Network access control method and device

Abstract

The invention discloses a network access control method and device. The method comprises the following steps: under the condition that a first mobile terminal and a first mobile subscriber number are bound, generating an authorization binding record of the first mobile terminal according to a first identifier and a first binding number, and storing the authorization binding record in an information register of a controlled terminal; and acquiring and analyzing a telephone traffic data set of the first binding number, screening out a mobile subscriber number of which the intimacy with the first binding number meets a preset condition, determining the screened-out mobile subscriber number as a first authorized number, and adding the first authorized number into an authorized binding record of the first mobile terminal. According to the scheme, the authorization binding record in the information register of the controlled terminal is updated in a self-adaptive manner, so that machine-card separation and terminal embezzlement are effectively prevented and controlled, higher flexibility and adaptability are achieved, and diversified actual scene requirements such as terminal giving, multi-person sharing and the like are met.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a network access control method and device. Background Art

[0002] In mobile communication networks, the pairing relationship between user terminal devices and SIM cards can effectively reflect the user's access behavior and usage patterns in the network. With the diversification of user device types and Internet access scenarios, some users may frequently change terminals or use SIM cards on unintended devices, resulting in the phenomenon of "device-card separation". In some scenarios, this phenomenon may affect the operator's accurate perception of user behavior, interfere with the implementation of operational strategies (such as the existing "device-card binding" contract sales model), and even cause security risks such as resource abuse and fraud. Therefore, preventing and controlling machine-card separation is an important business requirement in current operations management.

[0003] Related technologies typically identify and monitor device-SIM separation by establishing a one-time mapping relationship between the phone number associated with the SIM card and the terminal device. However, these solutions suffer from fixed mapping relationships and insufficient flexibility, making them difficult to adapt to the dynamic needs of actual terminal applications, potentially impacting user experience, and failing to accurately and continuously prevent and control device-SIM separation. Summary of the Invention

[0004] The embodiments of the present application provide a network access control method and device that can effectively prevent and control machine-card separation while having higher flexibility and adaptability.

[0005] In a first aspect, an embodiment of the present application provides a network access control method, the method comprising:

[0006] In the case of binding the first mobile terminal to the first mobile user number, generating an authorized binding record of the first mobile terminal according to the first identifier and the first binding number, and storing the record in the controlled terminal information register, where the first identifier is the terminal identifier of the first mobile terminal, and the first binding number is the first mobile user number;

[0007] Acquire and analyze the call traffic data set of the first bound number, screen out mobile user numbers whose intimacy with the first bound number meets a preset condition, determine the screened mobile user numbers as first authorized numbers, and add them to the authorized binding record of the first mobile terminal;

[0008] In response to receiving a network access request sent by a terminal to be networked, parsing out a target terminal identifier and a target mobile user number of the terminal to be networked;

[0009] Matching the authorization binding record in the controlled terminal information register based on the target terminal identifier and the target mobile user number;

[0010] Based on the matching results, the terminal is allowed or denied to access the network.

[0011] In a second aspect, an embodiment of the present application provides a network access control device, the device comprising:

[0012] a data acquisition module, configured to generate, when binding the first mobile terminal to the first mobile user number, an authorized binding record of the first mobile terminal based on the first identifier and the first binding number, and store the record in a controlled terminal information register, where the first identifier is the terminal identifier of the first mobile terminal and the first binding number is the first mobile user number;

[0013] an authorization maintenance module, configured to obtain and analyze a set of call traffic data of the first bound number, screen out mobile user numbers whose intimacy with the first bound number meets a preset condition, determine the screened mobile user numbers as first authorized numbers, and add them to the authorization binding record of the first mobile terminal;

[0014] The network element device is configured to parse out a target terminal identifier and a target mobile user number of the terminal to be networked in response to receiving a network access request sent by the terminal to be networked;

[0015] The machine-card separation prevention and control module is used to match the authorization binding record in the controlled terminal information register based on the target terminal identification and the target mobile user number, and allow or deny the terminal to access the network according to the matching result.

[0016] In a third aspect, an embodiment of the present application provides a computer device, comprising: a processor, and a memory storing computer program instructions; the processor reads and executes the computer program instructions to implement any one of the methods in the first aspect above.

[0017] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having computer program instructions stored thereon, which implement any one of the methods in the first aspect when executed by a processor.

[0018] In a fifth aspect, an embodiment of the present application provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements any one of the methods in the first aspect above.

[0019] The technical solutions provided by the embodiments of this application bring at least the following beneficial effects:

[0020] The network access control method provided in the embodiments of this application achieves flexible control over terminal access behavior by constructing an authorization binding record based on the terminal identifier and the mobile user number, combining it with traffic data analysis to dynamically identify authorized numbers with high communication intimacy, and accordingly expanding the terminal's set of legally accessible numbers. Compared to the existing approach based on one-time number binding, this solution effectively prevents and controls device-card separation while offering greater flexibility and adaptability. It can meet the needs of diverse practical scenarios such as terminal donation and multi-person sharing, thereby improving the practicality and intelligence of terminal access control. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application.

[0022] Figure 1 This is a flow chart of a network access control method provided by an embodiment of the present application;

[0023] Figure 2 This is a flow chart of a network access control method provided by an embodiment of the present application;

[0024] Figure 3 This is a flow chart of a network access control method provided by an embodiment of the present application;

[0025] Figure 4 This is a schematic diagram of the structure of a network access control device provided in an embodiment of the present application;

[0026] Figure 5 This is a schematic diagram of the structure of a network access control device provided in an embodiment of the present application;

[0027] Figure 6 This is a flow chart of a network access control method provided by an embodiment of the present application;

[0028] Figure 7 It is a structural diagram of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0029] In order to make those of ordinary skill in the art better understand the technical solutions of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings. It should be understood that the specific embodiments described herein are only intended to explain the present application, rather than to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is merely to provide a better understanding of the present application by illustrating the examples of the present application.

[0030] It should be noted that the terms "first," "second," and the like in the specification and claims of this application and the accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate so that the embodiments of the application described herein can be implemented in an order other than those illustrated or described herein. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples consistent with certain aspects of the present application as detailed in the appended claims.

[0031] As mentioned in the technical background section, preventing and controlling device-card separation is a critical business and technical requirement in current operations management. A particularly critical application scenario is the "device-card binding" contract phone sales model currently widely adopted by operators.

[0032] In the communications industry, operators often increase user stickiness and revenue by selling "device-SIM binding" terminal devices (contract phones) to users. This model requires users to use the terminal device (such as a mobile phone) with a designated SIM card provided by the operator and to promise not to replace the terminal or SIM card within a certain period of time. Through this binding mechanism, operators can not only effectively control terminal resources and share terminal subsidy costs, but also achieve long-term user retention and stable operations.

[0033] However, in order to circumvent contract restrictions, some users may insert the SIM card into other devices after purchasing the phone, resulting in "phone-card separation" behavior. This behavior will bring risks to the operator's contract control, subsidy recovery and customer management, so effective technical means are urgently needed to prevent and control it.

