital video images
  • external USB port 125 external USB port 125 .
  • the interface connected to the I/O interface 115 may be a USB interface.
  • the processor 103 may be any conventional processor, including a reduced instruction set computing (reduced instruction set computing, RISC) processor, a complex instruction set computing (complex instruction set computing, CISC) processor or a combination of the above.
  • the processor may be a special purpose device such as an ASIC.
  • Terminal 101 may communicate with software deployment server 149 through network interface 129 .
  • network interface 129 is a hardware network interface, such as a network card.
  • the network 127 may be an external network, such as the Internet, or an internal network, such as an Ethernet network or a virtual private network (VPN).
  • the network 127 may also be a wireless network, such as a WiFi network, a cellular network, and the like.
  • the hard drive interface 131 is coupled to the system bus 105 .
  • the hardware driver interface is connected to the hard disk drive 133 .
  • System memory 135 is coupled to system bus 105 .
  • the data running in the system memory 135 may include the operating system (OS) 137 of the terminal 101 , the application programs 143 and the schedule.
  • OS operating system
  • the operating system includes a Shell 139 and a kernel 141 .
  • Shell 139 is an interface between the user and the operating system's kernel.
  • the shell is the outermost layer of the operating system. The shell manages the interaction between the user and the operating system: waiting for user input, interpreting user input to the operating system, and processing various operating system output.
  • Kernel 141 consists of those parts of the operating system that manage memory, files, peripherals, and system resources.
  • the kernel 141 directly interacts with the hardware, and the operating system kernel usually runs processes, provides inter-process communication, provides CPU time slice management, interrupts, memory management, IO management, and the like.
  • the application program 143 includes a cloud computing related program.
  • the terminal 101 may download the application 143 from the software deployment server 149 when the application 143 needs to be executed.
  • the terminal 101 may also download the schedule corresponding to the application 143 from the software deployment server 149 .
  • FIG. 2 is a schematic diagram of an application scenario provided by an embodiment of the present application.
  • a host process and an isolated process run in the terminal, and the untrusted application runs in the isolated process.
  • An untrusted application running in an isolated process does not have permission to access resources in the terminal (such as system resources in the terminal or user personal data).
  • the isolation process intercepts the access request initiated by the untrusted application, and sends the intercepted access request to the host process.
  • the host process performs permission verification on the access request. When the access request passes the permission verification, the host process executes the host access request and returns the corresponding access result to the isolation process.
  • the isolated process then returns the received access result to the untrusted application.
  • the host process does not execute the access request and returns an error code to the isolation process.
  • FIG. 3 is a schematic flowchart of an access control method 300 provided by an embodiment of the present application. As shown in FIG. 3, the method 300 includes the following steps 301-306.
  • Step 301 the second process obtains an access request from a target application, the target application runs in the second process, and the second process does not have the permission to execute the access request.
  • a first process and a second process run in the terminal, and the first process and the second process can communicate with each other.
  • the first process has the right to access resources in the terminal (such as system resources or user personal data), while the second process does not have the right to access the external environment. Therefore, the second process may forward the obtained access request to the first process, and the first process may perform the access request as a proxy.
  • the first process may be, for example, a host process in the Android system
  • the second process may be, for example, an isolated process in the Android system.
  • the host process is used to establish a connection with the isolated process, control and proxy the access behavior of the isolated process to the outside world.
  • An isolated process is a special process in the Android system.
  • An application or service running in the isolated process has no permission to access the external environment, that is, this part of the application or service is isolated from the rest of the system.
  • One or more application programs may be running in the second process, and the target application program may be any application program in the second process.
  • a target application needs to access resources in the system, such as system resources such as a network, a file directory, or a file in a specific path
  • the target application initiates an access request, which is used to request access to resources in the system.
  • the system resources refer to software resources, hardware resources in the terminal, and data resources stored in the terminal.
  • the access request may be, for example, a system call request.
  • the system call refers to the interface between the application program and the system, such as a program interface or an application programming interface (Application Programming Interface, API) provided by the operating system to the application program.
  • the application program communicates with the operating system through system calls, and obtains the services of the operating system. That is to say, an application can request to execute a call to an interface provided by the operating system by initiating a system call request, thereby realizing access to system resources.
  • the second process obtains the access request from the target application by intercepting the access request.
  • multiple system call numbers may be pre-configured in the second process, and when the second process identifies that the access request initiated by the target application includes the same system call number, then intercepts the access. ask.
  • system call number since many different system calls are implemented in the operating system, the application program needs to pass a parameter named system call number when initiating a system call request, so as to identify the system call required by the application program. That is, the system call number is used to identify the type of system call requested by the application.
  • Step 302 the second process sends the access request to the first process, and the first process has the right to execute the access request.
  • the second process Since the second process does not have the right to execute the access request, but the first process has the right to execute the access request, the second process can send the access request from the target application to the first process through inter-process communication.
  • the inter-process communication mode between the second process and the first process may be various, for example, a pipeline communication mode, a message queue communication mode, or a shared memory communication mode.
  • a command transmission channel may be pre-established between the first process and the second process, and the second process may send an access request to the first process through the established command transmission channel.
  • the first process creates a command transmission channel, and sends the identifier of the command transmission channel to the second process.
  • the second process can send an access request to the first process through the command transmission channel.
  • the second process may add information of the target application, such as the identifier of the target application, to the access request to obtain a new access request . Then, the second process sends a new access request to the first process, and the new access request includes the information of the target application, so that the first process can perform permission verification on the new access request.
  • the information of the target program added by the second process in the access request may be inherent information of the target application program itself, such as the identifier or name set by the target application program during development.
  • the information of the target program added by the second process in the access request may also be an identifier assigned by the second process or the first process to the target application program, for example, during the initialization process of the first process and the second process, the first process A process or a second process can assign a unique identifier to the target application that needs to run in the second process, and the first process can determine the application that initiates the access request according to the identifier of the application carried in the access request.
  • the second process may create a channel identifier pair according to the access request, where the channel identifier pair includes a third channel identifier and a fourth channel identifier. Then, the second process adds the third channel identifier to the access request from the target application, and sends the access request added with the third channel identifier to the first process.
  • the channel identifier pair corresponds to a data transmission channel, which is used for data transmission between the first process and the second process.
  • the first process After the first process receives the access request added with the third channel identifier, the first process writes the data to be returned in the data transmission channel corresponding to the third channel identifier based on the third channel identifier. In this way, the second process can obtain the data returned by the first process based on the fourth channel identifier.
  • the target application program running in the second process may have multiple threads running at the same time.
  • the second process may create an independent data transmission channel for each thread, and each independent data transmission channel is identified by a channel identification pair.
  • the second process can carry the channel identifier corresponding to the thread in the access request, so that the first process can transfer data from the data transmission channel corresponding to the thread.
  • the data is returned to the second process in the middle, which ensures the isolation of data between different threads, effectively avoids data confusion, and ensures the reliability of data transmission.
  • the second process may also add a thread identifier to the access request, where the thread identifier is used to identify the thread that initiated the access request, that is, the second process adds a thread identifier to the access request Thread ID and channel ID.
  • the first process After receiving the access request including the thread identifier and the channel identifier, the first process establishes a corresponding relationship between the thread identifier and the channel identifier. In this way, when the first process subsequently receives other access requests including the same thread identifier, the first process can determine the corresponding channel identifier according to the thread identifier, and send subsequent access results based on the channel identifier.
  • the second process may add the information of the target application and the identifier of the data transmission channel allocated by the second process to the access request.
  • the information of the target application in the access request is used for the first process to perform permission verification on the access request, and the identifier of the data transmission channel in the access request is used for the first process to return the result of executing the access request.
  • Step 303 the first process performs permission verification on the access request to obtain a verification result.
  • the access authority information of the application may be configured in the terminal.
  • the access permission information of the application may include the access permission corresponding to each of the multiple application programs of the terminal, for example, application A has the permission to access network resources, and application B does not have the permission to access network resources.
  • Application C has access permission information such as the permission to access the system file directory.
  • the access permission information of the application may also include the access permission corresponding to the application type, for example, the application of type A has the permission to access network resources, the application of type B does not have the permission to access network resources, and the application of type C does not have the permission to access system files.
  • the first process obtains the access permission information of the application program configured in the terminal, and performs permission verification on the access request to obtain the verification result.
  • the access request sent by the second process includes a system call number and the information of the target application, where the system call number is used to represent the system call requested by the target application to be executed, and the information of the target application For example, it can be the identifier of the target application, which is used to identify the identity information of the target application or the type to which the target application belongs.
  • the first process can perform permission verification according to the system call number and the information of the target application.
  • the first process may query the access permission information of the application program configured in the terminal based on the system call number and the information of the target application program.
  • the query result is that the target application has the right to access the system call corresponding to the system call number
  • it can be determined that the verification result is that the target application has the access right
  • the query result is that the target application has no access to the system call number
  • the corresponding system call permissions it can be determined that the verification result is that the target application does not have access permissions.
  • Step 304 based on the verification result that the target application program has access rights, the first process executes the access request to obtain a target descriptor for accessing system resources.
  • the first process may execute the access request as an agent, thereby obtaining the target descriptor for accessing the system resource.
  • the first process may terminate the execution of the access request.
  • the target descriptor is an abstract concept pointing to system resources, which can be used to identify system resources. The application program can access the corresponding system resources through the target descriptor.
  • Step 305 The first process allocates a proxy descriptor to the target descriptor, and the target descriptor has a corresponding relationship with the proxy descriptor.
  • the first process when the second process is used as an isolation process that isolates the external environment, due to the limitation of the isolation process itself, the first process usually cannot directly return a target descriptor (for example, a target descriptor that directly points to system resources) to the second process. socket descriptor or file descriptor). Therefore, the first process can allocate a proxy descriptor to the target descriptor, and the proxy descriptor has a corresponding relationship with the target descriptor. The first process can look up the unique corresponding target descriptor according to the proxy descriptor.
  • a target descriptor for example, a target descriptor that directly points to system resources
  • Step 306 the first process sends the proxy descriptor to the second process.
  • the first process may send a proxy descriptor to the second process based on the data transmission channel corresponding to the third channel identifier, so as to realize data transfer between different threads. isolation.
  • Step 307 the second process sends the proxy descriptor to the target application.
  • the second process forwards the access result returned by the first process to the target application.
  • the first process when the first process executes the access request from the untrusted application and obtains the target descriptor pointing to the system resource, the first process allocates the corresponding proxy descriptor to the target descriptor, and sends the untrusted application to the untrusted process through the second process.
  • the letter application returns the proxy descriptor.
  • the untrusted application in the second process can obtain the proxy descriptor corresponding to the target descriptor, and implement system resource access based on the proxy descriptor.
  • the proxy descriptor when the untrusted application accesses the system resource through the proxy descriptor, the proxy descriptor must be replaced by the target descriptor through the first process, so that the access to the system resource can be completed.
  • the first process ensures that the behavior of the untrusted application accessing the system resources can be effectively monitored, and the security of the system is ensured while realizing the untrusted application accessing the system resources.
  • FIG. 4 is a schematic flowchart of an access control method 400 provided by an embodiment of the present application. As shown in FIG. 4, the method 400 includes the following steps 401-410.
  • Step 401 the second process sends a first system call request to the first process.
  • the access request intercepted by the second process from the target application is specifically a first system call request, where the first system call request is used to request to call an interface provided in the system.
  • the second process does not have the authority to execute the system call request, and the first process has the authority to execute the system call request.
  • the first system call request may be, for example, a request for initiating network access; in the case that the target application needs to access files in the terminal directory, the The first system call request may be, for example, a request to open a directory file.
  • Step 402 the first process executes the first system call request to obtain a target descriptor for accessing system resources.
  • the first process After receiving the first system call request, the first process parses the first system call request and performs permission verification. After the first system call request passes the permission check, the first process executes the first system call request to obtain the target descriptor.
  • the target descriptor may be a socket descriptor.
  • a socket is an abstraction of an endpoint for bidirectional communication between application processes on different hosts in a network, that is, a socket is an interface for applications to communicate through network protocols.
  • the operating system returns a small integer as a descriptor to identify the socket, so that the application can use this socket descriptor to Refers to the socket, enabling network access. That is, when the first process executes the first system call request for initiating network access, the operating system returns a socket descriptor for identifying the socket to the first process.
  • the target descriptor may be a file descriptor.
  • a file descriptor is formally a non-negative integer.
  • the file descriptor is an index value that points to the record table of files opened by the process maintained by the operating system for each process.
  • the operating system returns a file descriptor to the process to identify the file opened or created by the process, and the process also needs to use the file descriptor to specify the file to be read and written. That is, when the first process executes the first system call request requesting to access the file, the operating system returns a socket descriptor for identifying the socket to the first process.
  • Step 403 The first process allocates a proxy descriptor to the target descriptor, and the target descriptor has a corresponding relationship with the proxy descriptor.
  • the first process when the second process is used as an isolation process that isolates the external environment, due to the limitation of the isolation process itself, the first process usually cannot directly return a target descriptor (for example, a target descriptor that directly points to system resources) to the second process. socket descriptor or file descriptor). Therefore, the first process can allocate a proxy descriptor to the target descriptor, and the proxy descriptor has a corresponding relationship with the target descriptor. The first process can look up the unique corresponding target descriptor according to the proxy descriptor.
  • a target descriptor for example, a target descriptor that directly points to system resources
  • Step 404 the first process sends the proxy descriptor to the second process.
  • the first process After assigning the corresponding proxy descriptor to the target descriptor, the first process sends the proxy descriptor to the second process as a response result of the first system call request.
  • Step 405 the second process sends the proxy descriptor to the target application.
  • Step 406 the second process sends a second system call request to the first process.
  • the target application may initiate a second system call request based on the proxy descriptor, where the second system call request includes the proxy descriptor to request access to the proxy The system resource corresponding to the descriptor.
  • the target application may initiate a second system call request for requesting to establish network connection based on the proxy descriptor.
  • the target application may initiate a second system call request for requesting to traverse the directory file based on the proxy descriptor.
  • the second process after the second process intercepts the second system call request from the target application, the second process also sends the second system call request to the first process. Specifically, before the second process sends the second system call request, the second process may add the identifier of the thread that initiates the second system call request in the target application in the second system call request, so that the first process can The thread identifies the corresponding data transmission channel, and returns the result obtained by executing the second system call request to the second process.
  • Step 407 the first process acquires the target descriptor corresponding to the proxy descriptor.
  • the first process After the first process receives the second system call request including the proxy descriptor, the first process parses the second system call request to obtain the proxy descriptor in the second system call request. Then, since a correspondence between the proxy descriptor and the target descriptor is established in the first process, the first process can obtain the target descriptor corresponding to the proxy descriptor by searching for the corresponding relationship, and the target descriptor is used for The first process subsequently executes the second system call request.
  • Step 408 the first process executes the second system call request according to the target descriptor to obtain a resource access result.
  • the first process can execute the second system call request based on the target descriptor to obtain the resource access result.
  • the first process may establish a connection with the corresponding network site based on the socket descriptor corresponding to the proxy descriptor, and obtain the representation returned by the network site. Status information of successful connection, which is the obtained resource access result.
  • the target application can implement the traversal of the directory file based on the target descriptor, and obtain the traversal result of the directory file, and the traversal result of the directory file is the obtained resource Access results.
  • the first process can find the target descriptor corresponding to the proxy descriptor in the second system call, it means that the first process has performed permission verification on the target application and the verification result is passed . Because only when the permission check is passed, the target application can obtain the proxy descriptor corresponding to the target descriptor. Therefore, the first process can no longer perform permission checking on the second system call request, so as to save resource overhead.
  • Step 409 the first process sends the resource access result to the second process.
  • Step 410 the second process sends the resource access result to the target application.
  • steps 409-410 are similar to the above-mentioned steps 305-306. For details, reference may be made to the above-mentioned steps 305-306, which will not be repeated here.
  • the first process when the first process executes the system call request and obtains the target descriptor pointing to the system resource, the first process allocates the corresponding proxy descriptor to the target descriptor, and returns the proxy descriptor to the second process. In this way, the untrusted application in the second process only obtains the proxy descriptor corresponding to the target descriptor.
  • the proxy descriptor When the untrusted application initiates the behavior of accessing system resources based on the proxy descriptor, the proxy descriptor must be replaced by the target description through the first process. to complete access to system resources. That is to say, by avoiding directly returning the target descriptor to the untrusted application, the first process ensures that the behavior of the untrusted application accessing the system resources can be effectively monitored, and the security of the system is guaranteed.
