BACKGROUND OF THE INVENTION

This disclosure is directed to an application program permission mechanism and more particularly, to a fine grained permission mechanism.

Permissions are the mechanism adopted by information systems to specify which software and hardware parts of a system a program is allowed to access. For example, the Android® operating system adopted a coarse permission system in which a program can ask and a user can grant access all or the application will not be downloaded. Depending on the type of application, permissions can only be granted to the whole file system or all Internet resources. A coarse system, however, exposes serious limits. The readability and understanding of these permissions from end users is quite poor, and they usually tend to grant these permissions to any applications. In addition, a coarse permission system is often made by numerous types of coarse permissions. The permissions may be dynamically enforced in various ways inside the platform, at the level of the source code of the libraries or by the operating system. Recent studies showed that several thousands of methods in Android®'s API require at least one permission. Fine grained permission systems have been proposed. However, these systems arbitrarily parameterize permissions, or they introduce a complex specification language (e.g., based on mathematical logic) that cannot be understood by an average user.

SUMMARY OF THE INVENTION

In one embodiment of the invention, a fine grained permission method and system is disclosed that provides parameterized permissions based on an objective criterion. In one embodiment the parameters are chosen based on the usage of the permissions. In one embodiment, given a permission, the steps of the method include extracting automatically the types of the parameters read by libraries requiring the given permission and filtering the types that satisfy certain usage criteria. Based on the filtering, the permission is parameterized with this parameter.

In one embodiment the method starts with accessing libraries of a plurality application programs requiring a first permission. The plurality of application programs being for a specific operating system. The method may include automatically extracting types of the parameters and respective corresponding fields read by the libraries requiring the first permission. The method may include filtering the extracted types of parameters and respective corresponding fields based on a usage criteria to determine a filtered type of parameter and respective corresponding field for the permission. The method may include storing the filtered type parameter and respective corresponding field for the first permission in a database. The method may further include repeating the above steps for a plurality of permissions for a plurality of application programs for the specific operating system.

In one embodiment the method includes receiving a request for a permission required by a library of an application program running on the specific operating system. In one embodiment, the permission request is received by a mobile device. The mobile device downloads the application program using an application download module. The application program module passes permissions required by the library of the program to a fine grained permission module.

In one embodiment, the fine grained permission module obtains from the database the filtered type of parameter and respective corresponding field for the permission. The fine grained permission module determines a specific parameter for the permission based on the filtered type of parameter and respective corresponding field obtained from the database. The fine grained permission module parameterizes the permission using the specific parameter. The fine grained permission module passes the parameterized permission back to the application download module which completes downloading the application program by limiting the permission based on the specific parameter.

In another embodiment, a system includes at least one data processor connected to at least one memory that stores software instructions, where execution of the software instructions by the at least one data processor causes the system to limit application program permissions by accessing libraries of a plurality application programs requiring a first permission. The plurality of application programs being for a specific operating system. The system may include automatically extracting types of the parameters and respective corresponding fields read by the libraries requiring the first permission. The system may include filtering the extracted types of parameters and respective corresponding fields based on a usage criteria to determine a filtered type of parameter and respective corresponding field for the permission. The system may include storing the filtered type parameter and respective corresponding field for the first permission in a database. The system may further include repeating the above steps for a plurality of permissions for a plurality of application programs for the specific operating system. The system may include a mobile device which downloads the application program using an application download module. The application program module passes permissions required by the library of the program to a fine grained permission module. The fine grained permission module obtains from a database the filtered type of parameter and respective corresponding field for the permission. The fine grained permission module determines a specific parameter for the permission based on the filtered type of parameter and respective corresponding field obtained from the database. The fine grained permission module parameterizes the permission using the specific parameter. The fine grained permission module passes the parameterized permission back to the application download module which completes downloading the application program by limiting the permission based on the specific parameter.

In another embodiment, a computer program product includes software instructions on a non-transitory computer-readable medium, where execution of the software instructions using a computer causes the computer to limit application program permissions by accessing libraries of a plurality application programs requiring a first permission. The plurality of application programs being for a specific operating system. The software instructions may include automatically extracting types of the parameters and respective corresponding fields read by the libraries requiring the first permission. The software instructions may include filtering the extracted types of parameters and respective corresponding fields based on a usage criteria to determine a filtered type of parameter and respective corresponding field for the permission. The software instructions may include storing the filtered type parameter and respective corresponding field for the first permission in a database. The software instructions may further include repeating the above steps for a plurality of permissions for a plurality of application programs for the specific operating system. The software instructions may include an application program module for a mobile device which passes permissions required by the library of the program to a fine grained permission module. The fine grained permission module obtains from a database the filtered type of parameter and respective corresponding field for the permission. The fine grained permission module determines a specific parameter for the permission based on the filtered type of parameter and respective corresponding field obtained from the database. The fine grained permission module parameterizes the permission using the specific parameter. The fine grained permission module passes the parameterized permission back to the application download module which completes downloading the application program by limiting the permission based on the specific parameter.