[0034] In the existing technology, operators or equipment manufacturers usually bind the phone number corresponding to the SIM card with the unique identifier of the mobile terminal device through a one-time binding. They collect relevant information during the terminal's network access request and compare it with the binding relationship in the background database: if it matches, access is allowed to continue; if it does not match, access may be directly denied or restricted by activating the pre-installed lock screen program on the mobile phone. Although such a solution can achieve basic machine-card binding protection functions, its binding relationship is fixed once established, lacks flexibility, and cannot adapt to the needs of changing device ownership during actual use. For example, a user may give the terminal device to a family member, relative or friend for continued use. Although this behavior is not profit-making or malicious, it may still be judged by the system as machine-card separation, thereby triggering a restriction policy. This not only does not conform to the user's normal usage habits, making it impossible to achieve the true prevention and control purpose, but also significantly reduces the user's willingness to purchase terminal devices from the operator, affecting the user experience.

[0035] In addition, the above solution is mainly aimed at the sales scenarios of strongly bound contract machines, lacks personalized configuration and adaptability, cannot cover more application scenarios that require machine-card separation and prevention and control, and is difficult to promote to all users. There are obvious limitations in both technical applicability and business expansion capabilities.

[0036] In order to solve this technical problem, the embodiment of the present application provides a network access control method and device, which integrates communication traffic data to dynamically identify authorized numbers with high communication intimacy with the current user, and accordingly constructs or expands the terminal's legal access number set to achieve refined and flexible control of terminal access behavior. This method not only ensures the effectiveness of the machine-card binding strategy, but also improves the compatibility with normal user usage scenarios.

[0037] The network access control method provided in the embodiment of the present application is described in detail below through specific embodiments in conjunction with the accompanying drawings.

[0038] Figure 1 A flow chart of a network access control method provided by an embodiment of the present application is shown.

[0039] like Figure 1 As shown, the method may include the following steps.

[0040] S110: When binding the first mobile terminal to the first mobile user number, generate an authorization binding record of the first mobile terminal according to the first identifier and the first binding number, and store the record in a controlled terminal information register.

[0041] The first mobile terminal is a terminal device that can be inserted with a SIM card to access a mobile communication network. For example, the first terminal device may include, but is not limited to, a smartphone, a tablet computer, an in-vehicle communication device, or other user equipment with cellular communication capabilities.

[0042] The first identifier is a terminal identifier of the first mobile terminal, used to identify the identity of the first mobile terminal. For example, the first identifier can be an International Mobile Equipment Identity (IMEI), which is preset by the device manufacturer and can be sensed by the network side to uniquely identify a specific terminal device.

[0043] The first mobile subscriber number is a mobile station international subscriber directory number (MSISDN), which is a telephone number used to identify a user's access identity in a mobile network. In practical applications, an example of the first mobile subscriber number may be a number format such as "135****8888".

[0044] It should be understood that, generally, one SIM card corresponds to one MSISDN. When an operator activates communication services for a user, the operator assigns the MSISDN to the user account and writes it into the SIM card to achieve user identity identification and access to communication services.

[0045] It should also be understood that the term "first" used in this embodiment does not specifically refer to a specific device or number, but rather represents the general situation in which a binding relationship is established between any mobile terminal and any mobile user number. Specifically, in a mobile communication network, when any mobile terminal is bound to any user number, a corresponding authorized binding record can be generated based on the terminal's identification information and the bound mobile user number, for subsequent access control and binding status verification.

[0046] It should be noted that the "binding" in the embodiment of the present application can be generally understood as "machine-card binding", that is, the bound mobile user number (for ease of understanding and expression, it may be referred to as "telephone number" hereinafter) can only be used in the designated mobile terminal and cannot be used in other devices at will.

[0047] Under normal circumstances, there is no strong binding relationship between the mobile device used by the user and the phone number. The user can insert the SIM card into any compatible terminal device as needed to complete access and communication. However, in specific business scenarios, for the purpose of operational management or security protection, the operator or user may proactively initiate the binding operation between the device and the phone number, resulting in a situation of "binding the first mobile terminal to the first mobile user number."

[0048] For example, the application scenarios of the binding operation include but are not limited to the following two categories:

[0049] Carrier-initiated binding: If a user purchases a contract phone sold by a carrier with a "phone-card binding" contract, the carrier will bind the mobile device to a designated phone number upon shipment. This binding is implemented through network-side control policies to ensure compliance with contract phone sales policies and prevent users from circumventing contract restrictions.

[0050] User-initiated binding: If a user proactively activates the terminal anti-theft service, they can bind their designated terminal device to their personal phone number. If the terminal device is lost or stolen, even if someone else replaces the SIM card, they will not be able to use the terminal normally, thus improving device security.

[0051] It should be pointed out that the binding scenarios are not limited to the above two categories. The technical solutions provided in the embodiments of the present application are applicable to various application scenarios where machine-card binding is required, which are not listed here one by one.

[0052] Regardless of the scenario, when the operation of binding the first mobile terminal with the first mobile user number is performed, an authorization binding record of the first mobile terminal is generated according to the first identifier and the first binding number, and the authorization binding record is stored in the controlled terminal information register.

[0053] The authorization binding record is used to represent the binding relationship between a specific terminal device and a specific user number, and is a structured expression of the binding status.

[0054] For example, the authorization binding record may include the following information:

[0055] A first identifier, such as the IMEI code of the mobile terminal;

[0056] The first binding number, such as the MSISDN code;

[0057] Optionally, it may also include auxiliary information such as binding time, binding source (such as operator or user initiated), binding status (activated / released), binding validity period, etc.

[0058] It should be understood that the authorization binding record in the controlled terminal information register can be used for subsequent terminal access control judgment, that is, when the terminal initiates network access, it is determined whether to allow communication or trigger restriction measures based on whether the current terminal identification and the number to be accessed are consistent with the authorization binding record.

[0059] Exemplarily, the controlled terminal information register may store the authorization binding record in a relational database structure or a mapping structure.

[0060] S120. Acquire and analyze the traffic data set of the first bound number, screen out mobile user numbers whose intimacy with the first bound number meets preset conditions, determine the screened mobile user numbers as first authorized numbers, and add them to the authorized binding record of the first mobile terminal.

[0061] It should be noted that, in view of the defects of the current fixed binding method mentioned above, such as solidified binding relationship, poor adaptability, and limited user experience, the embodiment of the present application creatively proposes a dynamic adaptive mechanism for the controlled terminal information register, which can dynamically identify and update the authorization binding records stored in the controlled terminal information register based on the user's call behavior during actual communication, thereby realizing intelligent adjustment and personalized relaxation of terminal access policies.

[0062] On the basis of the "terminal identification-binding number" correspondence described in step S110, the element of authorization number is further introduced into the authorization binding record to expand the set of user numbers that the terminal device can legally access.

[0063] An authorized number is a mobile user number that is granted access to a specific mobile terminal without disrupting the original binding relationship with the mobile terminal. It should be understood that an authorized number is a collection of other mobile user numbers that have legal access to the terminal under certain conditions.

[0064] The embodiment of the present application transforms the mobile terminal access policy from static binding to dynamic empowerment through real-time learning and updating of authorized numbers, realizes flexible management of mobile terminal usage scenarios, effectively improves user experience, and ensures the effectiveness of operation control strategies.

[0065] Taking the authorization binding record generated by the first mobile terminal and the first binding number as an example, in addition to the first identifier and the first binding number, the record may also include a set of first authorization numbers. The first authorization numbers are a set of numbers that are temporarily or periodically allowed to access the terminal under the conditions of complying with the authorization policy.

[0066] In one implementation, the system determines the authorized number based on an active identification mechanism. Specifically, the system obtains and analyzes the call data set of the first bound number, selects mobile user numbers whose affinity with the first bound number meets preset conditions, determines the selected mobile user numbers as the first authorized number, and adds them to the authorized binding record of the first mobile terminal.

