Message processing method and device, equipment and storage medium

Abstract

The invention provides a message processing method and device, equipment and a storage medium, relates to the technical field of communication, and is used for controlling internet surfing behaviors of user equipment more finely. The method comprises the following steps: acquiring a to-be-transmitted message; determining a terminal to which the message to be transmitted belongs and an application to which the message to be transmitted belongs; and controlling the transmission of the message to be transmitted under the condition that the belonging terminal is determined to be a controlled terminal and the belonging application program is a controlled application program according to the preset internet access control information.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a message processing method, device, equipment and storage medium. Background Art

[0002] In the prior art, users usually restrict the networking of smart devices by manually turning on and off the router, thereby achieving Internet access control. However, simply turning on and off the router manually is relatively simple and crude. Although it can effectively control the Internet access behavior of specific users, it also hinders the use of other users while restricting their Internet access. It can be seen that the current Internet access control method is not comprehensive enough and is not convenient to use. Summary of the invention

[0003] The present application provides a message processing method, apparatus, device and storage medium for more finely controlling the Internet access behavior of user devices.

[0004] In order to at least achieve the above-mentioned purpose, on the one hand, the present application provides a message processing method, which includes: obtaining a message to be transmitted; determining the terminal and the application to which the message to be transmitted belongs; and controlling the transmission of the message to be transmitted when the terminal is determined to be a controlled terminal and the application to which it belongs is a controlled application according to preset Internet access control information. .

[0005] In an embodiment of the present application, a gateway device obtains a message to be transmitted, and determines the terminal and the application to which the message to be transmitted belongs. In this way, the gateway device can clearly identify the message that needs to be controlled, and can determine the terminal and the application to which the message to be transmitted belongs, so as to realize the identification of the message to be transmitted. When it is determined that the terminal to which it belongs is a controlled terminal according to the preset Internet control information, and the application to which it belongs is a controlled application, the transmission of the message to be transmitted is controlled. Since the present application needs to clarify not only the terminal to which the message to be transmitted belongs, but also the application to which the message to be transmitted belongs during the message processing process, the gateway device can detect the message to be transmitted more specifically, thereby realizing the message transmission control of the controlled application of the controlled terminal, and meeting the user's refined and differentiated Internet control needs.

[0006] In another aspect, a message processing device is provided, the device comprising an acquisition unit, a determination unit and a control unit. The acquisition unit is used to acquire a message to be transmitted; the determination unit is used to determine the terminal and the application to which the message to be transmitted belongs; the control unit is used to control the transmission of the message to be transmitted when the terminal is determined to be a controlled terminal and the application to which the message belongs is a controlled application according to preset Internet access control information.

[0007] On the other hand, a gateway device is provided, comprising: a processor and a memory for storing processor executable instructions; wherein the processor is configured to execute instructions so that the gateway device executes the message processing method as described in the first aspect above.

[0008] On the other hand, a computer-readable storage medium is provided, on which computer instructions are stored. When the computer instructions are executed on a computer, the computer executes the message processing method of the first aspect described above. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] In order to more clearly illustrate the technical solution in the present application, the drawings required for use in some embodiments of the present application will be briefly introduced below. Obviously, the drawings described below are only drawings of some embodiments of the present application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0010] Figure 1 A schematic diagram of a message processing system provided for some embodiments of the present application;

[0011] Figure 2 One of the flowcharts of the message processing method provided in some embodiments of the present application;

[0012] Figure 3 A schematic diagram of the interaction of functional modules provided in some embodiments of the present application;

[0013] Figure 4 A second flowchart of a message processing method provided in some embodiments of the present application;

[0014] Figure 5 A schematic diagram of an APP library provided for some embodiments of the present application;

[0015] Figure 6 A third flowchart of a message processing method provided in some embodiments of the present application;

[0016] Figure 7 A fourth flowchart of a message processing method provided in some embodiments of the present application;

[0017] Figure 8 A fifth flowchart of a message processing method provided in some embodiments of the present application;

[0018] Fig. 9 A schematic diagram of the relationship between the APP setting list and the APP library provided in some embodiments of the present application;

[0019] Fig.10 Flow chart six of the message processing method provided in some embodiments of the present application;

[0020] Fig.11 A schematic diagram of system file formation provided for some embodiments of the present application;

[0021] Fig.12 A schematic diagram of system file usage provided in some embodiments of the present application;

[0022] Fig.13 A schematic diagram of the structure of a message processing device provided in some embodiments of the present application;

[0023] Fig.14 A schematic diagram of the structure of a gateway device provided for some embodiments of the present application. DETAILED DESCRIPTION

[0024] The following will be combined with the drawings in this application to clearly and completely describe the technical solutions in this application. Obviously, the described embodiments are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0025] It should be noted that, in this application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in this application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0026] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features.

[0027] In the description of this application, unless otherwise specified, " / " means "or", for example, A / B can mean A or B. "And / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, "at least one" means one or more, and "multiple" means two or more.

[0028] With the popularization and application of the Internet, routers or customer premise equipment (CPE) have become common devices that provide Internet access services to users. For example, most households that have opened Internet access now have at least one home wireless router. Wireless routers have become the entry hub of the home Internet, used to provide Internet access and wireless connection functions. Wireless routers can be regarded as a repeater, forwarding broadband network signals to nearby wireless network devices (laptops, mobile phones and other smart devices) through antennas.

[0029] With the popularization of smart devices, more and more people own at least one smart device. For some special groups (such as those who lack self-control, minors or Internet addicts), Internet access control is necessary.

[0030] However, in terms of Internet access control, most routers can only perform simple filtering, such as setting up a blacklist or whitelist of URLs to prohibit or only allow access to certain websites, controlling Internet access for specific devices through media access control address (MAC) / internet protocol address (IP) / port number, or manually controlling the switch of the router to implement Internet access restrictions during specific time periods.

