Network restriction methods, devices, terminal equipment and storage media

Abstract

This application provides a network restriction method, apparatus, terminal device, and storage medium. The method, applied to a terminal device, executes a first command when it detects that the terminal device is establishing a data connection with the internet. This first command restricts non-root user processes and non-system user processes from accessing the internet. After successfully establishing the data connection, N threads are started to send simulated packets to preset network addresses, where N is a positive integer. Finally, if any thread receives a response packet corresponding to the simulated packet within a preset time period, the data connection is disconnected. This technical solution first restricts ordinary users from accessing the internet. After a successful data connection, it simulates sending packets to multiple preset network addresses. If a response packet is received within a certain time, it indicates that the data connection can access the internet, and the connection is then disconnected. This double-insurance approach implements a universal internet access prevention mechanism at the terminal level.

Description

Technical Field

[0001] This application relates to the field of Internet technology, and in particular to a network restriction method, apparatus, terminal device and storage medium. Background Technology

[0002] Virtual Private Dial Network (VPDN) technology is widely used by government, enterprise, and regulatory users. Users utilize dedicated terminals equipped with a built-in Subscriber Identity Module (SIM) card and a Dedicated Access Point Name (APN) to connect to the enterprise's private network via a dedicated Public Data Network (PDN) provided by the operator. The terminals are pre-installed with office or business-related applications (APPs) to communicate with servers deployed on the private network.

[0003] Currently, there is no comprehensive and unified approach in the industry to prevent private network terminals from accidentally accessing the Internet. Some private network terminals have not taken any measures at all. The few methods that have been implemented to prevent Internet access are limited to the APP level, such as verifying the legality of the SIM card, checking whether the private network server is connected, or imposing some restrictions on the phone, such as forcibly locking the screen.

[0004] In existing technologies, the data connection capability acquired by a terminal depends entirely on the operator. It is impossible to identify scenarios of accidental internet connection from the signaling level, and therefore it is impossible to implement a universal anti-internet access mechanism at the terminal level. Summary of the Invention

[0005] This application provides a network restriction method, apparatus, terminal device, and storage medium to solve the problem that existing technologies cannot implement a universal anti-internet access mechanism at the terminal level.

[0006] In a first aspect, embodiments of this application provide a network restriction method applied to a terminal device, the method comprising:

[0007] When it is detected that the terminal device is establishing a data connection with the Internet, a first command is executed. The first command is used to restrict non-root user processes and non-system user processes from accessing the Internet.

[0008] If the data connection is successfully established, N threads are started to send simulated packets to a preset network address, where N is a positive integer.

[0009] If any of the threads receives a response packet corresponding to the simulated packet within a preset time period, the data connection is disconnected.

[0010] In one possible design of the first aspect, the method further includes:

[0011] If any of the threads does not receive a response packet corresponding to the simulated packet within the preset time period, the data connection is maintained.

[0012] In another possible design of the first aspect, the method further includes:

[0013] If the data connection is disconnected, or if the duration after the successful establishment of the data connection exceeds the preset duration and no response packet is received, the first reset command is executed to remove the restriction on the non-root user's process and the non-system user's process accessing the Internet network.

[0014] In another possible design of the first aspect, the network address includes: the address corresponding to an Internet domain name, the Internet Protocol version IPv4 address, and the Internet IPv6 address;

[0015] Accordingly, N is greater than or equal to 3;

[0016] Accordingly, starting N threads to send simulated packets to preset network addresses includes:

[0017] Start at least three threads to send the simulated packets to the address corresponding to the Internet domain name, the Internet IPv4 address, and the Internet IPv6 address, respectively.

[0018] In another possible design in the first aspect, N is 9.

[0019] In another possible design of the first aspect, the first command is the iptables command.

[0020] Secondly, embodiments of this application provide a network restriction device applied to a terminal device, the device comprising:

[0021] The processing module is used to execute a first command when it detects that the terminal device is establishing a data connection with the Internet network. The first command is used to restrict non-root user processes and non-system user processes from accessing the Internet network.

[0022] The startup module is used to detect that the data connection has been successfully established, and then start N threads to send simulated packets to a preset network address, where N is a positive integer;

[0023] The disconnect module is used to disconnect the data connection if any of the threads receives a response packet corresponding to the simulated packet within a preset time period.

