A network access information management method, device and computer readable storage medium

Abstract

Embodiments of the present application disclose a network access information management method, device and computer readable storage medium; in the embodiments of the present application, after obtaining the network access process currently running and extracting the network access request in the network access process, the intercepted address in the intercepted address set is matched based on the identity mark, the basic intercepted address corresponding to the network access request is obtained, the network data packet is identified and processed according to the type of network data packet, and the identified access address and the basic intercepted address are intercepted and configured to determine the intercepted list corresponding to the network access request, when the access address is the intercepted address needing interception in the intercepted list, the network access request is intercepted according to the type of access address, so that the data security of local data is effectively protected. The scheme can improve the management efficiency of network access information. The present embodiment can be applied to cloud technology, artificial intelligence, intelligent transportation and various scenes.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of communication technology, in particular to a network access information management method and device and a computer readable storage medium. BACKGROUND

[0002] In recent years, with the rapid development of Internet technology, the resources on the network are also more and more rich. The network resources are mixed with good and bad, and when accessing these network resources, there are also risks, so it is necessary to manage the network access information corresponding to the network access behavior. The existing network access information management is often that the access behavior control module (network access control DLL) is injected into each network access process or a specific browser process to manage the network access information.

[0003] In the research and practice process of the prior art, the inventor of the present application found that injecting the network access control DLL into the network access process can easily affect the user state process, and injecting the network access control DLL into the browser process often cannot manage the network access of non-browser processes, and some browsers have anti-injection logic, which causes the network access control DLL injection to fail, so that the management efficiency of the network access information is greatly reduced. SUMMARY

[0004] The embodiments of the present application provide a network access information management method, device and computer readable storage medium, which can improve the management efficiency of network access information.

[0005] A network access information management method, comprising:

[0006] obtaining a currently running network access process, and extracting a network access request in the network access process, the network access request carrying an identity and a network data packet;

[0007] Based on the identity, the interception addresses in the interception address set are matched to obtain the basic interception address corresponding to the network access request;

[0008] According to the type of the network data packet, the network data packet is subjected to access address identification processing to obtain the access address corresponding to the network access request;

[0009] The access address and the basic interception address are subjected to interception configuration to determine the interception list corresponding to the network access request;

[0010] When the access address is an interception address that needs to be intercepted in the interception list, the network access request is intercepted according to the type of the access address.

[0011] Correspondingly, the embodiment of the present application provides a network access information management device, comprising:

[0012] an acquisition unit configured to acquire a network access process running currently and extract a network access request from the network access process, the network access request carrying an identity and a network data packet;

[0013] a matching unit configured to perform matching processing on an interception address in a set of interception addresses based on the identity to obtain a basic interception address corresponding to the network access request;

[0014] an identification unit configured to perform access address identification processing on the network data packet according to a type of the network data packet to obtain an access address corresponding to the network access request;

[0015] a determination unit configured to perform interception configuration on the access address and the basic interception address to determine an interception list corresponding to the network access request;

[0016] an interception unit configured to perform interception on the network access request according to a type of the access address when the access address is an interception address required to be intercepted in the interception list.

[0017] Optionally, in some embodiments, the identification unit can be specifically configured to perform domain name resolution on the network data packet when the network data packet is a user data packet, and take a first network domain name and a first network address resolved as the access address corresponding to the network access request; perform network address identification in the network data packet when the network data packet is a transmission data packet, and take a second network address identified as the access address corresponding to the network access request; and perform network domain name identification in the network data packet when the network data packet is an application data packet, and take a second network domain name identified as the access address corresponding to the network access request.

[0018] Optionally, in some embodiments, the identification unit can be specifically configured to filter out domain name protocol data of a preset port in the network data packet; and perform resolution on the domain name protocol data to obtain the first network domain name and the first network address.

[0019] Optionally, in some embodiments, the determining unit can be specifically configured to extract a network domain name blacklist, a network domain name whitelist and a network address whitelist from the basic interception address; update a network address blacklist based on the first network address when the first network domain name matches the network domain name blacklist; add the first network address to the network address whitelist when the first network domain name matches the network domain name whitelist; and take the network domain name whitelist, the network domain name blacklist, the network address whitelist and the updated network address blacklist as an interception list corresponding to the network access request; and the intercepting the network access request according to the type of the access address when the access address is an interception address that needs to be intercepted in the interception list comprises: intercepting the network access request according to the type of the access address when the access address matches the network domain name blacklist or the updated network address blacklist.

[0020] Optionally, in some embodiments, the intercepting unit can be specifically configured to intercept a network connection established by the network access request when the access address is a second network address; and intercept a network data packet in the network access request when the access address is a second network domain name.

[0021] Optionally, in some embodiments, the intercepting unit can be specifically configured to obtain connection data of a network connection established by the network access request; add an interception identifier in the interception data to obtain target connection data; and send the target connection data to a first server corresponding to the network connection, so that the first server discards the target connection data.

[0022] Optionally, in some embodiments, the intercepting unit can be specifically configured to obtain an unencrypted original network data packet corresponding to the network data packet; add an interception identifier in the original network data packet to obtain target network data packet; and send the target network data packet to a second server corresponding to the second network domain name, so that the second server discards the target network data packet.

[0023] Optionally, in some embodiments, the matching unit can be specifically configured to determine a target group corresponding to the network access request according to the identity; and filter out an interception address corresponding to the target group from the interception address set to obtain a basic interception address corresponding to the network access request.

[0024] Optionally, in some embodiments, the network access information management apparatus can further comprise a configuration unit, which can be specifically configured to obtain interception configuration information, and parse the interception configuration information to obtain an interception process whitelist, a basic network domain name interception blacklist, a basic network domain name interception whitelist, and a basic network address interception whitelist; delete interception addresses that are duplicated in the basic network domain name interception blacklist and the basic network domain name whitelist to obtain a target network domain name interception blacklist, and use the target network domain name interception blacklist, the basic network domain name interception whitelist, and the basic network address interception whitelist as the interception address set; and obtain the network access process currently running, including obtaining at least one candidate network access process currently running, and filtering the candidate network access process based on the interception process whitelist to obtain the network access process.

[0025] Optionally, in some embodiments, the configuration unit can be specifically configured to obtain security configuration information of a current terminal, and determine a network interception state of the current terminal according to the security configuration information; when the network interception state is a start state, send an interception configuration request to a security server; and receive interception configuration information corresponding to the interception configuration request returned by the security server.

[0026] Optionally, in some embodiments, the configuration unit can be specifically configured to, when receiving interception configuration update information sent by the security server, obtain updated interception configuration information; and replace the interception configuration information corresponding to the interception configuration request with the updated interception configuration information.

[0027] Optionally, in some embodiments, the configuration unit can be specifically configured to display an interception configuration page, the interception configuration page comprising a group list, the group list comprising at least one group and a basic identity of at least one terminal joining the group; in response to a selection operation on the basic identity, display an interception strategy configuration page, the interception strategy configuration page comprising an interception address list; in response to a selection operation on the interception address list, generate interception configuration page information; and send the interception configuration page information to the security server, so that the security server generates interception configuration information based on the interception page configuration information.

[0028] Optionally, in some embodiments, the configuration unit can be specifically configured to display a group application page, the group application page comprising a group identity input control; receive a group identity input through the group identity input control, and add a basic identity of a terminal to a group corresponding to the group identity to obtain group information; and generate the interception configuration page based on the group information.

[0029] In addition, the embodiment of the present application further provides an electronic device, comprising a processor and a memory, wherein the memory stores an application program, and the processor is used to run the application program in the memory to realize the network access information management method provided by the embodiment of the present application.

[0030] In addition, the embodiment of the present application further provides a computer readable storage medium, wherein the computer readable storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor to execute the steps in any one of the network access information management methods provided by the embodiment of the present application.