  • FIG. 5a is a schematic flowchart of an access control method 500 provided by an embodiment of the present application. As shown in Figure 5a, the method 500 includes the following steps 501-510.
  • Step 501 Thread 1 in the target application initiates a system call request 1, where the system call request 1 is used to request to initiate network access.
  • the target application creates thread 1 .
  • thread 1 when thread 1 needs to request to access the network, thread 1 initiates system call request 1, and the system call request 1 is used to request to initiate network access.
  • the system call request 1 may specifically include a system call number, and the name corresponding to the system call number is socket, that is, the socket that the system call request 1 is used to request for network access.
  • Step 502 the second process intercepts system call request 1 from thread 1 in the target application.
  • the second process can intercept the system call request 1 from thread 1 in the target application according to the system call number.
  • Step 503 the second process creates a data transmission channel 1 for thread 1 .
  • the second process may create an independent data transmission channel 1 for thread 1.
  • the data transmission channel 1 can be understood as a data return channel, and the first process can transmit the data returned to the second process through the data transmission channel 1 .
  • the second process may obtain a pair of channel identifiers corresponding to the data transmission channel 1, such as the third channel identifier and the fourth channel identifier described in the foregoing embodiment.
  • the second process may send one channel identifier of a pair of channel identifiers corresponding to the data transmission channel 1 to the first process. In this way, when the first process writes data in the data transmission channel 1 through one of the channel identifiers, the second process can read the data written by the first process in the data transmission channel 1 through the other channel identifier, That is, to realize the transmission of data.
  • Step 504 the second process adds the identifier of the data transmission channel 1 and the identifier of the thread 1 to the system call request 1 to obtain the system call request 2 .
  • the identifier of the data transmission channel 1 added by the second process in the system call request 1 is a channel identifier, that is, one of a pair of channel identifiers corresponding to the data transmission channel 1, such as the third channel identifier described in the above embodiment.
  • Channel ID is a channel identifier, that is, one of a pair of channel identifiers corresponding to the data transmission channel 1, such as the third channel identifier described in the above embodiment.
  • the second process may also add information of the target application in the system call request 1, such as the identifier of the target application, where the identifier of the target application is used to identify the identity information of the target application or to identify the target application The type to which the program belongs.
  • the identifier of the target application can be, for example, the unique identifier or name set by the target application during development; the identifier of the target application can also be, for example, the identifier assigned by the second process or the first process to the target application. logo.
  • Step 505 the second process sends a system call request 2 to the first process.
  • Step 506 the first process parses the system call request 2, and performs permission verification on the system call request 2.
  • the first process can perform permission verification on the system call request 2 based on the system call number and the information of the target application to determine whether the target application has Request permission to execute system call request 2.
  • the first process can obtain the identification of the data transmission channel 1 and the identification of the thread 1 in the system call request 2, and the first process is the identification of the data transmission channel 1 and the identification of the thread 1.
  • the identification establishes a corresponding relationship, so that when other requests including the identification of thread 1 are subsequently received, the corresponding data transmission channel 1 can be determined.
  • Step 507 after the system call request 2 passes the permission check, the first process executes the system call request 2 to obtain the socket descriptor.
  • system call request 2 Since the system call request 2 is used to request to initiate network access, after the first process executes the system call request 2, it can obtain the socket descriptor returned by the operating system for performing network access.
  • Step 508 The first process allocates a channel identifier pair to the socket descriptor, where the channel identifier pair includes a channel identifier 1 and a channel identifier 2.
  • the channel identifier pair allocated by the first process is used for data transmission between the first process and the target application.
  • the channel identifier pair includes a channel identifier 1 and a channel identifier 2, which may be, for example, the first channel identifier and the second channel identifier described in the foregoing embodiment.
  • the first process may further establish a correspondence between the socket descriptor and the channel identifier pair, for example, save the socket descriptor and the channel identifier pair to a in the mapping table, so that the first process can find the corresponding socket descriptor according to any one of the channel identifiers in the pair of channel identifiers.
  • Step 509 the first process sends the channel identifier 1 to the second process.
  • the first process After the first process allocates the channel identifier pair to the socket descriptor, the first process returns one channel identifier in the channel identifier pair to the second process, for example, the channel identifier 1. Specifically, the first process may send the channel identifier 1 to the second process according to the identifier of the data transmission channel 1 in the system call request 2, that is, the first process transmits the channel identifier 1 through the data transmission channel 1.
  • Step 510 the second process sends the channel identifier 1 to thread 1 of the target application.
  • the second process After the second process receives the channel identifier 1 through the data transmission channel 1, the second process returns the channel identifier 1 to the thread 1 of the target application, so that the thread 1 can initiate a request for establishing a network connection based on the channel identifier 1.
  • FIG. 5b is another schematic flowchart of an access control method 500 provided by an embodiment of the present application. As shown in Figure 5b, the method 500 further includes the following steps 511-521.
  • Step 511 the second process intercepts the system call request 3 from thread 1 in the target application.
  • the channel identifier 1 returned by the first process is actually equivalent to a socket descriptor, that is, thread 1 can use the channel identifier 1 to access the network.
  • thread 1 After thread 1 obtains the channel identifier 1, if thread 1 needs to access a certain network site, thread 1 also needs to request to establish a connection with the network site to be accessed based on the channel identifier 1. Therefore, thread 1 can initiate a system call request 3, where the system call request 3 includes the channel identifier 1 and the address of the network site, and the system call request 3 is used for requesting to establish a connection with the network site.
  • the system call request 3 may specifically include a system call number and a parameter for executing the system call request 3 (that is, the address of the network site), and the name corresponding to the system call number is connect (connection), that is, the system call.
  • Request 3 is used to request to establish a connection with a network site.
  • Step 512 the second process adds the identifier of thread 1 to system call request 3 to obtain system call request 4 .
  • the second process may add the identifier of the thread 1 to the system call request 3 to obtain the system call request 4 .
  • the first process can actually use the channel identifier 1 to determine the initiation The thread of the system call request. Therefore, the second process may also be one that does not need to add the identifier of thread 1 in system call request 3 .
  • Step 513 the second process sends a system call request 4 to the first process.
  • Step 514 the first process searches and obtains the corresponding socket descriptor according to the channel identifier 1 in the system call request 4.
  • the first process establishes the corresponding relationship between the channel identifier pair and the socket descriptor, such as the mapping table described in the above embodiment, after the first process parses the system call request 4 and obtains the channel identifier 1, the first process The process can find the corresponding socket descriptor based on the channel ID 1.
  • Step 515 the first process executes the system call request 4 according to the socket descriptor, and obtains the connection status information with the network site.
  • the first process parses the system call request 4, the first process can also obtain the parameters included in the system call request 4, that is, the address of the above-mentioned network site. In this way, the first process can execute the system call request 4 based on the socket descriptor and the address of the network site, that is, establish a connection with the network site. After the first process successfully establishes the connection with the network site, the first process can receive the connection state information returned by the network site, where the connection state information is used to indicate that the network connection is successful.
  • Step 516 the first process establishes a listener for the channel ID 1.
  • the first process acts as a proxy between the network site and thread 1 of the target application, and is responsible for transferring data from thread 1 Forward to the web site, and forward data from the web site to thread 1.
  • the channel corresponding to the channel identifier 1 and the channel identifier 2 is the channel for data transmission between the first process and the thread 1 . Due to the limited resources of channel identifiers and socket descriptors, when thread 1 does not need to perform network access, thread 1 closes channel identifier 1 to release system resources. Therefore, in order to identify the closing operation of the channel identifier 1 by the thread 1 in time, the first process may establish a listener for the channel identifier 1. When the thread 1 closes the channel identifier 1, the first process will receive the callback information returned by the listener, and the callback information can indicate that the thread 1 has closed the channel identifier 1.
  • the first process may also establish a listener for the socket descriptor. In this way, when the socket descriptor is closed, the first process can obtain the message sent by the listener, and the message is used to indicate that the socket descriptor is closed. The first process closes the proxy descriptor corresponding to the socket descriptor according to the message.
  • the first process can monitor the socket descriptor through the listener. When the socket descriptor is closed, it can be considered that the network is interrupted, so the first process is triggered to close and connect to the socket.
  • the proxy descriptor corresponding to the word descriptor is used to reclaim system resources in time.
  • the listener in the system is used to monitor the occurrence of an event (program).
  • the event generator ie the event source
  • the listener can also obtain an event object. According to this object, it can obtain related properties and perform related operations. For example, the listener sends callback information to the process that registered the listener.
  • Step 517 the first process sends connection status information to the second process.
  • the first process may send the connection state information to the second process through the data transmission channel 1 corresponding to thread 1 .
  • the first process searches for the corresponding data transmission channel according to the identifier of thread 1, so as to send connection status information based on the searched data transmission channel 1.
  • Step 518 the second process sends connection status information to thread 1 of the target application.
  • thread 1 can determine that the connection with the network site has been successful. Therefore, thread 1 can exchange data with the web site based on channel ID 1.
  • thread 1 when thread 1 needs to send data to a network site, thread 1 writes the data to be sent in the data transmission channel corresponding to channel identifier 1 based on channel identifier 1; The data sent by thread 1 is read in the transmission channel. Then, the first process searches for the socket descriptor corresponding to the channel identifier 2, and sends the read data to the network site based on the socket descriptor. After the network site returns the network data to the first process, the first process writes the data that needs to be returned by the network site in the data transmission channel corresponding to the channel ID 2 based on the channel ID 2; in this way, thread 1 can be based on the channel ID 1 The data returned by the first process is read in the data transmission channel.
  • the first process acts as an intermediary between thread 1 and the network site, the first process exchanges data with the network site through socket descriptors, and the first process and thread 1 use channel ID 1 and channel ID 2 Realize the interaction of data, and finally realize the data interaction between the network site and thread 1.
  • the obtained socket can be Word descriptors allocate channel identification pairs.
  • thread 1 can subsequently communicate with the first process based on the channel identifier. That is to say, when thread 1 needs to exchange data with a network site, thread 1 and the first process implement data interaction through the assigned channel identifier pair, and the first process realizes data interaction with the network site.
  • Thread 1 and the first process can implement data interaction based on the channel identifier pair.
  • the first process allocates a pair of channel identifiers and returns a channel identifier in the pair of channel identifiers to the target application, so that the first process and the target application can communicate with each other based on the channel corresponding to the pair of channel identifiers. . It avoids the continuous forwarding of a large amount of network data between the first process and the target application by the second process, improves the efficiency of data transmission, and the data that the target application interacts with the network site is transmitted through an independent channel, ensuring that Reliability of data transmission.
  • Step 519 thread 1 of the target application closes the channel identifier 1.
  • the thread 1 of the target application ends the access to the network site, the thread 1 closes the channel identifier 1 for realizing data interaction with the network site.
  • the thread 1 no longer needs the channel ID 1, it can call the close function to close the access to the network site, and release the channel ID 1 for reuse.
  • Step 520 the first process obtains the callback information returned by the listener, where the callback information indicates that the channel identifier 1 has been closed.
  • the listener Since the first process establishes a listener for monitoring the channel identifier 1, when thread 1 closes the channel identifier 1, the listener returns callback information to the first process to indicate that the channel identifier 1 has been closed.
  • Step 521 the first process closes the socket descriptor corresponding to the channel identifier 1.
  • the first process searches for the channel identifier 2 corresponding to the channel identifier 1 and the socket descriptor. Then, the first process closes the channel identifier 2 and the socket descriptor to reclaim system resources in time.
  • FIG. 6a is a schematic flowchart of an access control method 600 provided by an embodiment of the present application. As shown in Figure 6a, the method 600 includes the following steps 601-610.
  • step 601 the thread 2 in the target application program initiates a system call request 5, where the system call request 5 is used to request to open the target file.
  • the target application may also create thread 2, and thread 2 and thread 1 are two different threads.
  • thread 2 when thread 2 needs to request to open a certain file, thread 2 initiates system call request 5, and the system call request 5 is used to request to open the target file.
  • the target file may be, for example, a directory file or a specific file.
  • the system call request 5 may specifically include a system call number and a parameter, the name corresponding to the system call number is open, and the parameter includes the path of the target file.
  • Step 602 the second process intercepts the system call request 5 from the thread 2 in the target application.
  • the second process can intercept the system call request 5 from the thread 2 in the target application program according to the system call number.
  • Step 603 the second process creates a data transmission channel 2 for thread 2 .
  • the second process may create an independent data transmission channel 2 for thread 1.
  • the data transmission channel 2 can be understood as a data return channel, and the first process can transmit the data returned to the second process through the data transmission channel 2 . That is to say, for the data that needs to be returned to thread 1, the first process transmits it through data transmission channel 1; for the data that needs to be returned to thread 2, the first process transmits it through data transmission channel 2, so as to realize the communication between different threads. data isolation.
  • the manner in which the second thread creates the data transmission channel 2 for the thread 2 is similar to the manner in which the second thread creates the data transmission channel 1 for the thread 1. For details, reference may be made to the above step 503, which will not be repeated here.
  • Step 604 the second process adds the identifier of the data transmission channel 2 and the identifier of the thread 2 to the system call request 5 to obtain the system call request 6 .
  • the second process may also add information of the target application in the system call request 5, such as an identifier of the target application, where the identifier of the target application is used to identify the identity information of the target application Or identify the type to which the target application belongs.
  • Step 605 the second process sends a system call request 6 to the first process.
  • Step 606 the first process parses the system call request 6 and performs permission verification on the system call request 6 .
  • the first process can perform permission verification on the system call request 6 based on the system call number and the information of the target application to determine whether the target application has Request permission to execute system call request 6.
  • the first process can obtain the identifier of the data transmission channel 2 and the identifier of the thread 2 in the system call request 6, and the first process is also the identifier of the data transmission channel 2 and the thread 2.
  • a corresponding relationship is established between the identifiers of the thread 2, so that the corresponding data transmission channel 2 can be determined when other requests including the identifier of the thread 2 are subsequently received.
  • Step 607 after the system call request 6 passes the permission check, the first process executes the system call request 6 to obtain the file descriptor.
  • system call request 6 Since the system call request 6 is used to request to open the target file, after the first process executes the system call request 6, it can obtain the file descriptor returned by the operating system for accessing the target file. Exemplarily, when the system call request 6 is specifically used to request to open a directory file, the first process executes the system call request 6 to obtain the directory file descriptor.
  • Step 608 the first process allocates a proxy file descriptor to the file descriptor, and establishes a listener for the proxy file descriptor.
  • the first process may further establish a correspondence between the file descriptor and the proxy file descriptor, for example, save the file descriptor and the proxy file descriptor to a map In the table, so that the first process can find the corresponding file descriptor according to the proxy file descriptor.
  • the first process can establish a listener for the proxy file descriptor, so that the first process can perceive the operation of closing the proxy file descriptor by the target application in time.
  • Step 609 the first process sends the proxy file descriptor to the second process.
  • the first process may send the proxy file descriptor to the second process according to the identifier of the data transmission channel 2 in the system call request 6 , that is, the first process transmits the proxy file descriptor through the data transmission channel 2 .
  • Step 610 the second process sends the proxy file descriptor to thread 2 of the target application.
  • the second process After the second process receives the proxy file descriptor through the data transmission channel 2, the second process returns the proxy file descriptor to thread 2 of the target application, so that thread 2 can initiate a request to access the target file based on the proxy file descriptor.
  • FIG. 6b is another schematic flowchart of an access control method 600 provided by an embodiment of the present application. As shown in Figure 6b, the method 600 further includes the following steps 611-620.
  • Step 611 the second process intercepts the system call request 7 from the thread 2 in the target application.
  • thread 2 After thread 2 obtains the proxy file descriptor, thread 2 can request to access the target file based on the proxy file descriptor. Therefore, thread 2 can initiate a system call request 7, where the system call request 7 includes the proxy file descriptor, and the system call request 7 is used to request access to the target file.
  • the system call request 7 may specifically include a system call number, and the name corresponding to the system call number is getdents.
  • Step 612 the second process adds the identifier of thread 2 to system call request 7 to obtain system call request 8 .
  • the second process may add the identifier of the thread 2 to the system call request 7 to obtain the system call request 8 .
  • the first process can actually pass the proxy file descriptor. to determine the thread that initiated the system call request. Therefore, the second process may also be one that does not need to add the identifier of thread 2 in the system call request 7 .
  • Step 613 the second process sends a system call request 8 to the first process.
  • Step 614 the first process searches and obtains the corresponding file descriptor according to the proxy file descriptor in the system call request 8.
  • the first process establishes the corresponding relationship between the proxy file descriptor and the file descriptor, such as the mapping table described in the above embodiment, after the first process parses the system call request 8 and obtains the proxy file descriptor, the first process The process can find the corresponding file descriptor based on the proxy file descriptor.
  • Step 615 the first process executes the system call request 8 according to the file descriptor, and obtains the access result of the target file.
  • the first process executes the system call request 8 according to the directory file descriptor, and can obtain the traversal result of the directory file.
  • Step 616 the first process sends the access result of the target file to the second process.
  • the first process After the first process obtains the access result of the target file, the first process can send the connection state information to the second process through the data transmission channel 2 corresponding to the thread 2.
  • Step 617 the second process sends the access result of the target file to thread 2 of the target application.
  • Step 618 thread 2 of the target application closes the proxy file descriptor.
  • thread 2 When thread 2 of the target application no longer needs to access the target file, thread 2 closes the proxy file descriptor used to access the target file. For example, when thread 2 calls the close function to close the proxy file descriptor, the proxy file descriptor is released for reuse.
  • Step 619 the first process obtains the callback information returned by the listener, where the callback information indicates that the proxy file descriptor has been closed.
  • the listener Since the first process establishes a listener for monitoring the proxy file descriptor, after thread 2 closes the proxy file descriptor, the listener returns callback information to the first process to indicate that the proxy file descriptor has been closed.
  • Step 620 the first process closes the file descriptor corresponding to the proxy file descriptor.
  • the first process searches for a file descriptor corresponding to the proxy file descriptor. Then, the first process closes the file descriptor to reclaim system resources in time.
