CN105978844A - Network access control method, router and system based on router - Google Patents

Abstract

Embodiments of the present invention provide a router-based network access control method, router, and system. On the router side, the method includes: receiving monitoring content delivered by a server, and configuring its own network monitoring information according to the monitoring content ; When the monitored device is detected, the message data of the monitored device is detected according to the network monitoring information; when the detection result is not passed, the data message is discarded to prohibit the monitored device from accessing the The data packet corresponds to the webpage; when the detection result is passed, the data packet is sent to the network. In this way, the router can control the network access of the monitored device, discard data packets that access illegal data such as bad websites, prevent waste of data resources and protect device security.

Description

A router-based network access control method, router and system

technical field

The invention relates to the technical field of communication, in particular to a router-based network access control method, a router, and a network access control system.

Background technique

A router is used to connect multiple logically separated networks. The so-called logical network represents a separate network or a subnet. When data is transferred from one subnet to another, it can be done through the router's routing function. Therefore, the router has the function of judging the network address and selecting the IP path. It can establish a flexible connection in a multi-network interconnection environment, and can connect various subnets with completely different data packets and media access methods. It belongs to a network layer. connected devices. Therefore, the user equipment can connect to the Internet through the router.

However, while the current network provides various resources required by users, it is also filled with a lot of bad information, such as violence, pornographic websites, etc. When using a router to connect to the network, you may visit websites with bad information. It causes a waste of data resources, and malicious content such as viruses may also exist in the website to affect the security of user equipment.

Contents of the invention

The technical problem to be solved by the embodiments of the present invention is to provide a router-based network access control method to control visited websites.

Correspondingly, the embodiment of the present invention also provides a router and a network access control system to ensure the implementation and application of the above method.

In order to solve the above problems, the embodiment of the present invention discloses a router-based network access control method, which is characterized in that, on the router side, it includes: receiving the monitoring content sent by the server, and configuring its own network monitoring according to the monitoring content information; when the monitored device is detected, the packet data of the monitored device is detected according to the network monitoring information; when the detection result is not passed, the data packet is discarded to prohibit the monitored device from accessing the The data message corresponds to the web page; when the detection result is passed, the data message is sent to the network.

The embodiment of the present invention also discloses a router, including: a receiving and configuring module, used to receive the monitoring content issued by the server, and configure its own network monitoring information according to the monitoring content; a packet detection module, used to detect When the monitored device is used, the message data of the monitored device is detected according to the network monitoring information; the access control module is used to discard the data message to prohibit the monitored device from accessing when the detection result is not passed The data message corresponds to the webpage; when the detection result is passed, the data message is sent to the network.

Compared with the prior art, the router-based network access control method, router and system of the embodiments of the present invention include the following advantages:

The router configures network monitoring information based on the monitoring content delivered by the server, thereby determining the data packet information to be monitored. After the monitored device sends a data packet to the router, the router sends a report to the monitored device according to the network monitoring information. When the test result is not passed, it is determined that the data message has illegal content, and the data message is discarded to prohibit the monitored device from accessing the corresponding web page of the data message. When the test result is passed, it is determined that the data message has illegal content. The text is legal data, and the data packets are sent to the network, so that the router can control the network access of the monitored device, discard the data packets that access illegal data such as bad websites, and prevent the waste of data resources while protecting Device security.

Description of drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description These are some embodiments of the present invention. Those skilled in the art can also obtain other drawings based on these drawings without creative work.

Fig. 1 is a flow chart of the steps of a router-based network access control method embodiment of the present invention;

Fig. 2 is a flow chart of the steps of router configuration in another router-based network access control method embodiment of the present invention;

Fig. 3 is a flow chart of the steps of access control in another router-based network access control method embodiment of the present invention;

Fig. 4 is an interactive schematic diagram of an access control system according to an embodiment of the present invention;

Fig. 5 is a structural block diagram of a router embodiment of the present invention;

Fig. 6 is a structural block diagram of another router embodiment of the present invention;

Fig. 7 is a structural block diagram of an embodiment of a network access control system according to the present invention.

detailed description

In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments It is a part of embodiments of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative efforts fall within the protection scope of the present invention.

One of the core concepts of the embodiments of the present invention lies in a router-based network access control method, router and system to control visited websites. The router configures network monitoring information based on the monitoring content delivered by the server, thereby determining the data packet information to be monitored. After the monitored device sends a data packet to the router, the router sends a report to the monitored device according to the network monitoring information. When the test result is not passed, it is determined that the data message has illegal content, and the data message is discarded to prohibit the monitored device from accessing the corresponding web page of the data message. When the test result is passed, it is determined that the data message has illegal content. The text is legal data, and the data packets are sent to the network, so that the router can control the network access of the monitored device, discard the data packets that access illegal data such as bad websites, and prevent the waste of data resources while protecting Device security.