[0031] In the embodiment of the present application, after a current running network access process is acquired and a network access request is extracted in the network access process, the interception address in the interception address set is matched based on the identity to obtain a basic interception address corresponding to the network access request, then the access address of the network data packet is identified based on the type of the network data packet to obtain an access address corresponding to the network access request, then the access address and the basic interception address are intercepted to determine an interception list corresponding to the network access request, and when the access address is an interception address that needs to be intercepted in the interception list, the network access request is intercepted according to the type of the access address. Since the network access process is directly intercepted in the embodiment, the network access request in the network access process is intercepted based on the interception list, and the network access control DLL does not need to be injected into the network access process, and the corresponding access address can be identified according to the type of the network data packet, so that various types of network access processes can be managed, and therefore the management efficiency of the network access information management can be improved. BRIEF DESCRIPTION OF DRAWINGS

[0032] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative effort.

[0033] Figure 1 is a scene diagram of the network access information management method provided by the embodiment of the present application;

[0034] Figure 2 is a flow diagram of the network access information management method provided by the embodiment of the present application;

[0035] Figure 3 is a page diagram of an interception strategy configuration page provided by the embodiment of the present application;

[0036] Figure 4 is a page diagram of a group application page provided by the embodiment of the present application;

[0037] Figure 5 is a page schematic diagram of a prompt page of successful group joining provided by an embodiment of the present application;

[0038] Figure 6 is a schematic diagram of determining an interception list corresponding to a network access request provided by an embodiment of the present application;

[0039] Figure 7 is a page schematic diagram of an interception page provided by an embodiment of the present application;

[0040] Figure 8 is a structural schematic diagram of a WFP framework provided by an embodiment of the present application;

[0041] Figure 9 is a flow schematic diagram of TCP / IP flow information management provided by an embodiment of the present application;

[0042] Figure 10 is another flow schematic diagram of network access information management provided by an embodiment of the present application;

[0043] Figure 11 is another flow schematic diagram of a network access information management method provided by an embodiment of the present application;

[0044] Figure 12 is a structural schematic diagram of a network access information management device provided by an embodiment of the present application;

[0045] Figure 13 is another structural schematic diagram of a network access information management device provided by an embodiment of the present application;

[0046] Figure 14 is a structural schematic diagram of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0047] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the present application.

[0048] The embodiments of the present application provide a network access information management method, device and computer readable storage medium. The network access information device can be integrated in an electronic device, which can be a server, a terminal or other device.

[0049] The server can be a stand-alone physical server, a server cluster composed of multiple physical servers, or a distributed system, and can also be a cloud server providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, network acceleration services (Content Delivery Network, CDN), and basic cloud computing services such as big data and artificial intelligence platforms. The terminal can be a smart phone, a tablet computer, a notebook computer, a desktop computer, a smart speaker, a smart watch, and the like, but is not limited thereto. The terminal and the server can be directly or indirectly connected through wired or wireless communication, and the present application is not limited in this regard.

[0050] For example, referring to Figure 1 For example, referring to

[0051] The network access information can be information of a user when accessing a network, and can include a network access request, a network data packet carried by the network access request, a network connection or a communication connection established through the network access request, or information generated by a network access behavior of the user. The network access information management can be understood as managing the network access behavior of the user. The management can include two aspects: one is to allow or pass the network access behavior of the user accessing a permitted access address, and the other is to intercept the network access behavior of the user accessing an unpermitted access address. For example, in an organization, the work of members of a team or an organization is managed to prevent employees from accessing irrelevant content during work, thereby improving the human efficiency of the enterprise.

[0052] The following will be described in detail. It should be noted that the order of the following embodiments is not limited to the preferred order of the embodiments.

[0053] The embodiment will be described from the perspective of a network access information management device, which can be integrated in an electronic device, which can be a server, a terminal, or the like. The terminal can include a tablet, a notebook computer, a personal computer (PC), a wearable device, a virtual reality device, or other smart devices that can manage network access information.

[0054] A network access information management method includes:

[0055] A network access process currently running is obtained, and a network access request is extracted from the network access process. The network access request carries an identity and a network packet. Based on the identity, a matching process is performed on the interception addresses in the interception address set to obtain a basic interception address corresponding to the network access request. According to the type of the network packet, an access address identification process is performed on the network packet to obtain an access address corresponding to the network access request. The access address and the basic interception address are subjected to interception configuration to determine an interception list corresponding to the access address. When the access address is an interception address that needs to be intercepted in the interception list, the network access request is intercepted according to the type of the access address.

[0056] As shown in Figure 2 , the specific process of the network access information management method is as follows:

[0057] 101. A network access process currently running is obtained, and a network access request is extracted from the network access process.

[0058] The network access process can be understood as a process triggered by a network access behavior. The network access process can include a network access request for network access. The network access request can be a request to access a network. The network access request can carry an identity and a network packet. The identity can be the identity of a user, a client, or a terminal that triggers a network access behavior or a network access request. The network packet can be a data packet composed of data for data communication in network access. The data packet can include various types, such as UDP data packets, TCP data packets, or data packets corresponding to HTTP / HTTPS protocols. These data packets can form TCP / IP data traffic.

[0059] The network access process currently running can be obtained in various ways, as follows:

[0060] For example, at least one candidate network access process currently running can be obtained, and the candidate network process is filtered based on an interception process white list to obtain the network access process.

[0061] The manner of obtaining the at least one currently running candidate network access process can be various. For example, current process information can be obtained, the currently running processes are identified in the current process information, the currently running processes are classified, the processes for network access are filtered from the currently running processes based on the classification result, and the candidate network access processes are obtained.

[0062] After the candidate network access processes are obtained, the candidate network access processes can be filtered based on the interception process whitelist. The filtering manner can be various. For example, the candidate network access processes can be matched with the processes in the interception process whitelist, and the candidate network access processes that fail to match are intercepted, so that the network access processes are obtained. In addition, the candidate network access processes that successfully match are released, and are not intercepted, so that the process for managing or issuing the interception configuration information for the network access information is not intercepted.

[0063] Optionally, before the network access processes are obtained, the interception configuration information can be obtained, and the interception configuration is performed based on the interception configuration information, so that the interception address set is obtained. For example, the interception configuration information is obtained, the interception configuration information is parsed, the interception process whitelist, the basic network domain name interception blacklist and the basic network address interception whitelist are obtained, the interception addresses that are repeated in the basic network domain name whitelist are deleted from the basic network domain name interception blacklist, the target network domain name interception blacklist is obtained, and the target network domain name interception blacklist, the basic network domain name interception whitelist and the basic network address whitelist are taken as the interception address set.

[0064] The interception address set can include at least one interception address that needs to be intercepted and at least one interception address that does not need to be intercepted. The interception address can include a network domain name and a network address. The network domain name can be understood as a character identifier (URL) for identifying and positioning a computer hierarchy structure on the Internet. The network address can be understood as an Internet protocol address, for example, an IP protocol address. In addition, the interception whitelist can be understood as an access address that does not need to be intercepted, and the interception blacklist can be understood as an access address that needs to be intercepted. The access address can include a network domain name and a network address. The difference between the access address and the interception address is that the access address is an address that a user needs to access, and the interception address is an access address that needs to be intercepted or released for the user's access behavior.

[0065] The interception configuration information can be understood as configuration information for intercepting the network access behavior of the user. The interception configuration information can be configured by the administrator on the security terminal and distributed to the local by the security server. The interception configuration information can be obtained in various ways. For example, the security configuration information of the current terminal can be obtained, and the network interception state of the current terminal can be determined according to the security configuration information. When the network interception state is in the start state, the interception configuration request is sent to the security server, and the interception configuration information corresponding to the interception configuration request returned by the security server is received.