  • the file descriptors allocated to a certain file are limited. That is, the system can return different file descriptors to multiple threads accessing the target file at the same time, and different file descriptors can point to the same target file, but for the same target file, the system can return the number of different file descriptors is limited. Therefore, when the thread does not need to access the target file, the file descriptor needs to be closed to facilitate the recycling of system resources.
  • the first process can monitor the behavior of thread 2 to close the proxy file descriptor in time, and then close the file descriptor corresponding to the proxy file descriptor in time, so as to realize the timely availability of system resources. Recycle.
  • FIG. 7 is a schematic flowchart of an access control method 700 provided by an embodiment of the present application.
  • Step 701 the client requests to use the Awareness Kit service to register a time fence during sunrise or sunset (inSunriseOrSunsetPeriod).
  • the client may refer to an application program running in the terminal, and the application program requests to use the Awareness Kit service to register the inSunriseOrSunsetPeriod time fence during the running process.
  • Awareness Kit is a situational awareness service that supports obtaining the user's current time-space, location, activity status, audio device status, ambient light, weather, beacons and other contextual awareness combined capabilities. By invoking the capabilities supported by the Awareness Kit service, the application can obtain the user's current situation in a more efficient way, thereby providing users with a more intelligent experience.
  • the inSunriseOrSunsetPeriod time fence is a service whose function is to set a time alarm. When the terminal is within a period of time (such as 30 minutes before sunrise) of local time sunrise or sunset, the state of the time fence is set to True, otherwise the time The state of the fence is set to Flase.
  • Step 702 the system starts the host process, and the host process starts the isolation process.
  • the system in the terminal starts the host process, and the host process further starts the isolation process to run the Awareness Kit service in the isolation process.
  • a service stub proxy can be created in the host process, and the service stub proxy is used to proxy the data exchanged between the inSunriseOrSunsetPeriod time fence in the isolation process and the client.
  • the host process can also establish a command channel between the host process and the isolation process, and send the channel identifier corresponding to the command channel to the isolation process. In this way, the isolated process can send access requests to the host process through the command channel.
  • the host process since the host process starts the isolation process for the purpose of loading the Awareness Kit service in the isolation process, the host process actually knows the services loaded in the isolation process. In this case, the host process can assign a unique identifier to the Awareness Kit service that needs to be loaded in the isolated process to identify the service running in the isolated process. In this way, when the host process is connected to multiple isolated processes, the host process can also determine the service or application running in the isolated process according to the identifier sent by the isolated process.
  • Step 703 the isolated process loads the Awareness Kit service.
  • the isolated process After the isolated process is started by the host process, the isolated process accepts the command of the host process and loads the Awareness Kit service.
  • the Awareness Kit service in the isolated process registers the inSunriseOrSunsetPeriod time fence.
  • the working logic of the inSunriseOrSunsetPeriod time fence is: first determine whether the local data of the terminal has a valid sunrise or sunset time, and this judgment process It involves the traversal behavior of the directory file; if the judgment result is that the local data of the terminal has a valid sunrise or sunset time, the behavior of reading the database file is continued. Both of the above processes involve initiating relevant system call requests.
  • Step 704 the inSunriseOrSunsetPeriod time fence in the Awareness Kit service initiates a system call request to open the directory file.
  • the inSunriseOrSunsetPeriod time fence initiates a system call request to open the directory file in order to determine whether the local data of the terminal has a valid sunrise or sunset time.
  • the system call request initiated by the inSunriseOrSunsetPeriod time fence may specifically include a system call number and a parameter, the name corresponding to the system call number is open, and the parameter includes the path of the directory file.
  • Step 705 the isolation process intercepts the system call request initiated by the inSunriseOrSunsetPeriod time fence.
  • the isolated process can intercept the system call request initiated by the inSunriseOrSunsetPeriod time fence.
  • Step 706 the isolated process sends a system call request to the host process.
  • the isolation process After intercepting the system call request initiated by the inSunriseOrSunsetPeriod time fence, the isolation process creates a data transmission channel for the inSunriseOrSunsetPeriod time fence, and obtains the identifier of the data transmission channel. In this way, the isolation process adds the identifier of the data transmission channel, the identifier of the inSunriseOrSunsetPeriod time fence, and the identifier of the Awareness Kit service in the system call request to obtain the updated system call request. The isolated process then sends the updated system call request to the host process through the command channel.
  • Step 707 the host process executes the system call request.
  • the host process receives and parses the system call request sent by the isolated process, then creates a task thread for the system call, and adds it to the thread pool for unified management and execution of the corresponding system call request. Specifically, the host process executes the system call request to open the directory file, and obtains the corresponding response result.
  • Step 708 the host process returns a response request to the isolation process.
  • the host process After obtaining the response result corresponding to the system call request, the host process sends a response request to the isolation process through the corresponding data transmission channel based on the identifier of the data transmission channel sent by the isolation process. After the isolation process receives the response request, it continues to return the response result to the inSunriseOrSunsetPeriod time fence. Finally, the inSunriseOrSunsetPeriod time fence determines that the local data is valid according to the response result, and the inSunriseOrSunsetPeriod time fence continues to initiate a system call request for reading the database file. The steps after the inSunriseOrSunsetPeriod time fence initiates a system call request for reading the database file are similar to the above steps 704-708, and are not repeated here.
  • the isolated process returns the response result to the client through the service stub proxy in the host process.
  • FIG. 8 is a schematic flowchart of an access control method 800 provided by an embodiment of the present application.
  • Step 801 the client requests to use the Awareness Kit service to call the weather snapshot interface for obtaining the device weather (getWeatherByDevice).
  • the client may refer to an application program running in the terminal, and the application program requests to use the Awareness Kit service to call the getWeatherByDevice weather snapshot interface during the running process.
  • the client in this embodiment and the client in method 800 may be the same client.
  • the getWeatherByDevice weather snapshot interface is a service whose function is to query the weather status of the current location of the terminal through the network.
  • Step 802 the host process obtains the request from the client, and notifies the isolation process to create a task thread corresponding to the getWeatherByDevice weather snapshot interface.
  • the client in this embodiment and the client in method 800 are the same client, since the client has started the host process in method 800, the client may also directly send an instruction to the host process, so that The host process notifies the isolation process to create a task thread corresponding to the getWeatherByDevice weather snapshot interface.
  • another service stub proxy can be created in the host process, and the service stub proxy is used to proxy the data exchanged between the getWeatherByDevice weather snapshot interface in the isolation process and the client .
  • Step 803 the Awareness Kit service in the isolation process creates a task thread corresponding to the getWeatherByDevice weather snapshot interface.
  • the getWeatherByDevice weather snapshot interface needs to obtain the weather at the current location of the terminal, the getWeatherByDevice weather snapshot interface needs to access the network site to obtain the weather information on the network site.
  • Step 804 the getWeatherByDevice weather snapshot interface in the Awareness Kit service initiates a system call request for establishing network access.
  • the getWeatherByDevice weather snapshot interface initiates a system call request to establish network access in order to obtain the weather status on the network site.
  • the system call request initiated by the getWeatherByDevice weather snapshot interface may specifically include a system call number, and the name corresponding to the system call number is socket.
  • Step 805 the isolation process intercepts the system call request initiated by the getWeatherByDevice weather snapshot interface.
  • the isolation process can intercept the system call request initiated by the getWeatherByDevice weather snapshot interface.
  • Step 806 the isolated process sends a system call request to the host process.
  • the isolation process After intercepting the system call request initiated by the getWeatherByDevice weather snapshot interface, the isolation process creates another data transmission channel for the getWeatherByDevice weather snapshot interface, and obtains the identifier of the data transmission channel. In this way, the isolation process adds the identifier of the data transmission channel, the identifier of the getWeatherByDevice weather snapshot interface, and the identifier of the Awareness Kit service in the system call request to obtain the updated system call request. The isolated process then sends the updated system call request to the host process through the command channel.
  • Step 807 the host process executes the system call request.
  • the host process receives and parses the system call request sent by the isolated process, then creates a task thread for the system call, and adds it to the thread pool for unified management and execution of the corresponding system call request. Specifically, the host process executes a system call request to open a directory file, and obtains a corresponding response result.
  • Step 808 the host process returns a response request to the isolation process.
  • the host process After obtaining the response result corresponding to the system call request, the host process sends a response request to the isolation process through the corresponding data transmission channel based on the identifier of the data transmission channel sent by the isolation process. After receiving the response request, the isolation process continues to return the response result to the getWeatherByDevice weather snapshot interface. Finally, the getWeatherByDevice weather snapshot interface continues to initiate a system call request for establishing a connection with the network site according to the response result. The steps after the getWeatherByDevice weather snapshot interface initiates a system call request for requesting to establish a connection with a network site are similar to the above-mentioned steps 804-808, and are not repeated here.
  • the isolation process returns the response result to the client through the service stub proxy in the host process.
  • FIG. 9 is a schematic flowchart of an inter-process execution access control provided by an embodiment of the present application.
  • an untrusted application runs in the isolated process, and the task thread in the untrusted application initiates a system call request during the running process, such as a system call request named socket or connect.
  • the management service thread in the isolation process includes a request transfer module and an execution module.
  • the request transfer module intercepts the system call request initiated by the untrusted application, and repackages the system call request to obtain the packaged system call request.
  • the encapsulated system call request includes the information of the untrusted application, the identifier of the data channel, and the identifier of the task thread in the untrusted application.
  • the request transposition module transfers the encapsulated system call request to the execution module for transposition, and the execution module sends the encapsulated system call request to the host process through the command channel, and waits for the callback information of the host process.
  • the host process also includes a management service thread, and the channel monitoring module in the management service thread can monitor the command channel in a polling manner.
  • the management service thread After monitoring the system call request sent by the isolation process, the management service thread creates a thread for the system call request, and adds the newly created thread to the thread pool.
  • the newly added thread in the thread pool is used to execute the system call request, which includes: parsing the system call request to obtain the parameters and proxy descriptors in the system call request; and then interpreting the proxy descriptor to obtain the corresponding Target descriptor; finally, based on the obtained parameters and target descriptor, the parsed system call request is executed, and the obtained response result is returned to the isolation process through the data channel.
  • the execution module in the isolated process reads the callback information on the data channel, it parses to obtain the calling result, and returns it to the untrusted application.
  • FIG. 10 is a schematic structural diagram of a terminal 1000 according to an embodiment of the present application.
  • the terminal 1000 includes a transceiver unit 1001 and a processing unit 1002 .
  • the transceiver unit 1001 is configured to receive an access request sent by a second process, where the access request comes from a target application running in the second process, and the second process does not have the permission to execute the access request;
  • the processing unit 1002 is configured to execute the first access request to obtain a target descriptor for accessing system resources; the processing unit 1002 is further configured to allocate a proxy descriptor to the target descriptor, and the target descriptor
  • the transceiver unit 1001 is further configured to receive a second access request sent by a second process, where the second access request includes the proxy descriptor, and the second access request The request is used to request access to system resources; the processing unit 1002 is further configured to obtain the target descriptor corresponding to the proxy descriptor; the processing unit 1002 is further configured to execute the second The access request is obtained, and the resource access result is obtained; the transceiver unit 1001 is further configured to send the resource access result to the second process.
  • the first access request is used to request to initiate network access
  • the target descriptor includes a socket descriptor
  • the second access request further includes an address of a target network site
  • the The second access request is used to request access to the target network site
  • the processing unit 1002 is further configured to execute the second access request according to the socket descriptor to obtain an access result of the target network site.
  • the processing unit 1002 is further configured to allocate a channel identifier pair to the target descriptor, where the channel identifier pair includes a first channel identifier and a second channel identifier, and the channel identifier pair uses For data transmission between the first process and the target application, the socket descriptor has a corresponding relationship with the channel identifier pair; the transceiver unit 1001 is further configured to send a message to the second process the first channel identifier.
  • the first access request is used for requesting to open a target file
  • the target descriptor includes a target file descriptor
  • the second access request is used for requesting access to the target file
  • the processing unit 1002 is further configured to execute the second access request according to the target file descriptor to obtain an access result of the target file.
  • the processing unit 1002 is further configured to establish a listener for the proxy descriptor; the transceiver unit 1001 is further configured to acquire a message sent by the listener, where the message is used to indicate The proxy descriptor is closed; the processing unit 1002 is further configured to close the target descriptor corresponding to the proxy descriptor according to the message.
  • the processing unit 1002 is further configured to establish a listener for the socket descriptor; the transceiver unit 1001 is further configured to acquire a message sent by the listener, the message using to indicate that the socket descriptor is closed; the processing unit 1002 is further configured to close the proxy descriptor corresponding to the socket descriptor according to the message.
  • the access request includes information of the target application; the processing unit 1002 is further configured to perform permission verification on the access request according to the information of the target application.
  • the access request further includes a third channel identifier, where the third channel identifier is used to indicate a data transmission channel; the transceiver unit 1001 is further configured to use the third channel identifier corresponding to a data transmission channel, for sending the access result to the second process.
  • the first access request and the second access request further include a thread identifier corresponding to the target application; the processing unit 1002 is further configured to, according to the first access request, establishing a correspondence between the third channel identifier and the thread identifier; the processing unit 1002 is further configured to determine the third channel identifier according to the thread identifier in the second access request; the The transceiver unit 1001 is further configured to identify the corresponding data transmission channel through the third channel, and send the resource access result to the second process.
  • the transceiver unit 1001 is configured to acquire an access request from a target application, where the target application runs in a second process, and the second process does not have the permission to execute the access request ;
  • the processing unit 1002 is configured to send the access request to the first process, and the first process has the authority to execute the access request;
  • the transceiver unit 1001 is further configured to receive the proxy description sent by the first process
  • the proxy descriptor is used to access system resources; the transceiver unit 1001 is further configured to send the proxy descriptor to the target application.
  • the transceiver unit 1001 is further configured to: obtain a second access request from the target application, where the second access request includes the proxy descriptor, and the second access request The request is used to request access to system resources; send the second access request to the first process; the second process receives the resource access result sent by the first process; the second process sends the target application Send the resource access result.
  • the first access request is used to request to initiate network access
  • the second access request further includes an address of a target network site
  • the second access request is used to request access to the target network site
  • the resource access result includes the access result of the target network site
  • the proxy descriptor includes a first channel identifier, where the first channel identifier is used for data transmission between the first process and the target application.
  • the first access request is used to request to open a target file
  • the target descriptor includes a target file descriptor
  • the second access request is used to request access to the target file
  • the The resource access result includes the access result of the target file
  • the processing unit 1002 is further configured to create a channel identifier pair according to the access request, where the channel identifier pair includes a third channel identifier and a fourth channel identifier, and the channel identifier pair is used for Data transmission between the first process and the second process; the processing unit 1002 is further configured to add the third channel identifier to the access request; the transceiver unit 1001 is further configured to send a message to the first process The access request identified by the third channel is added.
  • the processing unit 1002 is further configured to add the information of the target application in the access request; the transceiver unit 1001 is further configured to send the added target application to the first process Access requests for application information.
  • the access control method provided in this embodiment of the present application may be specifically executed by a chip in the terminal, where the chip includes: a processing unit and a communication unit, the processing unit may be, for example, a processor, and the communication unit may be, for example, an input/output interface, a pin or a communication unit. circuit, etc.
  • the processing unit can execute the computer-executed instructions stored in the storage unit, so that the chip in the server executes the access control method described in the embodiments shown in FIG. 1 to FIG. 10 .
  • the storage unit is a storage unit in the chip, such as a register, a cache, etc.
  • the storage unit may also be a storage unit located outside the chip in the wireless access device, such as a read-only memory (read-only memory, ROM) Or other types of static storage devices that can store static information and instructions, random access memory (RAM), etc.
  • ROM read-only memory
  • RAM random access memory
  • the present application also provides a computer program product.
  • the method disclosed in FIG. 3 may be implemented as encoded on a computer-readable storage medium in a machine-readable format or encoded in a computer-readable storage medium.
  • FIG. 11 schematically illustrates a conceptual partial view of an example computer program product including a computer program for executing a computer process on a computing device, arranged in accordance with at least some embodiments presented herein.
  • computer program product 1100 is provided using signal bearing medium 1101 .
  • the signal bearing medium 1101 may include one or more program instructions 1102 that, when executed by one or more processors, may provide the functions, or portions thereof, described above with respect to FIG. 2 .
  • program instructions 1102 in FIG. 11 also describe example instructions.
  • signal bearing medium 1101 may include computer readable medium 1103, such as, but not limited to, a hard drive, compact disc (CD), digital video disc (DVD), digital tape, memory, ROM or RAM, and the like.
  • computer readable medium 1103 such as, but not limited to, a hard drive, compact disc (CD), digital video disc (DVD), digital tape, memory, ROM or RAM, and the like.
  • the signal bearing medium 1101 may include a computer recordable medium 1104 such as, but not limited to, memory, read/write (R/W) CDs, R/W DVDs, and the like.
  • signal bearing medium 1101 may include communication medium 1105, such as, but not limited to, digital and/or analog communication media (eg, fiber optic cables, waveguides, wired communication links, wireless communication links, etc.).
  • the signal bearing medium 1101 may be conveyed by a wireless form of communication medium 1105 (eg, a wireless communication medium that conforms to the IEEE 802.11 standard or other transmission protocol).
  • the one or more program instructions 1102 may be, for example, computer-executable instructions or logic-implemented instructions.
  • a computing device of a computing device may be configured to respond to program instructions 1102 communicated to the computing device through one or more of computer readable media 1103 , computer recordable media 1104 , and/or communication media 1105 . , which provides various operations, functions, or actions.
  • the disclosed system, apparatus and method may be implemented in other manners.
  • the apparatus embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented.
  • the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the above-mentioned integrated units may be implemented in the form of hardware, or may be implemented in the form of software functional units.
  • the integrated unit if implemented in the form of a software functional unit and sold or used as an independent product, may be stored in a computer-readable storage medium.
  • the technical solutions of the present application can be embodied in the form of software products in essence, or the parts that contribute to the prior art, or all or part of the technical solutions, and the computer software products are stored in a storage medium , including several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage medium includes: a U disk, a removable hard disk, a read-only memory, a random access memory, a magnetic disk or an optical disk and other media that can store program codes.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Virology (AREA)
  • Computer And Data Communications (AREA)
  • Storage Device Security (AREA)