Embodiment one

Referring to Fig. 1, it shows a flow chart of steps of a router-based network access control method embodiment of the present invention, which may specifically include the following steps:

Step 102, receiving the monitoring content delivered by the server, and configuring its own network monitoring information according to the monitoring content.

In this embodiment, in order to monitor the network address accessed by the user through the router, the server configures the network access control rules of the router to realize the router's control of the data packets of the connected devices.

The server determines the monitoring content through data analysis and other means, and the monitoring content is information content for monitoring network access data determined by the server through data analysis. The server sends the monitoring content to the router, and the router configures corresponding network monitoring information according to the monitoring content, and the network monitoring information is used for the router to monitor the data packets of the connected devices.

In the embodiments of the present invention, various devices used by users that can connect to the network are called user equipment, that is, user equipment includes various computing devices that can connect to the network, such as computers, and mobile devices such as tablet computers and mobile phones. Among them, the user equipment connected to the network through a router is called a local area network device, and the device directly connected to the network without a router is called an external network device. When the mobile device turns on WIFI (WIreless-Fidelity, wireless fidelity) to connect to the router and then connect to the network, the mobile phone is a LAN device.

In this embodiment, the router is used as the monitoring device for network access control, and the device to be monitored is selected from the LAN devices as the monitored device, that is, the monitored device is part or all of the LAN devices.

Step 104, when the monitored device is detected, the packet data of the monitored device is detected according to the network monitoring information.

When a user accesses the network through a LAN device connected to a router, the router monitors the connected LAN device, and when it detects that the mobile device currently sending data packets is the monitored device, it will monitor the status of the monitored device according to the network monitoring information. The message data is detected, and the corresponding processing operation is performed on the message data according to the detection result. The corresponding detection result of the legal data message is passed, and the corresponding detection result of the illegal data message is not passed.

Step 106, discarding the data packet.

When the test result is not passed, it indicates that the data message is illegal, that is, the network data that it requests is prohibited from accessing, and the router discards the data message to prohibit the monitored device (i.e. the monitored LAN device) from accessing the The data packet corresponds to a web page.

Therefore, for illegal data such as bad websites, it can be configured into the network monitoring information, so that the request for illegal data can be intercepted on the router side, which can not only save data resources, but also prevent these illegal data from being transmitted to the local area network by malicious content such as viruses in the website. Impact on device security.

Step 108, sending the data packet to the network.

When the detection result is passed, it indicates that the data packet does not have illegal content, and the router normally forwards the data packet to the network, for example, normally sends the data packet to request a web page, so that the monitored device can normally access the corresponding web pages.

To sum up, the router configures the network monitoring information based on the monitoring content sent by the server to determine the data packet information to be monitored. After the monitored device sends the data packet to the router, the router The message data of the monitored device is detected. When the data result is not passed, it is determined that the data message has illegal content, and the data message is discarded to prohibit the monitored device from accessing the corresponding web page of the data message. When the data result is When it passes through, it is determined that the data packet is legal data, and the data packet is sent to the network, so that the router can control the network access of the monitored device, discard the data packet that accesses illegal data such as bad websites, and prevent the data from being damaged. Waste of resources while protecting equipment security.

Embodiment two

On the basis of the above embodiments, this embodiment discusses in detail the router-based network browsing control method.

When the router performs access control on LAN devices, it needs to configure the monitoring content in the router in advance, and then the router monitors the connected LAN devices.

1. Router configuration

Referring to FIG. 2 , it shows a flow chart of router configuration steps in another router-based network access control method embodiment of the present invention, which may specifically include the following steps:

Step 202, collecting device information of each LAN device connected to the router to generate a list of LAN devices.

After the LAN device is connected to the router, it can connect to the network through the router. The router will collect the device information of the connected LAN device and generate a corresponding LAN device list. That is, the LAN list is used to record device information of LAN devices connected to the router, such as device name, model, identification, MAC (Media Access Control, Media Access Control) address of the device, access time and other information.

Step 204, feeding back device information in the LAN device list for the user to select a monitored device.

Step 206: Determine the monitored device according to the instruction information of the user, obtain the device information of the monitored device according to the local area network device list, and add it to the monitoring list.