[0024] In one possible design of the second aspect, the processing module is further configured to:

[0025] If any of the threads does not receive a response packet corresponding to the simulated packet within the preset time period, the data connection is maintained.

[0026] In another possible design of the second aspect, the release module is used for:

[0027] If the data connection is disconnected, or if the duration after the successful establishment of the data connection exceeds the preset duration and no response packet is received, the first reset command is executed to remove the restriction on the non-root user's process and the non-system user's process accessing the Internet network.

[0028] In another possible design, the network address includes: the address corresponding to an Internet domain name, an Internet IPv4 address, and an Internet IPv6 address;

[0029] Accordingly, N is greater than or equal to 3;

[0030] Accordingly, the startup module is specifically used for:

[0031] Start at least three threads to send the simulated packets to the address corresponding to the Internet domain name, the Internet IPv4 address, and the Internet IPv6 address, respectively.

[0032] In another possible design, N is 9.

[0033] In another possible design in the second aspect, the first command is the iptables command.

[0034] Thirdly, this application provides a terminal device, including: a processor, and a memory and a transceiver communicatively connected to the processor;

[0035] The memory stores computer-executed instructions; the transceiver is used for sending and receiving data.

[0036] The processor executes computer execution instructions stored in the memory to implement the network restriction method as described in the first aspect or any of the above.

[0037] Fourthly, this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the network restriction method described in the first aspect or any of the above embodiments.

[0038] The network restriction method, apparatus, terminal device, and storage medium provided in this application embodiment are applied to a terminal device. When the terminal device detects that it is establishing a data connection with the Internet, it executes a first command to restrict non-root user processes and non-system user processes from accessing the Internet. After detecting that the data connection is successfully established, it starts N threads to send simulated packets to preset network addresses, where N is a positive integer. Finally, if any thread receives a response packet corresponding to the simulated packet within a preset time period, the data connection is disconnected. In this technical solution, ordinary users accessing the Internet are first restricted. After a successful data connection is established, packets are simulated to multiple preset network addresses. If a response packet is received within a certain time, it indicates that the data connection can access the Internet, and the connection is then disconnected. This double-insurance approach implements a universal Internet access prevention mechanism at the terminal level. Attached Figure Description

[0039] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0040] Figure 1 This is a schematic diagram illustrating an application scenario of the network restriction method provided in the embodiments of this application;

[0041] Figure 2 Flowchart of the network restriction method provided in the embodiments of this application Figure 1 ;

[0042] Figure 3 Flowchart of the network restriction method provided in the embodiments of this application Figure 2 ;

[0043] Figure 4 Flowchart of the network restriction method provided in the embodiments of this application Figure 3 ;

[0044] Figure 5 A schematic diagram of the structure of an embodiment of the network restriction device provided in this application;

[0045] Figure 6 This is a schematic diagram of the structure of a terminal device provided in an embodiment of this application.

[0046] The accompanying drawings have illustrated specific embodiments of this disclosure, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concepts of this disclosure to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0047] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0048] Before introducing the embodiments of this application, the application background involved in the embodiments of this application will be explained first:

[0049] With the rapid development of information and network technologies, the internet has gradually become the main platform for people to exchange information, and network security has become a top priority for all kinds of online activities.

[0050] As the first line of defense in building a secure network environment, the most fundamental and effective way to prove whether a firewall is effective and whether its performance meets the requirements is to test it.

[0051] Existing technologies based on firewall packet filtering functions have designed test cases for firewall rule effectiveness testing, Network Address Translation (NAT) type testing, and information leakage exploitability testing, and their testing methods have been analyzed and studied. For firewall rule effectiveness testing, a scheme using Extensible Markup Language (XML) technology to establish a general testing platform is proposed, which can automatically generate test data packets based on the configuration files provided by the vendor. In NAT type testing, the program can automatically send and receive packets, analyze and compare them to test the firewall's NAT type. In information leakage exploitability testing, through in-depth analysis of the Transmission Control Protocol / Internet Protocol (TCP / IP) protocol, test cases were designed based on the vulnerabilities of the TCP / IP protocol to conduct penetration testing on the firewall and detect whether the firewall can prevent information leakage from the internal network.

[0052] Furthermore, Virtual Private Dial Network (VPDN) technology is currently widely used by government, enterprise, and regulatory users. Users utilize dedicated terminals equipped with a built-in Subscriber Identity Module (SIM) card and a Dedicated Access Point Name (APN) to access the enterprise's private network via a dedicated Public Data Network (PDN) provided by the operator. The terminals are pre-installed with office or business-related applications (APPs) to communicate with servers deployed on the enterprise's private network.