Abstract

本申请公开了一种访问控制方法，可以应用于终端。该方法包括隔离进程截获不可信应用发起的访问请求，并将访问请求转发给宿主进程。宿主进程执行该访问请求，得到用于访问***资源的目标描述符，并为该目标描述符分配代理描述符。最终，隔离进程将宿主进程返回的代理描述符转发给不可信应用，从而实现对不可信应用的访问行为的监控。

Description

一种访问控制方法及相关装置
本申请要求于2021年2月9日提交中国专利局、申请号为202110176129.8、发明名称为“一种访问控制方法及相关装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及操作***技术领域，尤其涉及一种访问控制方法及相关装置。
背景技术
沙箱是一种按照安全策略限制程序行为的执行环境，目前已经广泛应用于各种操作***中。以安卓(Android)操作***为例，部分恶意应用程序通过申请***权限，实现获取用户隐私数据、执行网络访问等操作，破坏了***的正常运行。通过将应用程序部署在沙箱环境中，可以对应用程序的行为进行有效监控，以保护***的安全。
相关技术中，通过将不可信的应用程序(以下简称不可信应用)运行在沙箱中，并截获不可信应用所发起的特定访问请求，来限制不可信应用对本地用户数据或操作***资源的访问。
在一些情况下，运行在沙箱中的不可信应用可能需要访问网络或本地的文件等***资源，来为终端提供特定的服务。然而，在相关技术中，运行在沙箱中的不可信应用通常难以访问网络或本地的文件等***资源。因此，目前亟需一种能够使得沙箱中的不可信应用访问***资源的方法。
发明内容
本申请提供了一种访问控制方法及相关装置，第一进程在执行来自于不可信应用的访问请求并获得指向***资源的目标描述符时，第一进程为目标描述符分配对应的代理描述符，并经由第二进程向不可信应用返回代理描述符。这样，第二进程中的不可信应用能够获得与目标描述符对应的代理描述符，并基于代理描述符实现***资源的访问。并且，不可信应用通过代理描述符访问***资源时，必须经由第一进程将代理描述符替换为目标描述符，才能够完成对***资源的访问。即第一进程通过避免直接将目标描述符返回给不可信应用，确保不可信应用访问***资源的行为能够得到有效的监控，在实现不可信应用访问***资源的同时，保障了***的安全性。
本申请第一方面提供一种访问控制方法，该访问控制方法应用于终端中，例如运行有安卓***的智能手机或平板电脑。在终端中运行有第一进程和第二进程，第一进程和第二进程之间可以互相进行通信。第一进程具有访问终端中的资源(例如***资源或用户个人数据)的权限，第二进程则不具有直接访问***资源或部分***资源的权限。
该访问控制方法具体包括：第一进程接收第二进程发送的第一访问请求，所述第一访问请求来自于运行在所述第二进程中的目标应用程序，所述第一访问请求例如可以为用于请求访问终端中的***资源。所述第二进程不具有执行所述访问请求的权限，所述第一进程则具有执行所述访问请求的权限。所述第一进程执行所述第一访问请求，得到用于访问 所述***资源的目标描述符。其中，目标描述符是一个指向***资源的抽象化概念，能够用于标识***资源。应用程序通过该目标描述符能够实现访问对应的***资源。在得到目标描述符后，所述第一进程为所述目标描述符分配代理描述符，所述目标描述符与所述代理描述符具有对应关系，第一进程能够根据代理描述符查找唯一对应的目标描述符。进一步的，第一进程可以建立映射表，该映射表中保存有目标描述符与代理描述符之间的对应关系。所述第一进程向所述第二进程发送所述代理描述符，以便于第二进程将所述代理描述符返回给所述目标应用程序，所述目标应用程序利用所述代理描述符访问所述***资源。
本实施例中，第一进程在执行来自于不可信应用的访问请求并获得指向***资源的目标描述符时，第一进程为目标描述符分配对应的代理描述符，并经由第二进程向不可信应用返回代理描述符。这样，第二进程中的不可信应用能够获得与目标描述符对应的代理描述符，并基于代理描述符实现***资源的访问。并且，不可信应用通过代理描述符访问***资源时，必须经由第一进程将代理描述符替换为目标描述符，才能够完成对***资源的访问。即第一进程通过避免直接将目标描述符返回给不可信应用，确保不可信应用访问***资源的行为能够得到有效的监控，在实现不可信应用访问***资源的同时，保障了***的安全性。
此外，本实施例提供的方案能够以安卓***应用程序安装包(Android application package，APK)的形式在第二进程中运行目标应用程序，不需要获取终端操作***的最高权限，不改动操作***的应用框架层，也无需修改目标应用程序的源文件，运行效率高。
在一种可能的实现方式中，所述第一访问请求例如可以为***调用请求，该***调用请求用于请求调用***所提供的接口来实现访问***资源。其中，***调用是指应用程序同***之间的接口，例如操作***向应用程序所提供的程序接口或应用编程接口(Application Programming Interface，API)。应用程序通过***调用来实现与操作***的通信，并获得操作***的服务。也就是说，应用程序可以通过发起***调用请求，来请求执行调用操作***所提供的接口，从而实现对***资源的访问。
在一种可能的实现方式中，在第二进程向目标应用程序返回代理描述符之后，目标应用程序可以基于该代理描述符，发起第二访问请求，所述第二访问请求包括所述代理描述符，以请求访问该代理描述符对应的***资源。因此，所述方法还包括：所述第一进程接收第二进程发送的第二访问请求，所述第二访问请求包括所述代理描述符，所述第二访问请求用于请求访问***资源。由于第一进程中建立有代理描述符与目标描述符的对应关系，因此第一进程可以通过查找对应关系的方式，获取到与代理描述符对应的目标描述符，该目标描述符用于第一进程后续执行第二访问请求。所述第一进程根据所述目标描述符执行所述第二访问请求，得到资源访问结果。所述第一进程向所述第二进程发送所述资源访问结果。
在一种可能的实现方式中，所述第一访问请求用于请求发起网络访问。第一进程执行所述第一访问请求得到的所述目标描述符则包括套接字描述符。其中，套接字是应用程序通过网络协议进行通信的接口。一般来说，当应用程序要为网络通信而创建一个套接字时，操作***就返回一个小整数作为描述符来标识这个套接字，这样，应用程序就能够使用这 个套接字描述符来引用该套接字，从而实现网络访问。也就是说，当第一进程执行请求发起网络访问的第一访问请求时，操作***向第一进程返回一个用于标识套接字的套接字描述符。
在第一进程向目标应用程序返回用于供执行网络访问的套接字描述符对应的代理描述符之后，目标应用程序可以继续发起用于请求与目标网络站点建立连接的第二访问请求。即所述第二访问请求包括代理描述符和目标网络站点的地址，所述第二访问请求用于请求访问所述目标网络站点。这样，所述第一进程根据第二访问请求中的代理描述符查找到对应的套接字描述符之后，第一进程根据所述套接字描述符和目标网络站点的地址执行所述第二访问请求，得到所述目标网络站点的访问结果。
在一种可能的实现方式中，在第一访问请求用于请求发起网络访问的情况下，所述第一进程为所述目标描述符分配代理描述符，包括：所述第一进程为所述目标描述符分配通道标识对，所述通道标识对包括第一通道标识和第二通道标识，所述通道标识对用于所述第一进程与所述目标应用程序之间的数据传输，所述套接字描述符与所述通道标识对具有对应关系。所述第一进程向所述第二进程发送所述代理描述符，具体包括：所述第一进程向所述第二进程发送所述第一通道标识。
这样，目标应用程序发起的第二访问请求中可以包括第一通道标识，所述第二访问请求则用于请求与目标网络站点建立连接。第一进程执行第二访问请求，实现与目标网络站点建立连接。在第一进程与目标网络站点建立连接之后，目标应用程序需要发送给目标网络站点的数据则可以基于第一通道标识对应的数据传输通道传输给第一进程，由第一进程基于相应的套接字描述符将数据转发给目标网络站点。类似地，目标网络站点向第一进程返回网络数据后，第一进程基于第二通道标识对应的数据传输通道向目标应用程序返回网络数据。其中，第一通道标识与第二通道标识对应于同一个数据传输通道，即第一进程和目标应用程序分别基于两个不同的通道标识来实现在相同的数据传输通道中互相传输数据。
本实施例中，第一进程通过分配通道标识对，并向目标应用程序返回通道标识对中的一个通道标识，使得第一进程与目标应用程序之间能够基于通道标识对所对应的通道实现互相通信。避免了由第二进程持续转发第一进程与目标应用程序之间所交互的大量网络数据，提高了数据传输的效率，并且目标应用程序与网络站点交互的数据通过独立的通道进行传输，保证了数据传输的可靠性。
在一种可能的实现方式中，目标应用程序发起的所述第一访问请求用于请求打开目标文件，所述第一进程执行所述第一访问请求后所得到的所述目标描述符包括目标文件描述符。那么，在目标应用程序接收到第一进程返回的代理描述符后，目标应用程序发起所述第二访问请求，且所述第二访问请求包括所述代理描述符，用于请求访问所述目标文件。所述第一进程根据所述目标描述符执行所述第二访问请求，得到资源访问结果，包括：所述第一进程根据所述目标文件描述符执行所述第二访问请求，得到所述目标文件的访问结果。
在一种可能的实现方式中，在第一进程为目标描述符分配代理描述符后，所述方法还 包括：所述第一进程为所述代理描述符建立***。所述第一进程获取所述***发送的消息，所述消息用于指示所述代理描述符被关闭。所述第一进程根据所述消息关闭与所述代理描述符对应的目标描述符。其中，***中的***用于监听某个事件(程序)的发生情况，当被监听的事件真的发生了的时候，事件发生者(即事件源)就会给注册该事件的***发送消息，从而告诉***某些信息。同时***也可以获得一份事件对象，根据这个对象可以获得相关属性和执行相关操作，例如***向注册***的进程发送回调信息。
本实施例中，第一进程通过建立代理文件描述符的***，可以及时监听到目标应用程序关闭代理文件描述符的行为，进而及时关闭代理文件描述符对应的目标描述符，实现***资源的及时回收。
在一种可能的实现方式中，在所述第一访问请求用于请求访问网络的情况下，所述第一进程为所述套接字描述符建立***。所述第一进程获取所述***发送的消息，所述消息用于指示所述套接字描述符被关闭。所述第一进程根据所述消息关闭与所述套接字描述符对应的代理描述符。
在目标应用程序访问网络的过程中，可能存在外部因素导致网络中断，从而使得目标应用程序无法访问网络。此时，为了及时回收***资源，第一进程可以通过***来监听套接字描述符，在套接字描述符被关闭的情况下，可以认为网络中断，因此触发第一进程关闭与套接字描述符对应的代理描述符，从而及时回收***资源。
在一种可能的实现方式中，所述访问请求包括所述目标应用程序的信息。所述方法还包括：所述第一进程根据所述目标应用程序的信息，对所述访问请求进行权限校验。其中，所述第一进程对所述访问请求进行权限校验的目的是确定所述第二进程中的目标应用程序是否具有请求执行所述访问请求的权限。在所述校验结果为所述目标应用程序具有访问权限的情况下，所述第一进程执行所述访问请求，得到访问结果。示例性地，所述目标应用程序发起的访问请求包括***调用号和所述目标应用程序的信息。其中，所述***调用号用于表示目标应用程序请求执行的***调用。所述目标应用程序的信息例如可以为目标应用程序的标识，该目标应用程序的标识用于标识所述目标应用程序的身份信息或标识所述目标应用程序所属的类型。
具体地，所述第一进程可以基于所述***调用号和所述目标应用程序的信息，查询终端中所配置的应用程序的访问权限信息。如果查询结果为目标应用程序具有访问所述***调用号对应的***调用的权限，则可以确定校验结果为目标应用程序具有访问权限；如果查询结果为目标应用程序不具有访问所述***调用号对应的***调用的权限，则可以确定校验结果为目标应用程序不具有访问权限。
本实施例中，通过将不可信的目标应用程序运行在没有访问外界环境权限的第二进程中，并由第二进程截获目标应用程序发起的访问请求。第二进程将截获到的访问请求转发给外部具有访问权限的第一进程，由第一进程确认目标应用程序的权限后，再执行访问请求，从而实现对目标应用程序的访问行为进行监控。由于第二进程中默认没有访问权限，因此只有在目标应用程序的访问请求被截获到，且目标应用程序具有访问权限的情况下， 才会执行该访问请求。这样一来，运行在第二进程中的恶意程序无法通过反拦截技术来获得访问***资源的权限，保证了***安全。
在一种可能的实现方式中，所述第二进程可以根据所述访问请求创建通道标识对，所述通道标识对包括第三通道标识和第四通道标识。然后，所述第二进程在来自于目标应用程序的访问请求中添加所述第三通道标识，并且向第一进程发送添加有所述第三通道标识的访问请求。即所述访问请求还包括第三通道标识，所述第三通道标识用于指示数据传输通道。所述第一进程向所述第二进程发送所述访问结果，包括：所述第一进程通过所述第三通道标识对应的数据传输通道，向所述第二进程发送所述访问结果。
本实施例中，在第二进程中运行有多个线程的情况下，为了保证多个线程之间的数据独立传输，第二进程为每一个线程创建一个独立的数据传输通道，每个独立的数据传输通道由通道标识对来标识。这样，第二进程从目标应用程序中的某一个线程截获到访问请求之后，第二进程可以在访问请求中携带该线程对应的通道标识，从而使得第一进程能够从该线程对应的数据传输通道中向第二进程返回数据，保证了不同线程间数据的隔离，有效地避免了数据错乱，保障了数据的传输可靠性。
在一种可能的实现方式中，在第二进程为线程创建独立的数据传输通道之后，第二进程还可以在访问请求中添加线程标识，该线程标识用于标识发起访问请求的线程，即第二进程在访问请求中添加线程标识以及通道标识。示例性地，在第二进程所发送的所述第一访问请求和所述第二访问请求还包括所述目标应用程序对应的线程标识。所述方法还包括：所述第一进程根据所述第一访问请求，建立所述第三通道标识与所述线程标识之间的对应关系；所述第一进程向所述第二进程发送所述资源访问结果，包括：所述第一进程根据所述第二访问请求中的所述线程标识，确定所述第三通道标识；所述第一进程通过所述第三通道标识对应的数据传输通道，向所述第二进程发送所述资源访问结果。也就是说，第一进程在后续接收到其他包括相同的线程标识的访问请求时，第一进程能够根据线程标识确定对应的通道标识，并且基于该通道标识发送后续的访问结果。
本申请第二方面提供一种访问控制方法，包括：第二进程获取来自于目标应用程序的访问请求，所述目标应用程序运行于所述第二进程中，所述第二进程不具有执行访问请求的权限；所述第二进程向第一进程发送所述访问请求，所述第一进程具有执行所述访问请求的权限；所述第二进程接收所述第一进程发送的代理描述符，所述代理描述符用于访问***资源；所述第二进程向所述目标应用程序发送所述代理描述符。
在一种可能的实现方式中，所述方法还包括：所述第二进程获取来自于所述目标应用程序的第二访问请求，所述第二访问请求包括所述代理描述符，所述第二访问请求用于请求访问***资源；所述第二进程向所述第一进程发送所述第二访问请求；所述第二进程接收所述第一进程发送的资源访问结果；所述第二进程向所述目标应用程序发送所述资源访问结果。
在一种可能的实现方式中，所述第一访问请求用于请求发起网络访问，所述第二访问请求还包括目标网络站点的地址，所述第二访问请求用于请求访问所述目标网络站点，所 述资源访问结果包括所述目标网络站点的访问结果。
在一种可能的实现方式中，所述代理描述符包括第一通道标识，所述第一通道标识用于所述第一进程与所述目标应用程序之间的数据传输。
在一种可能的实现方式中，所述第一访问请求用于请求打开目标文件，所述目标描述符包括目标文件描述符，所述第二访问请求用于请求访问所述目标文件，所述资源访问结果包括所述目标文件的访问结果。
在一种可能的实现方式中，所述方法还包括：所述第二进程根据所述访问请求创建通道标识对，所述通道标识对包括第三通道标识和第四通道标识，所述通道标识对用于第一进程与所述第二进程之间的数据传输；所述第二进程在所述访问请求中添加所述第三通道标识；所述第二进程向第一进程发送添加了所述第三通道标识的访问请求。
在一种可能的实现方式中，所述方法还包括：所述第二进程在所述访问请求中添加所述目标应用程序的信息；所述第二进程向第一进程发送添加了所述目标应用程序的信息的访问请求。
本申请第三方面提供一种终端，所述终端包括收发单元和处理单元。所述收发单元用于接收第二进程发送的访问请求，所述访问请求来自于运行在所述第二进程中的目标应用程序，所述第二进程不具有执行所述访问请求的权限；所述处理单元用于执行所述第一访问请求，得到用于访问***资源的目标描述符；所述处理单元还用于为所述目标描述符分配代理描述符，所述目标描述符与所述代理描述符具有对应关系；所述收发单元还用于向所述第二进程发送所述代理描述符。
在一种可能的实现方式中，所述收发单元还用于接收第二进程发送的第二访问请求，所述第二访问请求包括所述代理描述符，所述第二访问请求用于请求访问***资源；所述处理单元还用于获取与所述代理描述符对应的所述目标描述符；所述处理单元还用于根据所述目标描述符执行所述第二访问请求，得到资源访问结果；所述收发单元还用于向所述第二进程发送所述资源访问结果。
在一种可能的实现方式中，所述第一访问请求用于请求发起网络访问，所述目标描述符包括套接字描述符，所述第二访问请求还包括目标网络站点的地址，所述第二访问请求用于请求访问所述目标网络站点；所述处理单元还用于根据所述套接字描述符执行所述第二访问请求，得到所述目标网络站点的访问结果。
在一种可能的实现方式中，所述处理单元还用于为所述目标描述符分配通道标识对，所述通道标识对包括第一通道标识和第二通道标识，所述通道标识对用于所述第一进程与所述目标应用程序之间的数据传输，所述套接字描述符与所述通道标识对具有对应关系；所述收发单元还用于向所述第二进程发送所述第一通道标识。
在一种可能的实现方式中，所述第一访问请求用于请求打开目标文件，所述目标描述符包括目标文件描述符，所述第二访问请求用于请求访问所述目标文件；所述处理单元还用于根据所述目标文件描述符执行所述第二访问请求，得到所述目标文件的访问结果。
在一种可能的实现方式中，所述处理单元还用于为所述代理描述符建立***；所述 收发单元还用于获取所述***发送的消息，所述消息用于指示所述代理描述符被关闭；所述处理单元还用于根据所述消息关闭与所述代理描述符对应的目标描述符。
在一种可能的实现方式中，所述处理单元还用于为所述套接字描述符建立***；所述收发单元还用于获取所述***发送的消息，所述消息用于指示所述套接字描述符被关闭；所述处理单元还用于根据所述消息关闭与所述套接字描述符对应的代理描述符。
在一种可能的实现方式中，所述访问请求包括所述目标应用程序的信息；所述处理单元还用于根据所述目标应用程序的信息，对所述访问请求进行权限校验。
在一种可能的实现方式中，所述访问请求还包括第三通道标识，所述第三通道标识用于指示数据传输通道；所述收发单元还用于通过所述第三通道标识对应的数据传输通道，向所述第二进程发送所述访问结果。
在一种可能的实现方式中，所述第一访问请求和所述第二访问请求还包括所述目标应用程序对应的线程标识；所述处理单元还用于根据所述第一访问请求，建立所述第三通道标识与所述线程标识之间的对应关系；所述处理单元还用于根据所述第二访问请求中的所述线程标识，确定所述第三通道标识；所述收发单元还用于通过所述第三通道标识对应的数据传输通道，向所述第二进程发送所述资源访问结果。
本申请第四方面提供一种终端，包括：收发单元和处理单元。所述收发单元用于获取来自于目标应用程序的访问请求，所述目标应用程序运行于第二进程中，所述第二进程不具有执行访问请求的权限；所述处理单元用于向第一进程发送所述访问请求，所述第一进程具有执行所述访问请求的权限；所述收发单元还用于接收所述第一进程发送的代理描述符，所述代理描述符用于访问***资源；所述收发单元还用于向所述目标应用程序发送所述代理描述符。
在一种可能的实现方式中，所述收发单元还用于：获取来自于所述目标应用程序的第二访问请求，所述第二访问请求包括所述代理描述符，所述第二访问请求用于请求访问***资源；向所述第一进程发送所述第二访问请求；所述第二进程接收所述第一进程发送的资源访问结果；所述第二进程向所述目标应用程序发送所述资源访问结果。
在一种可能的实现方式中，所述第一访问请求用于请求发起网络访问，所述第二访问请求还包括目标网络站点的地址，所述第二访问请求用于请求访问所述目标网络站点，所述资源访问结果包括所述目标网络站点的访问结果。
在一种可能的实现方式中，所述代理描述符包括第一通道标识，所述第一通道标识用于所述第一进程与所述目标应用程序之间的数据传输。
在一种可能的实现方式中，所述第一访问请求用于请求打开目标文件，所述目标描述符包括目标文件描述符，所述第二访问请求用于请求访问所述目标文件，所述资源访问结果包括所述目标文件的访问结果。
在一种可能的实现方式中，所述处理单元还用于根据所述访问请求创建通道标识对，所述通道标识对包括第三通道标识和第四通道标识，所述通道标识对用于第一进程与所述第二进程之间的数据传输；所述处理单元还用于在所述访问请求中添加所述第三通道标识； 所述收发单元还用于向第一进程发送添加了所述第三通道标识的访问请求。
在一种可能的实现方式中，所述处理单元还用于在所述访问请求中添加所述目标应用程序的信息；所述收发单元还用于向第一进程发送添加了所述目标应用程序的信息的访问请求。
本申请第五方面提供一种终端，该终端包括：处理器、非易失性存储器和易失性存储器；其中，非易失性存储器或易失性存储器中存储有计算机可读指令；处理器读取计算机可读指令以使终端实现如第一方面或第二方面中的任意一种实现方式的方法。
本申请第六方面提供一种计算机可读存储介质，计算机可读存储介质中存储有计算机程序，当其在计算机上运行时，使得计算机执行如第一方面或第二方面中的任意一种实现方式的方法。