[0031] Setting up a blacklist and whitelist of URLs is to filter matching packets by adding firewall rules. This method only restricts access to websites, and when the terminal device accesses the Internet by using APPs instead of accessing websites, the Internet access control function of the blacklist and whitelist of URLs is completely ineffective.

[0032] Set the time period for Internet access. During the time period, the terminal can access the Internet, and other time periods will be prohibited. This method is a "one-size-fits-all" control strategy, which cannot support common scenarios such as taking online classes but not playing games during the same time period.

[0033] Through the MAC / IP / port number filtering method, the matching messages are intercepted through the firewall to filter the messages of specific source MAC, target MAC, source IP, target IP, and port (port number range). However, this method has limitations. For example, if the MAC address of the terminal can be random, the filtering will fail, or if the source IP of the terminal changes, the filtering will fail. In addition, this method requires that the website or service to be accessed by the terminal needs to specify the IP address in advance, and the IP of some websites may not be unique. And it cannot effectively control the way the terminal accesses the Internet through APP.

[0034] The strategy of restricting the applications installed on the terminal itself, on the one hand, has a huge reliance on the server as an intermediate communication. On the other hand, the terminal's disabling of specific apps installed on it is based on the control at the operating system level, but a large number of existing terminals do not support this function.

[0035] It can be seen that the above solutions cannot achieve more precise Internet access control, especially when various different applications (applications, APPs) have been installed on a large scale on smart devices. The above Internet access control solutions either cannot effectively implement Internet access restrictions on one or some specific APPs of a specific device, or all APPs of the entire device cannot access any network.

[0036] In view of this, the present application provides a message processing method, apparatus, device and storage medium for more finely controlling the Internet access behavior of user devices, such as restricting the Internet access of one or some APPs of a specific device.

[0037] The message processing method provided by the embodiment of the present application is described in detail below in conjunction with the accompanying drawings. It should be noted that the embodiments of the present application can refer to each other, for example, the same or similar steps, method embodiments, system embodiments and device embodiments can refer to each other without limitation.

[0038] The message processing method provided in the embodiment of the present application can be applied to a message processing system. Figure 1 FIG. 2 shows a structural diagram of the message processing system. Figure 1 As shown, the message processing system 10 includes a message processing device 11 and a plurality of terminal devices 12. The message processing device 11 is communicatively connected with each terminal device 12 respectively.

[0039] The message processing device 11 can provide data conversion services between multiple networks for the connected terminal device 12. For example, the message processing device 11 can control the message transmission of each terminal device 12. The specific message processing process can refer to the message processing method introduced in the following method embodiment, which will not be repeated here.

[0040] The message processing device 11 can be a gateway device in various forms. For example, the message processing device 11 can be a router, a CPE, an internetwork connector, a protocol converter, etc. The embodiment of the present application does not limit the specific type of the gateway device.

[0041] The terminal device 12 may be an electronic device with an Internet access function. For example, the terminal device 12 may be a mobile phone, a tablet computer, a laptop computer, an ultra-mobile personal computer (UMPC), a netbook, a personal digital assistant (PDA), a desktop computer, a cloud server, etc. The embodiment of the present application does not limit the specific type of the electronic device.

[0042] Various APPs can be installed on the terminal device 12. After the terminal device 12 is connected to the message processing device 11, the message processing device 11 can send or receive APP-related messages to the Internet to realize the function of the terminal device 12 using APP to access the Internet.

[0043] The application scenarios of the embodiments of the present application are not limited. The system architecture and business scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. It is known to those skilled in the art that with the evolution of the network architecture and the emergence of new business scenarios, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems.

[0044] The execution subject of the message processing method provided in the embodiment of the present application may be the above-mentioned message processing device 11. As mentioned above, the message processing device 11 may be a gateway device. In some exemplary embodiments, the message processing device 11 may also be a processor (e.g., a central processing unit (CPU)) in the aforementioned gateway device; or, the message processing device 11 may also be an application (application, APP) with a message processing function installed in the aforementioned gateway device; or, the message processing device 11 may also be a functional module with a message processing function in the aforementioned gateway device, etc. The embodiment of the present application does not limit this.

[0045] For simplicity of description, the message processing device 11 is taken as a gateway device as an example for introduction below.

[0046] The following is an introduction to the message processing method provided in the embodiment of the present application.

[0047] Figure 2 The flowchart of the message processing method provided in the embodiment of the present application may include the following steps:

[0048] S201: Obtain a message to be transmitted.

[0049] As a possible implementation, when the Internet access control function of the gateway device is activated, the gateway device obtains Internet access control information and the message to be transmitted, and screens the message to be transmitted according to the Internet access control information to determine whether to transmit the message to be transmitted (for details, please refer to S202-S203 below). When the Internet access control function of the gateway device is turned off, the gateway device transmits the message to be transmitted normally (without screening). This part can refer to the gateway device forwarding technology for messages in the relevant technology, which will not be repeated here.

[0050] The Internet access control function includes a function of prohibiting Internet access or a function of allowing Internet access. The Internet access control information is used to instruct to control the message transmission of at least one controlled application of at least one controlled terminal.

[0051] It should be noted that the Internet access control information can be pre-set by the user and stored in the gateway device. The controlled terminal can be a terminal that has accessed the gateway device. For example, the controlled terminal can be a terminal that is communicating with the gateway device (such as Figure 1 The controlled terminal may be any terminal device 12 in the gateway device, and the controlled terminal may also be a terminal (such as an offline terminal device) that is connected to the gateway device in a historical time. The message to be transmitted may be any message passing through the gateway device, for example, the message to be transmitted is each message in the gateway device.

[0052] In some embodiments, the gateway device may hook the to-be-transmitted message in the transmission path through a hook function in the operating system kernel, and analyze the hooked to-be-transmitted message in the operating system kernel.