If the user wants to monitor the device, for example, the parent wants to specify the child's device to be monitored, the user can interact with the router to set the monitored device. Wherein, the user can set the monitored device in the local area network formed by the router through the management page of the router, that is, the web page or the APP (Application, application program) of the mobile device.

A. Web page settings

The user uses a LAN device to connect to the router to access the web page of the router. The web page will feed back the device information in the LAN device list collected by the router, and identify different LAN devices through the device information, such as device name, device model, device MAC address, etc. at least one of the information. The user can select the device to be monitored on the web page, such as a children's machine used by children at home, such as an Ipad, etc. After the selection is completed, an instruction message can be sent. The instruction information carries the device ID of the device, and the user can be determined through the device ID. Select the LAN device, set the selected LAN device as the monitored device, and add the device information of the monitored device, such as device name, MAC address, etc., to the monitoring list.

B. Setting of mobile device APP page

Mobile devices such as mobile phones can connect to the Internet through a router or a communication network, and set the monitored device in the APP, that is, one way is to set the monitored device through the APP page when the mobile device itself is a LAN device. The device is used as an external network device to set the monitored device through the APP page. The app is installed on the mobile phone to control the functions of the router.

Among them, when the mobile device is used as a LAN device, the mobile device connects to the Internet through a router. After starting the APP on the mobile device and entering the relevant page of the router’s monitoring settings, the page will feed back the device information in the LAN device list collected by the router. It can be understood that there is device information of the mobile device in the local area network device list, and different local area network devices are identified by the device information on the page, such as at least one item of information such as device name, device model, and device MAC address. The user can select the device to be monitored on the web page, and after the selection is completed, the instruction information can be sent. The instruction information carries the device identification of the device, and the local area device selected by the user is determined through the device identification, and the selected LAN device is set as Monitored device, add the device information of the monitored device, such as device name, MAC address, etc., to the monitoring list.

When the mobile device is used as an external network device, the mobile device connects to the Internet through a communication network such as 2G, 3G, 4G and other networks. After starting the APP in the mobile device, the mobile phone and the router communicate through the cloud server at this time, and enter the monitoring setting related page of the router. Finally, the page will feed back the device information in the LAN device list collected by the router. At this time, it is understandable that the device information of the mobile device may not be included in the LAN device list. Of course, if the device has ever connected to the Internet through the router , the device information of the mobile device will be included in the LAN device list. Different LAN devices are identified by device information on the page, such as at least one item of device name, device model, device MAC address and other information. The user can select the device to be monitored on the setting page of the app, and after the selection is completed, an instruction message can be sent, which contains the device ID of the device, and the local area device selected by the user can be determined through the device ID, and the selected LAN Set the device as the monitored device, and add the device information of the monitored device, such as device name and MAC address, to the monitoring list.

Step 208, receiving the monitoring content delivered by the server.

When the router performs access control on LAN devices for the first time, it can receive the monitoring content sent by the server, so as to configure the network monitoring information of the router according to the monitoring content.

In an optional embodiment of the present invention, the monitoring content updated by the server is received; and the network monitoring information is updated according to the updated monitoring content.

In this embodiment, the server can also obtain data packets fed back from the router, collect information such as network data in the network, and update monitoring content through analysis of the above information and set rules. For example, after the webpage information collected after the data message is transmitted to the data server of the platform through the Internet, the big data intelligence center of the cloud platform can analyze the above data information and determine the corresponding data frame information, thereby forming an updated Internet access rule generation corresponding monitoring content, and send the updated monitoring content to the router, so as to update the network monitoring information of the router.

Step 210, acquiring the website data to be monitored from the monitored content.

Step 212, configure the website data to be monitored in the firewall list of the router, and use the firewall list as network monitoring information.

In the embodiment of the present invention, the monitoring content includes at least one of the following: website data to be monitored, time data, and message identification rules, and corresponding monitoring items can be configured through the above monitoring content.

Wherein, the URL data to be monitored is the URL data of prohibited websites, such as an IP address, or the root domain name of a website, etc., the URL data to be monitored is obtained from the monitoring content, and the URL data to be monitored is configured to the router In the firewall list Iptable, the firewall list is used as one of the network monitoring information, and the monitored device is subsequently monitored.

For example, the URL data to be monitored includes an IP address of 1.1.0.0, assuming that the corresponding URL is a violent and illegal website, the IP address 1.1.0.0 will be set in the Iptable table of the router.

Step 214, acquiring the time data from the monitoring content.