本申请第七方面提供一种计算机程序产品，当其在计算机上运行时，使得计算机执行如第一方面或第二方面中的任意一种实现方式的方法。
本申请第八方面提供一种芯片，包括一个或多个处理器。处理器中的部分或全部用于读取并执行存储器中存储的计算机程序，以执行上述任一方面任意可能的实现方式中的方法。
可选地，该芯片该包括存储器，该存储器与该处理器通过电路或电线与存储器连接。可选地，该芯片还包括通信接口，处理器与该通信接口连接。通信接口用于接收需要处理的数据和/或信息，处理器从该通信接口获取该数据和/或信息，并对该数据和/或信息进行处理，并通过该通信接口输出处理结果。该通信接口可以是输入输出接口。本申请提供的方法可以由一个芯片实现，也可以由多个芯片协同实现。
附图说明
图1为本申请实施例提供的一种终端101的结构示意图；
图2为本申请实施例提供的一种应用场景的示意图；
图3为本申请实施例提供的一种访问控制方法300的流程示意图；
图4为本申请实施例提供的一种访问控制方法400的流程示意图；
图5a为本申请实施例提供的一种访问控制方法500的流程示意图；
图5b为本申请实施例提供的一种访问控制方法500的另一个流程示意图；
图6a为本申请实施例提供的一种访问控制方法600的流程示意图；
图6b为本申请实施例提供的一种访问控制方法600的另一个流程示意图；
图7为本申请实施例提供的一种访问控制方法700的流程示意图；
图8为本申请实施例提供的一种访问控制方法800的流程示意图；
图9为本申请实施例提供的一种进程间执行访问控制的流程示意图；
图10为本申请实施例提供的一种终端1000的结构示意图；
图11为本申请实施例提供的一种计算机程序产品1100的结构示意图。
具体实施方式
下面结合附图，对本申请的实施例进行描述，显然，所描述的实施例仅仅是本申请一部分的实施例，而不是全部的实施例。本领域普通技术人员可知，随着技术的发展和新场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的实施例能够以除了在这里图示或描述的内容以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或模块的过程、方法、***、产品或设备不必限于清楚地列出的那些步骤或模块，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或模块。在本申请中出现的对步骤进行的命名或者编号，并不意味着必须按照命名或者编号所指示的时间/逻辑先后顺序执行方法流程中的步骤，已经命名或者编号的流程步骤可以根据要实现的技术目的变更执行次序，只要能达到相同或者相类似的技术效果即可。
沙箱是一种按照安全策略限制程序行为的执行环境，能够为运行中的应用程序提供隔离环境。沙箱环境通常用于执行未经测试或不受信任的第三方应用程序的代码，而不会损害操作***。
相关技术中，通过将不可信应用运行在沙箱中，并截获不可信应用所发起的特定访问请求，来限制不可信应用对本地用户数据或操作***资源的访问。然而，相关技术中完全依赖于拦截技术来确保沙箱环境的安全性。对于部分采用了反拦截技术的恶意程序，相关技术中可能难以截获到恶意程序所发起的访问请求，从而导致***安全得不到保障。
有鉴于此，本申请实施例提供了一种访问控制方法，该方法可以应用于终端中。通过将终端中的不可信应用运行在没有访问权限的隔离进程中，并由隔离进程截获不可信应用发起的访问请求。隔离进程将截获到的访问请求转发给外部的进程，由外部的进程确认不可信应用的权限后，再执行访问请求。由于隔离进程中默认没有访问权限，因此只有在不可信应用的访问请求被截获到，且不可信应用具有访问权限的情况下，才执行该访问请求。通过本方案，恶意程序无法通过反拦截技术来获得访问权限，保证了***安全。
本申请实施例所涉及的终端可以为具有能够运行隔离进程的终端。示例性地，该终端例如可以是个人电脑(personal computer，PC)、笔记本电脑、服务器、手机(mobile phone)、平板电脑、移动互联网设备(mobile internet device，MID)、可穿戴设备，虚拟现实(virtual reality，VR)设备、增强现实(augmented reality，AR)设备、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程手术(remote medical surgery)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端等。该终端可以是运行安卓***、IOS***、windows***以及其他***的设备。为便于理解，以下将以终端为运行安卓***的智能手机为例，对本申请实施例提供的访问控制方法进行介绍。
可以参阅图1，图1为本申请实施例提供的一种终端101的结构示意图。如图1所示，终端101包括处理器103，处理器103和***总线105耦合。处理器103可以是一个或者多个处理器，其中每个处理器都可以包括一个或多个处理器核。显示适配器(video adapter)107，显示适配器可以驱动显示器109，显示器109和***总线105耦合。***总线105通过总线桥111和输入输出(I/O)总线耦合。I/O接口115和I/O总线耦合。I/O接口115和多种I/O设备进行通信，比如输入设备117(如：触摸屏等)，多媒体盘(media tray)121,(例如，只读光盘(compact disc read-only memory，CD-ROM)，多媒体接口等)。收发器123(可以发送和/或接收无线电通信信号)，摄像头155(可以捕捉静态和动态数字视频图像)和外部USB端口125。其中，可选地，和I/O接口115相连接的接口可以是USB接口。
其中，处理器103可以是任何传统处理器，包括精简指令集计算(reduced instruction set Computing，RISC)处理器、复杂指令集计算(complex instruction set computing，CISC)处理器或上述的组合。可选地，处理器可以是诸如ASIC的专用装置。
终端101可以通过网络接口129和软件部署服务器149通信。示例性的，网络接口129是硬件网络接口，比如，网卡。网络127可以是外部网络，比如因特网，也可以是内部网络，比如以太网或者虚拟私人网络(virtual private network，VPN)。可选地，网络127还可以是无线网络，比如WiFi网络，蜂窝网络等。
硬盘驱动器接口131和***总线105耦合。硬件驱动接口和硬盘驱动器133相连接。***内存135和***总线105耦合。运行在***内存135的数据可以包括终端101的操作***(OS)137、应用程序143和调度表。
操作***包括Shell 139和内核(kernel)141。Shell 139是介于使用者和操作***的内核间的一个接口。shell是操作***最外面的一层。shell管理使用者与操作***之间的交互：等待使用者的输入，向操作***解释使用者的输入，并且处理各种各样的操作***的输出结果。
内核141由操作***中用于管理存储器、文件、外设和***资源的那些部分组成。内核141直接与硬件交互，操作***内核通常运行进程，并提供进程间的通信，提供CPU时间片管理、中断、内存管理和IO管理等等。
示例性地，在终端101为服务器的情况下，应用程序143包括云计算相关的程序。在一个实施例中，在需要执行应用程序143时，终端101可以从软件部署服务器149下载应用程序143。在一个实施例中，在终端101从软件部署服务器149下载应用程序143时，终端101也可以从软件部署服务器149下载与该应用程序143对应的调度表。
可以参阅图2，图2为本申请实施例提供的一种应用场景的示意图。如图2所示，终端中运行有宿主进程和隔离进程，不可信应用程序运行在隔离进程中。运行在隔离进程中的不可信应用程序没有访问终端中的资源(例如终端中的***资源或用户个人数据)的权限。当不可信应用程序发起访问网络或文件目录等资源的访问请求时，隔离进程截获不可信应用程序发起的访问请求，并且向宿主进程发送截获到的访问请求。宿主进程对访问请 求进行权限校验，在访问请求通过权限校验时，宿主进程执行宿主访问请求，并向隔离进程返回相应的访问结果。隔离进程再将接收到的访问结果返回给不可信应用程序。在访问请求不通过权限校验时，宿主进程则不执行该访问请求，并向隔离进程返回错误码。通过将不可信应用程序运行在隔离进程中，并且由宿主进程代理不可信应用程序的访问请求，能够实现监控不可信应用程序对网络或文件目录等资源的访问行为，防止恶意程序干扰***的正常运行。此外，由于隔离进程中默认没有任何的访问权限，因此不可信应用在通过反拦截技术绕开隔离进程对访问请求的拦截之后，不可信应用也无法顺利执行该访问请求。通过本方案，恶意程序无法通过反拦截技术来获得访问权限，保证了***安全。
可以参阅图3，图3为本申请实施例提供的一种访问控制方法300的流程示意图。如图3所示，该方法300包括以下的步骤301-306。
步骤301，第二进程获取来自于目标应用程序的访问请求，所述目标应用程序运行于所述第二进程中，所述第二进程不具有执行访问请求的权限。
本实施例中，终端中运行有第一进程和第二进程，第一进程和第二进程之间可以互相进行通信。第一进程具有访问终端中的资源(例如***资源或用户个人数据)的权限，第二进程则不具有访问外界环境的权限。因此，第二进程可以将获取到的访问请求，转发给第一进程，由第一进程代理执行访问请求。
示例性地，第一进程例如可以为安卓***中的宿主进程，第二进程例如可以为安卓***中的隔离进程。宿主进程用于与隔离进程建立连接，管控和代理隔离进程对外界的访问行为。隔离进程是安卓***中的一种特殊进程，运行在隔离进程中的应用程序或服务没有访问外界环境的权限，即这部分应用程序或服务与***中的其余部分隔离。
第二进程中可以运行有一个或多个应用程序，目标应用程序可以为第二进程中的任意一个应用程序。当目标应用程序需要访问***中的资源时，例如网络、文件目录或特定路径下的文件等***资源，目标应用程序发起访问请求，该访问请求用于请求访问***中的资源。其中，***资源是指终端中的软件资源、硬件资源以及终端所存储的数据资源。
一般地，在***的底层实现中，通常需要通过调用***所提供的接口来实现访问***资源。因此，该访问请求例如可以为***调用请求。其中，***调用是指应用程序同***之间的接口，例如操作***向应用程序所提供的程序接口或应用编程接口(Application Programming Interface，API)。应用程序通过***调用来实现与操作***的通信，并获得操作***的服务。也就是说，应用程序可以通过发起***调用请求，来请求执行调用操作***所提供的接口，从而实现对***资源的访问。
在目标应用程序发起访问请求的情况下，第二进程通过截获访问请求的方式，来获取来自于目标应用程序的访问请求。示例性地，在第二进程中可以预先配置有多个***调用号(system call number)，当第二进程识别到目标应用程序发起的访问请求中包括相同的***调用号时，则截获该访问请求。应理解，由于操作***中实现了很多不同的***调用，因此应用程序在发起***调用请求时需要传递一个名为***调用号的参数，以便于识别应用程序所需的***调用。也就是说，***调用号用于标识应用程序所请求执行的***调用的类型。
步骤302，所述第二进程向第一进程发送所述访问请求，所述第一进程具有执行所述访问请求的权限。
由于第二进程不具有执行访问请求的权限，而第一进程具有执行访问请求的权限，因此第二进程可以通过进程间通信方式，向第一进程发送来自于目标应用程序的访问请求。
其中，第二进程与第一进程之间的进程间通信方式可以有多种，例如管道通信方式、消息队列通信方式或共享内存通信方式。示例性地，第一进程与第二进程之间可以预先建立有命令传输通道，第二进程可以通过建立好的命令传输通道向第一进程发送访问请求。例如，第一进程和第二进程在初始化之后，第一进程创建命令传输通道，并且向第二进程发送该命令传输通道的标识。第二进程根据接收到的命令传输通道的标识，可以实现通过命令传输通道向第一进程发送访问请求。
在一个可能的实施例中，第二进程在获取到来自于目标应用程序的访问请求后，第二进程可以在访问请求添加目标应用程序的信息，例如目标应用程序的标识，得到新的访问请求。然后，第二进程再向第一进程发送新的访问请求，新的访问请求中包括目标应用程序的信息，以便于第一进程对新的访问请求进行权限校验。应理解，第二进程在访问请求中所添加的目标程序的信息可以是目标应用程序本身的固有信息，例如目标应用程序在开发时所设定的标识或名称。第二进程在访问请求中所添加的目标程序的信息还可以是第二进程或第一进程为所述目标应用程序所分配的标识，例如在第一进程和第二进程的初始化过程中，第一进程或第二进程可以为需要在第二进程中运行的目标应用程序分配一个唯一的标识，第一进程可以根据访问请求中所携带的应用程序的标识来确定发起访问请求的应用程序。
在一个可能的实施例中，所述第二进程可以根据所述访问请求创建通道标识对，所述通道标识对包括第三通道标识和第四通道标识。然后，所述第二进程在来自于目标应用程序的访问请求中添加所述第三通道标识，并且向第一进程发送添加有所述第三通道标识的访问请求。其中，所述通道标识对与一个数据传输通道对应，用于第一进程与所述第二进程之间的数据传输。当第一进程接收到添加有第三通道标识的访问请求之后，所述第一进程基于第三通道标识，在第三通道标识对应的数据传输通道中写入需要返回的数据。这样，第二进程能够基于第四通道标识，获取到第一进程所返回的数据。
可以理解的是，第二进程中所运行的目标应用程序可能同时运行有多个线程。为了保证多个线程之间的数据独立传输，第二进程可以为每一个线程创建一个独立的数据传输通道，每个独立的数据传输通道由通道标识对来标识。这样，第二进程从目标应用程序中的某一个线程截获到访问请求之后，第二进程可以在访问请求中携带该线程对应的通道标识，从而使得第一进程能够从该线程对应的数据传输通道中向第二进程返回数据，保证了不同线程间数据的隔离，有效地避免了数据错乱，保障了数据的传输可靠性。
此外，在第二进程为线程创建独立的数据传输通道之后，第二进程还可以在访问请求中添加线程标识，该线程标识用于标识发起访问请求的线程，即第二进程在访问请求中添加线程标识以及通道标识。第一进程在接收到包括线程标识和通道标识的访问请求之后，建立线程标识与通道标识之间的对应关系。这样，第一进程在后续接收到其他包括相同的 线程标识的访问请求时，第一进程能够根据线程标识确定对应的通道标识，并且基于该通道标识发送后续的访问结果。
也就是说，第二进程在获取到来自于目标应用程序的访问请求后，可以在访问请求中添加目标应用程序的信息以及第二进程所分配的数据传输通道的标识。访问请求中的目标应用程序的信息用于第一进程对访问请求进行权限校验，访问请求中的数据传输通道的标识则用于第一进程返回执行访问请求的结果。
步骤303，所述第一进程对所述访问请求进行权限校验，得到校验结果。
本实施例中，终端中可以配置有应用程序的访问权限信息。示例性地，应用程序的访问权限信息可以包括终端的多个应用程序中的每个应用程序对应的访问权限，例如应用程序A具有访问网络资源的权限、应用程序B不具有访问网络资源的权限、应用程序C具有访问***文件目录的权限等访问权限信息。应用程序的访问权限信息还可以包括应用程序类型对应的访问权限，例如类型A的应用程序具有访问网络资源的权限、类型B的应用程序不具有访问网络资源的权限、类型C不具有访问***文件目录的权限等访问权限信息。第一进程通过获取终端中所配置的应用程序的访问权限信息，对访问请求进行权限校验，以得到校验结果。
示例性地，第二进程所发送的访问请求中包括***调用号和所述目标应用程序的信息，所述***调用号用于表示目标应用程序请求执行的***调用，所述目标应用程序的信息例如可以为目标应用程序的标识，用于标识所述目标应用程序的身份信息或标识所述目标应用程序所属的类型。这样，所述第一进程可以根据所述***调用号和所述目标应用程序的信息进行权限校验。具体地，所述第一进程可以基于所述***调用号和所述目标应用程序的信息，查询终端中所配置的应用程序的访问权限信息。如果查询结果为目标应用程序具有访问所述***调用号对应的***调用的权限，则可以确定校验结果为目标应用程序具有访问权限；如果查询结果为目标应用程序不具有访问所述***调用号对应的***调用的权限，则可以确定校验结果为目标应用程序不具有访问权限。
步骤304，基于所述校验结果为所述目标应用程序具有访问权限，所述第一进程执行所述访问请求，得到用于访问***资源的目标描述符。
在校验结果为目标应用程序具有访问权限的情况下，第一进程可以代理执行该访问请求，从而得到用于访问***资源的目标描述符。在校验结果为目标应用程序不具有访问权限的情况下，第一进程可以终止执行该访问请求。其中，目标描述符是一个指向***资源的抽象化概念，能够用于标识***资源。应用程序通过该目标描述符能够实现访问对应的***资源。
步骤305，所述第一进程为所述目标描述符分配代理描述符，所述目标描述符与所述代理描述符具有对应关系。
本实施例中，在第二进程作为隔绝外界环境的隔离进程的情况下，受限于隔离进程本身的限制，第一进程通常无法直接向第二进程返回直接指向***资源的目标描述符(例如套接字描述符或文件描述符)。因此，第一进程可以为所述目标描述符分配一个代理描述符，该代理描述符与目标描述符具有对应关系。第一进程能够根据代理描述符查找唯一对应的 目标描述符。
步骤306，所述第一进程向所述第二进程发送所述代理描述符。
在第二进程发送的访问请求中包括第三通道标识的情况下，第一进程可以基于该第三通道标识对应的数据传输通道向第二进程发送代理描述符，以实现不同线程间的数据的隔离。
步骤307，所述第二进程向所述目标应用程序发送所述代理描述符。
本实施例中，第二进程在接收到第一进程返回的访问结果后，第二进程向目标应用程序转发第一进程所返回的访问结果。
本实施例中，第一进程在执行来自于不可信应用的访问请求并获得指向***资源的目标描述符时，第一进程为目标描述符分配对应的代理描述符，并经由第二进程向不可信应用返回代理描述符。这样，第二进程中的不可信应用能够获得与目标描述符对应的代理描述符，并基于代理描述符实现***资源的访问。并且，不可信应用通过代理描述符访问***资源时，必须经由第一进程将代理描述符替换为目标描述符，才能够完成对***资源的访问。即第一进程通过避免直接将目标描述符返回给不可信应用，确保不可信应用访问***资源的行为能够得到有效的监控，在实现不可信应用访问***资源的同时，保障了***的安全性。
可以参阅图4，图4为本申请实施例提供的一种访问控制方法400的流程示意图。如图4所示，该方法400包括以下的步骤401-410。
步骤401，第二进程向第一进程发送第一***调用请求。
本实施例中，第二进程从目标应用程序截获到的访问请求具体为第一***调用请求，该第一***调用请求用于请求调用***中所提供的接口。其中，第二进程不具有执行***调用请求的权限，第一进程具有执行***调用请求的权限。
示例性地，在目标应用程序需要访问网络资源的情况下，所述第一***调用请求例如可以是用于请求发起网络访问；在目标应用程序需要访问终端目录下的文件的情况下，所述第一***调用请求例如可以是用于请求打开目录文件。
步骤402，第一进程执行第一***调用请求，得到用于访问***资源的目标描述符。
第一进程在接收到第一***调用请求之后，对第一***调用请求进行解析以及权限校验。在第一***调用请求通过权限校验后，第一进程则执行第一***调用请求，得到目标描述符。
示例性地，在第一***调用请求用于请求发起网络访问时，所述目标描述符可以为套接字(socket)描述符。其中，套接字是网络中不同主机上的应用进程之间进行双向通信的端点的抽象，即套接字是应用程序通过网络协议进行通信的接口。一般来说，当应用程序要为网络通信而创建一个套接字时，操作***就返回一个小整数作为描述符来标识这个套接字，这样，应用程序就能够使用这个套接字描述符来引用该套接字，从而实现网络访问。也就是说，当第一进程执行请求发起网络访问的第一***调用请求时，操作***向第一进程返回一个用于标识套接字的套接字描述符。
示例性地，在第一***调用请求用于请求访问文件时，所述目标描述符可以为文件描述符。文件描述符在形式上是一个非负整数。实际上，文件描述符是一个索引值，指向操作***为每一个进程所维护的该进程打开文件的记录表。当进程打开一个现有文件或者创建一个新文件时，操作***则向进程返回一个文件描述符来标识进程所打开或创建的文件，进程也需要使用文件描述符来指定待读写的文件。也就是说，当第一进程执行请求访问文件的第一***调用请求时，操作***向第一进程返回一个用于标识套接字的套接字描述符。
步骤403，所述第一进程为所述目标描述符分配代理描述符，所述目标描述符与所述代理描述符具有对应关系。
本实施例中，在第二进程作为隔绝外界环境的隔离进程的情况下，受限于隔离进程本身的限制，第一进程通常无法直接向第二进程返回直接指向***资源的目标描述符(例如套接字描述符或文件描述符)。因此，第一进程可以为所述目标描述符分配一个代理描述符，该代理描述符与目标描述符具有对应关系。第一进程能够根据代理描述符查找唯一对应的目标描述符。
步骤404，所述第一进程向所述第二进程发送所述代理描述符。
在为目标描述符分配了对应的代理描述符之后，第一进程则向第二进程发送代理描述符作为第一***调用请求的响应结果。
步骤405，第二进程向目标应用程序发送所述代理描述符。
步骤406，第二进程向第一进程发送第二***调用请求。