[0053] It should be noted that the operating system kernel of the gateway device can be a Linux kernel, which has a built-in prerouting chain and an embedded NF_HOOK function. The operation and maintenance personnel can set the parameters of the NF_HOOK function to construct a hook function.

[0054] For example, Figure 3 As shown, the operation and maintenance personnel can deploy the APP identification module in the kernel. The APP identification module includes a packet hooking program, a message processing program, and an APP library.

[0055] The APP identification module can call nf_register_hook to register the hook function and obtain the hook program to hook packets passing through the gateway device. The hook point is the prerouting chain, the priority queue is NF_IP_PRI_MANGLE, and the protocol family is PF_INET.

[0056] In practical applications, such as Figure 4As shown, the gateway device is started, and the kernel loads the APP identification module. Since the netfilter hook package of the hook function of the MANGLE table prerouting chain has been mounted, the IP original message can be passed as a parameter to the message handler of the kernel's APP identification module to perform subsequent processing on the hooked message.

[0057] It can be understood that the gateway device processes the message at the kernel level instead of in the user state, and there is no need to unload the acceleration module, which reduces the processor load and ensures the network speed, thus being more efficient.

[0058] S202: Determine the terminal and application to which the message to be transmitted belongs.

[0059] As a possible implementation, the gateway device analyzes the message to be transmitted to determine the address information and feature information of the message to be transmitted. Further, the gateway device determines the terminal to which the message to be transmitted belongs according to the address information, and determines the application to which the message to be transmitted belongs according to the feature information.

[0060] It should be noted that the address information may include source address, destination address, port number, host name, etc. The characteristic information includes some information that can reflect the specific content of the message, such as some keywords, suffix names, etc.

[0061] Exemplary, reference Figure 3 , the gateway device can parse the fixed header part (such as the first 20 bytes) and the variable part of the message to be transmitted through the message processing program of the kernel's APP identification module, and identify the source address, destination address, port number, host name and other characteristic information of the message to be transmitted. The gateway device can determine the terminal to which the message to be transmitted belongs based on the source address, destination address, port number and other information of the message to be transmitted. The gateway device can determine the application identifier (App ID) to which the message to be transmitted belongs by comparing the characteristic information of the message to be transmitted with the APP library. Among them, the APP library is pre-established by the operation and maintenance personnel and stored in the gateway device. The APP library includes mapping relationships between multiple APPs and multiple characteristic information.

[0062] like Figure 5 As shown, an APP library is shown, which includes APP1-APPn, and feature information 1 corresponding to APP1, ..., feature information n corresponding to APPn. After analyzing the feature information of the message to be transmitted, the gateway device can query the corresponding APP from the APP library according to the feature information, and determine the queried APP as the application to which the message to be transmitted belongs.

[0063] S203: When it is determined according to the preset Internet access control information that the terminal is a controlled terminal and the application is a controlled application, control the transmission of the message to be transmitted.

[0064] As a possible implementation, the target controlled terminal is any one of the at least one controlled terminal. The target controlled application is any one of the at least one controlled application of the target controlled terminal. The gateway device compares the identifier of the belonging terminal with the identifiers of each controlled terminal. If there is a controlled terminal with the same identifier as the belonging terminal, the gateway device takes the controlled terminal as the target controlled terminal. Further, the gateway device compares the identifier of the belonging application with the identifiers of each controlled application of the target controlled terminal. If there is a controlled application with the same identifier as the belonging application, the gateway device takes the controlled application as the target controlled application, and then the gateway device performs corresponding transmission control on the message to be transmitted. Otherwise, the gateway device transmits the message to be transmitted normally.

[0065] It should be noted that controlling the transmission of the message to be transmitted includes allowing transmission or prohibiting transmission. For example, if the transmission of the message to be transmitted is allowed, the gateway device may send the message to the relevant protocol layer for transmission. If the transmission of the message to be transmitted is prohibited, the gateway device may discard the message to be transmitted.

[0066] For example, when the Internet access control function is to prohibit the Internet access function, the gateway device determines that the terminal is the same as the target controlled terminal, and the application is the same as the target controlled application of the target controlled terminal, and the gateway device prohibits the transmission of the message to be transmitted. Otherwise, the gateway device allows the transmission of the message to be transmitted. When the Internet access control function is to allow the Internet access function, the gateway device determines that the terminal is the same as the target controlled terminal, and the application is the same as the target controlled application of the target controlled terminal, and the gateway device allows the transmission of the message to be transmitted. Otherwise, the gateway device prohibits the transmission of the message to be transmitted.

[0067] In some embodiments, the Internet access control information further includes the control time of the target controlled application of the target controlled terminal. The gateway device can control the transmission of the message to be transmitted within the control time.

[0068] For example, the gateway device prohibits the transmission of messages related to the controlled application of the controlled terminal during the control time, and allows the transmission of messages related to the controlled application of the controlled terminal outside the control time.

[0069] For another example, the gateway device allows the transmission of messages related to the controlled application of the controlled terminal during the control time, and prohibits the transmission of messages related to the controlled application of the controlled terminal outside the control time.

[0070] In an embodiment of the present application, when it is determined that the Internet access control function is activated, the gateway device obtains Internet access control information and the message to be transmitted. Among them, the Internet access control function includes prohibiting the Internet access function or allowing the Internet access function, and the Internet access control information is used to indicate the control of the message transmission of at least one controlled application of at least one controlled terminal. In this way, the gateway device can clearly identify the message to be controlled, and can filter the message to be transmitted according to the Internet access control information. The gateway device determines the terminal to which the message to be transmitted belongs and the application to which it belongs, so as to realize the identification of the message to be transmitted. When the terminal to which it belongs is the same as the target controlled terminal in at least one controlled terminal, and the application to which it belongs is the same as the target controlled application in at least one controlled application of the target controlled terminal, the transmission of the message to be transmitted is controlled. Since the Internet access control information in the present application can reflect the specific application on the specific terminal corresponding to the message that the user wants to control, the gateway device can detect the message to be transmitted more specifically, thereby realizing the message transmission control of the target controlled application of the target controlled terminal, and meeting the user's refined and differentiated Internet access control needs.