[0067] Traffic data refers to a collection of data that reflects the actual communication behavior of mobile users.

[0068] Exemplarily, the traffic data may include one or more data types of telecommunication traffic data, social application interaction data, and payment behavior data.

[0069] Telecommunications traffic data refers to the traffic data generated in the telecommunications operator's network.

[0070] For example, telecommunication traffic data may include but is not limited to voice call records (number of calls, call duration, call direction), short message (SMS and MMS) service records, and data service usage (such as hotspot sharing records).

[0071] Social application interaction data refers to the interaction data on application platforms that bypass the core networks of traditional telecom operators and provide communication or content services through the Internet.

[0072] For example, the social application interaction data may be obtained from an Internet OTT (Over-The-To, cross-operator service) platform.

[0073] For example, social application interaction data may include but is not limited to the frequency of message exchange, video call or voice call records, group interaction behavior, the frequency of comment forwarding behavior, etc.

[0074] Payment behavior data refers to the interactive behavior data conducted through mobile payment platforms.

[0075] Exemplarily, the payment behavior data is obtained from a payment platform.

[0076] For example, payment behavior data may include but is not limited to transfer records, account binding relationships, etc.

[0077] Intimacy, or communication intimacy, is an indicator used to measure the strength of the communication relationship between two mobile user numbers.

[0078] Exemplarily, the intimacy can be calculated based on the above-mentioned traffic data.

[0079] The preset condition may be a preset communication intimacy threshold.

[0080] Exemplarily, a mobile user number may be included in the first authorized number set only when the strength of the communication relationship between the number and the first bound number reaches the preset standard.

[0081] In one example, the call records of the first bound number within a certain time window can be counted to screen out other user numbers with high call frequency, stable call duration, and normal incoming and outgoing call ratio; if the call frequency between a certain number and the first bound number exceeds a preset threshold, it can be judged as a high communication intimacy number and included in the authorized number set of the first mobile terminal.

[0082] In one example, the account interaction data in the social platform application (such as instant messaging apps, short video platforms, social media, etc.) associated with the first bound number can be analyzed. If there is long-term and stable interactive behavior between the user account corresponding to a certain number and the account associated with the first bound number, such as frequent message exchanges, picture / video transmission, likes and comments, or joining multiple groups together, it can be considered that the two have a strong social relationship. Based on this, the system can determine that the number has the possibility of trusted authorized use and identify it as the first authorized number of the first mobile terminal.

[0083] In the embodiments of this application, the bound numbers and authorized numbers are collectively referred to as "authorized numbers," which are the set of all mobile user numbers that are granted legal access rights on a specific terminal. The introduction of the authorized number set breaks the rigid binding model of "unique number - unique terminal" and, while ensuring security, allows multiple numbers to share a terminal or for a terminal to be legally used under the control of multiple users, thereby better adapting to diverse usage scenarios such as terminal transfer or family sharing.

[0084] S130: In response to receiving the network access request sent by the terminal to be networked, parse out the target terminal identifier and target mobile user number of the terminal to be networked.

[0085] A terminal waiting to access the network refers to a mobile terminal device that is currently attempting to initiate a communication connection request through the operator's network.

[0086] It should be understood that the terminal to be connected to the network has not yet completed the network access authentication process and is in a waiting state.

[0087] For example, the terminal to be connected to the network may be a smart phone, a tablet computer, a vehicle-mounted terminal, a wearable device, or other terminal device that can be inserted with a SIM card and has network communication capabilities.

[0088] The target terminal identification refers to the device identification information used to identify the terminal to be connected to the network, namely the International Mobile Equipment Identity (IMEI).

[0089] The target mobile user number refers to the mobile user number corresponding to the SIM card inserted into the terminal to be connected to the network, that is, the Mobile Station International Subscriber Directory Number (MSISDN), which is also the user's telephone number in the communication network.

[0090] For example, in addition to the above two pieces of information, a traffic request can also be parsed from the network access request.

[0091] A traffic request refers to the specific type of communication service that a terminal that is about to access the network applies to the network side during the process of initiating network access.

[0092] Exemplarily, the types of traffic requests may include but are not limited to: call requests, text message requests, data service requests, etc.

[0093] In one implementation, when the terminal to be networked sends an operator network access application to the network element device of the nearest base station through an access link, the network element device will parse and process the received network access request, extract the target terminal identifier (such as IMEI), extract the target mobile user number (such as MSISDN), and analyze the accompanying call request type.

[0094] S140: Match the authorization binding record in the controlled terminal information register based on the target terminal identifier and the target mobile user number.

[0095] The target terminal identifier and the target mobile user number are used as joint query conditions to match the authorization binding record in the controlled terminal information register.

[0096] In one implementation, step S140 may be implemented by the following steps:

[0097] S141: Using the target terminal identifier as an index, query whether there is a target authorization binding record corresponding to the terminal to be networked in the controlled terminal information register.

[0098] S142: When the target authorization binding record is found, the target mobile user number is verified according to the target authorization number in the target authorization binding record.

[0099] This implementation uses the target terminal identifier as an index to retrieve the target authorization binding record in the controlled terminal information register. The target mobile user number of the terminal to be connected is then verified against the authorization number in the record, thereby efficiently verifying the binding relationship between the terminal and the user. By using the terminal identifier index to improve matching efficiency and verifying the authorization number set constructed using the binding number and authorization number, the accuracy and flexibility of access control are effectively enhanced, ensuring that only terminal-user combinations with valid authorization relationships can access the network, further improving the security and protection capabilities of network access.

[0100] S150: Based on the matching result, the terminal to be connected is allowed or denied to access the network.

[0101] This step is to determine whether the current network access request is legal based on the matching result of the controlled terminal information register in step S140, so as to decide whether to allow the terminal to access the operator's network.

[0102] In one implementation, step S150 may include the following steps:

[0103] S151: When the target mobile user number is any target authorized number, confirm that the match is successful, and allow the terminal to access the network.

[0104] The target authorized number refers to the set of all legally usable user numbers associated with the target terminal identity, which may include a bound number and one or more authorized numbers.

[0105] In this case, if the target mobile user number belongs to the set in the queried authorization binding record (ie, is consistent with the binding number or any authorized number), the network access request is considered to belong to the authorized scenario and can be released normally.

[0106] S152: If no target authorization binding record is found, or if the target mobile user number is different from any target authorization number, it is determined that the match fails and the receiving terminal is denied access to the network.

[0107] It is understandable that the matching failure situations can be divided into two categories:

[0108] No record is found, that is, no authorization binding record corresponding to the target terminal identifier is found in the controlled terminal information register;

[0109] The number does not match, that is, although there is an authorized binding record for the target terminal, the target mobile user number does not belong to the bound number or authorized number set.

[0110] The above situations all indicate that the network access request is unauthorized and may involve potential risks such as device lending, number theft, and black card access. Therefore, the network access request of the mobile device to be connected to the network is determined to be an illegal access request.

[0111] For example, the following operations may be performed:

[0112] Reject network registration and block communications;

[0113] Returns authentication failure prompt information;

[0114] Record request information in the audit log to facilitate subsequent tracing and analysis;

[0115] Guide the user to enter the authentication process for re-authorization and binding.

