A management method of a device, an electronic device, a storage medium and a chip

Abstract

The application provides a management method of a device, an electronic device, a storage medium and a chip. The method is applied to a router, and the router is configured with regular expressions of domain names of a plurality of servers that need to be managed. Then, it is determined whether a regular expression corresponding to a domain name used by a user for online surfing exists in the plurality of regular expressions, so as to identify whether the domain name used by the user for online surfing is a domain name that needs to be managed. Since the regular expression data set of the domain name is obtained based on common features of a plurality of domain names of a server, even if the server that needs to be managed is deployed with a plurality of domain names, when the user accesses different domain names of the server, the regular expression of the domain name can be successfully matched with the plurality of domain names of the server, so that it can be identified that the plurality of domain names are domain names that need to be managed, and the domain name that needs to be managed is avoided from being identified as a domain name that does not need to be managed, the accuracy of identifying the managed domain name is improved, and the user experience is improved.

Description

Technical Field

[0001] This application relates to the field of terminals, and more particularly to a method for controlling a device, an electronic device, a storage medium, and a chip. Background Technology

[0002] Routers are widely used in homes, offices, and other settings. Among their functions, the domain name control function of routers is a network security measure.

[0003] The relevant solution implements domain name control in the following way: For example, after the router intercepts the domain name A used by the user to access the Internet, it identifies the domain name A through a domain name control list (such as a blacklist). The domain name control list includes multiple domain names that need to be controlled. If the domain name control list includes the domain name A, then the user is restricted from accessing the server corresponding to the domain name A. If the domain name control list does not include the domain name A, then the user is allowed to access the server corresponding to the domain name A.

[0004] However, a server typically deploys multiple domains to improve security and stability. When configuring the domains to be managed in the domain management list, due to the difficulty and high cost of obtaining multiple domains from a single server, only a small number of domains from one server are usually configured. Thus, although the domain management list contains the domains of the server that need to be managed, the small number of domains configured in the list and the fact that the server deploys multiple domains may cause the domains that need to be managed to be identified as those that do not need to be managed, resulting in inaccurate identification. This can cause the router's domain management function to fail, affecting the user experience. Summary of the Invention

[0005] This application provides a device control method, electronic device, storage medium, and chip, which can improve the accuracy of identifying and controlling domain names, thereby reducing the probability of domain name control function failure and improving user experience.

[0006] Firstly, a method for controlling a device is provided, applied to a first electronic device, the method comprising:

[0007] During the process of the second electronic device accessing the third electronic device through the first electronic device, the system obtains the response message returned by the domain name system server to the second electronic device after the second electronic device sends a query message to the domain name system server. The query message includes the first domain name of the third electronic device, and the response message includes the first domain name and the first IP address corresponding to the first domain name. If it is determined that there is a first regular expression corresponding to the first domain name in the regular expression dataset, the system restricts the second electronic device from accessing the third electronic device through the first IP address. The regular expression dataset includes regular expressions of multiple domain names under control, and the regular expressions of multiple domain names include the first regular expression, which is obtained based on the common characteristics of multiple domain names of the third electronic device.

[0008] To improve security and stability, a server typically deploys multiple domains. While solutions may use a domain management list to manage domains, the limited number of domains in the list can lead to inaccurate identification, causing the router's domain management function to fail and impacting user experience.

[0009] This application embodiment configures a regular expression dataset of the domain names of servers (third electronic devices) that need to be controlled. It then determines whether the dataset contains a regular expression corresponding to a domain name (first domain name) used by users to access the internet. If a regular expression for the first domain name is found in the dataset, the domain name is identified as needing control, and users can be restricted from accessing the corresponding server (third electronic device) using that domain name. Since each regular expression in the dataset is derived from the common features of multiple domain names of the third electronic device, even if the third electronic device to be controlled deploys multiple domain names (each domain name having some content identical to other domain names), the regular expressions can still successfully match multiple domain names, thus identifying multiple domain names as needing control. This avoids misidentifying domain names that need control as uncontrollable, improving the accuracy of domain name identification, reducing the probability of domain name control function failure, and enhancing user experience.