[0071] In one design, in order to determine the controlled terminals and the controlled applications of each controlled terminal, such as Figure 6 As shown, the message processing method provided in the embodiment of the present application may also include:

[0072] S301: When a request for setting Internet access control is received, an Internet access control page is displayed.

[0073] The Internet access control page is used to display the identification of at least one candidate terminal and the identification of at least one candidate application corresponding to each candidate terminal.

[0074] As a possible implementation, the user equipment initiates an Internet access management request to the gateway equipment. In response to the request operation of the user equipment, the gateway equipment sends Internet access control page display information to the user equipment, so that the user equipment displays the Internet access control page.

[0075] It should be noted that the user device can be any terminal connected to the gateway device. The request operation can be a request operation related to Internet access management initiated by the user device. Exemplarily, the user device can initiate an Internet access management request to the gateway device through the WebUI or management APP of the gateway device. In response to the request operation of the user device, the gateway device sends Internet access control page display information to the user device. Correspondingly, the user device displays the Internet access control page to the user through the WebUI or management APP. The Internet access control page contains the identifiers of multiple candidate terminals and the identifiers of multiple candidate applications. Among them, the identifier of a candidate terminal is used to uniquely identify this terminal device, and the identifier of a candidate terminal can correspond to the MAC address, hostname, IP address and other information of this terminal device.

[0076] As another possible implementation, the user can also perform Internet access settings on the gateway device. That is, the user directly initiates an Internet access control request on the gateway device, and accordingly, the gateway device responds to the Internet access control request and displays an Internet access control page. S302, receiving an identifier of at least one controlled terminal selected from identifiers of multiple candidate terminals, and an identifier of at least one controlled application of each controlled terminal.

[0077] The at least one controlled terminal and the at least one controlled application are determined by the user equipment in response to a selection operation on the Internet access control page.

[0078] As a possible implementation, the user can select from multiple candidate terminals on the Internet access control page, and can also select a candidate application corresponding to any candidate terminal. The user device determines the controlled terminal identifier selected by the user and the controlled application identifier of the controlled terminal in response to the user's selection operation, and sends these identifiers to the gateway device. Correspondingly, the gateway device receives the identifier of the controlled terminal and the identifier of at least one controlled application of each controlled terminal sent by the user device.

[0079] It can be understood that in response to the request operation of the user device, the gateway device sends an Internet access control page to the user device, so that the user device can display the identifiers of multiple candidate terminals and multiple candidate application programs. The user can make Internet access settings on the Internet access control page, for example, select a terminal (i.e., a controlled terminal) that he wants to control the Internet from multiple candidate terminals, and can also select an application (i.e., a controlled application) that he wants to control the Internet from multiple candidate applications. In this way, the user can flexibly and finely set the controlled terminal and the controlled application, meet the user's refined Internet access control needs, and facilitate user operation. Further, the user device sends the identifier of the controlled terminal and the identifier of the controlled application selected by the user in the Internet access control page to the gateway device, and accordingly, the gateway device can filter the transmission message according to the received identifier of the controlled terminal and the identifier of the controlled application.

[0080] In some embodiments, the Internet access control page also includes an Internet access control group list. Figure 7 As shown, the gateway device can also generate an identifier of the terminal in response to the user device adding an access terminal to the Internet access control group list. Further, the gateway device searches for the terminal in the access list. If the gateway device finds the terminal in the access list, it adds the terminal identifier of the terminal to the terminal identifier set, adds the terminal to the Internet access control group, and updates the Internet access control group list.

[0081] like Figure 8 As shown, if the gateway device does not find the terminal in the access list, it continues to search for the terminal device in the offline list according to the terminal identifier. If the gateway device finds the terminal in the offline list, it adds the terminal identifier of the terminal to the terminal identifier set, then adds the terminal to the Internet access control group, and updates the Internet access control group list. If the terminal is not found in the offline list, it proves that the terminal does not exist. The gateway device can remind the user device by popping up a reminder box, etc., and supports users to add terminals by manually entering the terminal identifier.

[0082] It can be understood that the embodiments of the present application provide users with a variety of settings for controlled terminals. Users can set controlled terminals in the Internet access control page according to actual needs to achieve Internet access control of the controlled terminals through a gateway device.

[0083] It should be noted that when the user makes Internet access settings on the Internet access control page displayed on the user device, he can first select a controlled terminal from multiple candidate terminals, and then select a controlled application from multiple candidate applications. He can also first select a controlled application from multiple candidate applications, and then select a controlled terminal from multiple candidate terminals. The embodiments of the present application are not limited to this.

[0084] In some exemplary embodiments, after the user device sends the identifier of the controlled terminal and the identifier of the controlled application selected by the user in the Internet access control page to the gateway device, the gateway device determines the controlled application of each controlled terminal as the controlled application selected by the user, that is, the controlled application of each controlled terminal is the same.

[0085] In some exemplary implementations, the user can also set different controlled applications for different controlled terminals. For example, each time the user selects a controlled terminal, the user device displays multiple candidate applications on the Internet access control page, and the user can select the corresponding controlled application from the multiple candidate applications for the controlled terminal. The gateway device can determine the controlled application of each controlled terminal according to the user's selection, that is, the controlled application of each controlled terminal can be different.

[0086] As a possible implementation, the Internet access control page includes an APP setting list, and multiple candidate applications are located in the APP setting list. The user can select a controlled application in the APP setting list.