[0053] Mobile work has made business operations more convenient, but information security issues must be addressed.

[0054] For example, regarding information security issues: on the one hand, it is necessary to restrict insecure terminals from accessing the enterprise's private network; on the other hand, it is also necessary to restrict the internal data of secure terminals from being copied out.

[0055] To protect the internal data of a secure mobile phone, certain restrictions also need to be imposed on the phone:

[0056] 1. Control the terminal's peripherals, such as Universal Serial Bus (USB) and Secure Digital Memory Card (SD card), to prevent internal files from being copied out.

[0057] 2. Restrict terminal devices from accessing the Internet to prevent terminal data from being transmitted over the network.

[0058] The embodiments in this application mainly provide strict protection for scenarios where terminals access the Internet.

[0059] As mentioned above, private network terminals generally only have private network APN information pre-installed, but there are cases where they are connected to the Internet.

[0060] For example, existing operators have separate core network configurations for each region. For instance, a company in region A might apply for private network access to a specific APN in region A. Therefore, when a dedicated network terminal inserts a SIM card with that private network capability, it will connect to the company's dedicated network. However, when the dedicated network terminal inserts a SIM card from the same operator in region B, the terminal still uses the dedicated network APN to make calls. When the call request reaches region B, the core network will consider it an invalid APN and assign a default data connection with internet capabilities, thus allowing the dedicated network terminal to access the internet. This situation is quite common. Of course, there are also cases where abnormal operator configurations lead to dedicated network terminals mistakenly connecting to the internet.

[0061] Currently, there is no comprehensive and unified approach in the industry to prevent private network terminals from accidentally accessing the Internet. Some private network terminals have not taken any measures at all. The few methods that have been implemented to prevent Internet access are limited to the APP level, such as verifying the legality of the SIM card, checking whether the private network server is connected, or imposing some restrictions on the phone, such as forcibly locking the screen.

[0062] Existing measures to prevent access to the public internet are tightly coupled with business operations, and the management apps for various projects cannot be standardized, making them unsuitable for widespread adoption. Furthermore, current measures are not perfect; attempts to bypass these measures, including unconventional methods and brute-force attacks, can still lead to internet access.

[0063] To address the technical problems existing in the prior art, the inventors of this application propose the following concept: The data connection capability of a terminal device depends entirely on the operator, and it cannot distinguish between incorrect internet access scenarios based on signaling alone. However, by using a detection mechanism combined with routing rule restrictions, complete isolation from the internet network can be achieved. Specifically, an internet address detection mechanism is added, which sends a probe packet to the internet server. Upon receiving the response packet, the data connection is disconnected. During the detection process until the data connection is disconnected, the terminal's routing rules can be modified to restrict non-root processes and system user processes from accessing the internet. After the data connection is disconnected, the routing rules are reset, releasing the restrictions on non-root and system user processes, thus ensuring continuous isolation between the terminal device on the private network and the internet network.

[0064] Figure 1 This is a schematic diagram illustrating an application scenario of the network restriction method provided in the embodiments of this application, such as... Figure 1 As shown, the application scenario includes: mobile phone 11 and network server 12.

[0065] In one possible implementation, when a user illegally manipulates mobile phone 11 to access data on network server 12, mobile phone 11 detects the attempted data connection request. At this time, mobile phone 11 restricts non-root user processes and system user processes from connecting to the Internet and simulates sending packets to a preset network address. Based on whether a response packet is received, it confirms whether mobile phone 11 has permission to access network server 12. If a response packet is received within a certain period of time, it is considered that the access has permission to access the Internet, which is a violation and needs to be isolated, that is, the data connection is disconnected.

[0066] In this application scenario, the undisclosed content is described in detail in the following embodiments.

[0067] It is worth noting that the application fields of the network restriction methods, devices, terminal equipment and storage media in this application are not limited.

[0068] In this application, the executing entity is a terminal device, specifically which may be... Figure 1 Among them are mobile phones, computers, smartwatches, and other devices.