[0116] This implementation establishes a clear access control judgment mechanism, determining the access rights of a terminal based on the matching results of authorization binding records. When the target mobile user number successfully matches any authorized number in the authorization binding record, a valid authorization relationship is confirmed, and the terminal is allowed to access the network. If no authorization binding record is found, or if an authorized number is found but not successfully matched, the match is considered a failure and the terminal is denied access. This solution, through precise matching logic and judgment processes, effectively prevents unauthorized terminals from accessing the network, enhancing the security and accuracy of network access control.

[0117] The network access control method provided in the embodiments of this application achieves flexible control over terminal access behavior by constructing an authorization binding record based on the terminal identifier and the mobile user number, combining it with traffic data analysis to dynamically identify authorized numbers with high communication intimacy, and accordingly expanding the terminal's set of legally accessible numbers. Compared to the existing approach based on one-time number binding, this solution effectively prevents and controls device-card separation while offering greater flexibility and adaptability. It can meet the needs of diverse practical scenarios such as terminal donation and multi-person sharing, thereby improving the practicality and intelligence of terminal access control.

[0118] It is understood that in order to identify and analyze interactions between mobile user numbers, embodiments of this application require obtaining and utilizing traffic data related to the target mobile user number. Based on this requirement, this application proposes a social circle information register for storing interaction data sets between user numbers, thereby assisting in identifying trusted authorized parties and implementing more intelligent and dynamic terminal access control policies.

[0119] Exemplarily, the process of constructing or updating the social circle information register includes:

[0120] Real-time collection of historical traffic data corresponding to public land mobile network numbers (such as GSM numbers) bound to mobile terminals across the entire network;

[0121] Sorting out and counting the types of calls and interaction frequencies between each mobile user number and other users, such as calls (number of calls / called and duration), number of short / multimedia messages, etc.

[0122] Integrate and introduce interactive information from Internet service platforms and payment behavior data to improve the comprehensiveness and accuracy of authorization judgments.

[0123] It should be noted that, since 2016, mainstream Internet application platforms have generally implemented a real-name registration mechanism for mobile user numbers. Therefore, the interactive behavior data of the mobile user number on different service platforms (such as social, work, content sharing, etc.) can be unified and aggregated based on the mobile user number as an index.

[0124] Table 1 shows an exemplary structure of traffic data stored in the social circle information register.

[0125]

[0126] As shown in Table 1 above, the social circle information register stores interaction data between a specific user number and multiple peer numbers in multiple dimensions in a structured manner.

[0127] Telecommunications traffic data is calculated based on the past six months, with the average monthly number of calls to the other end number, the average monthly call duration, and the number of SMS or MMS sent.

[0128] The Internet platform interaction data uses the monthly message interaction frequency as the statistical dimension, and records the interaction intensity in different platform scenarios.

[0129] Payment platform behavior data is based on payment behaviors such as transactions and transfers between users, and calculates the average monthly number of interactions or amount.

[0130] Financial platform behavior data can be further expanded into auxiliary criteria for indirect interaction behaviors such as account sharing, joint bills, and joint payments.

[0131] For example, the data in Table 1 above shows that the average monthly number of calls between user numbers msisdn_A and msisdn_B in the past six months was 45, with a total call duration of 1,128 seconds and 5 text messages. At the same time, the two parties interacted and used messages on multiple internet platforms, and had an average monthly transaction behavior. Based on this, it can be judged that there is a strong interactive relationship between the two.

[0132] By building a social circle information register, we can connect and integrate multi-source heterogeneous traffic and interaction information, providing a unified data support and knowledge base for subsequent modules such as authorized number identification, trusted device access judgment, and intelligent early warning.

[0133] Figure 2 A flow chart of a network access control method provided in an embodiment of the present application is shown.

[0134] It should be understood that Figure 2 The illustrated embodiment can be regarded as an example of step S120 .

[0135] First of all, it should be noted that according to the example shown in Table 1 above:

[0136] The traffic data set of the first bound number refers to a set of all historical interaction behavior data in the social circle information register with the number as the main index.

[0137] A traffic data record is a basic unit in a traffic data set, and a traffic data set may include at least one traffic data record.

[0138] A traffic data record is used to record the communication behavior data between the first bound number and a peer mobile user number.

[0139] As shown in Table 1, communication behavior data can integrate multi-dimensional data from the telecommunications network, the Internet social platform, and the payment service platform. For example, communication behavior data can include: telecommunications traffic data, social application interaction data, and payment behavior data.

[0140] like Figure 2 As shown, the method may include the following steps.

[0141] S210: Using the first bound number as an index, search for at least one traffic data record of the first bound number from the social circle information register.

[0142] S220. For each call data record, calculate the intimacy between the first bound number and the corresponding peer user number based on the communication behavior data in the call data record, screen out the peer user number whose intimacy meets the preset conditions, determine it as the first authorized number, and add it to the authorized binding record of the first mobile terminal.

[0143] For each traffic data record retrieved above, a quantitative analysis is performed on the interaction intensity between the first bound number and its communication partner based on a preset intimacy evaluation model.

[0144] In one implementation, the preset intimacy evaluation model is constructed by integrating multiple types of communication behavior metrics through weighted summation. In other words, intimacy can be obtained through weighted calculation based on various types of communication behavior data and corresponding preset weights.

[0145] Exemplarily, the formula for the preset intimacy evaluation model is as follows:

[0146] SUM(P) = αΣ(Telecom traffic data) + βΣ(Social application interaction data) + γΣ(Payment behavior data)

[0147] = α(Duration of calls + Frequency of calls + Number of text messages) + β(Frequency of interaction on social platforms + Frequency of interaction on work platforms + Frequency of interaction on media platforms) + γ(Frequency of interaction on all payment platforms).

[0148] α, β, and γ are the preset weights for telecom traffic data, social application interaction data, and payment behavior data respectively, and satisfy α + β + γ = 1.

[0149] Compare each calculation result SUM(P) with the preset intimacy threshold S;

[0150] If SUM(P) ≥ S, then determine that the current peer number is a high-intimacy communication object, and add this number as the first authorized number to the authorized binding record of the terminal corresponding to the current bound number.

[0151] If SUM(P) < S, then do not process it, and regard this peer number as a non-trusted access object to prevent unauthorized use of the terminal.

[0152] Exemplarily, the preset intimacy threshold can be obtained based on empirical data and statistics of historical cases of SIM-card separation or theft.

[0153] For example, if the current terminal identifier is imei_A, the bound number is msisdn_A, and it is recognized that msisdn_B meets the high-intimacy condition, then msisdn_B will be inserted into the authorized number sequence (auth_msisdn) corresponding to msisdn_A and imei_A in the "controlled terminal information register".

[0154] In the above method, when calculating the intimacy between the first bound number and the peer user, multiple types of communication behavior information such as telecom traffic data, social application interaction data, and payment behavior data are integrated, and preset weights are assigned based on the importance of each type of data for weighted calculation, so as to obtain a more comprehensive and objective evaluation result of user intimacy.

[0155] This embodiment introduces a social circle information register to centrally manage the call data records between the first bound number and multiple peer users, and calculates the intimacy between the two parties based on the communication behavior data in each call data record. High-frequency or high-intensity communication users that meet preset conditions are selected as the first authorized number, and the authorized binding relationship is dynamically established, thereby realizing a dynamic adaptive mechanism of the controlled terminal information register.

[0156] The aforementioned embodiments provide a method for automatically identifying and updating authorized binding records, enabling dynamic authorization determination based on the user's historical communication behavior data when a network access request is triggered. However, considering that in some scenarios, a user's binding relationship has not yet been established, or it is impossible to determine whether the target number has a valid authorized binding relationship, this application also provides a method that supports manual active binding to meet the actual needs of network access control.

