Electronic device for controlling access to device resource and operation method thereof
An electronic device for controlling access to a device resource, and an operation method thereof, are disclosed. The electronic device may include a memory; and a processor configured to execute at least one operating system executed in a first region allowing an operation based on a first authority; execute at least one application executed in a second region allowing an operation based on a second authority; and in response to detection of access to at least one device resource by the at least one application, determine authority of access to the at least one device resource by using an authority determination module executed in a third region allowing an operation based on a third authority.
1. An electronic device comprising:
a memory; and
a processor configured to:
execute at least one operating system executed in a first region of the processor allowing an operation based on a first authority,
execute at least one application executed in a second region of the processor allowing an operation based on a second authority,
in response to detection of access to at least one device resource by the at least one application, configure authority of access to the at least one device resource by using an authority determination module executed in a third region of the processor allowing an operation based on a third authority,
store an authority policy defining a device resource restricted from being accessed by the at least one application, in the third region allowing an operation based on the third authority, and
provide the authority policy through a secure region of the processor to a non-secure region of the processor allowing an operation based on the third authority, wherein the third region allowing an operation based on the third authority comprises a region in which at least one of a hypervisor which is a non-secure region, or a secure exception level, is executed.
2. The electronic device of claim 1 , wherein the third authority comprises an authority higher than the first authority.
3. The electronic device of claim 1 , wherein the processor is further configured to obtain the authority policy in the electronic device or from an external device.
4. The electronic device of claim 1 , wherein the processor is further configured to provide the authority policy through a non-secure region of the processor to a non-secure region of the processor allowing an operation based on the third authority.
5. The electronic device of claim 1 , wherein the processor is further configured to provide the authority policy through a secure region of the processor to a secure region of the processor allowing an operation based on the third authority.
6. The electronic device of claim 1 , wherein the processor is further configured to:
determine access authority of the at least one application, based on the configured authority of access to the at least one device resource; and
if the configured authority is determined to be an authority by which access to the at least one device resource is restricted, provide information indicating restriction of access to the at least one device resource.
7. The electronic device of claim 1 , wherein the authority determination module comprises a hypervisor.
8. An operation method of an electronic device, the method comprising:
executing at least one operating system executed in a first region of a processor allowing an operation based on a first authority;
executing at least one application executed in a second region of the processor allowing an operation based on a second authority; and
in response to detection of access to at least one device resource by the at least one application, configuring authority of access to the at least one device resource by using an authority determination module executed in a third region of the processor allowing an operation based on a third authority,
storing an authority policy defining a device resource restricted from being accessed by the at least one application, in the third region allowing an operation based on the third authority, and
providing the authority policy through a secure region of the processor to a non-secure region of the processor allowing an operation based on the third authority, wherein the third region allowing an operation based on the third authority comprises a region in which at least one of a hypervisor which is a non-secure region, or a secure exception level, is executed.
9. The method of claim 8 , wherein the third authority comprises an authority higher than the first authority.
10. The method of claim 8 , further comprising:
obtaining the authority policy in the electronic device or from an external device.
11. The method of claim 10 , wherein obtaining the authority policy comprises:
obtaining a designated first authority policy during a boot-on operation; and
after the boot-on operation is complete, obtaining a second authority policy.
12. The method of claim 8 , further comprising:
providing the authority policy through a non-secure region of the processor to a non-secure region of the processor allowing an operation based on the third authority.
13. The method of claim 8 , further comprising:
providing the authority policy through a secure region of the processor to a secure region of the processor allowing an operation based on the third authority.
14. The method of claim 8 , further comprising:
determining access authority of the at least one application, based on the configured authority of access to the at least one device resource; and
if the configured authority is determined to be an authority by which access to the at least one device resource is restricted, providing information indicating restriction of access to the at least one device resource.