[0066] The security configuration information is used to indicate the start state of the security service in the current terminal. The security service can include various services, such as access address detection or network interception service. In addition, when the administrator closes the network interception service function in the background, the network interception service is stopped through the driver after the security configuration information is obtained and the network interception state corresponding to the network interception service is detected to be in the closed state. The user can normally access the network. When the administrator modifies the interception configuration information in the background, the administrator can also receive prompt information sent by the security server to update the interception configuration information. The update method can be various, such as replacing the interception configuration information corresponding to the interception configuration request with the updated interception configuration information when receiving the interception configuration update information sent by the security server.

[0067] Optionally, before obtaining the security configuration information, the interception configuration information can also be configured on the security terminal to generate the interception configuration information. The configuration method can be various, such as displaying an interception configuration page, the interception configuration page including a group list, the group list including at least one group and the basic identity of at least one terminal joined in the group, displaying an interception policy configuration page in response to a selection operation on the basic identity, the interception policy configuration page including an interception address list, generating interception page configuration information in response to a selection operation on the interception address list, and sending the interception page configuration information to the security server to enable the security server to generate the interception configuration information based on the interception page configuration information.

[0068] The one or more operations performed in response to the condition or state on which the operation depends can be real-time or have a set delay when the condition or state on which the operation depends is met. When not specifically stated, there is no limitation on the execution order of the multiple operations performed.

[0069] The interception configuration page can be a page for an administrator to configure interception of user network access behavior, and the interception configuration page can include at least one group and a basic identity of at least one terminal that joins the group. The interception policy configuration page can be a page for configuring an interception policy for a selected terminal or user, and specifically can be as shown in Figure 3 The so-called interception policy can be understood as setting an interception address blacklist that needs to be intercepted and an interception address whitelist that does not need to be intercepted. The interception address blacklist and the interception address whitelist can include at least one access address, and the access address can include a network domain name (URL) and a network address (IP address).

[0070] Optionally, before displaying the interception configuration page, the user can also apply to join the corresponding group. For example, a group application page is displayed, the group application page includes a group identifier input control, receives a group identifier input through the group identifier input control, and adds a basic identity of the terminal to a group corresponding to the group identifier to obtain group information. Based on the group information, the interception configuration page is generated.

[0071] The group application page can be a page for a user to apply to join a group. In the group application page, a group identifier input control can be included. Taking a company PIN code as an example, the group application page can be as shown in Figure 4 By inputting the corresponding company PIN code, the user can join the group of the company. After successfully joining the group corresponding to the company, a prompt page indicating successful group joining can be displayed, and can be as shown in Figure 5

[0072] 102. Based on the identity, the interception addresses in the interception address set are matched to obtain a basic interception address corresponding to the network access request.

[0073] The interception address can include a blacklist of interception addresses that are intercepted and a whitelist of interception addresses that are directly passed. The interception address can include a network domain name and a network address.

[0074] The way of matching the interception addresses in the interception address set based on the identity can be various, and specifically can be as follows:

[0075] For example, the target group corresponding to the network access request can be determined according to the identity, the interception addresses corresponding to the target group are filtered out from the interception address set, and the basic interception address corresponding to the network access request is obtained.

[0076] ​The target group corresponding to the network access request can be determined in various manners. For example, the identity can be used to query the group list to obtain the group corresponding to the identity, and the group corresponding to the identity can be used as the target group corresponding to the network access request.

[0077] The basic interception address can include a network domain name blacklist, a network domain name whitelist, and a network address whitelist.

[0078] 103. The network data packet is subjected to an access address identification process according to the type of the network data packet, to obtain an access address corresponding to the network access request.

[0079] The network data packet can be a data packet for information transmission or connection of network connection or network communication. The network data packet can include multiple types, such as a user data packet, a transmission data packet, and an application data packet. The user data packet can be a UDP data packet, the transmission data packet can be a TCP data packet, and the application data packet can be a data packet corresponding to an HTTP / HTTPS protocol.

[0080] The access address can be a target address for network access. The access address can include a network domain name (URL) and a network address (IP).

[0081] The network data packet can be subjected to an access address identification process in various manners. Specifically, the network data packet can be subjected to an access address identification process in the following manners:

[0082] For example, when the network data packet is a user data packet, the network data packet is subjected to domain name resolution, and a first network domain name and a first network address obtained by the resolution are used as the access address corresponding to the network access request. When the network data packet is a transmission data packet, a network address in the network data packet is identified, and a second network address obtained by the identification is used as the access address corresponding to the network access request. When the network data packet is an application data packet, a network domain name in the network data packet is identified, and a second network domain name obtained by the identification is used as the access address corresponding to the network access request.

[0083] When the network data packet is a user data packet, the network data packet can be subjected to domain name resolution in various manners. For example, domain name protocol data of a preset port in the network data packet can be filtered, and the domain name protocol data can be subjected to resolution to obtain a first network domain name and a first network address.

[0084] The domain name protocol data can be protocol data in DNS protocol flow with a port number of 53 in the UDP data packet. The resolution of the domain name protocol data mainly involves resolving the DNS protocol, so that IP and domain name information can be obtained. The domain name information is used as the first network domain name, and the IP is used as the first network address.

[0085] When the network packet is a transmission packet, the network packet can be identified in multiple ways. For example, the TCP packet can be parsed when the TCP protocol is connected, so as to obtain a remote IP (Internet Protocol), and the obtained remote IP is taken as the second network address.

[0086] When the network packet is an application packet, the network domain name in the network packet can be identified in multiple ways. For example, the HTTP protocol header in the network packet can be parsed, so as to obtain domain name information of a connection, and the obtained domain name information is taken as the second network domain name.

[0087] 104. The access address and the basic interception address are intercepted and configured to determine the interception list corresponding to the network access request.

[0088] The interception configuration can be understood as configuring the access address and the basic interception address as the interception list. The specific configuration method can be to determine the access address, and based on the determination result, the basic interception address is adjusted, so as to obtain the interception list used for intercepting the network access request. The interception list can include an interception blacklist and an interception whitelist.

[0089] The interception list can include an interception blacklist and an interception whitelist for the access address. The access address can include a network domain name (URL) and a network address (IP).

[0090] The access address and the basic interception address can be intercepted and configured in multiple ways to determine the interception list. Specifically, the following methods can be used:

[0091] For example, the network domain name blacklist, the network domain name whitelist, and the network address whitelist are extracted from the basic interception address. When the first network domain name matches the network domain name blacklist, the network address blacklist is updated based on the first network address. When the first network domain name matches the network domain name whitelist, the first network address is added to the network address whitelist. The network domain name whitelist, the network domain name blacklist, the network address whitelist, and the updated network address blacklist are taken as the interception list corresponding to the network access request.

[0092] The network address blacklist needs to be updated because the blacklist IP and the whitelist IP information are continuously stored in the kernel layer. Since the DNS resolution has a time limit, the kernel module needs to clean up the blacklist IP regularly, and the whitelist IP is allowed by default, so it will not be cleaned up during the life cycle of the system. The network address blacklist needs to be updated after each DNS resolution.

[0093] The intercept list corresponding to the network access request is mainly updated according to the DNS resolution result to update the network address black list and the network address white list, and can be as shown in the following. Figure 6 The intercept configuration information issued by the security server includes a default black list URL policy (network domain name black list), a default white list URL policy (network domain name white list), and a default white IP policy (network address white list). By issuing the three intercept policies, the network access and policy issuing process corresponding to the security terminal or the security server can be ensured not to be intercepted by itself. The three policies are fused in the application layer to obtain the intercept configuration information, which is issued to the current terminal by the security server. The IP information of the classification policy is updated by the driver layer DNS resolution (the IP list is updated), so that the black list IP list (network address black list) and the white list IP list (network address white list) can be obtained.