Step 216, configure the monitoring time of network monitoring information according to the time data;

The time data is the data for monitoring the time of accessing the network. For example, it is set to prohibit access to the network from Monday to Saturday, or it is set to prohibit access to the network at times other than 18:00 to 20:00 every day. Obtain the time data from the monitoring content, and configure the monitoring time of the network monitoring information according to the time data. The monitoring time can be configured as a time when access to the network is prohibited, or as a time when access to the network is allowed, and can be based on actual conditions. The required equipment is not limited in this embodiment of the present invention.

Step 218, acquire message identification rules from the monitored content.

Step 220, storing the packet identification rule as network monitoring information in the local cache of the router.

The message identification rule is a relevant rule for identifying the message when the router executes network access control. The message identification rule is obtained from the monitoring content, and the message identification rule is used as the network monitoring information, and then the message The identification rules are stored in the local cache of the router.

In this way, the monitored device can be configured through the LAN device list collected by the router, and the network monitoring information can be configured through the monitoring content delivered. The URL, time, and access content can be configured separately to generate accurate network monitoring information and provide more accurate access control. .

2. Access control

Referring to FIG. 3 , it shows a flow chart of steps of access control in another router-based network access control method embodiment of the present invention, which may specifically include the following steps:

Step 302, receiving a data packet.

Step 304: Determine the LAN device sending the message according to the data message.

Step 306, detecting whether the LAN device is a monitored device in the monitoring list.

To access the network through a router using a LAN device, a user needs to send a requested data message to the router first. For example, if the data message is a TCP/IP (Transmission Control Protocol/Internet Protocol) message, the data The message is analyzed to determine the MAC address of the LAN device sending the message, and based on the MAC address, the monitoring list is searched to determine whether the MAC address is the MAC address of the monitored device in the monitoring list.

If it is the MAC address of the monitored device in the monitoring list, execute step 308 . If it is not the MAC address of the monitored device in the monitoring list, go to step 314 .

Step 308, acquiring current time information, and detecting whether the time information is within the monitoring time.

Access control is required for monitored devices, one of which is to control the time of accessing the network. Obtain the current time information, that is, the time of accessing the network. When the monitoring time is configured as the time when accessing the network is prohibited, it is detected whether the time information is within the monitoring time. If it is within the monitoring time, execute step 316; if it is not within the monitoring time, execute step 310.

Of course, if the monitoring time is configured as the time allowed to access the network, it may be detected whether the time information is outside the monitoring time. That is, the network packets are discarded at the time when access to the network is prohibited, and the monitored device is not allowed to access the network.

For example, access to the network is prohibited from 18:00 to 20:00 every day. If the current time information is not 21:00, discard network packets and prohibit access to the network. If the current time information is 19:00, it is the time to allow access to the network. .

Step 310, detecting whether the network address requesting access in the packet data of the monitored device is in the firewall list.

In addition to controlling the access time, the network address of the network can also be controlled, that is, if the current time information does not allow the time to access the network, it is detected whether the network address requesting access in the message data of the monitored device is in the firewall list.

The firewall list is configured with access-prohibited URL data, so it is determined whether the network address requesting access in the message data is in the firewall list, if it is in the firewall list, go to step 316, if not in the firewall list, go to step 312. Of course, if the data packet is not identified, step 314 can be directly executed after judging that the network address requesting access is not in the firewall list.

For example, the network address requested for access is 1.1.0.0, and it is determined through detection that it is in the Iptable table of the router, then the packet is discarded to access the network address.

Step 312: Determine whether the data packet can be identified according to the packet identification rule in the local cache.

In the embodiment of the present invention, network access control also includes the identification of data packets, that is, when access to the network is not allowed, and the network address requested for access in the packet data is not in the firewall list, the network address in the local cache can still continue to be accessed. The data packet is identified according to the packet identification rule, and it is determined that the data packet can be identified.

If the data packet can be identified, execute step 314; if the data packet cannot be identified, execute step 318.

Step 314, sending the data packet to the network.

When the LAN device sending the data message is not the monitored device, there is no need to detect the data message, and the data message can be directly sent to the network, that is, the external network such as the Internet connected by the router.

When the current time information does not allow access to the network, and the network address requested for access in the message data is not in the firewall list, the data message can be directly sent to the network, so that the monitored device can access the requested webpage corresponding to the data message .

Or, when the current time information does not allow access to the network, the network address requested in the packet data is not in the firewall list, and the data packet can be identified according to the packet identification rules in the local cache, the data packet representing the request The text is legal data, and the data packet can be directly sent to the network, so that the monitored device can access the webpage corresponding to the request of the data packet.

Step 316, discard the data packet.