[0087] Exemplarily, after the user selects a controlled terminal from among multiple candidate terminals on the Internet access control page, the Internet access control page displays an APP setting list, and the user can select a controlled application corresponding to the controlled terminal in the APP setting list.

[0088] like Fig. 9 As shown, the APP setting list provided on the WebUI or management APP of the gateway device has a one-to-one correspondence with the APP library in the kernel APP identification module. The APP library records the AppID and IP message feature information of all APPs in the APP list, where the AppID can uniquely identify a specific APP, and the feature information is the unique feature value of the IP message of each different APP, which can be obtained through analysis and training.

[0089] It can be understood that in the embodiments of the present application, the user can set a corresponding controlled application for each controlled terminal according to actual needs, so as to realize accurate identification and filtering of specific applications of specific terminals through the gateway device, so that the user can perform Internet access settings more flexibly and conveniently.

[0090] In one design, in order to determine whether to activate the Internet access control function, the message processing method provided in the embodiment of the present application further includes:

[0091] The gateway device receives the selection result of the Internet prohibition control by the user device, adds the identification of at least one controlled terminal and the identification of at least one controlled application of each controlled terminal to the Internet prohibition list, and determines to activate the Internet prohibition function.

[0092] Alternatively, the gateway device receives the selection result of the user device for the Internet access permission control, adds the identification of at least one controlled terminal and the identification of at least one controlled application of each controlled terminal to the Internet access permission list, and determines to activate the Internet access permission function.

[0093] Exemplarily, the user sets a blacklist of APPs that prohibit Internet access for the controlled terminals that join the Internet access control group through the WebUI or management APP of the gateway device (one or more controlled APPs can be set), so that the gateway device prohibits the message transmission of the controlled APP of the controlled terminal, but allows the message transmission of other APPs. After the user selects the controlled terminal and the controlled application in the Internet access control page of the WebUI or management APP, select to add to the APP blacklist control, and send the control selection result to the gateway device through the user device. Accordingly, the gateway device receives the selection result of the APP blacklist control by the user device, adds the identification of at least one controlled terminal and the identification of at least one controlled application of each controlled terminal to the prohibited Internet access list, and determines to activate the prohibited Internet access function.

[0094] In another exemplary embodiment, the user sets an APP whitelist (one or more controlled APPs) that are allowed to access the Internet for the controlled terminals that join the Internet access control group through the WebUI or management APP of the gateway device, so that the gateway device allows the message transmission of the controlled APP of the controlled terminal, while prohibiting the message transmission of other APPs. After the user selects the controlled terminal and the controlled application in the Internet access control page of the WebUI or management APP, he chooses to add to the APP whitelist control, and sends the control selection result to the gateway device through the user device. Accordingly, the gateway device receives the selection result of the APP whitelist control by the user device, adds the identification of at least one controlled terminal and the identification of at least one controlled application of each controlled terminal to the list of allowed Internet access, and determines to activate the function of allowing Internet access.

[0095] refer to Figure 3 The gateway device has an upper-layer application (such as a management APP) for processing user devices. The upper-layer application is responsible for receiving and processing user settings, including adding the controlled terminal to the Internet access control group, removing the controlled terminal from the Internet access control group, setting an APP that prohibits Internet access for the controlled terminal in the Internet access control group, and setting an APP that allows Internet access for the controlled terminal in the Internet access control group. The upper-layer application searches for the controlled terminal in the access list and the offline list, records the terminal identification of the controlled terminal, and adds it to the terminal identification set. The gateway device associates the terminal identification of the controlled terminal with the AppID of the Internet access control APP, generates a system file, and reads this system file in the memory.

[0096] In one design, in order to enable the gateway device to more accurately implement Internet access control, the message processing method provided in the embodiment of the present application also includes:

[0097] The gateway device receives the control time of at least one controlled application of at least one controlled terminal from the user device, wherein the control time is the message transmission time for controlling the corresponding controlled application.

[0098] Accordingly, the gateway device can associate each controlled terminal, the controlled application corresponding to each controlled terminal, and the control time corresponding to each controlled application to obtain Internet access control information.

[0099] Exemplarily, the user can also set the allowed Internet access time period (i.e., control time) for the controlled APP of the controlled terminal through the WebUI or management APP of the gateway device. The Internet access time period can be defaulted (i.e., the default time period). When the user does not set the allowed Internet access time period, the controlled APP of the controlled terminal is prohibited from accessing the Internet at any time. The Internet access time period can be set to any time period from 00:00 to 23:59 from Monday to Sunday, and periodic cycles are supported. For example, APP1 of terminal 1 is allowed to access the Internet from 18:00 to 20:00 every Saturday and Sunday, and is prohibited from accessing the Internet at other times.

[0100] In another exemplary embodiment, the prohibited Internet access period can be set to any period from 00:00 to 23:59 from Monday to Sunday, supporting periodic cycles. For example, the APP1 of the terminal 1 is set to prohibit Internet access from 18:00 to 20:00 every Saturday and Sunday, and Internet access is allowed in other periods.

[0101] It is understandable that after receiving the controlled terminal information, controlled application information and control time information set by the user, the gateway device can filter the transmission message according to the specific Internet access control function (forbid Internet access function or allow Internet access function) to control the Internet access of the controlled application information of the controlled terminal information within the control time. In addition, in the embodiment of the present application, the Internet access control function is isolated from other terminals connected to the gateway device, which can ensure that the Internet access control function will not be easily modified.

[0102] For example, Fig.10 As shown, the gateway device adds a write lock to the system file APP_BLACKLIST that stores the blacklist AppID and terminal identification, and then performs a write operation. The gateway device reads the terminal identification of the controlled terminal from the terminal identification set, and writes the AppID of the APP set by the user, the terminal identification of the controlled terminal, and the Internet access time period into the system file APP_BLACKLIST. After the writing is completed, the gateway device unlocks the system file APP_BLACKLIST and uses the system file APP_BLACKLIST as the Internet access control information.