[0094] 105、When the access address is an intercept address that needs to be intercepted in the intercept list, the network access request is intercepted according to the type of the access address.

[0095] The intercept address that needs to be intercepted can be a network domain name black list and an updated network address black list. Therefore, when the access address matches the network domain name black list or the updated network address black list, it can be determined that the access address is an intercept address that needs to be intercepted in the intercept list.

[0096] When it is determined that the access address is an intercept address that needs to be intercepted in the intercept list, the network access request needs to be intercepted. The interception method can be various, and can be as follows:

[0097] For example, when the access address is a second network address, the network connection established by the network access request is intercepted, and when the access address is a second network domain name, the network data packet in the network access request is intercepted.

[0098] The network connection established by the network access request can be intercepted in various ways, such as obtaining the connection data of the network connection established by the network access request, adding an intercept identifier in the intercepted data to obtain target connection data, sending the target connection data to a first server corresponding to the network connection, and making the first server discard the target connection data, so as to intercept the network access request.

[0099] The connection data of the network connection established by the network access request can be understood as TCP connection data, which can be connection data generated in the TCP three-way handshake, and the connection data can be obtained by registering the FWPS_LAYER_ALE_AUTH_CONNECT layer in the Windows Filter Platform (WFP) framework. After the interception identifier of the connection blocking is returned to the TCP / IP protocol stack through the WFP framework, the first server discards the target connection data marked with the interception identifier, so as to achieve the purpose of intercepting the network access request.

[0100] The network data packet in the network access request can be intercepted in various ways, such as obtaining the original network data packet corresponding to the network data packet without encryption, adding an interception identifier in the original network data packet to obtain a target network data packet, and sending the target network data packet to the second server corresponding to the second network domain name, so that the second server discards the target network data packet, thereby intercepting the network access request.

[0101] The network data packet sent through the HTTP / HTTPS protocol is encrypted when passing through the proxy tunnel protocol, but the plaintext information of the connection, i.e., the original network data packet, can be obtained before the tunnel is established. The original network data packet can be obtained in various ways, such as registering a callback function through the WFP framework FWPS_LAYER_STEAM_DATA layer to obtain the outgoing data information, thereby obtaining the original network data packet. Then, the data packet blocking identifier (interception identifier) is returned to the TCP / IP protocol stack through the WFP framework, so that the second server discards the target network data packet. Therefore, the interception method for the network data packet can be interception of the TCP data sent out.

[0102] Optionally, when the access address does not match the network domain name blacklist or the updated network address blacklist, or when the access address matches the network domain name whitelist or the network address whitelist, the network access request is released, so that the user or the terminal can normally access the network.

[0103] After intercepting the network access request, an interception page can be displayed on the current terminal, as shown in Figure 7 The scheme can intercept and modify the data of each layer of the TCP / IP protocol through the WFP framework, and from the user side, the user has no awareness, the behavior is similar to the system, and the user feels that the system restricts the online behavior. The WFP framework can also be called the EFP filtering framework, which can be used to conveniently implement network firewall, intrusion detection system, network detection, and other system software. The specific structure is as shown in Figure 8As shown, the filtering engine of the WFP can interact with each layer of the seven-layer network model to process network data at different layers, perform transparent network behavior control through the driver, thereby avoiding bypassing, and because the logic is embedded in the TCP / IP protocol stack, the system has high stability.

[0104] In the entire process of managing network access information, the TCP / IP flow information generated by the user's network access can be managed. The management method can be understood as intercepting or passing the network access request through the blacklist policy information. The entire management process can be as follows Figure 9 As shown, the user or the terminal of the user needs to join the group, and the terminal can pull the security configuration information to determine the network interception state of the current terminal. When the network interception state is the start state, the blacklist policy information (interception configuration information) can be pulled to start the online management and control module. The online management and control module is mainly a driver module based on the WFP framework. The driver module intercepts the flow information of the TCP / IP protocol stack. Each data packet flow passing through the protocol stack will flow through the online behavior management and control driver module. Then, when the data packet flow is UDP flow, the DNS protocol flow with the filter port number 53 is intercepted to parse the DNS protocol to obtain IP and domain name information. Then, it is judged whether the domain name matches the network domain name blacklist and the network domain name whitelist. The IP blacklist and the IP whitelist are determined based on the matching result. When the data packet flow is TCP flow, the TCP protocol connection is parsed to obtain the Remote IP. Then, it is judged whether the IP matches the IP blacklist and the IP whitelist. When the IP matches the IP blacklist, the TCP connection is intercepted. When the IP matches the IP whitelist or the IP does not match the IP blacklist, no interception is performed. When the data packet flow is HTTP / HTTPS protocol flow, the HTTP protocol header is parsed to obtain the domain name information of the connection. It is judged whether the domain name matches the domain name blacklist. When the domain name matches the domain name blacklist, the flow data is intercepted. When the domain name does not match the domain name blacklist or the domain name matches the domain name whitelist, no interception is performed, and the network access request is passed.

[0105] In summary, the entire process of managing network access information can be found that the network access request in the network flow information and the network data packet carried in the network access request are mainly managed. The main management method is interception or passing, such as Figure 10The application shows a group application page, so that the user or user terminal joins the corresponding target group through the group application page, displays an interception configuration page, generates interception page information through the interception configuration page, sends the interception page information to the security server, and receives the interception configuration information generated by the security server based on the interception page information. Based on the interception configuration information, the network access process currently running is obtained, and the network access request is extracted in the network access process. The interception configuration information is parsed to obtain an interception address set, and the interception address corresponding to the identity carried in the network access request is filtered out in the interception address set to obtain the basic interception address corresponding to the network access request. The network data packet carried in the network access request is identified to obtain the packet type of the network data packet. When the network data packet is a user data packet, the protocol data of the preset port of the user data packet is filtered, and the protocol data is parsed to obtain a first network domain name and a first network address. The first network domain name is matched with the network domain name blacklist and the network domain name whitelist in the basic interception address. When the first network domain name matches the network domain name blacklist successfully, the first network address corresponding to the first network domain name is added to the network address blacklist. When the first network domain name matches the network domain name whitelist successfully, the first network address corresponding to the first network domain name is added to the network address whitelist. When the network data packet is a transmission data packet, the connection data in the transmission data packet is parsed to obtain a second network address, and the second network address is matched with the network address blacklist and the network address whitelist. When the second network address matches the network address blacklist successfully, the connection data in the transmission data packet is intercepted. When the second network address matches the network address whitelist successfully, or the second network address fails to match the network address blacklist, the network access request is released. When the network data packet is an application data packet, the protocol header of the preset data protocol of the application data packet is parsed to obtain a second network domain name, and the second network domain name is matched with the network domain name blacklist. When the second network domain name matches the network domain name blacklist successfully, the application data packet is intercepted. When the second network domain name fails to match the network domain name blacklist, the network access request is released, thereby realizing management of the network access information.

[0106] From the above, the embodiment of the application obtains the currently running network access process, extracts the network access request in the network access process, and performs matching processing on the interception address in the interception address set based on the identity to obtain the basic interception address corresponding to the network access request. Then, the network data packet is identified according to the type of the network data packet to obtain the access address corresponding to the network access request. Then, the access address and the basic interception address are intercepted to determine the interception list corresponding to the network access request. When the access address is the interception address that needs to be intercepted in the interception list, the network access request is intercepted according to the type of the access address. Since the scheme directly intercepts the currently running network access process, the network access request in the network access process is intercepted based on the interception list, without the need to inject the network access control DLL in the network access process. Moreover, the corresponding access address can be identified according to the type of the network data packet, so that various types of network access processes can be managed. Therefore, the management efficiency of network access information management can be improved.