[0069] The technical solution of this application will now be described in detail through specific embodiments. It should be noted that the following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0070] Figure 2 Flowchart of the network restriction method provided in the embodiments of this application Figure 1 ,like Figure 2 As shown, the network restriction method may include the following steps:

[0071] Step 21: When it is detected that the terminal device is establishing a data connection with the Internet network, execute the first command.

[0072] The first command is used to restrict non-root user processes and non-system user processes from accessing the Internet network.

[0073] In this step, when it is detected that a terminal device is attempting to establish a data connection with the Internet, in order to prevent non-root users or non-system users, such as ordinary users, from accessing the Internet, a command needs to be executed to restrict non-root user processes and non-system user processes from accessing the Internet; this is the first command.

[0074] Optionally, the first command is the iptables command.

[0075] The iptables command is used to set, maintain, and inspect the Internet Protocol (IP) packet filtering rules in the Linux kernel. In other words, it can be used to filter non-root user processes and non-system user processes from accessing the internet.

[0076] Step 22: Once the data connection is successfully established, start N threads to send simulated packets to the preset network address.

[0077] Where N is a positive integer.

[0078] In this step, after detecting that the terminal device has established a data connection with the Internet, in order to verify whether the current terminal device has the ability to access the Internet, one or more threads can be started to send simulated packets to a pre-set network address for verification.

[0079] The simulated packet can be a pre-defined data packet.

[0080] Optionally, network addresses include: addresses corresponding to Internet domain names, Internet Protocol version 4 (IPv4) addresses, and Internet IPv6 addresses.

[0081] Then N is greater than or equal to 3.

[0082] In one possible implementation, the internet domain name could be www.sina.com.cn, the internet IPv4 address could be 110.242.68.66, and the internet IPv6 address could be 2400:3200::1.

[0083] Accordingly, this step can be implemented by starting at least three threads to send simulated packets to the address corresponding to the Internet domain name, the Internet IPv4 address, and the Internet IPv6 address, respectively.

[0084] In one possible implementation, three threads are started, for example, thread A, thread B, and thread C. Thread A sends the first simulated packet to www.sina.com.cn; thread B sends the second simulated packet to 110.242.68.66; and thread C sends the third simulated packet to 2400:3200::1.

[0085] Optional, N is 9.

[0086] Based on some experiments, the results obtained were relatively optimal when the number of threads was 9.

[0087] Step 23: If any thread receives a response packet corresponding to the simulated packet within a preset time period, disconnect the data connection.

[0088] In this step, after at least one thread sends a simulated packet to a preset network address, it is monitored whether at least one thread receives a response packet from the simulated packet within a preset time period.

[0089] Furthermore, if at least one thread can receive a response packet from the simulated packet, it indicates that the current terminal device has the ability to access the Internet network, and the data connection needs to be disconnected.

[0090] In one possible implementation, a timer can be used to keep track of the time. When N threads send simulated packets to a preset network address, the timer is started, for example, with a duration of 0.003 seconds.

[0091] For example, Table 1 is an example table of thread-response situation 1 provided in the embodiments of this application, as shown in Table 1 (taking a preset duration of 0.003s as an example):

[0092] Table 1

[0093]

[0094] In other words, if threads A, B, and E receive a response within 0.003 seconds, it indicates that the current terminal device has the ability to access the Internet network, and the data connection needs to be disconnected.

[0095] Furthermore, given the above implementation, if thread B has already received a response packet at 0.0015s, the data connection can be directly disconnected without waiting for other threads to receive a response packet.

[0096] In addition, if any thread does not receive a response packet corresponding to the simulated packet within a preset time period, the data connection will be maintained.

[0097] In this case, if no thread fails to receive a response packet corresponding to the simulated packet within the preset time period, it indicates that the current terminal device does not have the ability to access the Internet network. Therefore, no further processing of the data connection is required, and the data connection can be maintained.

[0098] For example, Table 2 is an example table of thread-response situation 2 provided in the embodiments of this application, as shown in Table 2 (taking a preset duration of 0.003s as an example):

[0099] Table 2

[0100]

[0101] In other words, if none of the above 9 threads received a response within 0.003 seconds, it means that the current terminal device does not have the ability to access the Internet network and can maintain the data connection.

[0102] Furthermore, if the data connection is lost, or if the duration after a successful data connection is established exceeds a preset duration and no response is received, the first reset command is executed to remove the restriction on non-root user processes and non-system user processes accessing the Internet network.