[0103] like Fig.11As shown, the controlled terminal is represented by the terminal identifier, the APP prohibited from accessing the Internet is represented by the corresponding AppID of the APP in the APP library, and the Internet access period from Monday to Sunday is represented as Mon, Tues, Wed, Thur, Fri, Sat, and Sun respectively. The time is represented by a 24-hour system, ranging from 00:00 to 23:59. Among them, the controlled terminals are terminal 1, terminal 2, terminal 3, and terminal 4, and each terminal has its own MAC address, IP address, and hostname. The APPs prohibited from accessing the Internet for terminal 1 are APP1 and APP2, among which the Internet prohibition time for APP1 is Sat, Sun 18:00-20:00 (i.e. 18:00-20:00 on Saturdays and Sundays), and the Internet prohibition time for APP2 is the default time (such as prohibition all day long). The APP prohibited from accessing the Internet for terminal 2 is APP3. The APPs prohibited from accessing the Internet for terminal 3 are APP2 and APP4. The APP prohibited from accessing the Internet of terminal 4 is APP1, wherein the Internet prohibition time of APP1 is Sat, Sun 18:00-20:00.

[0104] In practical applications, such as Fig.12 As shown, the kernel APP identification module of the gateway device parses the message to be transmitted and outputs the terminal identifier and AppID of the message to be transmitted. The gateway device reads the system file APP_BLACKLIST from the memory, and searches for the terminal identifier and AppID that match the message to be transmitted from the system file APP_BLACKLIST. If the gateway device does not find the terminal identifier and AppID corresponding to the message to be transmitted, it means that the current message to be transmitted does not belong to the controlled APP of the controlled terminal device that is prohibited from accessing the Internet, so the message is released and handed over to the upper layer protocol for processing. If the gateway device finds the terminal identifier and AppID corresponding to the message to be transmitted, it means that the current message to be transmitted belongs to the controlled APP of the controlled terminal that is prohibited from accessing the Internet, and the gateway device further determines whether the current time belongs to the period of time allowed to access the Internet. If it is within the period of time allowed to access the Internet, the gateway device releases this message, otherwise it terminates this message (DROP).

[0105] Exemplarily, the gateway device can also add a write lock to the system file APP_WHITELIST that stores the whitelist AppID and terminal identification, and then perform a write operation. The gateway device reads the terminal identification of the controlled terminal from the terminal identification set, and writes the AppID of the APP set by the user, the terminal identification of the controlled terminal, and the Internet access time period into the system file APP_WHITELIST. After the writing is completed, the gateway device unlocks the system file APP_WHITELIST and uses the system file APP_WHITELIST as Internet access control information.

[0106] Furthermore, the controlled terminal is represented by the terminal identifier, and the APP allowed to access the Internet is represented by the corresponding AppID of the APP in the APP library. The Internet access time from Monday to Sunday is represented as Mon, Tues, Wed, Thur, Fri, Sat, and Sun respectively. The time is represented by a 24-hour system, ranging from 00:00 to 23:59. Among them, the controlled terminals are terminal 1, terminal 2, terminal 3, and terminal 4, and each terminal has its own MAC address, IP address, and hostname. The APPs allowed to access the Internet for terminal 1 are APP1 and APP2, among which the Internet access time allowed for APP1 is Sat, Sun 18:00-20:00 (i.e. 18:00-20:00 on Saturdays and Sundays), and the Internet access time allowed for APP2 is the default time (such as prohibited all day long). The APP allowed to access the Internet for terminal 2 is APP3. The APPs allowed to access the Internet for terminal 3 are APP2 and APP4. The APP allowed to access the Internet of terminal 4 is APP1, wherein the Internet access permission time of APP1 is Sat, Sun 18:00-20:00.

[0107] In actual applications, the kernel APP identification module of the gateway device parses the message to be transmitted and outputs the terminal identifier and AppID of the message to be transmitted. The gateway device reads the system file APP_WHITELIST from the memory and searches for the terminal identifier and AppID that match the message to be transmitted from the system file APP_WHITELIST. If the gateway device does not find the terminal identifier and AppID corresponding to the message to be transmitted, it means that the current message to be transmitted does not belong to the controlled APP of the controlled terminal device that is allowed to access the Internet, so it is prohibited to send this message (such as terminating this message (DROP)). If the gateway device finds the terminal identifier and AppID corresponding to the message to be transmitted, it means that the current message to be transmitted belongs to the controlled APP of the controlled terminal that is allowed to access the Internet. The gateway device further determines whether the current time belongs to the period allowed to access the Internet. If it is within the period allowed to access the Internet, the gateway device releases this message and hands it over to the upper layer protocol for processing, otherwise it terminates this message (DROP).

[0108] In general, users add specific terminals to the Internet access control group and set the APPs that are prohibited or allowed to access the Internet. Correspondingly, the gateway device records the terminal identification, adds the terminal to the Internet access control group, associates the terminal identification with the AppID, and saves it to the system file. The gateway device loads the kernel APP identification module and reads the system file that saves the terminal identification and AppID into the memory. After capturing the message, the gateway device analyzes the message, identifies the APP and terminal to which the message belongs, and obtains the analysis result. Furthermore, the gateway device compares the message analysis result with the records in the memory to find out whether there is a matching AppID and device, and releases or drops the message accordingly.