[0107] According to the method described in the above embodiment, the following will be further described in detail by way of example.

[0108] In this embodiment, the network access information management device is specifically integrated in an electronic device, the electronic device is a terminal, the user data packet is a UDP data packet, the transmission data packet is a TCP data packet, the application data packet is an HTTP / HTTPS protocol data packet, and the network address is an IP address.

[0109] As shown in Figure 11 A network access information management method, the specific process is as follows:

[0110] 201. The terminal obtains interception configuration information.

[0111] For example, the terminal displays a group application page, the group application page includes a group identity input control, receives a group identity input through the group identity input control, and adds a basic identity of the terminal to a group corresponding to the group identity to obtain group information. Based on the group information, an interception configuration page is generated.

[0112] The terminal displays the interception configuration page, the interception configuration page includes a group list, the group list includes at least one group and the basic identity of at least one terminal joined in the group. In response to a selection operation on the basic identity, an interception strategy configuration page is displayed, the interception strategy configuration page includes an interception address list. In response to a selection operation on the interception address list, interception page configuration information is generated. The interception page configuration information is sent to a security server, so that the security server generates interception configuration information based on the interception page configuration information.

[0113] The terminal acquires security configuration information of the terminal, and determines a network interception state of the terminal according to the security configuration information. When the network interception state is a start state, the terminal sends an interception configuration request to the security server, and receives interception configuration information corresponding to the interception configuration request returned by the security server.

[0114] Optionally, when receiving the interception configuration update information sent by the security server, the terminal can also acquire the updated interception configuration information, and replace the interception configuration information corresponding to the interception configuration request with the updated interception configuration information.

[0115] 202. The terminal acquires a network access process currently running based on the interception configuration information, and extracts a network access request in the network access process.

[0116] For example, the terminal parses the interception configuration information to obtain an interception process white list, a basic network domain name interception black list, and a basic network address interception white list. The terminal acquires current process information, identifies a process currently running in the current process information, classifies the process currently running, filters a process for network access in the process currently running based on a classification result to obtain a candidate network access process, matches the candidate network access process with a process in the interception process white list, and intercepts the candidate network access process that fails to match, thereby obtaining a network access process. The terminal extracts a network access request in the network access process, and the network access request includes a network data packet and an identity of a user or the terminal.

[0117] 203. The terminal matches an interception address in an interception address set based on the identity, to obtain a basic interception address corresponding to the network access request.

[0118] For example, the terminal deletes an interception address that is repeated in the basic network domain name white list from the basic network domain name interception black list in the parsed interception configuration information, to obtain a target network domain name interception black list. The terminal takes the target network domain name interception black list, the basic network domain name interception white list, and a basic network address white list as the interception address set. The terminal queries a group corresponding to the identity in a group list, and takes the group corresponding to the identity as a target group corresponding to the network access request. The terminal filters an interception address corresponding to the target group from the interception address set, to obtain the basic interception address corresponding to the network access request.

[0119] 204. The terminal identifies an access address of the network data packet according to a type of the network data packet, to obtain an access address corresponding to the network access request.

[0120] For example, when the network packet is a UDP packet, the terminal can filter the protocol data in the DNS protocol flow with a port number of 53 in the UDP packet, parse the DNS protocol, so as to obtain IP and domain name information, take the domain name information as the first network domain name, and take the IP as the first IP address.

[0121] When the network packet is a TCP packet, the terminal can parse the TCP packet when the TCP protocol is connected, so as to obtain a Remote IP, and take the obtained Remote IP as the second IP address.

[0122] When the network packet is an HTTP / HTTPS protocol packet, the terminal can parse the HTTP protocol header in the network packet, so as to obtain the domain name information of the connection, and take the obtained domain name information as the second network domain name.

[0123] 205, the terminal intercepts the access address and the basic interception address to determine the interception list corresponding to the network access request.

[0124] For example, the terminal extracts the network domain name blacklist, the network domain name whitelist and the network address whitelist in the basic interception address, updates the IP address blacklist based on the first IP address when the first network domain name matches the network domain name blacklist, adds the first IP address to the IP address whitelist when the first network domain name matches the network domain name whitelist, and takes the network domain name whitelist, the network domain name blacklist, the IP address whitelist and the updated IP address blacklist as the interception list corresponding to the network access request.

[0125] 206, when the access address is an interception address that needs to be intercepted in the interception list, the network access request is intercepted according to the type of the access address.

[0126] For example, when the access address matches the network domain name blacklist or the updated network address blacklist, the access address is determined as an interception address in the interception list that needs to be intercepted. When the access address is the second IP address, the connection data of the network connection established by the network access request is obtained through registration at the FWPS_LAYER_ALE_AUTH_CONNECT layer in the WFP framework, and the interception identifier of the connection blocking is returned to the TCP / IP protocol stack, so that the first server discards the target connection data marked with the interception identifier, thereby achieving the purpose of intercepting the network access request. When the access address is the second network domain name, the unencrypted original network packet corresponding to the outgoing network packet is obtained through the callback function registered at the FWPS_LAYER_STEAM_DATA layer in the WFP framework, and the packet blocking mark (interception identifier) is returned to the TCP / IP protocol stack through the WFP framework, so that the second server discards the target network packet, thereby intercepting the network access request.

[0127] Optionally, when the access address does not match the network domain name blacklist or the updated network address blacklist, or when the access address matches the network domain name whitelist or the network address whitelist, the network access request is released, so that the user or the terminal can normally access the network.

[0128] As can be seen from the above, in the embodiment, after the terminal obtains the currently running network access process and extracts the network access request in the network access process, the basic interception address corresponding to the network access request is obtained by matching the interception addresses in the interception address set based on the identity identifier, then the access address corresponding to the network access request is obtained by identifying the access address of the network packet according to the type of the network packet, and then the interception configuration of the access address and the basic interception address is performed to determine the interception list corresponding to the network access request. When the access address is an interception address in the interception list that needs to be intercepted, the network access request is intercepted according to the type of the access address. Since the scheme directly intercepts the currently running network access process and intercepts the network access request in the network access process based on the interception list, it is not necessary to inject the network access control DLL in the network access process, and the corresponding access address can be identified according to the type of the network packet, so that various types of network access processes can be managed, and therefore the management efficiency of network access information management can be improved.

[0129] In order to better implement the above method, an embodiment of the present application further provides a network access information management device, which can be integrated in an electronic device, such as a server or a terminal device. The terminal device can include a tablet computer, a notebook computer, and / or a personal computer, etc.

[0130] For example, as shown in FIG. 1, the network access information management device can be integrated in a terminal device, such as a server or a terminal device. Figure 12As shown, the network access information apparatus can include an acquisition unit 301, a matching unit 302, an identification unit 303, a determination unit 304, and an interception unit 305, as follows:

[0131] (1) The acquisition unit 301;

[0132] The acquisition unit 301 is configured to acquire a network access process that is currently running, and extract a network access request from the network access process, the network access request carrying an identity and a network packet.

[0133] For example, the acquisition unit 301 can be specifically configured to acquire current process information, identify a process that is currently running from the current process information, classify the process that is currently running, based on a classification result, filter a process for network access from the process that is currently running to obtain a candidate network access process, match the candidate network access process with a process in a white list of intercepted processes, and intercept a candidate network access process that fails to match, thereby obtaining the network access process, and extracting the network access request from the network access process, the network access request carrying the identity and the network packet.

[0134] (2) The matching unit 302;

[0135] The matching unit 302 is configured to perform matching processing on an interception address in a set of interception addresses based on the identity, to obtain a basic interception address corresponding to the network access request.