[0010] In conjunction with the first aspect, in one possible implementation of the first aspect, if it is determined that a first regular expression corresponding to the first domain name exists in the regular expression dataset, restricting the second electronic device from accessing the third electronic device through the first IP address includes:

[0011] If it is determined that a first regular expression corresponding to the first domain name exists in the regular expression dataset, the first IP address is stored in the IP address dataset; the first message sent by the second electronic device to the third electronic device is obtained, and the first message includes the first IP address; if it is determined that the first IP address in the first message exists in the IP address dataset, the second electronic device is restricted from accessing the third electronic device through the first IP address.

[0012] The existing solution manages domain names by intercepting query requests sent from mobile phones to the server, obtaining the domain names included in the query requests, and then determining whether the domain name needs to be managed. If it is determined to be a domain name that needs to be managed, the solution modifies the query response sent from the server to the mobile phone so that the mobile phone cannot obtain the IP address corresponding to the domain name. However, there are two ways for a mobile phone to obtain the IP address corresponding to a domain name. The first way is that the mobile phone sends a query request to the server, and the server returns a query response to the mobile phone that includes the IP address corresponding to the domain name. The second way is that the mobile phone obtains the IP address corresponding to the domain name from the domain name cache. The solution can manage the first method but not the second method. In other words, when a user accesses a domain name that needs to be managed, they can obtain the IP address corresponding to the domain name that needs to be managed from the domain name cache through the second method, and then transmit messages to the server based on that IP address. The solution cannot prevent the mobile phone from transmitting messages to the server based on the IP address obtained from the domain name cache, resulting in the failure of the management.

[0013] In this embodiment, after the router (first electronic device) determines that the domain name is a domain name that needs to be controlled, it can store the IP address corresponding to the domain name that needs to be controlled (store the first IP address in the IP address dataset). Then, when the mobile phone (second electronic device) transmits a message (first message) to the server (third electronic device) through the IP address obtained in the first method or the IP address obtained in the second method, the router can query the stored data (which includes the IP address corresponding to the domain name that needs to be controlled) to find that the message contains an IP address. If the stored data contains the IP address in the message, then the second electronic device can be restricted from accessing the third electronic device through the first IP address to block the transmission of the message. Compared with related solutions, this embodiment can block the message transmitted by the second electronic device to the third electronic device through the IP address obtained in the second method, which can improve the blocking efficiency, thereby reducing the probability of domain name control function failure and improving user experience.

[0014] In conjunction with the first aspect, in one possible implementation of the first aspect, the first IP address in the first message is obtained based on the response message.

[0015] In conjunction with the first aspect, in one possible implementation of the first aspect, the first IP address in the first message is obtained based on the first cache, which refers to the cache of the second electronic device storing the first IP address in the response message.

[0016] In conjunction with the first aspect, in one possible implementation of the first aspect, if it is determined that a first regular expression corresponding to the first domain name exists in the regular expression dataset, restricting the second electronic device from accessing the third electronic device through the first IP address includes:

[0017] If it is determined that a first regular expression corresponding to the first domain name exists in the regular expression dataset, the memory occupied by the first message sent by the second electronic device to the third electronic device is released, so as to restrict the second electronic device from accessing the third electronic device through the first IP address.

[0018] In this embodiment of the application, the first electronic device can restrict the second electronic device from accessing the third electronic device through the first IP address by releasing the memory occupied by the first message sent by the second electronic device to the third electronic device, thereby controlling the domain name of the third electronic device and improving the control efficiency of the domain name control function.

[0019] In conjunction with the first aspect, in one possible implementation of the first aspect, if it is determined that a first regular expression corresponding to the first domain name exists in the regular expression dataset, restricting the second electronic device from accessing the third electronic device through the first IP address includes:

[0020] If it is determined that a first regular expression corresponding to the first domain name exists in the regular expression dataset, an interference message is sent to the second or third electronic device to restrict the second electronic device from accessing the third electronic device through the first IP address. The interference message is used to instruct the second electronic device to disconnect from the third electronic device.

[0021] In this embodiment of the application, the first electronic device can disconnect the network connection between the second electronic device and the third electronic device by sending interference messages to the second electronic device or the third electronic device. This can achieve the purpose of restricting the second electronic device from accessing the third electronic device through the first IP address and thus controlling the domain name of the third electronic device, thereby improving the control efficiency of the domain name control function.