[0157] It is understandable that after the user's network access request is rejected due to the lack of authorized binding relationship, the user can be guided to actively initiate the authorized binding process by sending a binding request to achieve manual confirmation and registration of the binding relationship.

[0158] Figure 3 A flow chart of a network access method provided in an embodiment of the present application is shown.

[0159] It should be understood that Figure 3 The embodiment shown can be seen as Figure 1 An example of an embodiment.

[0160] like Figure 3 As shown, the method may include the following steps.

[0161] S310: Determine the type of traffic request in the network access request of the terminal to be connected to the network.

[0162] S320: When it is determined that the traffic request is a target SMS request, extract the newly added authorization binding record included in the target SMS request.

[0163] The target SMS request is used to trigger the update of the authorization binding record in the controlled terminal information register.

[0164] If the traffic request type is determined to be a "SMS request", the SMS information is further extracted and it is determined whether the SMS is a target SMS request for binding authorization.

[0165] In one implementation, determining the target SMS request may include the following steps.

[0166] S321: When the traffic request is a text message request, parse the text message port number and content information in the text message request.

[0167] S322: When the SMS port number is a preset operator port number and the content information includes a terminal identifier and an authorization number, determine that the call request is a target SMS request, and generate a new authorization binding record according to the terminal identifier and the authorization number.

[0168] The SMS request is identified as a "target SMS request" when the following two conditions are met:

[0169] The SMS port number is the binding service port number preset by the operator;

[0170] The SMS content contains binding parameters in a specified format, including a terminal identifier (such as IMEI) and an authorization number (such as the MSISDN of the target binding user).

[0171] Once identified as a target SMS request, a new authorization binding record will be generated based on the binding information carried in the SMS for subsequent network access verification.

[0172] This implementation accurately identifies the target SMS message containing a binding request by parsing the SMS port number and content. When pre-defined conditions are met, the terminal identifier and authorization number are extracted, automatically generating an authorized binding record and improving the automation and security of the binding operation.

[0173] S330: Store the newly added authorization binding record in the controlled terminal information register, and re-execute the operation of matching the authorization binding record in the controlled terminal information register based on the target terminal identifier and the target mobile user number.

[0174] The newly generated authorization binding record is stored in the controlled terminal information register, and the authorization number sequence associated with the current terminal identification is updated.

[0175] After the update is completed, the system will re-execute the authorization relationship matching process based on the target terminal identifier and the target mobile user number to determine whether the current user has valid access rights.

[0176] If the binding relationship is confirmed to be valid, the user number is allowed to successfully access the network; otherwise, the rejection policy is maintained and the user can be guided again to perform additional binding operations.

[0177] This embodiment provides a dynamic authorization mechanism for specific scenarios where the traffic request is a text message request, even if the terminal's network access request fails existing authorization verification. This mechanism extracts the newly added authorization binding record carried in the text message and uses it as a trigger to update the authorization data in the controlled terminal information register. After the newly added binding record is stored, the matching process is re-executed to ensure that the terminal regains access under the latest authorization relationship. This solution effectively improves the system's ability to adaptively update terminal authorization relationships, enhances users' flexible control over terminal usage scenarios, and ensures the security and controllability of the network access process.

[0178] comprehensive Figure 1 Examples and Figure 3 As can be seen from the embodiment, this application proposes a network access control method with a two-level verification mechanism. Figure 1 The initial access judgment process in Figure 3 The SMS correction mechanism in the APP is applicable to the scenario where the terminal to be connected to the network initiates an access request. The process is as follows:

[0179] The target terminal identification, target mobile user number and current traffic request content are parsed from the network access request of the terminal to be accessed.

[0180] Level 1 verification: Using the parsed target terminal identifier as the index, match the corresponding authorization binding record from the controlled terminal information register:

[0181] If the target terminal identification exists in a record in the controlled terminal information register, and the requested target mobile user number matches the bound number or authorized number registered in the record, the current terminal and the number are determined to be legally paired; access is allowed, and the call request is handed over to the traditional call billing device for processing.

[0182] If the above matching fails, that is, the target terminal identifier exists but the target mobile user number is not in the authorized number, it is determined to be an illegal pairing and the secondary verification mechanism is further activated.

[0183] Secondary verification: Based on the failure of the first-level verification, further determine the type of traffic currently requested:

[0184] If the request is of SMS type, the destination port number and SMS body content of the SMS are parsed;

[0185] If the SMS content conforms to the operator's preset terminal binding correction format (i.e. the SMS destination port is the operator's designated port, and the content contains valid mobile user number and terminal identification pairing information), the controlled terminal information register is updated, and the mobile user number is written as the authorized number into the authorization binding record of the corresponding terminal identification, and the correction method and operation time are recorded;

[0186] Then, return to the first-level verification process to verify the legitimacy of the access.

[0187] If the request type is not SMS, or the SMS content does not conform to the revised format, the request is pre-judged as a potential card-phone separation or number theft. To prevent illegal access, the request is not responded to and the user is denied network access.

[0188] Through the above-mentioned secondary verification mechanism, the present application solution not only realizes the rapid determination of the legitimacy of terminal binding, but also adds a SMS self-service correction channel for abnormal pairing requests, which not only ensures network security, but also improves the fault tolerance and flexibility of the user access experience.

[0189] It should be understood that the "device-card binding" mechanism can be applied not only to contract phone scenarios, but can also be extended to terminal anti-theft service businesses to improve terminal security and number usage compliance. Therefore, this application method is also applicable to the application scenario of preventing and controlling device-card separation after activating the terminal anti-theft service.

[0190] In the contract phone scenario, the first identifier of the first mobile terminal is usually automatically bound to the first mobile user number when the mobile terminal leaves the warehouse. In the terminal anti-theft service scenario, users can independently bind the terminal identifier to the number used after purchasing the terminal to achieve terminal identity confirmation and network access control.

[0191] In one embodiment, when the solution of the present application is applied to a scenario of preventing and controlling machine-card separation in a terminal anti-theft service, step S110 may include the following steps.

[0192] S111. Based on the first identifier, query whether there is a historical call usage record of the first mobile terminal in the full terminal information register.

[0193] The embodiment of the present application proposes a full terminal information register for storing historical traffic information of a mobile terminal in an operator network.

[0194] In one implementation, by collecting the operator's historical traffic logs (such as mobile phone Internet GPRS records, voice calls, SMS and MMS, etc.), the correspondence between the terminal identification (IMEI) and the mobile user number (MSISDN) when the communication behavior occurs is registered, thereby building a full terminal information register.

[0195] S112: If the query fails, determine that the first mobile terminal is a new terminal for which an anti-theft service is being activated, and generate an authorization binding record of the first mobile terminal according to the first identifier and the first binding number.

[0196] That is, if no historical call information corresponding to the first identifier is found, the first mobile terminal is determined to be a new terminal in the anti-theft service activation stage. At this time, an authorization binding record of the first mobile terminal is generated and inserted based on the first identifier and the first binding number submitted by the user.

[0197] This embodiment introduces a full terminal information register to query the historical call usage records of the first mobile terminal to determine whether the terminal has a past communication history. If no historical records are found, the terminal is automatically identified as a new terminal for which the anti-theft service is being activated, and an authorization binding record is generated based on the terminal identification and binding number.