When the current time information is the time when accessing the network is prohibited, the network message is discarded, and the monitored device is prohibited from accessing the network.

When the current time information does not allow access to the network, but the network address requested for access in the message data is in the firewall list, it indicates that the network address requested for access by the message data contains illegal data, the network message is discarded, and the monitored device is prohibited access the web.

Step 318, copy the data message, and upload the copied data message to the server.

When the current time information does not allow access to the network, the network address requested in the packet data is not in the firewall list, but the data packet cannot be identified according to the packet identification rules in the local cache, the data packet representing the request is For unrecognized data, copy the data message, and upload the copied data message to the server. The follow-up server can analyze the data packet to determine whether the message data is legal, so as to determine the follow-up processing operation based on the analysis result of legality or not. For example, if the analysis determines that the data message is illegal data, it can be used as the subsequent update of the monitoring content Network monitoring information.

In this way, the router monitors the connected LAN devices through the monitoring list, detects the data packets of the monitored devices through the configured network monitoring information, and monitors the data packets through time, access URL, and data packet content. Comprehensive detection, more accurate control of the access of the monitored equipment.

It can be understood that this embodiment of the present invention is not limited by the described sequence of actions, and certain steps may be performed in other orders or at the same time, for example, step 312 is not performed, or step 312 is performed before step 308, etc., so this Those skilled in the art know that the embodiments described in the specification belong to preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

In an embodiment of the present invention, an interactive diagram of an access control system is shown in FIG. 4 . The access control system includes user equipment, routers, cloud platform servers and external networks. User equipment includes LAN equipment and external network equipment.

After the user equipment accesses the router, it is determined that it is a LAN device, and then sends a TCP/IP message to the router. The data flow monitoring process in the router detects whether the source MAC of the TCP/IP message is in the list of monitored devices. When it is determined that the source MAC is in the list of monitored devices, the data message is forwarded to the security detection process; otherwise, it is determined that the source MAC is not in the list of monitored devices, indicating that the corresponding LAN device of the data message is a non-monitored device, and directly The datagram is forwarded to an external network, such as the Internet.

The security detection process analyzes the data packets according to the configured network monitoring information, including analyzing the time information of accessing the network (namely, the online time), the network address of the requested access (namely, the destination IP), and the packet identification rules cached locally. If the analysis of the network monitoring information is passed, the router forwards the TCP/IP packet to the Internet; if the TCP/IP packet is determined to be illegal data through the analysis of the network monitoring information, the monitored device is prohibited from accessing the network, and the security detection process is directly discarded This message; if it is determined that the data of the TCP/IP message cannot be identified through network monitoring information analysis, then copy a TCP/IP message and transmit it to the data server of the cloud platform through the Internet.

Subsequent TCP/IP messages pass through the big data intelligence center to analyze the data frames of the TCP/IP messages to form new Internet access rules, that is, updated monitoring content, and send the updated monitoring content to the router. The security monitoring process of the router The network monitoring information is updated based on the monitoring content.

In the embodiment of the present invention, the data flow of the data message to be monitored is intercepted on the router side through network flow analysis, analyzed through the built-in process of the router, and can be forwarded to the server of the cloud platform to match with the security database. data flow, the router can automatically block the data connection between the device and illegal websites.

In this embodiment, the network monitoring information of the router is automatically configured through the monitoring content issued by the server, and the user does not need to understand complex network security protocols. It can automatically realize the access control of the device by configuring with the router.

In this embodiment, a large amount of logic processing is placed on the server side, such as analyzing data to determine monitoring content, etc., thereby reducing the hardware cost of the router and reducing the CPU configuration of the router.

Moreover, by continuously analyzing data on the server side, and constantly updating the security database and monitoring content on the server side, the network monitoring information configured by the router is also constantly updated, thereby accurately controlling network access and making network access more secure.

It should be noted that, for the method embodiment, for the sake of simple description, it is expressed as a series of action combinations, but those skilled in the art should know that the embodiment of the present invention is not limited by the described action sequence, because According to the embodiment of the present invention, certain steps may be performed in other orders or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification belong to preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

Embodiment Three

On the basis of the foregoing embodiments, this embodiment also provides a router.

Referring to FIG. 5, it shows a structural block diagram of a router embodiment of the present invention, which may specifically include the following modules:

The receiving and configuring module 502 is configured to receive monitoring content issued by the server, and configure its own network monitoring information according to the monitoring content.

The message detection module 504 is configured to detect the message data of the monitored device according to the network monitoring information when the monitored device is detected.