[0022] In conjunction with the first aspect, in one possible implementation of the first aspect, the interfering message includes a Transmission Control Protocol Reset message or an Internet Control Message Protocol Unreachable message.

[0023] In a second aspect, an electronic device is provided for performing the method provided in the first aspect. Specifically, the electronic device may include a processing unit for performing any possible implementation of the first aspect.

[0024] Thirdly, an electronic device is provided, comprising: one or more processors; one or more memories; wherein the one or more memories store one or more computer programs, the one or more computer programs including instructions that, when executed by the one or more processors, cause the electronic device to perform any possible implementation of the method in the first aspect described above.

[0025] Fourthly, a computer-readable storage medium is provided, including computer instructions that, when executed on an electronic device, cause the electronic device to perform the method described in the first aspect.

[0026] Fifthly, a chip is provided, including a memory for storing instructions; and a processor for retrieving and executing the instructions from the memory, causing an electronic device on which the chip is mounted to perform the method described in the first aspect above. Attached Figure Description

[0027] Figure 1 This is a schematic diagram of the structure of a router provided in an embodiment of this application.

[0028] Figure 2 This is a software structure block diagram of a router provided in an embodiment of this application.

[0029] Figure 3 This is a schematic diagram illustrating the setting of a controlled domain name according to an embodiment of this application.

[0030] Figure 4 This is a schematic diagram of an interface for adding a domain name to a blacklist provided in an embodiment of this application.

[0031] Figure 5 This is a timing diagram of generating and storing a domain name control list provided in an embodiment of this application.

[0032] Figure 6 This is a schematic diagram illustrating the data transmission process in network communication.

[0033] Figure 7 This is a schematic diagram of a device control method provided in a related solution.

[0034] Figure 8 This is a schematic diagram of a device control method provided in an embodiment of this application.

[0035] Figure 9This is a timing diagram of a device control method provided in an embodiment of this application.

[0036] Figure 10 This is a schematic flowchart of a device control method provided in an embodiment of this application. Detailed Implementation

[0037] First, some terms mentioned in the embodiments of this application will be introduced.

[0038] A domain name is a hierarchical character identifier used on the Internet to identify and locate a computer or network server. It corresponds to the Internet Protocol (IP) address of that computer or network server, but is easier for humans to remember and use. Computers and network servers can also be collectively referred to as servers. A domain name includes top-level domains, second-level domains, subdomains, etc.

[0039] An IP address is a unique identifier assigned to each device on a network; every device connected to the network has a unique IP address.

[0040] A domain name regular expression is a string of text patterns used to match the format of a domain name. A basic domain name regular expression might contain the following elements: Start and end: ^ is usually used to indicate the beginning of the regular expression, and $ to indicate the end, ensuring the entire string matches the pattern. Tags: A domain name consists of multiple tags, separated by dots. Length limit: Each tag is usually no more than 63 characters, and the entire domain name cannot exceed 253 characters. Character limit: Domain names can contain letters, numbers, and hyphens (-), but cannot begin or end with a hyphen. Top-level domain (TLD): The last part of the domain name is the top-level domain, such as .com, .org, .net, .tv, etc., and is usually 2 to 63 characters long.

[0041] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0042] Routers are widely used in homes, offices, and other settings. One of their key functions is domain name control, a network security measure that provides a healthy and secure internet environment. Routers can manage the domain names of servers through this function. For example, by controlling domain names, users can be restricted from accessing websites that are irrelevant to their work or contain inappropriate content.

[0043] The relevant solution implements domain name control in the following way: For example, after the router intercepts the domain name A used by the user to access the Internet, it identifies the domain name A through a domain name control list (such as a blacklist). The domain name control list includes multiple domain names that need to be controlled. If the domain name control list includes the domain name A, then the user is restricted from accessing the server corresponding to the domain name A. If the domain name control list does not include the domain name A, then the user is allowed to access the server corresponding to the domain name A.