[0198] The above embodiments illustrate that the present application solution is not only applicable to the strong binding scenario of contract phone sales, but can also be extended to a wider range of terminal security binding scenarios initiated by users, to achieve terminal and number confirmation binding and dynamic permission control.

[0199] Existing terminal anti-theft solutions rely on a monitoring program embedded in the terminal. This program uses GPS information to monitor the distance between the mobile terminal and the anti-loss monitoring device in real time. When the distance exceeds a preset value, the program automatically activates features such as screen lock and GPS address upload to prevent theft in the event of loss. However, the monitoring program is easily deactivated after the terminal is flashed or the system is reset. Furthermore, in environments with weak GPS signals, such as underground garages, elevators, and buildings, the lack of positioning information often leads to monitoring failure.

[0200] The solution in this embodiment completes the authority judgment at the initial stage of terminal network access, effectively blocking unauthorized numbers from accessing and using the terminal, and realizing prevention and control from the source. The overall security and practicality are significantly better than the existing solutions based on terminal monitoring programs.

[0201] Taking into account various application scenarios involved in the present application solution, Table 2 exemplarily shows the structure of the authorization binding record stored in the controlled terminal information register.

[0202]

[0203]

[0204] As shown in Table 2 above, the authorization binding record can store the following field information:

[0205] Terminal Identification (IMEI): used to uniquely identify a mobile terminal device;

[0206] Terminal type (imei_mode): identifies the purchase source of the terminal, such as contract phone (contract) or self-purchased phone (free_contract);

[0207] Bound number (msisdn): the mobile user number that establishes a binding relationship with the terminal identity;

[0208] Authorized number (auth_msisdn): other numbers that are authorized to be inserted into the terminal;

[0209] Authorization mode (auth_mode) and authorization time (op_time): used to distinguish the source of the binding relationship, such as automatic authorization by the operator's algorithm (auto) and user-initiated binding (manual). It can also record the salesperson's employee number (such as Oper_no).

[0210] Monitoring expiration time (auth): that is, the service validity period of the terminal and the binding relationship.

[0211] The first record in Table 2 indicates that the device type (imei 86639405972***59) is a contract device in the operator's sales database. The binding number (msisdn_A) was automatically registered during the sale, with the operator (Oper_no_A) and the operation time (Sale_time_A). The system also automatically activated the device / SIM card separation prevention service, with a monitoring period ending at EXP_DATEA.

[0212] The second to fourth records indicate that msisdn_B, msisdn_C, and msisdn_D are automatically identified as high-intimacy numbers of msisdn_A based on the social circle information register and the intimacy assessment model, and are authorized to access in auto mode.

[0213] The fifth record indicates that the device with terminal imei 86639407666***10 is a user-purchased terminal (free_contract), has no historical record in the full terminal information register, has a binding number of msisdn_X, has the system default authorization method (default), and has an operation time of op_time_X.

[0214] The seventh record indicates that user msisdn_X manually authorized the number msisdn_Z by sending a binding SMS message at op_time_Z. The system records the authorization method as manual.

[0215] The above-mentioned controlled terminal information register has a standardized authorization record structure, which can adapt to the differentiated needs of different business scenarios (such as contract sales binding, terminal anti-theft service binding, manual authorization, etc.), and provides a unified data foundation for subsequent permission verification, abnormality judgment and customer service support.

[0216] The above primarily describes a network access control method according to an embodiment of the present application, with reference to the accompanying drawings. It should also be understood that while the steps in the flowcharts of the various embodiments described above are shown sequentially, these steps are not necessarily executed in the order shown in the figures. Unless otherwise specified herein, there are no strict restrictions on the order in which these steps are executed; these steps may be executed in other orders. Furthermore, at least some of the steps in the flowcharts of the various embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily executed at the same time, but may be executed at different times. These steps or stages are not necessarily executed sequentially, but may be executed in rotation or alternation with other steps or at least a portion of the steps or stages within the other steps. A network access control device according to an embodiment of the present application is described below, with reference to the accompanying drawings. For the sake of brevity, some details will be omitted in the following description of the device. The relevant content can be referred to in the description of the method above and will not be repeated.

[0217] Corresponding to the method described in the above embodiment, Figure 4 A structural block diagram of a network access control device 1000 provided in an embodiment of the present application is shown. For ease of explanation, only the parts related to the embodiment of the present application are shown.

[0218] like Figure 4 As shown, the apparatus 1000 may include:

[0219] A first storage unit 10 is configured to, when binding a first mobile terminal to a first mobile user number, generate an authorized binding record of the first mobile terminal according to a first identifier and a first binding number, and store the record in a controlled terminal information register, wherein the first identifier is a terminal identifier of the first mobile terminal, and the first binding number is the first mobile user number;

[0220] an authorization maintenance unit 20 configured to obtain and analyze a set of call traffic data of the first bound number, screen out mobile user numbers whose intimacy with the first bound number meets a preset condition, determine the screened mobile user numbers as first authorized numbers, and add them to the authorized binding record of the first mobile terminal;

[0221] The network element device 30 is configured to parse out the target terminal identifier and target mobile user number of the terminal to be connected to the network in response to receiving the network connection request sent by the terminal to be connected to the network;

[0222] The device-card separation prevention and control unit 40 is used to match the authorization binding record in the controlled terminal information register based on the target terminal identifier and the target mobile user number, and to allow or deny the terminal to access the network according to the matching result.

[0223] Exemplarily, the first storage unit 10 may be a controlled terminal information register 11 .

[0224] In some embodiments, the network access control device 1000 may further include a second storage unit. For example, the second storage unit may be a full terminal information register 12 .

[0225] In some embodiments, the network access control device 1000 may further include a third storage unit. For example, the third storage unit may be a social circle information register 13 .

[0226] In one embodiment, the network access control device 1000 may further include a short message correction unit 50 .

[0227] In one embodiment, the SMS correction unit 50 may be configured to execute steps S310 - S330 .

[0228] Furthermore, in order to decouple data collection and business processing and improve the scalability of the system, this application also proposes the following Figure 5 The structural diagram of the network access control device is shown.

[0229] like Figure 5 As shown, the apparatus 1000 may include:

[0230] Data collection module 1001 , service processing module 1002 and network element device 30 .

[0231] The data collection module 1001 is responsible for carrying the storage function of mobile communication data, and may include a controlled terminal information register 11 , a full terminal information register 12 , and a social circle information register 13 .

[0232] The business processing module 1002 is responsible for the authority maintenance and access control process, and may include an authorization maintenance unit 20 , a device-card separation prevention and control unit 40 , and a text message correction unit 50 .

[0233] The data collection module 1001 pushes the collected and structured three types of register information (i.e., the controlled terminal information register 11, the full terminal information register 12, and the social circle information register 13) to the business processing module 1002 in real time through the internal interface. Specifically:

[0234] Using interface A1, the authorization binding record in the controlled terminal information register 11 is pushed to the authorization maintenance unit 20 for subsequent authorization relationship update;

[0235] By using interface A2, the terminal history usage information constructed in the full terminal information register 12 is pushed to the authorization maintenance unit 20 for binding behavior evolution analysis;

[0236] Using interface A3, the social circle information in the social circle information register 13 is pushed to the authorization maintenance unit 20 for calculating the intimacy index between the numbers;

[0237] Data synchronization can be achieved by combining scheduled batch synchronization with event-triggered incremental synchronization to ensure the timeliness and integrity of information.