The access control module 506 is used to discard the data message to prohibit the monitored device from accessing the web page corresponding to the data message when the detection result is not passed; when the detection result is passed, the data message is sent to The internet.

To sum up, the router configures the network monitoring information based on the monitoring content sent by the server to determine the data packet information to be monitored. After the monitored device sends the data packet to the router, the router The message data of the monitored equipment is detected. When the detection result is not passed, it is determined that the data message has illegal content, and the data message is discarded to prohibit the monitored device from accessing the corresponding web page of the data message. When the detection result is When it passes through, it is determined that the data packet is legal data, and the data packet is sent to the network, so that the router can control the network access of the monitored device, discard the data packet that accesses illegal data such as bad websites, and prevent the data from being damaged. Waste of resources while protecting equipment security.

Referring to FIG. 6, it shows a structural block diagram of another router embodiment of the present invention, which may specifically include the following modules:

The receiving and configuring module 602 is configured to receive the monitoring content issued by the server, and configure its own network monitoring information according to the monitoring content.

The message detection module 604 is configured to detect the message data of the monitored device according to the network monitoring information when the monitored device is detected.

The access control module 606 is used to discard the data message to prohibit the monitored device from accessing the webpage corresponding to the data message when the detection result is not passed; when the detection result is passed, the data message is sent to The network enables the monitored device to normally access the webpage corresponding to the data message; when the detection result is not recognized, the data message is uploaded to the server for analysis.

In an optional embodiment of the present invention, the monitoring content includes at least one of the following: website data to be monitored, time data and identification rules.

The receiving and configuring module 602 includes:

The website configuration sub-module 60202 is used to acquire website data to be monitored from the monitored content; configure the website data to be monitored into the firewall list of the router, and use the firewall list as network monitoring information.

The time configuration sub-module 60204 is configured to obtain the time data from the monitoring content, and configure the monitoring time of the network monitoring information according to the time data.

The identification rule configuration sub-module 60206 is configured to acquire packet identification rules from the monitoring content, and store the packet identification rules as network monitoring information in the router's local cache.

The message detection module 604 includes:

The URL detection sub-module 60402 is used to detect whether the network address requesting access in the message data of the monitored device is in the firewall list; when the network address requesting access is in the firewall list, confirm that the data message and The network monitoring information matches, and the detection result is recorded as failed; when the network address requested for access is not in the firewall list, it is confirmed that the data packet does not match the network monitoring information, and the detection result is recorded as passed.

The time detection sub-module 60404 is used to obtain the current time information, and detect whether the time information is within the monitoring time; when the time information is within the monitoring time, record the detection result as fail; when the time information is not within the monitoring time Within the time, execute the step of detecting whether the network address requesting access is in the firewall list.

The identification rule detection sub-module 60406 is used to identify the data message according to the message identification rule in the local cache. When the data message cannot be identified, record the detection result as not identified, and perform The step of sending the data message to the network is uploaded to the server for analysis; when the data message can be identified, the step of sending the data message to the network is executed to enable the monitored device to access the corresponding Web page.

In another optional embodiment of the present invention, the receiving and configuring module 602 is further configured to acquire the updated monitoring content of the server; and update the network monitoring information according to the updated monitoring content.

The monitored device configuration module 608 is used to collect the device information of each LAN device connected to the router to generate a LAN device list; feed back the device information in the LAN device list for the user to select the monitored device; according to the user's instruction information Selecting a local area network device as a monitored device from the local area network device list, acquiring device information of the monitored device and adding it to the monitoring list.

The device detection module 610 receives the data message sent by the LAN device, obtains the address information of the LAN device according to the data message; detects whether the LAN device is a monitored device configured in the monitoring list according to the address information; when the When the local area network device is not a monitored device, send the data packet to the network.

Embodiment four

On the basis of the above embodiments, this embodiment also provides a network access control system.

Referring to FIG. 7 , it shows a structural block diagram of an embodiment of a network access control system according to the present invention.

The network access control system includes: a user equipment 702, a server 704, and a router 706 as described in the third embodiment above.

In the embodiment of the present invention, the data flow of the data message to be monitored is intercepted on the router side through network flow analysis, analyzed through the built-in process of the router, and can be forwarded to the server of the cloud platform to match with the security database. data flow, the router can automatically block the data connection between the device and illegal websites.

In this embodiment, the network monitoring information of the router is automatically configured through the monitoring content issued by the server, and the user does not need to understand complex network security protocols. It can automatically realize the access control of the device by configuring with the router.