[0136] For example, the matching unit 302 can be specifically configured to query a group corresponding to the identity in a group list, take the group corresponding to the identity as a target group corresponding to the network access request, filter an interception address corresponding to the target group from the set of interception addresses, and obtain the basic interception address corresponding to the network access request.

[0137] (3) The identification unit 303;

[0138] The identification unit 303 is configured to perform identification processing on the network packet according to a type of the network packet, to obtain an access address corresponding to the network access request.

[0139] For example, the identification unit 303 can be specifically configured to, when the network packet is a user packet, perform domain name resolution on the network packet, and take a first network domain name and a first network address resolved as the access address corresponding to the network access request, when the network packet is a transmission packet, perform network address identification on the network packet, and take a second network address identified as the access address corresponding to the network access request, and when the network packet is an application packet, perform network domain name identification on the network packet, and take a second network domain name identified as the access address corresponding to the network access request.

[0140] The determining unit 304 is configured to perform interception configuration on the access address and the basic interception address to determine the interception list corresponding to the network access request.

[0141] The determining unit 304 is configured to extract the network domain name blacklist, the network domain name whitelist and the network address whitelist from the basic interception address, update the network address blacklist based on the first network address when the first network domain name matches the network domain name blacklist, add the first network address to the network address whitelist when the first network domain name matches the network domain name whitelist, and take the network domain name whitelist, the network domain name blacklist, the network address whitelist and the updated network address blacklist as the interception list corresponding to the network access request.

[0142] The determining unit 304 is configured to extract the network domain name blacklist, the network domain name whitelist and the network address whitelist from the basic interception address, update the network address blacklist based on the first network address when the first network domain name matches the network domain name blacklist, add the first network address to the network address whitelist when the first network domain name matches the network domain name whitelist, and take the network domain name whitelist, the network domain name blacklist, the network address whitelist and the updated network address blacklist as the interception list corresponding to the network access request.

[0143] The intercepting unit 305 is configured to intercept the network access request according to the type of the access address when the access address is an interception address that needs to be intercepted in the interception list.

[0144] The intercepting unit 305 is configured to intercept the network access request according to the type of the access address when the access address is an interception address that needs to be intercepted in the interception list.

[0145] For example, the intercepting unit 305 can be specifically configured to determine that the access address is an interception address that needs to be intercepted in the interception list when the access address matches the network domain name blacklist or the updated network address blacklist. When the access address is the second network address, the intercepting unit 305 is configured to obtain connection data of a network connection established by the network access request, add an interception identifier to the interception data to obtain target connection data, and send the target connection data to a first server corresponding to the network connection, so that the first server discards the target connection data, thereby intercepting the network access request. When the access address is the second network domain name, the intercepting unit 305 is configured to obtain an unencrypted original network data packet corresponding to the network data packet, add an interception identifier to the original network data packet to obtain a target network data packet, and send the target network data packet to a second server corresponding to the second network domain name, so that the second server discards the target network data packet, thereby intercepting the network access request.

[0146] Optionally, the network access information management apparatus can further include a configuration unit 306, as shown in Figure 13 The configuration unit 306 can be specifically configured as follows:

[0147] The configuration unit 306 is configured to obtain interception configuration information and parse the interception configuration information to obtain an interception address set.

[0148] For example, the configuration unit 306 can be specifically configured to acquire security configuration information of the current terminal, and determine a network interception state of the current terminal according to the security configuration information. When the network interception state is a start state, the configuration unit 306 sends an interception configuration request to a security server, and receives interception configuration information corresponding to the interception configuration request returned by the security server. The interception configuration information is parsed to obtain an interception process white list, a basic network domain name interception blacklist and a basic network address interception white list. The interception addresses that are repeated in the basic network domain name interception blacklist and the basic network domain name white list are deleted to obtain a target network domain name interception blacklist. The target network domain name interception blacklist, the basic network domain name interception white list and the basic network address white list are taken as an interception address set.

[0149] In a specific implementation, the units can be implemented as independent entities, or combined as one or more entities, and the specific implementation of the units can refer to the method embodiments above, which will not be described here.

[0150] As can be seen from the above, after the acquisition unit 301 acquires a network access process currently running and extracts a network access request in the network access process, the matching unit 302 matches the interception addresses in the interception address set based on the identity to obtain a basic interception address corresponding to the network access request. Then, the identification unit 303 identifies the network data packet based on the type of the network data packet to obtain an access address corresponding to the network access request. Then, the determination unit 304 determines the interception configuration of the access address and the basic interception address to determine an interception list corresponding to the network access request. When the access address is an interception address that needs to be intercepted in the interception list, the interception unit 305 intercepts the network access request according to the type of the access address. Since the scheme directly intercepts the network access process currently running and intercepts the network access request in the network access process based on the interception list, it is not necessary to inject a network access control DLL in the network access process. Moreover, the corresponding access address can be identified according to the type of the network data packet, so that various types of network access processes can be managed, and therefore, the management efficiency of network access information management can be improved.

[0151] The embodiment of the application further provides an electronic device, as shown in the figure, which shows a structural schematic diagram of the electronic device related to the embodiment of the application, and specifically: Figure 14

[0152] The electronic device can include a processor 401 with one or more processing cores, a memory 402 with one or more computer readable storage media, a power supply 403 and an input unit 404, and the like. Those skilled in the art can understand that the electronic device can further include other components, which will not be described here. Figure 14 ​The electronic device structure shown in the figure does not constitute a limitation on the electronic device, and can include more or fewer components than shown, or combine certain components, or arrange different components. Among them:

[0153] The processor 401 is the control center of the electronic device, connects various parts of the entire electronic device through various interfaces and lines, executes various functions of the electronic device and processes data by running or executing software programs and / or modules stored in the memory 402, and calling data stored in the memory 402, thereby overall detecting the electronic device. Optionally, the processor 401 can include one or more processing cores; preferably, the processor 401 can integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application program, etc., and the modem processor mainly processes wireless communication. It can be understood that the above-mentioned modem processor can also not be integrated into the processor 401.

[0154] The memory 402 can be used to store software programs and modules, and the processor 401 executes various functions and data processing by running the software programs and modules stored in the memory 402. The memory 402 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application program required by a function (such as a sound playing function, an image playing function, etc.), etc.; the data storage area can store data created according to the use of the electronic device, etc. In addition, the memory 402 can include a high-speed random access memory, and can also include a non-volatile memory, such as at least one magnetic disk storage device, a flash memory device, or other volatile solid-state memory device. Accordingly, the memory 402 can also include a memory controller to provide access for the processor 401 to the memory 402.

[0155] The electronic device also includes a power supply 403 for supplying power to various components, and preferably the power supply 403 can be logically connected to the processor 401 through a power management system, so as to realize functions such as management of charging, discharging, and power consumption management through the power management system. The power supply 403 can also include one or more direct current or alternating current power supplies, a recharging system, a power supply failure detection circuit, a power supply converter or inverter, a power supply state indicator, and any other components.

[0156] The electronic device can also include an input unit 404, which can be used to receive input digital or character information, and generate keyboard, mouse, joystick, optical or trackball signal inputs related to user settings and function control.

[0157] Although not shown, the electronic device can further include a display unit and the like, which will not be described herein. In particular, in the present embodiment, the processor 401 in the electronic device will load the executable file corresponding to the process of one or more application programs into the memory 402 according to the following instructions, and run the application program stored in the memory 402 by the processor 401, thereby realizing various functions, as follows:

[0158] The network access process currently running is obtained, and a network access request carrying an identity and a network packet is extracted from the network access process. Based on the identity, the interception addresses in the interception address set are matched to obtain a basic interception address corresponding to the network access request. According to the type of the network packet, the network packet is subjected to identification processing of the access address to obtain an access address corresponding to the network access request. The access address and the basic interception address are subjected to interception configuration to determine an interception list corresponding to the access address. When the access address is an interception address that needs to be intercepted in the interception list, the network access request is intercepted according to the type of the access address.