在第二进程向目标应用程序返回代理描述符之后，目标应用程序可以基于该代理描述符，发起第二***调用请求，所述第二***调用请求包括所述代理描述符，以请求访问该代理描述符对应的***资源。示例性地，在第一***调用请求用于请求发起网络访问的情况下，目标应用程序可以基于代理描述符发起用于请求建立网络连接的第二***调用请求。在第一***调用请求用于请求打开目录文件的情况下，目标应用程序可以基于代理描述符发起用于请求遍历目录文件的第二***调用请求。
因此，第二进程在截获到来自于目标应用程序的第二***调用请求之后，第二进程同样向第一进程发送第二***调用请求。具体地，第二进程在发送第二***调用请求之前，第二进程可以在第二***调用请求中添加目标应用程序中发起第二***调用请求的线程的标识，以便于第一进程能够基于与线程标识对应的数据传输通道，向第二进程返回执行第二***调用请求所得到的结果。
步骤407，所述第一进程获取与所述代理描述符对应的所述目标描述符。
第一进程在接收到包括代理描述符的第二***调用请求后，第一进程解析该第二***调用请求，得到第二***调用请求中的代理描述符。然后，由于第一进程中建立有代理描述符与目标描述符的对应关系，因此第一进程可以通过查找对应关系的方式，获取到与代理描述符对应的目标描述符，该目标描述符用于第一进程后续执行第二***调用请求。
步骤408，所述第一进程根据所述目标描述符执行所述第二***调用请求，得到资源访问结果。
可以理解的是，在第一进程查找到第二***调用请求中的代理描述符对应的目标描述 符之后，第一进程则能够基于目标描述符来执行第二***调用请求，得到资源访问结果。示例性地，在第二***调用请求用于请求建立网络连接时，第一进程可以基于代理描述符对应的套接字描述符与相应的网络站点建立连接，并得到由网络站点所返回的表示连接成功的状态信息，该状态信息即为所得到的资源访问结果。在第一***调用请求用于请求遍历目录文件的情况下，目标应用程序可以基于目标描述符实现对目录文件的遍历，得到目录文件的遍历结果，该目录文件的遍历结果即为所得到的资源访问结果。
在一个可能的实施例中，由于第一进程能够查找到第二***调用中的代理描述符对应的目标描述符，则代表第一进程对目标应用程序执行过权限校验且校验结果为通过。因为只有在权限校验通过的情况下，目标应用程序才能够获取到与目标描述符对应的代理描述符。因此，第一进程可以不再对第二***调用请求执行权限校验，以节省资源开销。
步骤409，所述第一进程向所述第二进程发送所述资源访问结果。
步骤410，第二进程向目标应用程序发送所述资源访问结果。
类似地，第一进程在获得资源访问结果之后，将资源访问结果返回给第二进程，以使得第二进程进一步将资源访问结果转发给目标应用程序。其中，步骤409-410与上述的步骤305-306类似，具体可以参考上述的步骤305-306，在此不再赘述。
本实施例中，第一进程在执行***调用请求并获得指向***资源的目标描述符时，第一进程为目标描述符分配对应的代理描述符，并向第二进程返回代理描述符。这样，第二进程中的不可信应用仅获得与目标描述符对应的代理描述符，不可信应用基于代理描述符发起访问***资源的行为时，必须经由第一进程将代理描述符替换为目标描述符，才能够完成对***资源的访问。也就是说，第一进程通过避免直接将目标描述符返回给不可信应用，确保不可信应用访问***资源的行为能够得到有效的监控，保障了***的安全性。
以上介绍了第一进程和第二进程对***调用请求进行访问控制的过程，为了便于理解，以下将结合具体例子介绍第一进程和第二进程对不同的***调用请求进行访问控制的过程。
可以参阅图5a，图5a为本申请实施例提供的一种访问控制方法500的流程示意图。如图5a所示，该方法500包括以下的步骤501-510。
步骤501，目标应用程序中的线程1发起***调用请求1，该***调用请求1用于请求发起网络访问。
目标应用程序在第二进程中运行的过程中，目标应用程序创建线程1。在线程1的运行过程中，当线程1需要请求访问网络时，线程1发起***调用请求1，该***调用请求1用于请求发起网络访问。示例性地，该***调用请求1中具体可以包括***调用号，该***调用号对应的名称为socket，即***调用请求1用于请求以供进行网络访问的套接字。
步骤502，第二进程截获来自于目标应用程序中的线程1的***调用请求1。
由于***调用请求1中包括请求发起网络访问的***调用号，因此第二进程可以根据***调用号截获到截获来自于目标应用程序中的线程1的***调用请求1。
步骤503，第二进程为线程1创建数据传输通道1。
为了保证第一进程后续返回给线程1的数据能够独立传输，第二进程可以为线程1创建独立的数据传输通道1。该数据传输通道1可以理解为一个数据回传通道，第一进程可以将回传给第二进程的数据通过数据传输通道1来传输。示例性地，第二进程在创建数据传输通道1后，可以得到数据传输通道1对应的一对通道标识，例如上述实施例所述的第三通道标识和第四通道标识。第二进程可以将数据传输通道1对应的一对通道标识中的一个通道标识发送给第一进程。这样，当第一进程通过其中的一个通道标识在数据传输通道1中写入数据时，第二进程能够通过另一个通道标识在数据传输通道1中读取到第一进程所写入的数据，即实现数据的传输。
步骤504，第二进程在***调用请求1中添加数据传输通道1的标识和线程1的标识，得到***调用请求2。
第二进程在***调用请求1中所添加的数据传输通道1的标识为一个通道标识，即数据传输通道1对应的一对通道标识中的其中一个通道标识，例如上述实施例所述的第三通道标识。
此外，第二进程还可以在***调用请求1中添加目标应用程序的信息，例如目标应用程序的标识，该目标应用程序的标识用于标识所述目标应用程序的身份信息或标识所述目标应用程序所属的类型。其中，目标应用程序的标识例如可以为目标应用程序在开发时所设定的唯一标识或名称；目标应用程序的标识例如还可以为第二进程或第一进程为所述目标应用程序所分配的标识。
步骤505，第二进程向第一进程发送***调用请求2。
步骤506，第一进程解析***调用请求2，并对***调用请求2进行权限校验。
由于***调用请求2中包括有***调用号以及目标应用程序的信息，因此第一进程可以基于***调用号以及目标应用程序的信息对***调用请求2进行权限校验，以确定目标应用程序是否具有申请执行***调用请求2的权限。
此外，第一进程在解析***调用请求2后，第一进程能够得到***调用请求2中的数据传输通道1的标识和线程1的标识，第一进程为数据传输通道1的标识和线程1的标识建立对应关系，以便于后续接收到包括线程1的标识的其他请求时，能够确定对应的数据传输通道1。
步骤507，在***调用请求2通过权限校验后，第一进程执行***调用请求2，得到套接字描述符。
由于***调用请求2用于请求发起网络访问，因此第一进程执行***调用请求2之后，能够得到操作***所返回的供执行网络访问的套接字描述符。
步骤508，第一进程为套接字描述符分配通道标识对，该通道标识对包括通道标识1和通道标识2。
其中，第一进程所分配的通道标识对用于所述第一进程与所述目标应用程序之间的数据传输。通道标识对包括通道标识1和通道标识2，例如可以为上述实施例所述的第一通道标识和第二通道标识。在分配通道标识对之后，第一进程还可以建立所述套接字描述符与所述通道标识对之间的对应关系，例如将所述套接字描述符与所述通道标识对保存到一 个映射表中，以便于第一进程能够根据通道标识对中的任意一个通道标识查找到对应的套接字描述符。
步骤509，第一进程向第二进程发送通道标识1。
在第一进程为套接字描述符分配了通道标识对之后，第一进程则向第二进程返回通道标识对中的一个通道标识，例如通道标识1。具体地，第一进程可以根据***调用请求2中的数据传输通道1的标识来向第二进程发送通道标识1，即第一进程通过数据传输通道1来传输所述通道标识1。
步骤510，第二进程向目标应用程序的线程1发送通道标识1。
第二进程通过数据传输通道1接收到通道标识1之后，第二进程则向目标应用程序的线程1返回通道标识1，以使得线程1能够基于通道标识1发起建立网络连接的请求。
可以参阅图5b，图5b为本申请实施例提供的一种访问控制方法500的另一个流程示意图。如图5b所示，该方法500还包括以下的步骤511-521。
步骤511，第二进程截获来自于目标应用程序中的线程1的***调用请求3。
对于线程1来说，第一进程所返回的通道标识1实际上相当于一个套接字描述符，即线程1可以采用通道标识1来访问网络。当线程1获取到通道标识1之后，如果线程1需要访问某一个网络站点，线程1还需要基于通道标识1请求与待访问的网络站点建立连接。因此，线程1可以发起***调用请求3，该该***调用请求3中包括通道标识1和网络站点的地址，该***调用请求3用于请求与该网络站点建立连接。示例性地，该***调用请求3中具体可以包括***调用号和用于执行***调用请求3的参数(即网络站点的地址)，该***调用号对应的名称为connect(连接)，即***调用请求3用于请求与网络站点建立连接。
步骤512，第二进程在***调用请求3中添加线程1的标识，得到***调用请求4。
为了便于第一进程确定发起***调用请求的线程，第二进程可以在***调用请求3中添加线程1的标识，得到***调用请求4。
在一个可能的实施例中，由于***调用请求3中包括了通道标识1，且通道标识1与套接字描述符建立了对应关系，因此第一进程实际上也可以通过通道标识1来确定发起***调用请求的线程。因此，第二进程也可以是不需要在***调用请求3中添加线程1的标识。
步骤513，第二进程向第一进程发送***调用请求4。
步骤514，第一进程根据***调用请求4中的通道标识1，查找得到对应的套接字描述符。
由于第一进程建立了通道标识对与套接字描述符之间的对应关系，例如上述实施例所述的映射表，因此第一进程在解析***调用请求4并得到通道标识1之后，第一进程基于该通道标识1能够查找得到对应的套接字描述符。
步骤515，第一进程根据套接字描述符执行***调用请求4，得到与网络站点之间的连接状态信息。
第一进程在解析***调用请求4后，第一进程还可以获得***调用请求4所包括的参数，即上述的网络站点的地址。这样，第一进程可以基于套接字描述符以及网络站点的地址执行***调用请求4，即与网络站点建立连接。在第一进程与网络站点建立连接成功后，第一进程能够接收到网络站点所返回的连接状态信息，该连接状态信息用于表示网络连接成功。
步骤516，第一进程为通道标识1建立***。
本实施例中，在第一进程基于套接字描述符与网络站点成功建立连接之后，第一进程作为网络站点与目标应用程序的线程1之间的代理者，负责将来自于线程1的数据转发给网络站点，以及将来自于网络站点的数据转发给线程1。其中，通道标识1和通道标识2对应的通道即为第一进程与线程1之间进行数据传输的通道。由于通道标识以及套接字描述符的资源有限，在线程1不需要执行网络访问时，线程1会关闭通道标识1，以释放***资源。因此，为了及时识别到线程1对通道标识1的关闭操作，第一进程可以为通道标识1建立***。当线程1关闭通道标识1时，第一进程会接收到***所返回的回调信息，该回调信息能够指示线程1已关闭通道标识1。
此外，第一进程还可以为所述套接字描述符建立***。这样，在套接字描述符被关闭时，所述第一进程能够获取***发送的消息，所述消息用于指示所述套接字描述符被关闭。所述第一进程则根据所述消息关闭与所述套接字描述符对应的代理描述符。
可以理解的是，在目标应用程序访问网络的过程中，可能存在外部因素导致网络中断，从而使得目标应用程序无法访问网络。此时，为了及时回收***资源，第一进程可以通过***来监听套接字描述符，在套接字描述符被关闭的情况下，可以认为网络中断，因此触发第一进程关闭与套接字描述符对应的代理描述符，从而及时回收***资源。
其中，***中的***用于监听某个事件(程序)的发生情况，当被监听的事件真的发生了的时候，事件发生者(即事件源)就会给注册该事件的***发送消息，从而告诉***某些信息。同时***也可以获得一份事件对象，根据这个对象可以获得相关属性和执行相关操作，例如***向注册***的进程发送回调信息。
步骤517，第一进程向第二进程发送连接状态信息。
在第一进程获取到网络站点返回的连接状态信息之后，第一进程可以通过与线程1对应的数据传输通道1向第二进程发送连接状态信息。例如，在第二进程所发送的***调用请求4包括线程1的标识时，第一进程根据线程1的标识查找对应的数据传输通道，从而基于查找得到的数据传输通道1发送连接状态信息。
步骤518，第二进程向目标应用程序的线程1发送连接状态信息。
本实施例中，在第二进程向目标应用程序的线程1返回连接状态信息之后，线程1可以确定与网络站点之间的连接已经成功。因此，线程1可以基于通道标识1与网络站点交互数据。
例如，当线程1需要向网络站点发送数据时，线程1基于通道标识1，在通道标识1对应的数据传输通道中写入需要发送的数据；这样，第一进程可以基于通道标识2在该数据传输通道中读取到线程1所发送的数据。然后，第一进程再查找通道标识2对应的套接 字描述符，并基于该套接字描述符将所读取到的数据发送给网络站点。当网络站点向第一进程返回网络数据之后，第一进程则基于通道标识2，在通道标识2对应的数据传输通道中写入需要网络站点所返回的数据；这样，线程1则可以基于通道标识1在该数据传输通道中读取到第一进程所返回的数据。也就是说，第一进程作为线程1与网络站点之间的中间者，第一进程通过套接字描述符与网络站点交互数据，第一进程与线程1之间则通过通道标识1和通道标识2实现数据的交互，最终实现网络站点与线程1之间的数据交互。
本实施例中，由于目标应用程序中的线程1与网络站点之间可能需要交互大量的数据，因此第一进程在执行了用于发起网络访问的***调用请求2之后，可以为获得的套接字描述符分配通道标识对。这样，在第一进程将通道标识对中的一个通道标识返回给线程1之后，线程1后续能够基于该通道标识实现与第一进程之间的通信。也就是说，在线程1需要与网络站点交互数据的情况下，线程1与第一进程通过所分配的通道标识对实现数据的交互，第一进程再与网络站点实现数据交互。这样一来，线程1中发往网络站点的数据不需要再经由第二进程截获后，再转发到第一进程中；第一进程向线程1返回的数据也不需要再经由第二进程转发。线程1与第一进程能够基于通道标识对实现数据的交互。
简单来说，第一进程通过分配通道标识对，并向目标应用程序返回通道标识对中的一个通道标识，使得第一进程与目标应用程序之间能够基于通道标识对所对应的通道实现互相通信。避免了由第二进程持续转发第一进程与目标应用程序之间所交互的大量网络数据，提高了数据传输的效率，并且目标应用程序与网络站点交互的数据通过独立的通道进行传输，保证了数据传输的可靠性。
步骤519，目标应用程序的线程1关闭通道标识1。
当目标应用程序的线程1结束对网络站点的访问时，线程1关闭用于与网络站点实现数据交互的通道标识1。简单来说，当线程1不再需要该通道标识1时，可以调用close函数来关闭对网络站点的访问,并且释放通道标识1以便重新使用。
步骤520，第一进程获取到***返回的回调信息，该回调信息指示通道标识1已关闭。
由于第一进程建立了用于监听通道标识1的***，因此当线程1关闭通道标识1后，***则向第一进程返回回调信息，以指示通道标识1已被关闭。
步骤521，第一进程关闭与通道标识1对应的套接字描述符。
基于***所返回的回调信息，第一进程查找与通道标识1对应的通道标识2以及套接字描述符。然后，第一进程关闭通道标识2以及套接字描述符，以及时回收***资源。
可以参阅图6a，图6a为本申请实施例提供的一种访问控制方法600的流程示意图。如图6a所示，该方法600包括以下的步骤601-610。
步骤601，目标应用程序中的线程2发起***调用请求5，该***调用请求5用于请求打开目标文件。
目标应用程序在第二进程中运行的过程中，目标应用程序还可以创建线程2，线程2与线程1为两个不同的线程。在线程2的运行过程中，当线程2需要请求打开某一个文件 时，线程2发起***调用请求5，该***调用请求5用于请求打开目标文件。其中，目标文件例如可以为目录文件或某一个具体的文件。示例性地，该***调用请求5中具体可以包括***调用号和参数，该***调用号对应的名称为open，该参数包括目标文件的路径。
步骤602，第二进程截获来自于目标应用程序中的线程2的***调用请求5。
由于***调用请求5中包括请求打开目标文件的***调用号，因此第二进程可以根据***调用号截获到截获来自于目标应用程序中的线程2的***调用请求5。
步骤603，第二进程为线程2创建数据传输通道2。
为了保证第一进程后续返回给线程2的数据能够独立传输，第二进程可以为线程1创建独立的数据传输通道2。该数据传输通道2可以理解为一个数据回传通道，第一进程可以将回传给第二进程的数据通过数据传输通道2来传输。也就是说，对于需要返回给线程1的数据，第一进程通过数据传输通道1来传输；对于需要返回给线程2的数据，第一进程则通过数据传输通道2来传输，从而实现不同线程之间的数据的隔离。
其中，第二线程为线程2创建数据传输通道2的方式与第二线程为线程1创建数据传输通道1的方式类似，具体可以参考上述的步骤503，在此不再赘述。
步骤604，第二进程在***调用请求5中添加数据传输通道2的标识和线程2的标识，得到***调用请求6。
在一个可能的实施例中，第二进程还可以在***调用请求5中添加目标应用程序的信息，例如目标应用程序的标识，该目标应用程序的标识用于标识所述目标应用程序的身份信息或标识所述目标应用程序所属的类型。
步骤605，第二进程向第一进程发送***调用请求6。
步骤606，第一进程解析***调用请求6，并对***调用请求6进行权限校验。
由于***调用请求6中包括有***调用号以及目标应用程序的信息，因此第一进程可以基于***调用号以及目标应用程序的信息对***调用请求6进行权限校验，以确定目标应用程序是否具有申请执行***调用请求6的权限。
此外，第一进程在解析***调用请求6后，第一进程能够得到***调用请求6中的数据传输通道2的标识和线程2的标识，第一进程同样为数据传输通道2的标识和线程2的标识建立对应关系，以便于后续接收到包括线程2的标识的其他请求时，能够确定对应的数据传输通道2。
步骤607，在***调用请求6通过权限校验后，第一进程执行***调用请求6，得到文件描述符。
由于***调用请求6用于请求打开目标文件，因此第一进程执行***调用请求6之后，能够得到操作***所返回的供访问目标文件的文件描述符。示例性地，在***调用请求6具体用于请求打开目录文件时，第一进程执行***调用请求6，得到目录文件描述符。
步骤608，第一进程为文件描述符分配代理文件描述符，并为代理文件描述符建立***。
在分配代理文件描述符之后，第一进程还可以建立所述文件描述符与所述代理文件描述符之间的对应关系，例如将所述文件描述符与所述代理文件描述符保存到一个映射表中， 以便于第一进程能够根据代理文件描述符查找到对应的文件描述符。
此外，在为文件描述符分配了代理文件描述符之后，第一进程即可为代理文件描述符建立***，以便于第一进程能够及时感知到目标应用程序关闭代理文件描述符的操作。
步骤609，第一进程向第二进程发送代理文件描述符。
具体地，第一进程可以根据***调用请求6中的数据传输通道2的标识来向第二进程发送代理文件描述符，即第一进程通过数据传输通道2来传输所述代理文件描述符。
步骤610，第二进程向目标应用程序的线程2发送代理文件描述符。
第二进程通过数据传输通道2接收到代理文件描述符之后，第二进程则向目标应用程序的线程2返回代理文件描述符，以使得线程2能够基于代理文件描述符发起访问目标文件的请求。
可以参阅图6b，图6b为本申请实施例提供的一种访问控制方法600的另一个流程示意图。如图6b所示，该方法600还包括以下的步骤611-620。
步骤611，第二进程截获来自于目标应用程序中的线程2的***调用请求7。
当线程2获取到代理文件描述符之后，线程2可以基于该代理文件描述符请求访问目标文件。因此，线程2可以发起***调用请求7，该该***调用请求7中包括代理文件描述符，该***调用请求7用于请求访问目标文件。示例性地，在目标文件为目录文件且线程2请求遍历目录文件时，该***调用请求7中具体可以包括***调用号，该***调用号对应的名称为getdents。
步骤612，第二进程在***调用请求7中添加线程2的标识，得到***调用请求8。
为了便于第一进程确定发起***调用请求的线程，第二进程可以在***调用请求7中添加线程2的标识，得到***调用请求8。
在一个可能的实施例中，由于***调用请求7中包括了代理文件描述符，且代理文件描述符与套接字描述符建立了对应关系，因此第一进程实际上也可以通过代理文件描述符来确定发起***调用请求的线程。因此，第二进程也可以是不需要在***调用请求7中添加线程2的标识。
步骤613，第二进程向第一进程发送***调用请求8。
步骤614，第一进程根据***调用请求8中的代理文件描述符，查找得到对应的文件描述符。
由于第一进程建立了代理文件描述符与文件描述符之间的对应关系，例如上述实施例所述的映射表，因此第一进程在解析***调用请求8并得到代理文件描述符之后，第一进程基于该代理文件描述符能够查找得到对应的文件描述符。
步骤615，第一进程根据文件描述符执行***调用请求8，得到目标文件的访问结果。
示例性地，在该文件描述符具体为目录文件描述符的情况下，第一进程根据目录文件描述符执行***调用请求8，可以得到目录文件的遍历结果。
步骤616，第一进程向第二进程发送目标文件的访问结果。
在第一进程获取到目标文件的访问结果后，第一进程可以通过与线程2对应的数据传 输通道2向第二进程发送连接状态信息。
步骤617，第二进程向目标应用程序的线程2发送目标文件的访问结果。
步骤618，目标应用程序的线程2关闭代理文件描述符。