[0109] It can be understood that the embodiments of the present application can accurately identify and process the messages of the controlled applications of the controlled terminal devices, meet the differentiated Internet access control needs of users, ensure that the restricted APPs of the terminals added by users to the Internet access control group cannot access the Internet, or only allow the APPs that can access the Internet to access the network normally, and at the same time will not affect the normal Internet access of other terminals and other APPs of the controlled terminals. Therefore, it can solve the defects existing in the relevant Internet access control strategies, provide users with more accurate Internet access control strategies, have the advantages of simple operation, flexible management, and adaptability to various current Internet access and Internet restriction scenarios, and can effectively improve the user experience.

[0110] In some embodiments, in response to a user device's modification operation on any controlled terminal and / or a controlled application corresponding to any controlled terminal and / or a control time corresponding to any controlled application, the gateway device updates the Internet access control information.

[0111] For example, if the user removes the device that has been added to the Internet access control group, the gateway device updates the terminal identification set, deletes the current device in the Internet access control group, updates the system files APP_BLACKLIST and / or APP_WHITELIST, and re-reads the updated system files APP_BLACKLIST and APP_WHITELIST from the memory. Accordingly, the gateway device processes the message according to the user's latest settings.

[0112] For another example, if a user updates an APP that prohibits Internet access on a device that has joined the Internet access control group, the gateway device updates the system files APP_BLACKLIST and APP_WHITELIST, and the memory re-reads the updated system files APP_BLACKLIST and APP_WHITELIST. Accordingly, the gateway device processes the message according to the user's latest settings.

[0113] The embodiment of the present application can divide the updating device of the functional module into functional modules or functional units according to the above method example. For example, each functional module or functional unit can be divided corresponding to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of software functional modules or functional units. Among them, the division of modules or units in the embodiment of the present application is schematic, which is only a logical function division. There may be other division methods in actual implementation.

[0114] In the case of dividing each functional module into corresponding functional modules, Fig.13 FIG. 4 is a schematic diagram showing the structure of a message processing device 40 of a functional module, and the message processing device 40 of the functional module can be used to execute the message processing method provided in the above embodiment. Fig.13 As shown, the message processing device 40 includes an acquisition unit 401 , a determination unit 402 and a control unit 403 .

[0115] The acquisition unit 401 is used to acquire the message to be transmitted. The determination unit 402 is used to determine the terminal and the application to which the message to be transmitted belongs. The control unit 403 is used to control the transmission of the message to be transmitted when it is determined that the terminal is a controlled terminal and the application is a controlled application according to the preset Internet access control information.

[0116] In some exemplary embodiments, the acquisition unit 401 is further used to acquire Internet access control information; the Internet access control information is used to indicate control of at least one controlled application of at least one controlled terminal. The determination unit 402 is specifically used to: when at least one controlled terminal includes the belonging terminal, and at least one controlled application includes the belonging application, determine that the belonging terminal is the controlled terminal and the belonging application is the controlled application.

[0117] In some exemplary embodiments, the determination unit 402 is specifically used to: determine whether the Internet access control function is activated; if the Internet access control function is activated, determine the terminal and application to which the message to be transmitted belongs; the Internet access control function includes prohibiting the Internet access function or allowing the Internet access function.

[0118] In some exemplary embodiments, the message processing device 40 further includes a receiving unit 404. The receiving unit 404 is configured to display an Internet access control page when receiving a request to set Internet access control; the Internet access control page is configured to display an identifier of at least one candidate terminal and an identifier of at least one candidate application corresponding to each candidate terminal, receive an identifier of at least one controlled terminal selected from the identifiers of multiple candidate terminals, and an identifier of at least one controlled application of each controlled terminal; the at least one controlled terminal and the at least one controlled application are determined in response to a selection operation on the Internet access control page.

[0119] In some exemplary embodiments, the Internet access control page also includes an Internet access prohibition control and an Internet access permission control; the receiving unit 404 is further used to: receive the selection result of the Internet access prohibition control, add the identification of at least one controlled terminal and the identification of at least one controlled application of each controlled terminal to the Internet access prohibition list, and determine to activate the Internet access prohibition function; or, receive the selection result of the Internet access permission control, add the identification of at least one controlled terminal and the identification of at least one controlled application of each controlled terminal to the Internet access permission list, and determine to activate the Internet access permission function.

[0120] In some exemplary implementations, the control unit 403 is specifically configured to: when the Internet access control function is to prohibit the Internet access function, prohibit the transmission of the message to be transmitted; when the Internet access control function is to allow the Internet access function, allow the transmission of the message to be transmitted.

[0121] In some exemplary implementations, the acquisition unit 401 is specifically configured to: hook the message to be transmitted through a hook function in the operating system kernel.

[0122] In some exemplary embodiments, the Internet access control information also includes the control time of the controlled application of the controlled terminal; the control unit 403 is specifically used to: when it is determined that the terminal is a controlled terminal and the application is a controlled application, confirm the control time corresponding to the application in the Internet access control information; when it is determined that the current time belongs to the control time, control the transmission of the message to be transmitted.

[0123] In some exemplary embodiments, the receiving unit 404 is further used to: receive the control time of at least one controlled application of at least one controlled terminal; the control time is the message transmission time for controlling the corresponding controlled application; and associate each controlled terminal, the controlled application corresponding to each controlled terminal, and the control time corresponding to each controlled application to obtain Internet access control information.

[0124] In some exemplary embodiments, the control unit 403 is further configured to update the Internet access control information in response to a change operation on any controlled terminal and / or a controlled application corresponding to any controlled terminal and / or a control time corresponding to any controlled application.

[0125] In the case of implementing the functions of the above-mentioned integrated modules in the form of hardware, the embodiment of the present application provides a possible structure of the gateway device involved in the above-mentioned embodiment. Fig.14 As shown, the gateway device 50 includes: a processor 502 and a bus 504. In some exemplary implementations, the gateway device 50 may further include a memory 501; optionally, the gateway device 50 may further include a communication interface 503.