[0103] That is, in the two cases described in the above embodiments:

[0104] Specifically, 1. If no response is received from any thread within the preset time period, the data connection is disconnected; 2. If no response is received after the preset time period (i.e., the timer expires).

[0105] Then the first command in the above steps needs to be reset in order to remove the restriction on non-root user processes and non-system user processes accessing the Internet network.

[0106] That is, issue a reset command to the iptables rules, thereby removing the routing rule restrictions that prevent non-root user processes and non-system user processes from accessing the Internet network.

[0107] The network restriction method provided in this application is applied to a terminal device. When the terminal device detects that it is establishing a data connection with the internet, it executes a first command to restrict non-root user processes and non-system user processes from accessing the internet. After detecting a successful data connection, it starts N threads to send simulated packets to preset network addresses, where N is a positive integer. Finally, if any thread receives a response packet corresponding to the simulated packet within a preset time period, the data connection is disconnected. This technical solution first restricts ordinary users from accessing the internet. After a successful data connection, it simulates sending packets to multiple preset network addresses. If a response packet is received within a certain time, it indicates that the data connection can access the internet, and the connection is then disconnected. This double-insurance approach implements a universal internet access prevention mechanism at the terminal level.

[0108] Based on the above embodiments, Figure 3 Flowchart of the network restriction method provided in the embodiments of this application Figure 2 ,like Figure 3 As shown, the executing entity is a mobile phone, and the network device can be a network server. The typical process of the detection mechanism when accessing the Internet may include the following steps:

[0109] Step 31: The phone attempts to activate a data connection with the network server;

[0110] Step 32: Send the iptables command from the mobile phone to restrict non-root users and non-system users from accessing the network server's routing rules;

[0111] Step 33: The network server returns a data connection activation message to the mobile phone;

[0112] Step 34: Start the timer on the phone;

[0113] Step 35: The phone starts a thread to initiate a ping command;

[0114] The network address can be: www.sina.com.cn; 110.242.68.66; 2400:3200::1;

[0115] Step 36: Before the timer expires, the network server returns a ping packet to the mobile phone.

[0116] Step 37: Turn off the timer on the phone;

[0117] Step 38: The mobile phone disconnects from the network server;

[0118] The data connection between the phone and the network server was then successfully disconnected.

[0119] Step 39: Send a reset command to iptables on the mobile phone to remove the routing rule restrictions on non-root user processes and non-system user processes accessing the network server.

[0120] The network restriction method provided in this application involves a mobile phone attempting to activate a data connection with a network server. The mobile phone issues an iptables command to restrict non-root user processes and non-system users from accessing the network server's routing rules. The network server returns a data connection activation response to the mobile phone. The mobile phone then starts a timer and initiates a ping command. The network address can be: www.sina.com.cn; 110.242.68.66; 2400:3200::1. The network server returns any ping packet response to the mobile phone. The mobile phone then stops the timer and disconnects the data connection with the network server. After the data connection is successfully disconnected, the mobile phone issues a reset iptables command to remove the routing rule restrictions on non-root user and non-system user processes accessing the network server. In this technical solution, the premise of a dual-system secure mobile phone is security, namely, restricting the work area from accessing the public network (network server), completely eliminating the possibility of the work area accessing the public network. This is achieved by using a detection mechanism in conjunction with routing rule restrictions to completely isolate the internet.

[0121] Based on the above embodiments, Figure 4 Flowchart of the network restriction method provided in the embodiments of this application Figure 3 ,like Figure 4 As shown, the executing entity is the mobile phone, and the network device is the network server. The typical process of the detection mechanism when accessing a legitimate enterprise network may include the following steps:

[0122] Step 41: The phone attempts to activate a data connection with the network server;

[0123] Step 42: Send the iptables command from the mobile phone to restrict non-root users and non-system users from accessing the network server's routing rules;

[0124] Step 43: The network server returns a data connection activation message to the mobile phone;

[0125] Step 44: Start the timer on the phone;

[0126] Step 45: The phone starts a thread to initiate a ping command;

[0127] The network address can be: www.sina.com.cn, 110.242.68.66, 2400:3200::1;

[0128] Step 46: The network server did not receive any ping packet response before the timer expired;

[0129] Step 47: Turn off the timer on the phone;

[0130] Step 48: Send a reset command to iptables on the mobile phone to remove the routing rule restrictions on non-root user processes and non-system user processes accessing the network server.