[0238] In the business processing module 1002, different functional units can call data from each other according to the logical process. Specifically:

[0239] After obtaining the intimacy index through interface A3, the authorization maintenance unit 20 determines whether to include the current network number in the authorization range, and calls interface A1 to write back the updated controlled terminal information;

[0240] The device-card separation prevention and control unit 40 reads the controlled terminal information register 11 through the interface A1 and determines the legitimacy of the access when performing the IMEI and MSISDN matching verification;

[0241] After receiving the formatted authorization SMS and completing the analysis, the SMS correction unit 50 can update the controlled terminal information register 11 through the interface A1, write a new authorization number field, and mark the authorization mode as "manual correction" and the operation time.

[0242] exist Figure 5 Based on the network access control device structure shown, Figure 6 A flowchart of a network access control method provided in a specific embodiment of the present application is further shown.

[0243] This embodiment takes a card number msisdn_X as an example and then requests access to the telecommunications operator network after being inserted into the mobile terminal imei_X. Figure 5 The functional division of the data acquisition module, service processing module and network element equipment shown in the figure systematically describes the entire process from data acquisition, authorization maintenance to access control.

[0244] S1. The data collection module 1001 obtains terminal sales and delivery information, user traffic data and terminal access information from the operator's CRM / BOSS side in real time.

[0245] S11. Collect the terminal sales information of the number msisdn_A registered on the operator side (such as the registered terminal is imei_S) and the terminals involved in its historical call usage (such as imei_a, imei_b, etc.) to build a full terminal information register to record all associated terminals.

[0246] S12. Collect the generalized social behavior information of msisdn_A on telecommunication networks and Internet platforms (such as OTT applications and payment platforms) to identify its stable interaction partners and build a social circle information register 13.

[0247] S13. Dynamically establish and maintain the controlled terminal information register 11 based on the above information, and generate an authorization binding record containing fields such as terminal IMEI, binding number msisdn_A, authorizable number auth_msisdn, authorization method and authorization time to support subsequent permission determination.

[0248] S14 , pushing the information stored in the full terminal information register 12 , the social circle information register 13 , and the controlled terminal information register 11 to the authorization maintenance unit 20 .

[0249] After data collection is completed, the authorization processing process begins.

[0250] S2. The authorization maintenance unit 20 receives and processes the data from the data acquisition module 1001, calls the information stored in the social circle information register 13, and analyzes the intimacy relationship between the number msisdn_A and the current network number msisdn_X; if the calculated intimacy coefficient meets the preset conditions, the controlled terminal information register 11 is updated, and msisdn_X is added as an authorized number to the authorization binding record of imei_S; if the conditions are not met, no update is performed, and the current authorization structure is maintained unchanged.

[0251] S3. The number msisdn_X logs in to the network element device 30 and initiates a network access request. The network element device 30 parses the mobile user number msisdn_X, the terminal identifier imei_X and the current traffic request content from the request and prepares to verify the access legitimacy.

[0252] S4. The network element device 30 pushes the parsed access information to the machine-card separation prevention and control unit 40, or makes a non-response processing according to the free-network monitoring strategy.

[0253] S5. The device-card separation prevention and control unit 40 determines whether the access is legal based on the received data packet containing msisdn_X, imei_X and traffic type and the record of the controlled terminal information register 11.

[0254] There are two specific situations:

[0255] S51. If there is a matching record of imei_X in the controlled terminal information register 11, it is further determined whether msisdn_X is the binding number or authorized number corresponding to the IMEI (that is, in the msisdn or auth_msisdn sequence); if so, it is allowed to access and billed according to the traditional number card logic; if msisdn_X is not in the authorized sequence, the authentication failure result is fed back and the terminal is denied access to the network.

[0256] S52. If there is no matching record of imei_X in the controlled terminal information register 11, it means that the terminal has not been included in the controlled range, and its access is allowed, and the billing process is still carried out in the traditional way.

[0257] S6. If the pairing of msisdn_X and imei_X fails in the above access process, resulting in the access request being rejected, the user can actively initiate an authorization correction request by sending a formatted SMS (including imei_X, msisdn_X, expected authorization number, etc.) to the operator's designated gateway. The SMS correction unit 50 receives and parses the SMS content. After verifying the legality of the format, it updates the corresponding entry in the controlled terminal information register 11, adds msisdn_X as the authorization number, and records the authorization method (such as manual) and operation time (such as op_time_X) to support subsequent re-verification of network access requests.

[0258] In summary, this embodiment realizes dynamic management of the terminal-number binding relationship and intelligent control of access behavior through multi-dimensional collaborative mechanisms such as data collection, authorization maintenance, access verification and anomaly correction, which not only improves the security and flexibility of the system, but also enhances the user's controllability and experience during the terminal access process.

[0259] Figure 7 A schematic diagram of the hardware structure of a computer device provided in an embodiment of the present application is shown.

[0260] The computer device may include a processor 7001 and a memory 7002 storing computer program instructions.

[0261] Specifically, the processor 7001 may include a central processing unit (CPU) or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0262] Memory 7002 may include a large capacity memory for data or instructions. By way of example and not limitation, memory 7002 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive, or a combination of two or more of these. In one example, memory 7002 may include removable or non-removable (or fixed) media, or memory 7002 may be a non-volatile solid-state memory. Memory 7002 may be inside or outside the integrated gateway disaster recovery device.

[0263] In one embodiment, the memory 7002 may be a read-only memory (ROM). In one embodiment, the ROM may be a mask-programmable ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (EEPROM), an electrically rewritable ROM (EAROM), or a flash memory, or a combination of two or more of these.

[0264] The memory 7002 may include read-only memory (ROM), random access memory (RAM), magnetic disk storage media devices, optical storage media devices, flash memory devices, electrical, optical or other physical / tangible memory storage devices. Thus, generally, the memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to an aspect of the present disclosure.

[0265] The processor 7001 reads and executes the computer program instructions stored in the memory 7002 to implement Figure 1 The network access control method in the illustrated embodiment.

[0266] In one example, the computer device may further include a communication interface 7003 and a bus 7004. Figure 7 As shown, the processor 7001, the memory 7002, and the communication interface 7003 are connected via a bus 7004 and communicate with each other.

[0267] The communication interface 7003 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiments of the present application.

[0268] Bus 7004 includes hardware, software or both, and couples the components of online data flow metering equipment to each other. For example, and not limitation, the bus may include Accelerated Graphics Port (AGP) or other graphics bus, Enhanced Industry Standard Architecture (EISA) bus, Front Side Bus (FSB), Hyper Transport (HT) interconnection, Industry Standard Architecture (ISA) bus, InfiniBand interconnection, Low Pin Count (LPC) bus, memory bus, Micro Channel Architecture (MCA) bus, Peripheral Component Interconnect (PCI) bus, PCI-Express (PCI-X) bus, Serial Advanced Technology Attachment (SATA) bus, Video Electronics Standards Association Local (VLB) bus or other suitable bus or a combination of two or more of these. Where appropriate, bus 7004 may include one or more buses. Although the present application embodiment describes and illustrates a specific bus, the present application considers any suitable bus or interconnection.

[0269] In addition, in conjunction with the network access control method in the above embodiments, embodiments of the present application may provide a computer storage medium for implementation. The computer storage medium stores computer program instructions; when the computer program instructions are executed by a processor, any one of the network access control methods in the above embodiments is implemented.