[0126] The processor 502 may be a processor that implements or executes various exemplary logic blocks, modules, and circuits described in conjunction with the embodiments of the present application. The processor 502 may be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array, or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the embodiments of the present application. The processor 502 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like.

[0127] The communication interface 503 is used to connect with other devices via a communication network, such as Ethernet, wireless access network, wireless local area network (WLAN), etc.

[0128] The memory 501 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program codes in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.

[0129] As a possible implementation, the memory 501 may exist independently of the processor 502, and the memory 501 may be connected to the processor 502 via a bus 504 for storing instructions or program codes. When the processor 502 calls and executes the instructions or program codes stored in the memory 501, the message processing method provided in the embodiment of the present application can be implemented.

[0130] In another possible implementation, the memory 501 may also be integrated with the processor 502 .

[0131] The bus 504 may be an extended industry standard architecture (EISA) bus, etc. The bus 504 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.14 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0132] Some embodiments of the present application provide a computer-readable storage medium (e.g., a non-transitory computer-readable storage medium), which stores computer program instructions. When the computer program instructions are executed on a computer, the computer executes the message processing method described in any of the above embodiments.

[0133] Exemplarily, the above-mentioned computer-readable storage media may include, but are not limited to: magnetic storage devices (e.g., hard disks, floppy disks or magnetic tapes, etc.), optical disks (e.g., compact disks (CD), digital versatile disks (DVD), etc.), smart cards and flash memory devices (e.g., erasable programmable read-only memory (EPROM), cards, sticks or key drives, etc.). The various computer-readable storage media described in this application may represent one or more devices and / or other machine-readable storage media for storing information. The term "machine-readable storage medium" may include, but is not limited to, wireless channels and various other media capable of storing, containing and / or carrying instructions and / or data.

[0134] An embodiment of the present application provides a computer program product including instructions. When the computer program product is run on a computer, the computer is enabled to execute the message processing method described in any one of the above embodiments.

[0135] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A message processing method, It is characterized in that The method comprises: Get the message to be transmitted; Determine the terminal and application to which the message to be transmitted belongs; When it is determined according to preset Internet access control information that the terminal is a controlled terminal and the application is a controlled application, the transmission of the message to be transmitted is controlled.

2. The method according to claim 1, It is characterized in that The method further comprises: Acquiring Internet access control information; the Internet access control information is used to instruct to control at least one controlled application of at least one controlled terminal; The determining that the terminal is a controlled terminal and the application is a controlled application includes: In a case where the at least one controlled terminal includes the belonging terminal, and the at least one controlled application includes the belonging application, it is determined that the belonging terminal is a controlled terminal, and the belonging application is a controlled application.

3. The method according to claim 1, It is characterized in that The determining the terminal and the application to which the message to be transmitted belongs includes: Determine whether the Internet access control function is activated; When it is determined to activate the Internet access control function, the terminal and the application program to which the message to be transmitted belongs are determined; the Internet access control function includes a function of prohibiting Internet access or a function of allowing Internet access.

4. The method according to claim 1, It is characterized in that The method further comprises: In the case of receiving a request to set an Internet access control, displaying an Internet access control page; the Internet access control page is used to display an identifier of at least one candidate terminal and an identifier of at least one candidate application corresponding to each candidate terminal; The identification of at least one controlled terminal selected from identifications of a plurality of candidate terminals and the identification of at least one controlled application of each controlled terminal are received; the at least one controlled terminal and the at least one controlled application are determined in response to a selection operation on the Internet access control page.

5. The method according to claim 4, It is characterized in that The Internet access control page also includes a control for prohibiting Internet access and a control for allowing Internet access; the method also includes: Receiving a selection result of the Internet access prohibition control, adding the identifier of the at least one controlled terminal and the identifier of at least one controlled application of each controlled terminal to an Internet access prohibition list, and determining to activate the Internet access prohibition function; Alternatively, a selection result of the Internet access permission control is received, the identification of the at least one controlled terminal and the identification of at least one controlled application of each controlled terminal are added to an Internet access permission list, and the Internet access permission function is activated.

6. The method according to claim 3, It is characterized in that The controlling the transmission of the message to be transmitted includes: When the Internet access control function is to prohibit the Internet access function, prohibit the transmission of the message to be transmitted; In the case where the Internet access control function is the Internet access permission function, the message to be transmitted is allowed to be transmitted.

7. The method according to claim 1, It is characterized in that The obtaining of the message to be transmitted comprises: The message to be transmitted is hooked through a hook function in the operating system kernel.

8. The method according to claim 1, It is characterized in that The Internet access control information also includes the control time of the controlled application of the controlled terminal; The controlling the transmission of the message to be transmitted includes: When it is determined that the terminal is a controlled terminal and the application is a controlled application, confirming the control time corresponding to the application in the Internet access control information; When it is determined that the current time belongs to the control time, the transmission of the message to be transmitted is controlled.

9. The method according to claim 1, It is characterized in that The method further comprises: Receiving a control time of at least one controlled application of at least one controlled terminal; the control time is a message transmission time for controlling the corresponding controlled application; The controlled terminals, the controlled applications corresponding to the controlled terminals, and the control time corresponding to the controlled applications are associated to obtain the Internet access control information.

10. The method according to claim 9, It is characterized in that The method further comprises: In response to a change operation on any controlled terminal and / or a controlled application corresponding to any controlled terminal and / or a control time corresponding to any controlled application, the Internet access control information is updated.

11. A gateway device, It is characterized in that include: a processor and a memory for storing instructions executable by the processor; The processor is configured to execute the instruction so that the gateway device executes the message processing method as described in any one of claims 1-10.

12. A computer-readable storage medium, It is characterized in that The computer-readable storage medium stores computer instructions, and when the computer instructions are executed on a computer, the computer is enabled to execute the message processing method according to any one of claims 1 to 10.

Images