In this embodiment, a large amount of logic processing is placed on the server side, such as analyzing data to determine monitoring content, etc., thereby reducing the hardware cost of the router and reducing the CPU configuration of the router.

Moreover, by continuously analyzing data on the server side, and constantly updating the security database and monitoring content on the server side, the network monitoring information configured by the router is also constantly updated, thereby accurately controlling network access and making network access more secure.

As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and for related parts, please refer to the part of the description of the method embodiment.

Each embodiment in this specification is described in a progressive manner, each embodiment focuses on the difference from other embodiments, and the same and similar parts of each embodiment can be referred to each other.

Those skilled in the art should understand that the embodiments of the present invention may be provided as methods, devices, or computer program products. Accordingly, embodiments of the invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, embodiments of the invention may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

Embodiments of the present invention are described with reference to flowcharts and/or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each procedure and/or block in the flowchart and/or block diagram, and a combination of procedures and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions may be provided to a general purpose computer, special purpose computer, embedded processor or processor of other programmable data processing terminal equipment to produce a machine such that instructions executed by the computer or processor of other programmable data processing terminal equipment Produce means for realizing the functions specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the The instruction means implements the functions specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions can also be loaded into a computer or other programmable data processing terminal equipment, so that a series of operational steps are performed on the computer or other programmable terminal equipment to produce computer-implemented processing, thereby The instructions executed above provide steps for implementing the functions specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

Having described preferred embodiments of embodiments of the present invention, additional changes and modifications to these embodiments can be made by those skilled in the art once the basic inventive concept is appreciated. Therefore, the appended claims are intended to be construed to cover the preferred embodiment and all changes and modifications which fall within the scope of the embodiments of the present invention.

Finally, it should also be noted that in this text, relational terms such as first and second etc. are only used to distinguish one entity or operation from another, and do not necessarily require or imply that these entities or operations, any such actual relationship or order exists. Furthermore, the term "comprises", "comprises" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article, or terminal equipment comprising a set of elements includes not only those elements, but also includes elements not expressly listed. other elements identified, or also include elements inherent in such a process, method, article, or end-equipment. Without further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article or terminal device comprising said element.

A router-based network access control method, a router, and a network access control system provided by the present invention have been described above in detail. In this paper, specific examples are used to illustrate the principle and implementation of the present invention. , the description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for those of ordinary skill in the art, according to the idea of the present invention, there will be changes in the specific implementation and application scope In summary, the contents of this specification should not be construed as limiting the present invention.

Claims (17)

1. a method for network access control based on router, it is characterised in that in router side, Including:

Receive the monitoring content that server issues, according to the network monitoring letter of described monitoring content configuration self Breath；

When monitored device being detected, according to the described network monitoring information report to described monitored device Literary composition data detect；

When testing result is obstructed out-of-date, abandon described data message described to forbid that monitored device accesses Data message correspondence webpage；

When testing result be by time, described data message is sent to network.

Method the most according to claim 1, it is characterised in that described monitoring content includes waiting to supervise Control website data, the described network monitoring information according to described monitoring content configuration self, including:

Website data to be monitored is obtained from described monitoring content；

Described website data to be monitored is configured in the fire wall list of described router, by described fire prevention Wall list is as network monitoring information.

Method the most according to claim 2, it is characterised in that described network monitoring information is to institute The message data stating monitored device detects, including:

Whether detect the network address asking to access in the message data of described monitored device at fire wall In list；

When the network address that described request accesses is in fire wall list, confirm that described data message is with described Network monitoring information mates, and record testing result is not for pass through；

When the network address that described request accesses is not in fire wall list, confirm described data message and institute Stating network monitoring information not mate, record testing result is for passing through.

Method the most according to claim 3, it is characterised in that described monitoring content also includes: Time data；

The described network monitoring information according to described monitoring content configuration self, also includes: from described monitoring Content obtains described time data, configures the monitoring of described network monitoring information according to described time data Time；

The message data of the described monitored device of described detection is asked the network address accessed whether anti- Before in wall with flues list, also include:

Obtain current temporal information, detect whether described temporal information is positioned at monitoring period；

When described temporal information is positioned at monitoring period, and record testing result is not for pass through；

When described temporal information is not positioned at monitoring period, and whether the network address that execution detection request accesses Step in fire wall list.