[0044] However, a server typically deploys multiple domains to improve security and stability. When configuring the domains to be managed in the domain management list, due to the difficulty and high cost of obtaining multiple domains from a single server, only a small number of domains from one server are usually configured. Thus, although the domain management list contains the domains of the servers that need to be managed, the small number of domains configured in the list may cause the domains that need to be managed to be identified as those that do not need to be managed, resulting in inaccurate identification. This would cause the router's domain management function to fail, affecting the user experience.

[0045] For example, server A deploys domains including domain 1 to domain 10. All of server A's domains are domains that need to be managed. However, the domain management list only configures domain 1 and domain 2 of server A. Suppose the router intercepts the user's internet access using domain 3. The router identifies domain 3 as a domain that does not need to be managed through the domain management list. However, domain 3 is actually a domain that needs to be managed. This results in inaccurate identification of the domain to be managed, and the user can still access server A through domain 3.

[0046] To address the aforementioned issues, this application provides a device management method. This method allows configuring regular expressions for the domain names of servers requiring management in a domain name management list. The regular expressions are then used to match domain names used by users to access the internet, identifying whether a domain name requires management. If a match is found, the domain name is identified as requiring management, and users can be restricted from accessing the corresponding server using domain name A. If a match fails, the domain name is identified as not requiring management, and users can access the corresponding server using domain name A. Since the domain name regular expression can be constructed based on the common parts of multiple domain names deployed on the server, even if the server requiring management deploys multiple domain names (each of which shares some content with other domain names), the regular expression corresponding to the domain name can still successfully match multiple domain names, thereby identifying multiple domain names requiring management. This improves the accuracy of domain name identification, reduces the probability of domain name management function failure, and enhances the user experience.

[0047] For example, please refer to Table 1, which shows... The server has multiple domain names, and regular expressions for domain names constructed based on these multiple domain names.

[0048] Table 1

[0049]

[0050] In domain name 1, .com refers to the top-level domain, douyincdn is the second-level domain, and pull-flv-f13 is the subdomain. Here, pull can represent a specific service, such as a data extraction service, flv can represent a file format, and f13 can represent the identifier of a specific service.

[0051] The common parts of domains 2 and 3 with domain 1 are: the top-level domain, second-level domain, and specific services and file formats in the subdomain. The difference lies in the identifier of the specific service in the subdomain. For example, domain 1 is f13, domain 2 is f1, and domain 3 is f4.

[0052] Therefore, the specific pattern formed by the common part of the above domain names 1, 2, and 3 is: pull-flv-identifier.douyincdn.com, which allows for the construction of... The regular expression for the server's domain name, for example, the constructed regular expression is ^pull-flv*.douyincdn\.com$ as shown in Table 1.

[0053] In this embodiment of the application, the regular expressions for the domain names shown in Table 1 can be configured in the domain name control list. Therefore, regardless of whether a user accesses the domain based on domain name 1, domain name 2, or domain name 3 shown in Table 1, the regular expressions will be configured. The regular expressions for the domain names shown in Table 1 all match successfully, after which user access is restricted.

[0054] The device management method provided in this application is applied to a first electronic device with domain name management function. The first electronic device may be a router, gateway, modem, and switch, etc. The embodiments of this application do not limit the specific technology and specific device form adopted by the first electronic device.

[0055] The device used by a user to access the internet is called a second electronic device. A second electronic device can be referred to as a terminal, user equipment (UE), mobile station (MS), mobile terminal (MT), etc. Second electronic devices can include mobile phones, smart TVs, tablets, laptops, desktop computers, computers with wireless transceiver capabilities, virtual reality (VR) electronic devices, augmented reality (AR) electronic devices, wireless terminals in industrial control, wireless terminals in self-driving, wireless terminals in remote medical surgery, wireless terminals in smart grids, wireless terminals in transportation safety, wireless terminals in smart cities, wireless terminals in smart homes, and so on. The embodiments of this application do not limit the specific technology or device form used in the second electronic device.

[0056] To better understand the embodiments of this application, the structure of the first electronic device in the embodiments of this application will be described below, taking a router as an example.