[0131] The network restriction method provided in this application involves a mobile phone attempting to activate a data connection with a network server. The phone issues an iptables command to restrict non-root and non-system users from accessing the network server's routing rules. The network server returns a data connection activation response to the phone. The phone then starts a timer and initiates a ping command. The network address can be www.sina.com.cn, 110.242.68.66, or 2400:3200::1. If the network server does not receive any ping packet response before the timer expires, the phone stops the timer and issues a reset iptables command, removing the routing rule restrictions on non-root and non-system user processes accessing the network server. In this technical solution, after not receiving any ping packet response, it indicates that the data connection does not have the function of accessing the Internet, meaning it can access legitimate enterprise networks and other permissions.

[0132] The following are embodiments of the apparatus of this application, which can be used to execute the network restriction method embodiments of this application. For details not disclosed in the network restriction apparatus embodiments of this application, please refer to the method embodiments of this application.

[0133] Figure 5 This is a schematic diagram of the structure of an embodiment of the network restriction device provided in this application. Figure 5 As shown, the network restriction device includes:

[0134] Processing module 51 is used to execute a first command when it detects that the terminal device is establishing a data connection with the Internet network. The first command is used to restrict non-root user processes and non-system user processes from accessing the Internet network.

[0135] The startup module 52 is used to detect that the data connection has been successfully established, and then start N threads to send simulated packets to the preset network address, where N is a positive integer;

[0136] Disconnect module 53 is used to disconnect the data connection if any thread receives a response packet corresponding to the simulated packet within a preset time period.

[0137] In one possible design of this application embodiment, the processing module 51 is further configured to:

[0138] If any thread does not receive a response packet corresponding to the simulated packet within the preset time period, the data connection is maintained.

[0139] In another possible design of this application embodiment, the release module is used for:

[0140] If the data connection is lost, or if the time elapsed after a successful data connection establishment exceeds a preset time and no response is received, execute the first reset command to remove the restriction on non-root user processes and non-system user processes accessing the Internet network.

[0141] In another possible design of the embodiments of this application, the network address includes: the address corresponding to the Internet domain name, the Internet IPv4 address, and the Internet IPv6 address;

[0142] Accordingly, N is greater than or equal to 3.

[0143] Accordingly, startup module 52 is specifically used for:

[0144] Start at least 3 threads to send simulated packets to the address corresponding to the Internet domain name, the Internet IPv4 address, and the Internet IPv6 address, respectively.

[0145] In another possible design of this application embodiment, N is 9.

[0146] In another possible design of this application embodiment, the first command is the iptables command.

[0147] The network restriction device provided in this application embodiment can be used to execute the network restriction method in any of the above embodiments. Its implementation principle and technical effect are similar, and will not be described again here.

[0148] It should be noted that the division of the various modules in the above device is merely a logical functional division. In actual implementation, they can be fully or partially integrated into a single physical entity, or they can be physically separated. Furthermore, these modules can be implemented entirely in software via processing element calls; they can be fully implemented in hardware; or some modules can be implemented by processing element calls to software, while others are implemented in hardware. Additionally, these modules can be fully or partially integrated together, or implemented independently. The processing element mentioned here can be an integrated circuit with signal processing capabilities. In the implementation process, each step of the above method or each of the above modules can be completed through the integrated logic circuits in the hardware of the processor element or through software instructions.

[0149] Figure 6 This is a schematic diagram of the structure of the terminal device provided in the embodiments of this application, such as... Figure 6 As shown, the terminal device may include: a processor 61, a memory 62, and computer program instructions stored in the memory 62 and executable on the processor 61. When the processor 61 executes the computer program instructions, it implements the method provided in any of the foregoing embodiments.

[0150] Optionally, the various components of the terminal device can be connected via a system bus.

[0151] The memory 62 can be a separate memory unit or a memory unit integrated into the processor 61. The number of processors 61 can be one or more.

[0152] It should be understood that processor 61 can be a Central Processing Unit (CPU), or other general-purpose processor 61, digital signal processor 61 (DSP), application-specific integrated circuit (ASIC), etc. The general-purpose processor 61 can be a microprocessor 61, or any conventional processor 61. The steps of the method disclosed in this application can be directly manifested as being executed by the hardware processor 61, or being executed by a combination of hardware and software modules within the processor 61.