当目标应用程序的线程2不再需要访问目标文件时，线程2关闭用于访问目标文件的代理文件描述符。例如，当线程2调用close函数来关闭代理文件描述符,从而实现释放代理文件描述符，以便重新使用。
步骤619，第一进程获取到***返回的回调信息，该回调信息指示代理文件描述符已关闭。
由于第一进程建立了用于监听代理文件描述符的***，因此当线程2关闭代理文件描述符后，***则向第一进程返回回调信息，以指示代理文件描述符已被关闭。
步骤620，第一进程关闭与代理文件描述符对应的文件描述符。
基于***所返回的回调信息，第一进程查找与代理文件描述符对应的文件描述符。然后，第一进程关闭该文件描述符，以及时回收***资源。可以理解的是，在***中，对于某一个文件所分配的文件描述符是有限的。即***可以给多个同时访问目标文件的线程返回不同的文件描述符，不同的文件描述符可以指向于同一个目标文件，但是对于同一个目标文件，***能够返回的不同的文件描述符的数量是有限的。因此，当线程不需要访问目标文件时，需要关闭文件描述符，以便于***资源的回收利用。
本实施例中，第一进程通过建立代理文件描述符的***，可以及时监听到线程2关闭代理文件描述符的行为，进而及时关闭代理文件描述符对应的文件描述符，实现***资源的及时回收。
以上介绍了第一进程和第二进程对不同的***调用请求进行访问控制的过程，以下将以安卓***为例，结合具体应用场景介绍通过两个进程对***调用请求进行访问控制的过程。
可以参阅图7，图7为本申请实施例提供的一种访问控制方法700的流程示意图。
步骤701，客户端请求使用Awareness Kit服务注册在日出或日落期间(inSunriseOrSunsetPeriod)时间围栏。
本实施例中，客户端可以是指终端中所运行的应用程序，该应用程序在运行过程中请求使用Awareness Kit服务注册inSunriseOrSunsetPeriod时间围栏。Awareness Kit是一种情景感知服务，支持获取用户当前时空、位置、活动状态、音频设备状态、环境光、天气、信标等情景感知组合能力。通过调用Awareness Kit服务所支持的能力，应用程序能够通过更高效的方式，获取用户当前所处的情景，从而为用户提供更加智慧的体验。此外，inSunriseOrSunsetPeriod时间围栏是一种服务，其功能是设置时间闹钟，当终端处于当地时间日出或日落的一段时间内(例如日出前30分钟)时，时间围栏的状态设置为Ture，否则时间围栏的状态设置为Flase。
步骤702，***启动宿主进程，宿主进程启动隔离进程。
对于终端而言，由于客户端请求使用的Awareness Kit服务为不可信应用，因此终端 中的***启动宿主进程，并且由宿主进程进一步启动隔离进程，以在隔离进程中运行Awareness Kit服务。在宿主进程启动隔离进程之后，宿主进程中可以创建一个服务桩代理，该服务桩代理用于代理传输隔离进程中的inSunriseOrSunsetPeriod时间围栏与客户端之间所交互的数据。此外，宿主进程还可以建立宿主进程与隔离进程之间的命令通道，并将命令通道对应的通道标识发送给隔离进程。这样，隔离进程能够通过命令通道向宿主进程发送访问请求。
在一个可能的实施例中，由于宿主进程启动隔离进程的目的为是在隔离进程中加载Awareness Kit服务，因此宿主进程实际上是知道隔离进程中所加载的服务的。在这种情况下，宿主进程可以为隔离进程中需要加载的Awareness Kit服务分配一个唯一的标识，以标识隔离进程中运行的服务。这样一来，宿主进程在连接有多个隔离进程的情况下，宿主进程也能够根据隔离进程所发送的标识确定隔离进程中所运行的服务或应用程序。
步骤703，隔离进程加载Awareness Kit服务。
在隔离进程被宿主进程启动之后，隔离进程接受宿主进程的命令，并加载Awareness Kit服务。隔离进程中的Awareness Kit服务注册inSunriseOrSunsetPeriod时间围栏。其中，由于inSunriseOrSunsetPeriod时间围栏需要获取终端当前所处位置的日出或日落时间，因此inSunriseOrSunsetPeriod时间围栏的工作逻辑是：先判断终端的本地数据是否存在有效的日出或日落时间，而这一判断过程涉及到对目录文件的遍历行为；如果判断结果为终端的本地数据存在有效的日出或日落时间，则继续发起读取数据库文件的行为。以上两个过程都涉及到发起相关***调用请求。
步骤704，Awareness Kit服务中的inSunriseOrSunsetPeriod时间围栏发起打开目录文件的***调用请求。
在隔离进程中，inSunriseOrSunsetPeriod时间围栏为了判断终端的本地数据是否存在有效的日出或日落时间，inSunriseOrSunsetPeriod时间围栏发起打开目录文件的***调用请求。其中，inSunriseOrSunsetPeriod时间围栏所发起的***调用请求中具体可以包括***调用号和参数，该***调用号对应的名称为open，该参数包括目录文件的路径。
步骤705，隔离进程截获inSunriseOrSunsetPeriod时间围栏发起的***调用请求。
基于***调用请求中的***号，隔离进程可以截获到inSunriseOrSunsetPeriod时间围栏发起的***调用请求。
步骤706，隔离进程向宿主进程发送***调用请求。
在截获到inSunriseOrSunsetPeriod时间围栏发起的***调用请求之后，隔离进程为inSunriseOrSunsetPeriod时间围栏创建一个数据传输通道，并得到该数据传输通道的标识。这样，隔离进程在***调用请求中添加该数据传输通道的标识、inSunriseOrSunsetPeriod时间围栏的标识以及Awareness Kit服务的标识，得到更新后的***调用请求。隔离进程再通过命令通道向宿主进程发送更新后的***调用请求。
步骤707，宿主进程执行该***调用请求。
宿主进程接收并解析隔离进程发送的***调用请求，然后为该***调用创建任务线程，并添加到线程池中进行统一管理和执行相应的***调用请求。具体地，宿主进程执行打开 目录文件的***调用请求，并得到相应的响应结果。
步骤708，宿主进程向隔离进程返回响应请求。
在得到***调用请求对应的响应结果后，宿主进程基于隔离进程发送的数据传输通道的标识，通过对应的数据传输通道向隔离进程发送响应请求。隔离进程在接收到响应请求后，则继续将响应结果返回给inSunriseOrSunsetPeriod时间围栏。最终，inSunriseOrSunsetPeriod时间围栏根据响应结果判断本地数据有效，则inSunriseOrSunsetPeriod时间围栏继续发起用于读取数据库文件的***调用请求。其中，inSunriseOrSunsetPeriod时间围栏发起用于读取数据库文件的***调用请求后的步骤与上述的步骤704-708类似，在此不再赘述。
在inSunriseOrSunsetPeriod时间围栏得到根据***调用请求得到最终的响应结果时，隔离进程通过宿主进程中的服务桩代理，将响应结果返回给客户端。
可以参阅图8，图8为本申请实施例提供的一种访问控制方法800的流程示意图。
步骤801，客户端请求使用Awareness Kit服务调用获取设备天气(getWeatherByDevice)的天气快照接口。
本实施例中，客户端可以是指终端中所运行的应用程序，该应用程序在运行过程中请求使用Awareness Kit服务调用getWeatherByDevice天气快照接口。示例性地，本实施例中的客户端与方法800中的客户端可以是同一个客户端。其中，getWeatherByDevice天气快照接口是一种服务，其功能是通过网络查询终端当前位置的天气状态。
步骤802，宿主进程获取到客户端的请求，并通知隔离进程创建getWeatherByDevice天气快照接口对应的任务线程。
在本实施例中的客户端与方法800中的客户端是同一个客户端的情况下，由于客户端在方法800中已启动宿主进程，因此客户端也可以是直接向宿主进程发送指令，以使得宿主进程通知隔离进程创建getWeatherByDevice天气快照接口对应的任务线程。
在宿主进程通知隔离进程2创建新的任务线程之后，宿主进程中可以创建另一个服务桩代理，该服务桩代理用于代理传输隔离进程中的getWeatherByDevice天气快照接口与客户端之间所交互的数据。
步骤803，隔离进程中的Awareness Kit服务创建getWeatherByDevice天气快照接口对应的任务线程。
由于getWeatherByDevice天气快照接口需要获取终端当前所处位置的天气，因此getWeatherByDevice天气快照接口需要访问网络站点，以获得网络站点上的天气信息。
步骤804，Awareness Kit服务中的getWeatherByDevice天气快照接口发起建立网络访问的***调用请求。
在隔离进程中，getWeatherByDevice天气快照接口为了获得网络站点上的天气状态，getWeatherByDevice天气快照接口发起建立网络访问的***调用请求。其中，getWeatherByDevice天气快照接口所发起的***调用请求中具体可以包括***调用号，该***调用号对应的名称为socket。
步骤805，隔离进程截获getWeatherByDevice天气快照接口发起的***调用请求。
基于***调用请求中的***号，隔离进程可以截获到getWeatherByDevice天气快照接口发起的***调用请求。
步骤806，隔离进程向宿主进程发送***调用请求。
在截获到getWeatherByDevice天气快照接口发起的***调用请求之后，隔离进程为getWeatherByDevice天气快照接口创建另一个数据传输通道，并得到该数据传输通道的标识。这样，隔离进程在***调用请求中添加该数据传输通道的标识、getWeatherByDevice天气快照接口的标识以及Awareness Kit服务的标识，得到更新后的***调用请求。隔离进程再通过命令通道向宿主进程发送更新后的***调用请求。
步骤807，宿主进程执行该***调用请求。
宿主进程接收并解析隔离进程发送的***调用请求，然后为该***调用创建任务线程，并添加到线程池中进行统一管理和执行相应的***调用请求。具体地，宿主进程执行打开目录文件的***调用请求，并得到相应的响应结果。
步骤808，宿主进程向隔离进程返回响应请求。
在得到***调用请求对应的响应结果后，宿主进程基于隔离进程发送的数据传输通道的标识，通过对应的数据传输通道向隔离进程发送响应请求。隔离进程在接收到响应请求后，则继续将响应结果返回给getWeatherByDevice天气快照接口。最终，getWeatherByDevice天气快照接口根据响应结果继续发起用于请求与网络站点建立连接的***调用请求。其中，getWeatherByDevice天气快照接口发起用于请求与网络站点建立连接的***调用请求后的步骤与上述的步骤804-808类似，在此不再赘述。
在getWeatherByDevice天气快照接口得到根据***调用请求得到最终的响应结果时，隔离进程通过宿主进程中的服务桩代理，将响应结果返回给客户端。
以上介绍了通过进程间的交互对访问请求进行访问控制的过程，为便于理解，以下将从内部实现侧详细介绍对访问请求进行访问控制的过程。
可以参阅图9，图9为本申请实施例提供的一种进程间执行访问控制的流程示意图。如图9所示，隔离进程中运行有不可信应用，不可信应用中的任务线程在运行过程中发起***调用请求，例如名称为socket或connect的***调用请求。隔离进程中的管理服务线程包括请求转调模块和执行模块，请求转调模块对不可信应用所发起的***调用请求进行截获，并且重新封装该***调用请求，得到封装后的***调用请求。封装后的***调用请求包括不可信应用的信息、数据通道的标识以及不可信应用中的任务线程的标识等信息。请求转调模块将封装后的***调用请求交由执行模块进行转调，执行模块将封装后的***调用请求通过命令通道发送给宿主进程，并等待宿主进程的回调信息。
宿主进程中同样包括有管理服务线程，管理服务线程中的通道监听模块能够以轮询的方式对命令通道进行监听。在监听到隔离进程发送过来的***调用请求后，管理服务线程对该***调用请求进行线程的创建，并将新创建的线程加入线程池中。线程池中新加入的线程用于执行***调用请求，具体包括：对***调用请求进行解析，得到***调用请求中 的参数以及代理描述符等信息；然后对代理描述符进行响应翻译，得到对应的目标描述符；最后，基于得到的参数以及目标描述符，执行解析后的***调用请求，并将得到的响应结果通过数据通道回传给隔离进程。这样，隔离进程中的执行模块读取数据通道上的回调信息后，解析得到调用结果，并返回给不可信应用。
在图1至图9所对应的实施例的基础上，为了更好的实施本申请实施例的上述方案，下面还提供用于实施上述方案的相关设备。
具体可以参阅图10，图10为本申请实施例提供的一种终端1000的结构示意图，该终端1000包括：收发单元1001和处理单元1002。所述收发单元1001用于接收第二进程发送的访问请求，所述访问请求来自于运行在所述第二进程中的目标应用程序，所述第二进程不具有执行所述访问请求的权限；所述处理单元1002用于执行所述第一访问请求，得到用于访问***资源的目标描述符；所述处理单元1002，还用于为所述目标描述符分配代理描述符，所述目标描述符与所述代理描述符具有对应关系；所述收发单元1001还用于向所述第二进程发送所述代理描述符。
访问请求访问请求在一种可能的实现方式中，所述收发单元1001还用于接收第二进程发送的第二访问请求，所述第二访问请求包括所述代理描述符，所述第二访问请求用于请求访问***资源；所述处理单元1002还用于获取与所述代理描述符对应的所述目标描述符；所述处理单元1002还用于根据所述目标描述符执行所述第二访问请求，得到资源访问结果；所述收发单元1001还用于向所述第二进程发送所述资源访问结果。
在一种可能的实现方式中，所述第一访问请求用于请求发起网络访问，所述目标描述符包括套接字描述符，所述第二访问请求还包括目标网络站点的地址，所述第二访问请求用于请求访问所述目标网络站点；所述处理单元1002还用于根据所述套接字描述符执行所述第二访问请求，得到所述目标网络站点的访问结果。
在一种可能的实现方式中，所述处理单元1002还用于为所述目标描述符分配通道标识对，所述通道标识对包括第一通道标识和第二通道标识，所述通道标识对用于所述第一进程与所述目标应用程序之间的数据传输，所述套接字描述符与所述通道标识对具有对应关系；所述收发单元1001还用于向所述第二进程发送所述第一通道标识。
在一种可能的实现方式中，所述第一访问请求用于请求打开目标文件，所述目标描述符包括目标文件描述符，所述第二访问请求用于请求访问所述目标文件；所述处理单元1002还用于根据所述目标文件描述符执行所述第二访问请求，得到所述目标文件的访问结果。
在一种可能的实现方式中，所述处理单元1002还用于为所述代理描述符建立***；所述收发单元1001还用于获取所述***发送的消息，所述消息用于指示所述代理描述符被关闭；所述处理单元1002还用于根据所述消息关闭与所述代理描述符对应的目标描述符。
在一种可能的实现方式中，所述处理单元1002还用于为所述套接字描述符建立***；所述收发单元1001还用于获取所述***发送的消息，所述消息用于指示所述套接字描述符被关闭；所述处理单元1002还用于根据所述消息关闭与所述套接字描述符对应的代 理描述符。
在一种可能的实现方式中，所述访问请求包括所述目标应用程序的信息；所述处理单元1002还用于根据所述目标应用程序的信息，对所述访问请求进行权限校验。
在一种可能的实现方式中，所述访问请求还包括第三通道标识，所述第三通道标识用于指示数据传输通道；所述收发单元1001还用于通过所述第三通道标识对应的数据传输通道，向所述第二进程发送所述访问结果。
在一种可能的实现方式中，所述第一访问请求和所述第二访问请求还包括所述目标应用程序对应的线程标识；所述处理单元1002还用于根据所述第一访问请求，建立所述第三通道标识与所述线程标识之间的对应关系；所述处理单元1002还用于根据所述第二访问请求中的所述线程标识，确定所述第三通道标识；所述收发单元1001还用于通过所述第三通道标识对应的数据传输通道，向所述第二进程发送所述资源访问结果。
在另一个可能的实施例中，所述收发单元1001用于获取来自于目标应用程序的访问请求，所述目标应用程序运行于第二进程中，所述第二进程不具有执行访问请求的权限；所述处理单元1002用于向第一进程发送所述访问请求，所述第一进程具有执行所述访问请求的权限；所述收发单元1001还用于接收所述第一进程发送的代理描述符，所述代理描述符用于访问***资源；所述收发单元1001还用于向所述目标应用程序发送所述代理描述符。
在一种可能的实现方式中，所述收发单元1001还用于：获取来自于所述目标应用程序的第二访问请求，所述第二访问请求包括所述代理描述符，所述第二访问请求用于请求访问***资源；向所述第一进程发送所述第二访问请求；所述第二进程接收所述第一进程发送的资源访问结果；所述第二进程向所述目标应用程序发送所述资源访问结果。
在一种可能的实现方式中，所述第一访问请求用于请求发起网络访问，所述第二访问请求还包括目标网络站点的地址，所述第二访问请求用于请求访问所述目标网络站点，所述资源访问结果包括所述目标网络站点的访问结果。
在一种可能的实现方式中，所述代理描述符包括第一通道标识，所述第一通道标识用于所述第一进程与所述目标应用程序之间的数据传输。
在一种可能的实现方式中，所述第一访问请求用于请求打开目标文件，所述目标描述符包括目标文件描述符，所述第二访问请求用于请求访问所述目标文件，所述资源访问结果包括所述目标文件的访问结果。
在一种可能的实现方式中，所述处理单元1002还用于根据所述访问请求创建通道标识对，所述通道标识对包括第三通道标识和第四通道标识，所述通道标识对用于第一进程与所述第二进程之间的数据传输；所述处理单元1002还用于在所述访问请求中添加所述第三通道标识；所述收发单元1001还用于向第一进程发送添加了所述第三通道标识的访问请求。
在一种可能的实现方式中，所述处理单元1002还用于在所述访问请求中添加所述目标应用程序的信息；所述收发单元1001还用于向第一进程发送添加了所述目标应用程序的信息的访问请求。
本申请实施例提供的访问控制方法具体可以由终端中的芯片来执行，该芯片包括：处理单元和通信单元，处理单元例如可以是处理器，通信单元例如可以是输入/输出接口、管脚或电路等。该处理单元可执行存储单元存储的计算机执行指令，以使服务器内的芯片执行上述图1至图10所示实施例描述的访问控制方法。可选的，存储单元为芯片内的存储单元，如寄存器、缓存等，存储单元还可以是无线接入设备端内的位于芯片外部的存储单元，如只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)等。
参照图11，本申请还提供了一种计算机程序产品，在一些实施例中，上述图3所公开的方法可以实施为以机器可读格式被编码在计算机可读存储介质上的或者被编码在其它非瞬时性介质或者制品上的计算机程序指令。
图11示意性地示出根据这里展示的至少一些实施例而布置的示例计算机程序产品的概念性局部视图，示例计算机程序产品包括用于在计算设备上执行计算机进程的计算机程序。
在一个实施例中，计算机程序产品1100是使用信号承载介质1101来提供的。信号承载介质1101可以包括一个或多个程序指令1102，其当被一个或多个处理器运行时可以提供以上针对图2描述的功能或者部分功能。因此，例如，参考图3中所示的实施例，步骤301-306的一个或多个特征可以由与信号承载介质1101相关联的一个或多个指令来承担。此外，图11中的程序指令1102也描述示例指令。
在一些示例中，信号承载介质1101可以包含计算机可读介质1103,诸如但不限于，硬盘驱动器、紧密盘(CD)、数字视频光盘(DVD)、数字磁带、存储器、ROM或RAM等等。
在一些实施方式中，信号承载介质1101可以包含计算机可记录介质1104，诸如但不限于，存储器、读/写(R/W)CD、R/W DVD、等等。在一些实施方式中，信号承载介质1101可以包含通信介质1105,诸如但不限于，数字和/或模拟通信介质(例如，光纤电缆、波导、有线通信链路、无线通信链路、等等)。因此，例如，信号承载介质1101可以由无线形式的通信介质1105(例如，遵守IEEE 802.11标准或者其它传输协议的无线通信介质)来传达。
一个或多个程序指令1102可以是，例如，计算机可执行指令或者逻辑实施指令。在一些示例中，计算设备的计算设备可以被配置为，响应于通过计算机可读介质1103、计算机可记录介质1104、和/或通信介质1105中的一个或多个传达到计算设备的程序指令1102，提供各种操作、功能、或者动作。
应该理解，这里描述的布置仅仅是用于示例的目的。因而，本领域技术人员将理解，其它布置和其它元素(例如，机器、接口、功能、顺序、和功能组等等)能够被取而代之地使用，并且一些元素可以根据所期望的结果而一并省略。另外，所描述的元素中的许多是可以被实现为离散的或者分布式的组件的、或者以任何适当的组合和位置来结合其它组件实施的功能实体。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的***，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的***，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个***，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器、随机存取存储器、磁碟或者光盘等各种可以存储程序代码的介质。