[0057] Please see Figure 1 , Figure 1This is a schematic diagram of a router provided in an embodiment of this application. The router includes at least one processor 101, a communication bus 102, a memory 103, and at least one communication interface 104. The processor 101 may be a microprocessor (such as a central processing unit (CPU)), an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of programs according to this application. The communication bus 102 may include a path for transmitting information between the aforementioned components. The memory 103 may be a read-only memory (ROM), random access memory (RAM), electrically erasable programmable read-only memory (EEPROM), or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by the router, but is not limited thereto. The memory 103 may exist independently and be connected to the processor 101 via the communication bus 102. The memory 103 may also be integrated with the processor 101.

[0058] The communication interface 104 uses any transceiver-like device for communicating with other devices or communication networks. In a specific implementation, as one embodiment, the processor 101 may include one or more CPUs, such as... Figure 1 CPU0 and CPU1 are shown in the diagram. In a specific implementation, as one example, the router may include multiple processors, such as... Figure 1The processors 101 and 105 are shown in the diagram. Each of these processors can be a single-core processor or a multi-core processor. Here, "processor" can refer to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions). As one embodiment, the router may also include an output device 106 and an input device 107. The output device 106 communicates with the processor 101 and can display information in various ways. For example, the output device 106 can be a liquid crystal display (LCD), a light-emitting diode (LED) display device, etc. The input device 107 communicates with the processor 101 and can receive user input in various ways. For example, the input device 107 can be a mouse, keyboard, touchscreen device, or sensing device, etc. The memory 103 is used to store program code 108 that executes the scheme of this application, and the processor 101 is used to execute the program code 108 stored in the memory 103. The router can implement the methods provided in the various embodiments below through the processor 101 and the program code 108 in the memory 103.

[0059] That concludes the introduction to the router's hardware structure. As you can understand... Figure 1 The components included in the hardware structure shown do not constitute a specific limitation on the router. A router may have more or fewer components than shown in the figure, may combine two or more components, or may have different component configurations. Figure 1 The various components shown can be implemented in hardware, software, or a combination of hardware and software, including one or more signal processing and / or application-specific integrated circuits.

[0060] In addition, an operating system runs on top of the aforementioned components. Examples include Windows Server™, MacOS X™, Unix™, Linux™, and FreeBSD™. This application uses a Linux system incorporating Netfilter as an example to describe the router's operating system.

[0061] Netfilter refers to a kernel firewall framework. As a general-purpose, abstract framework, it provides a complete management mechanism for hook point functions, enabling features such as packet filtering, packet processing, address masquerading, transparent proxying, dynamic Network Address Translation (NAT), as well as filtering based on user and Media Access Control (MAC) addresses, stateful filtering, and packet rate limiting. In other words, when using a Linux kernel with Netfilter integrated for data transmission, the above functions can be implemented according to business needs based on the management mechanism provided by Netfilter, thereby better ensuring network security and preventing malicious third-party access and virus intrusion.

[0062] Figure 2 This is a software structure block diagram of a router provided in an embodiment of this application. For example... Figure 2 As shown, the router's software structure includes a configuration management module, a domain name management list storage module, an IP address storage module, a protocol stack, a first processing module, a second processing module, and a driver module.

[0063] The configuration management module receives external input to access the router's management interface and perform various configuration and management tasks. For example, in a home setting, if a user wants to restrict children's access to certain websites, they can perform a user action on the router or mobile interface, entering the domain names to be controlled. After receiving the user action, the configuration management module in the router's user space can generate a regular expression for the domain name based on the input domain name, and then send the regular expression to the domain name control list storage module in the kernel space for storage.

[0064] The domain name control list storage module is used to store the domain name control list, which includes regular expressions for the domain names. In this embodiment, the domain name control list storage module is decoupled from the deep packet inspection module, facilitating the maintenance of the data in the domain name control list. In other embodiments, the domain name control list storage module may also be referred to as a blacklist, knowledge base, rule base, etc., and this embodiment does not limit it in this way.

[0065] The IP address storage module is used to store the IP addresses corresponding to the domain names that need to be controlled. In this embodiment, the IP address storage module is decoupled from the protocol stack, which facilitates the maintenance of the data in the IP address storage module. In other embodiments, the IP address storage module may also be called a controlled module, a controlled IP module, etc., and this embodiment does not limit it in this way.