Method the most according to claim 3, it is characterised in that described monitoring content also includes: Message recognition rule,

The described network monitoring information according to described monitoring content configuration self, including: in described monitoring Appearance obtains message recognition rule, described message recognition rule is stored as described network monitoring information In the local cache of described router；

The network address that the request that detects accesses is not after fire wall list, and described method also includes:

According to the message recognition rule in local cache, described data message is identified；

When data message described in None-identified, record testing result is nonrecognition, performs described data Message is sent to the step of network and is analyzed to be uploaded to server；

When being capable of identify that described data message, perform the step that described data message is sent to network with Described monitored device is made to access the webpage that described data message is corresponding.

6. according to the method described in any one of claim 1 to 5, it is characterised in that also include:

Receive the monitoring content of server update；

Described network monitoring information is updated according to the monitoring content of described renewal.

Method the most according to claim 1, it is characterised in that also include:

The facility information collecting each lan device accessing described router generates lan device list；

The facility information fed back in described lan device list selects monitored device for user；

From described lan device list, select monitored device according to the instruction information of user, obtain institute The facility information stating monitored device adds in watch-list.

Method the most according to claim 7, it is characterised in that also include:

Receive the data message that lan device sends, obtain lan device according to described data message Address information；

Whether detect described lan device according to described address information is being supervised of configuration in watch-list Control equipment；

When described lan device is non-monitored device, described data message is sent to network.

9. a router, it is characterised in that including:

Receive and configure module, for receiving the monitoring content that server issues, according to described monitoring content Configure the network monitoring information of self；

Packet check module, for when detecting monitored device, according to described network monitoring information pair The message data of described monitored device detects；

Access control module, for being obstructed out-of-date when testing result, abandons described data message to forbid Monitored device accesses described data message correspondence webpage；When testing result be by time, by described data Message is sent to network.

Router the most according to claim 9, it is characterised in that described monitoring content includes treating Monitoring website data, described reception also configures module, including:

Network address configuration submodule, for obtaining website data to be monitored from described monitoring content；By described Website data to be monitored is configured in the fire wall list of described router, using described fire wall list as Network monitoring information.

11. routers according to claim 10, it is characterised in that described network monitoring information To described packet check module, including:

Network address detection sub-module, asks the net accessed in the message data detecting described monitored device Whether network address is in fire wall list；When the network address that described request accesses is in fire wall list, Confirming that described data message mates with described network monitoring information, record testing result is not for pass through；Work as institute The network address that request of stating accesses, not in fire wall list, confirms that described data message is supervised with described network Control information is not mated, and record testing result is for passing through.

12. routers according to claim 11, it is characterised in that described monitoring content also wraps Include: time data；

Described reception also configures module, also includes: time configuration submodule, for from described monitoring content The described time data of middle acquisition, when configuring the monitoring of described network monitoring information according to described time data Between；

Described packet check module, also includes: time detecting submodule, for obtaining current time letter Breath, detects whether described temporal information is positioned at monitoring period；When described temporal information is positioned at monitoring period In, record testing result is not for pass through；When described temporal information is not positioned at monitoring period, call network address Detection sub-module performs the network address whether step in fire wall list that detection request accesses.

13. routers according to claim 11, it is characterised in that described monitoring content also wraps Include: message recognition rule,

Described reception also configures module, including: recognition rule configuration submodule, in described monitoring Appearance obtains message recognition rule, described message recognition rule is stored as described network monitoring information In the local cache of described router；

Described packet check module, also includes: recognition rule detection sub-module, for according to local cache In message recognition rule described data message is identified, when data message described in None-identified, Record testing result is nonrecognition, performs the step that described data message is sent to network to be uploaded to clothes Business device is analyzed；When being capable of identify that described data message, perform described data message is sent to net The step of network is so that described monitored device accesses the webpage that described data message is corresponding.

14. according to the router described in any one of claim 9 to 13, it is characterised in that

Described reception also configures module, is additionally operable to receive the monitoring content of server update；According to described more New monitoring content updates described network monitoring information.

15. routers according to claim 9, it is characterised in that also include:

Monitored device configuration module, for collecting the equipment of each lan device accessing described router Information generates lan device list；Feed back the facility information in described lan device list for user Select monitored device；From described lan device list, LAN is selected according to the instruction information of user Equipment adds in watch-list as monitored device, the facility information obtaining described monitored device.

16. routers according to claim 15, it is characterised in that also include:

Equipment Inspection module, receives the data message that lan device sends, obtains according to described data message Take the address information of lan device；Detect whether described lan device is prison according to described address information The monitored device of configuration in control list；When described lan device is non-monitored device, by described Data message is sent to network.

17. 1 kinds of network access control systems, it is characterised in that including: subscriber equipment, server and Router described in the claims 9-13,15 any one.