[0159] For example, after obtaining the current process information, the electronic device identifies the currently running process in the current process information, classifies the currently running process, filters the process for network access in the currently running process based on the classification result, obtains the candidate network access process, matches the candidate network access process with the processes in the interception process white list, intercepts the candidate network access process that fails to match, and obtains the network access process. The network access request is extracted from the network access process, and the network access request carries an identity and a network packet. The identity corresponding group is queried in the group list, and the identity corresponding group can be used as the target group corresponding to the network access request. The interception address corresponding to the target group is filtered in the interception address set to obtain the basic interception address. When the network packet is a user packet, the network packet is domain name resolved, and the first network domain name and the first network address resolved are used as the access address corresponding to the network access request. When the network packet is a transmission packet, the network address is identified in the network packet, and the second network address identified is used as the access address corresponding to the network access request. When the network packet is an application packet, the network domain name is identified in the network packet, and the second network domain name identified is used as the access address corresponding to the network access request. The network domain name blacklist, the network domain name whitelist, and the network address whitelist are extracted in the basic interception address. When the first network domain name matches the network domain name blacklist, the network address blacklist is updated based on the first network address. When the first network domain name matches the network domain name whitelist, the first network address is added to the network address whitelist. The network domain name whitelist, the network domain name blacklist, the network address whitelist, and the updated network address blacklist are used as the interception list corresponding to the network access request. When the access address matches the network domain name blacklist or the updated network address blacklist, it can be determined that the access address is an interception address that needs to be intercepted in the interception list. When the access address is the second network address, the connection data of the network connection established by the network access request is obtained, the interception identifier is added in the interception data to obtain the target connection data, the target connection data is sent to the first server corresponding to the network connection, so that the first server discards the target connection data, thereby intercepting the network access request; when the access address is the second network domain name, the original network packet without encryption corresponding to the network packet is obtained, the interception identifier is added in the original network packet to obtain the target network packet, and the target network packet is sent to the second server corresponding to the second network domain name, so that the second server discards the target network packet, thereby intercepting the network access request.

[0160] The specific implementation of each operation can be referred to the foregoing embodiments, which will not be repeated here.

[0161] From the above, the embodiment of the present application obtains the currently running network access process, extracts the network access request in the network access process, and performs matching processing on the interception addresses in the interception address set based on the identity to obtain the basic interception address corresponding to the network access request. Then, the network data packet is processed to identify the access address based on the type of the network data packet to obtain the access address corresponding to the network access request. Then, the access address and the basic interception address are intercepted to determine the interception list corresponding to the network access request. When the access address is the interception address that needs to be intercepted in the interception list, the network access request is intercepted according to the type of the access address. Since the scheme directly intercepts the currently running network access process, the network access request in the network access process is intercepted based on the interception list, without the need to inject the network access control DLL in the network access process. In addition, the corresponding access address can be identified according to the type of the network data packet, so that various types of network access processes can be managed. Therefore, the management efficiency of network access information management can be improved.

[0162] Those skilled in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructions or by controlling related hardware by instructions, which can be stored in a computer readable storage medium and loaded and executed by a processor.

[0163] To this end, the embodiment of the present application provides a computer readable storage medium, which stores a plurality of instructions capable of being loaded by a processor to execute the steps in any network access information management method provided by the embodiment of the present application. For example, the instructions can execute the following steps:

[0164] The currently running network access process is obtained, and the network access request is extracted in the network access process. The network access request carries an identity and a network data packet. The interception addresses in the interception address set are matched based on the identity to obtain the basic interception address corresponding to the network access request. The network data packet is processed to identify the access address based on the type of the network data packet to obtain the access address corresponding to the network access request. The access address and the basic interception address are intercepted to determine the interception list corresponding to the access address. When the access address is the interception address that needs to be intercepted in the interception list, the network access request is intercepted according to the type of the access address.

[0165] For example, current process information is acquired, and a currently running process is identified in the current process information. The currently running process is classified, and based on the classification result, a process for network access is filtered out from the currently running process to obtain a candidate network access process. The candidate network access process is matched with processes in the interception process white list, and the candidate network access process that fails to match is intercepted to obtain a network access process. A network access request is extracted from the network access process, and the network access request carries an identity and a network packet. The identity corresponding group is queried in the group list, and the identity corresponding group can be used as a target group corresponding to the network access request. An interception address corresponding to the target group is filtered out in the interception address set to obtain a basic interception address. When the network packet is a user packet, a first network domain name and a first network address resolved by domain name resolution of the network packet are used as access addresses corresponding to the network access request. When the network packet is a transmission packet, a second network address is identified in the network packet, and the second network address is used as the access address corresponding to the network access request. When the network packet is an application packet, a second network domain name is identified in the network packet, and the second network domain name is used as the access address corresponding to the network access request. A network domain name blacklist, a network domain name whitelist, and a network address whitelist are extracted in the basic interception address. When the first network domain name matches the network domain name blacklist, the network address blacklist is updated based on the first network address. When the first network domain name matches the network domain name whitelist, the first network address is added to the network address whitelist. The network domain name whitelist, the network domain name blacklist, the network address whitelist, and the updated network address blacklist are used as an interception list corresponding to the network access request. When the access address matches the network domain name blacklist or the updated network address blacklist, it is determined that the access address is an interception address that needs to be intercepted in the interception list. When the access address is the second network address, connection data of a network connection established by the network access request is acquired, an interception identifier is added in interception data to obtain target connection data, and the target connection data is sent to a first server corresponding to the network connection, so that the first server discards the target connection data, thereby intercepting the network access request. When the access address is the second network domain name, an original network packet that is not encrypted corresponding to the network packet is acquired, an interception identifier is added in the original network packet to obtain target network data packet, and the target network data packet is sent to a second server corresponding to the second network domain name, so that the second server discards the target network data packet, thereby intercepting the network access request.

[0166] The specific implementation of each operation can be referred to the foregoing embodiments, which will not be described herein.

[0167] The computer readable storage medium can include a read only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0168] The steps of any of the network access information management methods provided by the embodiments of the present application can be executed due to the instructions stored in the computer readable storage medium, thus the beneficial effects of any of the network access information management methods provided by the embodiments of the present application can be achieved, which will be described in detail in the foregoing embodiments and will not be repeated here.

[0169] According to an aspect of the present application, a computer program product or computer program is provided, which includes computer instructions stored in a computer readable storage medium. A processor of a computer device reads the computer instructions from the computer readable storage medium, and the processor executes the computer instructions, so that the computer device executes the method provided in any of the various optional implementation manners of the network access information management aspects or the online behavior management and control aspects.

[0170] The network access information management method, device and computer readable storage medium provided by the embodiments of the present application are described in detail above, and the principles and implementation manners of the present application are described by applying specific examples in this paper. The above description of the embodiments is only used to help understand the method of the present application and its core idea; meanwhile, for those skilled in the art, the specific implementation manners and application ranges will be changed according to the idea of the present application, and the above description should not be understood as a limitation of the present application.