[0066] A protocol stack is a collection of network protocols and forms the core framework of network communication. It defines how electronic devices such as mobile phones and tablets connect to the Internet and the rules governing data transmission between networks. Protocol stacks are based on a layered model of communication protocols; for example, a protocol stack could be a Transmission Control Protocol (TCP) / Internet Protocol (IP) stack, or it could be based on the Open Systems Interconnection Model (OSI).

[0067] Netfilter operates within the protocol stack. At its core, Netfilter provides a set of hook points, each corresponding to a different network processing stage. Different processing functions can be registered at these hook points, typically organized in chains. For example, hook points include pre-routing hooks (NF_IP_PRE_ROUTING), local upload hooks (NF_IP_LOCAL_IN), forwarding hooks (NF_IP_FORWARD), local send hooks (NF_IP_LOCAL_OUT), and post-routing hooks (NF_IP_POST_ROUTING). The PREROUTING chain can be registered at the pre-routing hook point. This chain processes incoming packets, such as performing network address translation and modifying the destination IP address of the packet. The INPUT chain can be registered at the local upload hook point. This chain controls which packets can be received by the router's local processes. At the forwarding detection point, a FORWARD chain can be registered. This chain handles packets that pass through the router but whose destination is not the router itself (i.e., forwarded packets), and controls whether and how the router forwards specific traffic, such as deciding whether to forward based on packet characteristics. At the local sending detection point, an OUTPUT chain is registered. This chain handles packets generated by the router and about to be sent out. At the post-routing detection point, a POSTROUTING chain is registered. This chain handles packets about to leave the router.

[0068] In this embodiment, Netfilter can configure hook points for the protocol stack, and attach a first processing module and a second processing module to the hook points. The hook points can be one or more of the aforementioned hook points, and this embodiment does not limit this.

[0069] The first processing module is used to monitor the destination domain name and its corresponding IP address. For example, the destination domain name refers to the target domain name of the network request, that is, the domain name of the server that the user wants to access or interact with. For instance, when a user accesses the server using a mobile phone... The server's domain name is the destination domain name. After detecting the destination domain name, the first processing module matches the destination domain name with the regular expressions of the domain names in the domain name control list. If the match is successful, the IP address corresponding to the destination domain name is stored in the IP address storage module. If the match fails, the first processing module does not process the IP address corresponding to the destination domain name.

[0070] The second processing module is used to monitor the destination IP address included in the messages sent by the sending device. The destination IP address refers to the IP address corresponding to the target domain name of the network request. The sending device refers to the device that initiates data transmission, such as the second electronic device mentioned in the above embodiment. After monitoring the destination IP address, the second processing module checks whether the destination IP address exists in the IP address storage module. If it exists, the second processing module blocks the monitored message. If it does not exist, the second processing module does not block the monitored message, allowing the message to be transmitted to the Internet through the port or network port in the driver module.

[0071] Figure 2 The driver module in a router acts as a bridge between hardware and software, ensuring that hardware devices operate efficiently and reliably, and cooperating with other software components. The driver module includes a Wi-Fi port (also called a Wi-Fi driver) and a network port (also called a network port driver). When a secondary electronic device such as a mobile phone or tablet connects to the router via Wi-Fi, the data packets transmitted from the device to the router are sent to the Internet through the Wi-Fi port. When an electronic device connects to the router via a wired network interface (i.e., a network port), the data packets transmitted from the device to the router are sent to the Internet through the network port driver.

[0072] It should be understood that Figure 2 The software architecture shown is for illustrative purposes only and should not be construed as limiting the embodiments of this application. The router software architecture may have more or fewer modules than shown in the figure, and may combine two or more modules.

[0073] The above embodiments describe the hardware structure and software architecture of the router. The following embodiments introduce the application scenarios of the device management method provided in this application.

[0074] The scenarios in which this application can be applied include, but are not limited to: network application scenarios in enterprises (e.g., prohibiting employees from accessing websites unrelated to work), and application scenarios for monitoring children's internet use (e.g., prohibiting children from accessing inappropriate websites). In all of the above application scenarios, it is necessary to set up the domain names that need to be controlled. The following... Figure 3 Taking children's internet use as an example, this article introduces the process of setting up controlled domain names.