[0153] The system bus can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The system bus can be divided into address bus, data bus, control bus, etc. For ease of representation, only one thick line is used in the diagram, but this does not indicate that there is only one bus or one type of bus. Memory 62 may include random access memory (RAM) 62, and may also include non-volatile memory (NVM) 62, such as at least one disk storage device 62.

[0154] All or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a readable memory 62. When the program is executed, it performs the steps of the above method embodiments; and the aforementioned memory 62 (storage medium) includes: read-only memory 62 (ROM), RAM, flash memory 62, hard disk, solid-state hard disk, magnetic tape, floppy disk, optical disk, and any combination thereof.

[0155] The terminal device provided in this application embodiment can be used to execute the network restriction method provided in any of the above method embodiments. Its implementation principle and technical effect are similar, and will not be described again here.

[0156] This application provides a computer-readable storage medium storing computer instructions that, when executed on a computer, cause the computer to perform the aforementioned network restriction method.

[0157] The aforementioned computer-readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory, electrically erasable programmable read-only memory, erasable programmable read-only memory, programmable read-only memory, read-only memory, magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0158] Optionally, a readable storage medium can be coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Alternatively, the readable storage medium can be an integral part of the processor. Both the processor and the readable storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components within the device.

[0159] This application also provides a computer program product, which includes a computer program stored in a computer-readable storage medium. At least one processor can read the computer program from the computer-readable storage medium, and the at least one processor can implement the above-described method when executing the computer program.

[0160] It should be understood that this disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this disclosure is limited only by the appended claims.

Claims

1. A network restriction method, characterized in that, Applied to a terminal device, the method includes: When it is detected that the terminal device is establishing a data connection with the network server, a first command is executed. The first command is used to restrict non-root user processes and non-system user processes from accessing the Internet network. If the data connection is successfully established, N threads are started to send simulated packets to a preset network address, where N is a positive integer. If any of the threads receives a response packet corresponding to the simulated packet within a preset time period, the data connection is disconnected, and the first reset command is executed to remove the restriction on the non-root user's process and the non-system user's process to access the Internet network; If any of the threads does not receive a response packet corresponding to the simulated packet within the preset time period, the data connection is maintained. If the time after the data connection is successfully established exceeds the preset time period and no response packet is received, the first reset command is executed to remove the restriction on the non-root user's process and the non-system user's process to access the Internet network.

2. The method according to claim 1, characterized in that, The network addresses include: addresses corresponding to Internet domain names, Internet Protocol version 4 (IPv4) addresses, and Internet IPv6 addresses; Accordingly, N is greater than or equal to 3; Accordingly, starting N threads to send simulated packets to preset network addresses includes: Start at least three threads to send the simulated packets to the address corresponding to the Internet domain name, the Internet IPv4 address, and the Internet IPv6 address, respectively.

3. The method according to claim 1, characterized in that, The value of N is 9.

4. The method according to claim 1, characterized in that, The first command is the iptables command.

5. A network restriction device, characterized in that, Applied to a terminal device, the device includes: The processing module is used to execute a first command when it detects that the terminal device is establishing a data connection with the network server. The first command is used to restrict non-root user processes and non-system user processes from accessing the Internet network. The startup module is used to detect that the data connection has been successfully established, and then start N threads to send simulated packets to a preset network address, where N is a positive integer; The processing module is also used to maintain the data connection if any of the threads does not receive a response packet corresponding to the simulated packet within a preset time period; The disconnect module is used to disconnect the data connection if any of the threads receives a response packet corresponding to the simulated packet within a preset time period. The release module is used to execute the reset first command when the data connection is broken, or when the duration after the data connection is successfully established exceeds the preset duration and no response packet is received, so as to release the restriction on the non-root user's process and the non-system user's process to access the Internet network.

6. The apparatus according to claim 5, characterized in that, The network address includes: the address corresponding to an Internet domain name, the Internet IPv4 address, and the Internet IPv6 address; Accordingly, N is greater than or equal to 3; Accordingly, the startup module is specifically used for: Start at least three threads to send the simulated packets to the address corresponding to the Internet domain name, the Internet IPv4 address, and the Internet IPv6 address, respectively.

7. The apparatus according to claim 5, characterized in that, The value of N is 9.

8. The apparatus according to claim 5, characterized in that, The first command is the iptables command.

9. A terminal device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1 to 4.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1 to 4.

Images