[0270] An embodiment of the present application further provides a computer program product, including a computer program, which implements any one of the network access control methods in the above embodiments when the computer program is processed and executed.

[0271] It should be understood that the present application is not limited to the specific configurations and processes described above and illustrated in the figures. For the sake of brevity, a detailed description of known methods is omitted here. In the above embodiments, several specific steps are described and illustrated as examples. However, the method process of the present application is not limited to the specific steps described and illustrated. Those skilled in the art can make various changes, modifications, and additions, or change the order of the steps after understanding the spirit of the present application.

[0272] The functional blocks shown in the above-described block diagram can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of the present application are programs or code segments used to perform the required tasks. The programs or code segments can be stored in a machine-readable medium, or transmitted on a transmission medium or communication link via a data signal carried in a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, read-only memories (ROMs), flash memories, erasable read-only memories (EROMs), floppy disks, compact disc read-only memories (CD-ROMs), optical discs, hard disks, optical fiber media, radio frequency (RF) links, etc. The code segments can be downloaded via computer networks such as the Internet and intranets.

[0273] Aspects of the present disclosure have been described above with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer or other programmable data processing device to produce a machine so that these instructions executed by the processor of the computer or other programmable data processing device enable the implementation of the function / action specified in one or more boxes of the flowchart and / or block diagram. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor or a field programmable logic circuit. It is also understood that each box in the block diagram and / or flowchart and the combination of the boxes in the block diagram and / or flowchart can also be implemented by dedicated hardware that performs the specified function or action, or can be implemented by a combination of dedicated hardware and computer instructions.

[0274] The above description is only a specific embodiment of the present application. Those skilled in the art will clearly understand that for the convenience and brevity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the scope of protection of the present application is not limited thereto. Any person skilled in the art can easily think of various equivalent modifications or replacements within the technical scope disclosed in the present application, and these modifications or replacements should be included in the scope of protection of the present application.

Claims

1. A network access control method, characterized in that: include: In the case of binding the first mobile terminal to the first mobile user number, generating an authorized binding record of the first mobile terminal according to the first identifier and the first binding number, and storing the record in the controlled terminal information register, where the first identifier is the terminal identifier of the first mobile terminal, and the first binding number is the first mobile user number; Acquire and analyze the call traffic data set of the first bound number, screen out mobile user numbers whose intimacy with the first bound number meets a preset condition, determine the screened mobile user numbers as first authorized numbers, and add them to the authorized binding record of the first mobile terminal; In response to receiving a network access request sent by a terminal to be networked, parsing out a target terminal identifier and a target mobile user number of the terminal to be networked; Matching the authorization binding record in the controlled terminal information register based on the target terminal identifier and the target mobile user number; Based on the matching result, the terminal to be connected to the network is allowed or denied access to the network.

2. The method according to claim 1, characterized in that The traffic data set of the first bound number includes at least one traffic data record, where one traffic data record is used to record communication behavior data between the first bound number and a peer mobile user number; The acquiring and analyzing the traffic data set of the first bound number, screening out mobile user numbers whose intimacy with the first bound number meets a preset condition, determining the screened mobile user numbers as first authorized numbers, and adding the numbers to the authorized binding record of the first mobile terminal includes: Using the first bound number as an index, searching for at least one traffic data record of the first bound number from a social circle information register, wherein the social circle information register is used to store traffic data between mobile user numbers; For each call data record, the intimacy between the first binding number and the corresponding end user number is calculated based on the communication behavior data in the call data record, and the end user number whose intimacy meets the preset conditions is screened out, determined as the first authorized number, and added to the authorization binding record of the first mobile terminal.

3. The method according to claim 2, characterized in that The types of the communication behavior data include multiple types of telecommunication traffic data, social application interaction data, and payment behavior data. The intimacy is obtained by weighted calculation based on multiple types of communication behavior data and corresponding preset weights.

4. The method according to any one of claims 1 to 3, characterized in that The matching of the authorization binding record in the controlled terminal information register based on the target terminal identifier and the target mobile user number includes: Using the target terminal identifier as an index, querying whether there is a target authorization binding record corresponding to the terminal to be networked in the controlled terminal information register; In the case where the target authorization binding record is found, the target mobile user number is verified according to the target authorization binding record. The authorization number includes a binding number and an authorization number.

5. The method according to claim 4, characterized in that The allowing or denying the terminal to access the network according to the matching result includes: If the target mobile user number is any of the target authorized numbers, confirm that the match is successful and allow the terminal to access the network; In the case that the target authorization binding record is not found, or in the case that the target mobile user number is different from any of the target authorization numbers, it is determined that the match fails and the terminal to be connected is denied access to the network.

6. The method according to claim 5, characterized in that The network access request includes a traffic request. When the target mobile user number is different from any of the target authorized numbers, the method further includes: If it is determined that the traffic request is a target SMS request, extracting a newly added authorization binding record contained in the target SMS request, wherein the target SMS request is used to trigger an update of the authorization binding record in the controlled terminal information register; The newly added authorization binding record is stored in the controlled terminal information register, and the operation of matching the authorization binding record in the controlled terminal information register based on the target terminal identifier and the target mobile user number is re-executed.

7. The method according to claim 6, characterized in that In the case where it is determined that the traffic request is a target SMS request, extracting the newly added authorization binding record contained in the target SMS request includes: In the case where the traffic request is a text message request, parsing the text message port number and content information in the text message request; When the SMS port number is a preset operator port number and the content information includes a terminal identifier and an authorization number, the traffic request is determined to be a target SMS request, and the new authorization binding record is generated according to the terminal identifier and the authorization number.

8. The method according to any one of claims 1 to 3, characterized in that In the case of binding the first mobile terminal to the first mobile user number, generating an authorization binding record of the first mobile terminal according to the first identifier and the first binding number, and storing the record in the controlled terminal information register includes: Based on the first identifier, querying whether there is a historical traffic usage record of the first mobile terminal in a full terminal information register, the full terminal information register being used to store historical traffic information of mobile terminals; In the case that the query fails, it is determined that the first mobile terminal is a new terminal for which an anti-theft service is being activated, and an authorization binding record of the first mobile terminal is generated according to the first identifier and the first binding number.

9. A network access control device, characterized in that: include: a data acquisition module, configured to, when binding a first mobile terminal to a first mobile user number, generate an authorized binding record for the first mobile terminal according to a first identifier and a first binding number, and store the record in a controlled terminal information register, wherein the first identifier is a terminal identifier of the first mobile terminal, and the first binding number is the first mobile user number; an authorization maintenance module, configured to obtain and analyze a set of call traffic data of the first bound number, screen out mobile user numbers whose intimacy with the first bound number meets a preset condition, determine the screened mobile user numbers as first authorized numbers, and add them to the authorized binding record of the first mobile terminal; A network element device, configured to parse out a target terminal identifier and a target mobile user number of the terminal to be networked in response to receiving a network access request sent by the terminal to be networked; The device-card separation prevention and control module is used to match the authorization binding record in the controlled terminal information register based on the target terminal identifier and the target mobile user number, and allow or deny the terminal to access the network according to the matching result.

10. A computer device, characterized in that: The device comprises: a processor and a memory storing computer program instructions; the processor reads and executes the computer program instructions to implement the method according to any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the method according to any one of claims 1 to 8.

12. A computer program product, characterized in that When the instructions in the computer program product are executed by a processor of a computer device, the computer device is caused to perform the method according to any one of claims 1 to 8.

Images