Claims

1. A network access information management method characterized by comprising: The method comprises the following steps: After a user or a terminal of the user joins a group, pulling security configuration information; Determining a network interception state of a current terminal through the security configuration information; When the network interception state is a start state, pulling interception configuration information to start an online management and control module, the online management and control module comprising a drive module based on a WFP framework, the drive module intercepting traffic information of a TCP / IP protocol stack, each data packet flowing through the drive module of the online behavior management and control; wherein the interception configuration information is generated in the following manner: displaying an interception configuration page, the interception configuration page comprising a group list, the group list comprising at least one group and basic identity identifiers of at least one terminal joining the group; in response to a selection operation on the basic identity identifiers, displaying an interception strategy configuration page, the interception strategy configuration page comprising an interception address list; in response to a selection operation on the interception address list, generating interception configuration page information; sending the interception configuration page information to a security server, so that the security server generates interception configuration information based on the interception configuration page information; Obtaining a currently running network access process and extracting a network access request from the network access process, the network access request carrying an identity identifier and a network data packet; Based on the identity identifier, performing matching processing on interception addresses in an interception address set to obtain a basic interception address corresponding to the network access request, the interception address set being obtained by analyzing the interception configuration information; According to the type of the network data packet, performing identification processing on the access address of the network data packet to obtain an access address corresponding to the network access request; Performing interception configuration on the access address and the basic interception address to determine an interception list corresponding to the network access request; When the access address is an interception address that needs to be intercepted in the interception list, intercepting the network access request according to the type of the access address.

2. The network access information management method according to claim 1, characterized by, The identification processing on the access address of the network data packet according to the type of the network data packet to obtain an access address corresponding to the network access request comprises: When the network data packet is a user data packet, performing domain name resolution on the network data packet, and taking a first network domain name and a first network address resolved as the access address corresponding to the network access request; When the network data packet is a transmission data packet, identifying a second network address in the network data packet, and taking the second network address identified as the access address corresponding to the network access request; When the network data packet is an application data packet, identifying a second network domain name in the network data packet, and taking the second network domain name identified as the access address corresponding to the network access request.

3. The network access information management method according to claim 2, wherein The domain name resolution on the network data packet comprises: Filtering a domain name protocol data of a preset port in the network data packet; Resolving the domain name protocol data to obtain the first network domain name and the first network address.

4. The network access information management method according to claim 3, wherein The access address and the basic interception address are intercepted and configured to determine the interception list corresponding to the network access request, and the method comprises the following steps: Extracting a network domain name blacklist, a network domain name whitelist and a network address whitelist from the basic interception address; When the first network domain name matches the network domain name blacklist, updating the network address blacklist based on the first network address; When the first network domain name matches the network domain name whitelist, adding the first network address to the network address whitelist; The network domain name whitelist, the network domain name blacklist, the network address whitelist and the updated network address blacklist are used as the interception list corresponding to the network access request; When the access address is an interception address that needs to be intercepted in the interception list, the network access request is intercepted according to the type of the access address, and the method comprises the following steps: when the access address matches the network domain name blacklist or the updated network address blacklist, the network access request is intercepted according to the type of the access address.

5. The network access information management method according to claim 4, characterized by, The network access request is intercepted according to the type of the access address, and the method comprises the following steps: When the access address is a second network address, the network connection established by the network access request is intercepted; When the access address is a second network domain name, the network data packet in the network access request is intercepted.

6. The network access information management method according to claim 5, wherein The network connection established by the network access request is intercepted, and the method comprises the following steps: Obtaining connection data of the network connection established by the network access request; Adding an interception identifier in the connection data to obtain target connection data; Sending the target connection data to a first server corresponding to the network connection, so that the first server discards the target connection data.

7. The network access information management method according to claim 5, wherein The network data packet in the network access request is intercepted, and the method comprises the following steps: Obtaining an unencrypted original network data packet corresponding to the network data packet; Adding an interception identifier in the original network data packet to obtain target network data packet; Sending the target network data packet to a second server corresponding to the second network domain name, so that the second server discards the target network data packet.

8. The network access information management method according to any one of claims 1 to 7, characterized by, The identity identifier is used for matching processing on the interception addresses in the interception address set to obtain the basic interception address corresponding to the network access request, and the method comprises the following steps: According to the identity identifier, a target group corresponding to the network access request is determined; The interception address corresponding to the target group is filtered out from the interception address set to obtain the basic interception address corresponding to the network access request.

9. The network access information management method according to claim 8, wherein Before obtaining the currently running network access process, the method further comprises the following steps: Obtaining interception configuration information and parsing the interception configuration information to obtain an interception process whitelist, a basic network domain name interception blacklist, a basic network domain name interception whitelist and a basic network address interception whitelist; The intercept address set is obtained by deleting the intercept addresses that are repeated in the basic network domain name interception blacklist from the basic network domain name interception blacklist, and the target network domain name interception blacklist, the basic network domain name interception whitelist and the basic network address interception whitelist are obtained as the intercept address set; The network access process includes at least one candidate network access process, and the network access process is obtained by filtering the candidate network access process based on the intercept process whitelist.

10. The network access information management method according to claim 9, wherein The intercept configuration information includes: The network intercept state of the current terminal is determined according to the security configuration information of the current terminal. When the network intercept state is the start state, the intercept configuration request is sent to the security server. The intercept configuration information corresponding to the intercept configuration request is received from the security server.

11. The network access information management method according to claim 10, wherein Further comprising: When the intercept configuration update information sent by the security server is received, the updated intercept configuration information is obtained. The intercept configuration information corresponding to the intercept configuration request is replaced by the updated intercept configuration information.

12. The network access information management method according to claim 1, wherein Before the intercept configuration page is displayed, further comprising: A group application page is displayed, and the group application page includes a group identifier input control. A group identifier input through the group identifier input control is received, and a basic identity identifier of a terminal is added to a group corresponding to the group identifier to obtain group information. The intercept configuration page is generated based on the group information.

13. A network access information management apparatus characterized by comprising: Further comprising: The device is further configured to pull security configuration information after a user or a terminal of the user joins a group. The network intercept state of the current terminal is determined based on the security configuration information. When the network intercept state is the start state, the intercept configuration information is pulled to start the online management and control module, the online management and control module includes a drive module based on the WFP framework, the drive module intercepts traffic information of a TCP / IP protocol stack, and each data packet flow passing through the protocol stack flows through the drive module of the online behavior management and control; wherein the intercept configuration information is generated in the following manner: an intercept configuration page is displayed, the intercept configuration page includes a group list, the group list includes at least one group and a basic identity identifier of at least one terminal that joins the group; in response to a selection operation on the basic identity identifier, an intercept strategy configuration page is displayed, the intercept strategy configuration page includes an intercept address list; in response to a selection operation on the intercept address list, intercept configuration page information is generated; and the intercept configuration page information is sent to a security server, so that the security server generates intercept configuration information based on the intercept configuration page information. An obtaining unit is configured to obtain a network access process currently running, and extract a network access request from the network access process, the network access request carrying an identity identifier and a network data packet. A matching unit is configured to perform matching processing on the intercepted addresses in a set of intercepted addresses based on the identity identifier, to obtain a basic intercepted address corresponding to the network access request, the set of intercepted addresses being obtained by parsing the interception configuration information; An identifying unit is configured to perform access address identifying processing on the network data packet according to the type of the network data packet, to obtain an access address corresponding to the network access request; A determining unit is configured to perform interception configuration on the access address and the basic intercepted address, to determine an interception list corresponding to the network access request; An intercepting unit is configured to perform interception on the network access request according to the type of the access address, when the access address is an intercepted address that needs to be intercepted in the interception list.

14. An electronic device, comprising: A computer program product is provided, which includes a processor and a memory, the memory storing an application program, and the processor being configured to run the application program in the memory to perform the steps in the network access information management method according to any one of claims 1 to 12.

15. A computer program product comprising computer programs / instructions, characterized in that, The computer program / instruction is executed by the processor to implement the steps in the network access information management method according to any one of claims 1 to 12.

16. A computer readable storage medium characterized by: The computer readable storage medium stores a plurality of instructions, which are adapted to be loaded by the processor to perform the steps in the network access information management method according to any one of claims 1 to 12.

Images