Claims (20)

  1. 一种访问控制方法，其特征在于，包括：
    第一进程接收第二进程发送的访问请求，所述访问请求来自于运行在所述第二进程中的目标应用程序，所述第二进程不具有执行所述访问请求的权限；
    所述第一进程执行所述第一访问请求，得到用于访问***资源的目标描述符；
    所述第一进程为所述目标描述符分配代理描述符，所述目标描述符与所述代理描述符具有对应关系；
    所述第一进程向所述第二进程发送所述代理描述符。
  2. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述第一进程接收第二进程发送的第二访问请求，所述第二访问请求包括所述代理描述符，所述第二***调用请求用于请求访问***资源；
    所述第一进程获取与所述代理描述符对应的所述目标描述符；
    所述第一进程根据所述目标描述符执行所述第二访问请求，得到资源访问结果；
    所述第一进程向所述第二进程发送所述资源访问结果。
  3. 根据权利要求2所述的方法，其特征在于，所述第一访问请求用于请求发起网络访问，所述目标描述符包括套接字描述符，所述第二访问请求还包括目标网络站点的地址，所述第二访问请求用于请求访问所述目标网络站点；
    所述第一进程根据所述目标描述符执行所述第二访问请求，得到资源访问结果，包括：
    所述第一进程根据所述套接字描述符执行所述第二访问请求，得到所述目标网络站点的访问结果。
  4. 根据权利要求1-3任意一项所述的方法，其特征在于，所述第一进程为所述目标描述符分配代理描述符，包括：
    所述第一进程为所述目标描述符分配通道标识对，所述通道标识对包括第一通道标识和第二通道标识，所述通道标识对用于所述第一进程与所述目标应用程序之间的数据传输，所述套接字描述符与所述通道标识对具有对应关系；
    所述第一进程向所述第二进程发送所述代理描述符，包括：
    所述第一进程向所述第二进程发送所述第一通道标识。
  5. 根据权利要求2所述的方法，其特征在于，所述第一访问请求用于请求打开目标文件，所述目标描述符包括目标文件描述符，所述第二访问请求用于请求访问所述目标文件；
    所述第一进程根据所述目标描述符执行所述第二访问请求，得到资源访问结果，包括：
    所述第一进程根据所述目标文件描述符执行所述第二访问请求，得到所述目标文件的访问结果。
  6. 根据权利要求2-5任意一项所述的方法，其特征在于，所述方法还包括：
    所述第一进程为所述代理描述符建立***；
    所述第一进程获取所述***发送的消息，所述消息用于指示所述代理描述符被关闭；
    所述第一进程根据所述消息关闭与所述代理描述符对应的目标描述符。
  7. 根据权利要求3所述的方法，其特征在于，所述第一进程为所述套接字描述符建立***；
    所述第一进程获取所述***发送的消息，所述消息用于指示所述套接字描述符被关闭；
    所述第一进程根据所述消息关闭与所述套接字描述符对应的代理描述符。
  8. 根据权利要求1-7任意一项所述的方法，其特征在于，所述访问请求包括所述目标应用程序的信息；
    所述方法还包括：
    所述第一进程根据所述目标应用程序的信息，对所述访问请求进行权限校验。
  9. 根据权利要求1-8任意一项所述的方法，其特征在于，所述访问请求还包括第三通道标识，所述第三通道标识用于指示数据传输通道；
    所述第一进程向所述第二进程发送所述访问结果，包括：
    所述第一进程通过所述第三通道标识对应的数据传输通道，向所述第二进程发送所述访问结果。
  10. 根据权利要求9所述的方法，其特征在于，所述第一访问请求和所述第二访问请求还包括所述目标应用程序对应的线程标识；
    所述方法还包括：
    所述第一进程根据所述第一访问请求，建立所述第三通道标识与所述线程标识之间的对应关系；
    所述第一进程向所述第二进程发送所述资源访问结果，包括：
    所述第一进程根据所述第二访问请求中的所述线程标识，确定所述第三通道标识；
    所述第一进程通过所述第三通道标识对应的数据传输通道，向所述第二进程发送所述资源访问结果。
  11. 一种访问控制方法，其特征在于，包括：
    第二进程获取来自于目标应用程序的访问请求，所述目标应用程序运行于所述第二进程中，所述第二进程不具有执行访问请求的权限；
    所述第二进程向第一进程发送所述访问请求，所述第一进程具有执行所述访问请求的权限；
    所述第二进程接收所述第一进程发送的代理描述符，所述代理描述符用于访问***资源；
    所述第二进程向所述目标应用程序发送所述代理描述符。
  12. 根据权利要求11所述的方法，其特征在于，所述方法还包括：
    所述第二进程获取来自于所述目标应用程序的第二访问请求，所述第二访问请求包括所述代理描述符，所述第二访问请求用于请求访问***资源；
    所述第二进程向所述第一进程发送所述第二访问请求；
    所述第二进程接收所述第一进程发送的资源访问结果；
    所述第二进程向所述目标应用程序发送所述资源访问结果。
  13. 根据权利要求12所述的方法，其特征在于，所述第一访问请求用于请求发起网络访问，所述第二访问请求还包括目标网络站点的地址，所述第二访问请求用于请求访问所述目标网络站点，所述资源访问结果包括所述目标网络站点的访问结果。
  14. 根据权利要求11-13任意一项所述的方法，其特征在于，所述代理描述符包括第一通道标识，所述第一通道标识用于所述第一进程与所述目标应用程序之间的数据传输。
  15. 根据权利要求12所述的方法，其特征在于，所述第一访问请求用于请求打开目标文件，所述目标描述符包括目标文件描述符，所述第二访问请求用于请求访问所述目标文件，所述资源访问结果包括所述目标文件的访问结果。
  16. 根据权利要求11-15任意一项所述的方法，其特征在于，所述方法还包括：
    所述第二进程根据所述访问请求创建通道标识对，所述通道标识对包括第三通道标识和第四通道标识，所述通道标识对用于第一进程与所述第二进程之间的数据传输；
    所述第二进程在所述访问请求中添加所述第三通道标识；
    所述第二进程向第一进程发送添加了所述第三通道标识的访问请求。
  17. 根据权利要求11-16任意一项所述的方法，其特征在于，所述方法还包括：
    所述第二进程在所述访问请求中添加所述目标应用程序的信息；
    所述第二进程向第一进程发送添加了所述目标应用程序的信息的访问请求。
  18. 一种终端，其特征在于，包括存储器和处理器；所述存储器存储有代码，所述处理器被配置为执行所述代码，当所述代码被执行时，所述终端执行如权利要求1至17任一所述的方法。
  19. 一种计算机可读存储介质，其特征在于，包括计算机可读指令，当所述计算机可读 指令在计算机上运行时，使得所述计算机执行如权利要求1至17中任一项所述的方法。
  20. 一种计算机程序产品，其特征在于，包括计算机可读指令，当所述计算机可读指令在计算机上运行时，使得所述计算机执行如权利要求1至17任一项所述的方法。
PCT/CN2022/073357 2021-02-09 2022-01-24 一种访问控制方法及相关装置 WO2022170946A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110176129.8A CN114912103A (zh) 2021-02-09 2021-02-09 一种访问控制方法及相关装置
CN202110176129.8 2021-02-09

Publications (1)

Publication Number Publication Date
WO2022170946A1 true WO2022170946A1 (zh) 2022-08-18

Family

ID=82761488

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/073357 WO2022170946A1 (zh) 2021-02-09 2022-01-24 一种访问控制方法及相关装置

Country Status (2)

Country Link
CN (1) CN114912103A (zh)
WO (1) WO2022170946A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115859291A (zh) * 2023-02-03 2023-03-28 北京小佑网络科技有限公司 安全监测方法、装置、设备及存储介质

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111352762A (zh) * 2020-03-04 2020-06-30 恒生电子股份有限公司 一种进程访问确定方法和相关装置

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103971051A (zh) * 2013-01-28 2014-08-06 腾讯科技（深圳）有限公司 一种文件隔离方法、装置和***
US20160306963A1 (en) * 2015-04-14 2016-10-20 Avecto Limited Computer device and method for controlling untrusted access to a peripheral device
CN107784221A (zh) * 2016-08-30 2018-03-09 阿里巴巴集团控股有限公司 权限控制方法、服务提供方法、装置、***及电子设备
CN110298165A (zh) * 2018-03-22 2019-10-01 腾讯科技（深圳）有限公司 安全访问共享内存的方法、装置以及认证代理
CN110968361A (zh) * 2019-11-04 2020-04-07 上海交通大学 隔离沙箱加载方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103971051A (zh) * 2013-01-28 2014-08-06 腾讯科技（深圳）有限公司 一种文件隔离方法、装置和***
US20160306963A1 (en) * 2015-04-14 2016-10-20 Avecto Limited Computer device and method for controlling untrusted access to a peripheral device
CN107784221A (zh) * 2016-08-30 2018-03-09 阿里巴巴集团控股有限公司 权限控制方法、服务提供方法、装置、***及电子设备
CN110298165A (zh) * 2018-03-22 2019-10-01 腾讯科技（深圳）有限公司 安全访问共享内存的方法、装置以及认证代理
CN110968361A (zh) * 2019-11-04 2020-04-07 上海交通大学 隔离沙箱加载方法

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115859291A (zh) * 2023-02-03 2023-03-28 北京小佑网络科技有限公司 安全监测方法、装置、设备及存储介质

Also Published As

Publication number Publication date
CN114912103A (zh) 2022-08-16

Similar Documents

Publication Publication Date Title
EP3471366B1 (en) Container deployment method, communication method between services and related devices
WO2020177482A1 (zh) 一种桌面虚拟化方法、相关设备及计算机存储介质
US8830870B2 (en) Network adapter hardware state migration discovery in a stateful environment
WO2022170946A1 (zh) 一种访问控制方法及相关装置
US10462228B2 (en) Providing access to a smartcard within a remote session
US20150052280A1 (en) Method and system for communications-stack offload to a hardware controller
US20120290703A1 (en) Distributed Policy Service
US20070198243A1 (en) Virtual machine transitioning from emulating mode to enlightened mode
US11563799B2 (en) Peripheral device enabling virtualized computing service extensions
WO2019174074A1 (zh) 一种处理业务数据的方法和网络设备
US11520530B2 (en) Peripheral device for configuring compute instances at client-selected servers
US11360824B2 (en) Customized partitioning of compute instances
US20180212817A1 (en) Enabling redirection policies to be applied based on the windows class of a usb device
JP6665190B2 (ja) ネットワーク共有実施方法及び装置
US20050049849A1 (en) Cross-platform virtual tape device emulation
WO2018107433A1 (zh) 信息处理方法和装置
CN107247618B (zh) 一种基于指令外部获取架构下的磁盘重定向方法
EP4035003A1 (en) Peripheral device for configuring compute instances at client- selected servers
US10223178B2 (en) Enabling WPD devices to be managed at the capability level
CN115373758A (zh) 启动运行时实例的方法、运行时命名空间***及存储介质
CN111796909B (zh) 一种轻量级移动应用虚拟化***
US11196799B2 (en) Redirection of USB devices from hardware isolated virtual desktop infrastructure clients
TWI814877B (zh) 將重定向的生物辨識裝置隔離到遠程會話
CN115225693A (zh) 一种容器间的通信方法及相关产品
US20230140827A1 (en) Secure control of packet filter programs by user space processes in virtual machines

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22752108

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 22752108

Country of ref document: EP

Kind code of ref document: A1