[0075] For example, please refer to Figure 3 , Figure 3 This is a schematic diagram illustrating the setting of a controlled domain name according to an embodiment of this application.

[0076] Figure 3 The interface 310 shown in (a) can refer to the main interface of the parent's mobile phone. Interface 310 includes a control 311, which the parent can click. In response to the parent clicking the control 311, the following is displayed: Figure 3 The interface 320 shown in (b) includes a card 321 that parents can click. In response to a parent clicking the control 321, the following is displayed: Figure 3 The interface 330 shown in (c) includes a card 331 that parents can click. In response to clicking the card 331, the following is displayed: Figure 3 Interface 340, shown in (d), includes one or more device names connected to the router among its online devices. Control 341 refers to the device name of the child's phone, which the parent can click. In response to the parent clicking control 341, the following is displayed: Figure 3 The interface 350 shown in (e) includes a control 351 corresponding to the child internet protection function, which parents can click. In response to a parent clicking control 351, the following is displayed: Figure 3 The interface 360 ​​shown in (f) includes a card 361, which parents can click. In response to the parent's click on card 361, the phone can display an interface for adding domains to the blacklist. For example, please refer to... Figure 4 , Figure 4 This is a schematic diagram of an interface for adding a domain name to a blacklist provided in an embodiment of this application.

[0077] The phone responds to parent clicks Figure 3 The operation of card 361 is shown in (e) in the figure. Figure 4 The interface 410 shown in (a) includes controls 411 and 412. Parents can click on control 411. The phone responds to the parent's click on control 411 by displaying... Figure 4The interface 420 shown in (b) includes an input box 421 for manually adding domain names. Parents can enter domain names to add to the blacklist in the input box 421, such as domain name 1 shown in interface 420. In response to the parent's input of a domain name in the input box 421, the phone displays... Figure 4 (d) shows interface 440, which displays a blacklist, such as domain 1.

[0078] Parents can also click Figure 4 The interface 410 shown in (a) includes control 412. In response to a parent clicking control 412, the phone displays... Figure 4 The interface 430 shown in (c) includes a list of domain names for quick addition. Parents can select a domain name from this list, such as checking the control 431 corresponding to domain name 3. The phone responds to the operation on control 431 by displaying... Figure 4 (d) shows interface 440, which displays a blacklist, such as domain 3.

[0079] It should also be understood that when the router receives the aforementioned external input, such as user actions on a mobile phone, for example, the user... Figure 4 The user can manually add a domain name in the interface 420 shown, or the user can... Figure 4 The interface 430 shown allows for quick addition of domain names. The router can generate a domain name control list based on the external input and store the domain name control list.

[0080] For example, please refer to Figure 5 , Figure 5 This is a timing diagram for generating and storing a domain name control list, provided in an embodiment of this application. The timing diagram includes steps S501 to S504.

[0081] S501, the configuration management module in the router's user space receives external input (the external input carries one or more domain names A).

[0082] It should be understood that the interpretation of external inputs can be referred to in the above embodiments, and will not be repeated here. Domain A refers to the domains added to the blacklist, and the number of domains A is determined by the number of domains in the blacklist, for example... Figure 4 The blacklist shown in (d) includes domain 1 and domain 3, so the number of domain A is 2.

[0083] S502, the configuration management module generates a domain name control list based on external input.

[0084] It should be understood that the configuration management module can pre-configure the mapping between regular expressions for domain names and the domain names themselves. This mapping includes regular expressions for multiple domain names, with each regular expression for a domain name corresponding to multiple domain names. For example, please refer to Table 2:

[0085] Table 2

[0086]

[0087] For example, the correspondence between a regular expression and multiple domain names can be seen in the data shown in Table 1 above. It should also be understood that when pre-configuring the regular expressions for domain names, the granularity of the domain names can be adjusted according to actual needs. The granularity of a regular expression typically refers to the fineness of the matching pattern. Higher granularity means more specific matching rules and more precise matching of specific patterns; lower granularity means broader matching rules and a wider matching range. For example, in the pre-configured regular expressions shown in Table 1... After using the domain name regular expression, in order to... The domain name regular expression matching rules are broader, allowing for the rapid filtering of large numbers of domain names. It also allows for the construction of domain name regular expressions at a lower granularity. For example, please refer to Table 3:

[0088] Table 3

[0089]

[0090] In implementation, the configuration management module generates the domain name control list based on the following method:

[0091] The configuration management module receives external input (containing domain name A). It can query the pre-configured mapping between domain names and their corresponding regular expressions (e.g., Table 2 above) to find the regular expression for the domain name corresponding to domain name A. If a regular expression for domain name A is found, it is included in the domain name control list. If no regular expression is found, the query ends. For example, if domain name A is domain name 1, regular expression 1 corresponding to domain name 1 in Table 2 can be included in the domain name control list. Similarly, if domain name A is domain name 3, regular expression 3 corresponding to domain name 3 in Table 2 can be included in the domain name control list. For example, the data included in the domain name control list can be found in Table 4.

[0092] Table 4

[0093] Regular expression for domain name Regular expression 1 Regular Expression 3

[0094] S503, the configuration management module sends the domain name control list to the domain name control list storage module in the kernel space.

[0095] S504, Domain Name Management List Storage Module stores the domain name management list.

[0096] The above embodiments illustrate the application scenarios of the device management method provided in this application and the generation method of the domain name management list. The following embodiments are divided into three parts, which respectively introduce the data transmission process in network communication, the implementation method of the device management method in the relevant scheme, and the implementation method of the device management method provided in this application.

[0097] Part 1: The process of data transmission in network communication.

[0098] For example, please refer to Figure 6 , Figure 6 This is a schematic diagram illustrating the data transmission process in network communication.

[0099] S61, the second electronic device (taking a mobile phone as an example) generates a domain name query request based on the triggering event (the request carries domain name 1).

[0100] It should be understood that a triggering event refers to an event in which a second electronic device needs to obtain the IP address corresponding to a domain name in order to establish a network connection. For example, a triggering event could be a user entering a domain name in a browser and pressing the Enter key, or it could be an application needing to download data from the Internet or access an online service, such as when a user opens... While watching videos, It requires downloading video data from the internet, etc.

[0101] A domain name query request can refer to a Domain Name System Request (DNS request), which includes a query field (qry.name). The qry.name field contains the domain name to be queried, such as domain name 1.

[0102] S62: After generating a domain name query request, the mobile phone queries the domain name cache for the IP address corresponding to domain name 1.

[0103] It should be understood that domain name caching can refer to DNS caching, which is a temporary storage area in a second electronic device used to store the mapping relationship between domain names and their corresponding IP addresses. In this mapping relationship, multiple domain names correspond to multiple IP addresses, with one domain name corresponding to one IP address. In other embodiments, one domain name may correspond to multiple IP addresses, or one IP address may correspond to multiple domain names, etc., and this application does not limit this.

[0104] DNS caches can exist in multiple places, including the phone's operating system, applications, routers, DNS servers, etc. This application example illustrates that the DNS cache is stored in the phone's operating system.

[0105] Each record in the DNS cache has a Time to Live (TTL), which can be 5 minutes, 10 minutes, etc. The TTL is obtained from the DNS response. Once the TTL expires, the record is deleted from the cache, and a new DNS request will retrieve the latest record. For example, when the record for IP address corresponding to domain name 1 in the DNS cache expires, and the mobile phone accesses domain name 1 again, it will initiate a new DNS request to update the cache.

[0106] In implementation, the mobile phone can traverse the mapping relationship between domain names and IP addresses. If the IP address corresponding to domain name 1 is found, S66 is executed; otherwise, S63 is executed.

[0107] S63: If the mobile phone does not find the IP1 corresponding to domain 1 in the domain cache, it sends a domain query request to the DNS server through the router (the domain query request carries domain 1).

[0108] It should be understood that the failure to find IP1 corresponding to domain 1 in the domain cache may be due to the fact that the record (IP1 corresponding to domain 1) has been stored in the DNS cache, but the record has exceeded the TTL, or it may be due to the DNS cache being cleared before S61, etc.

[0109] S64. After receiving the DNS request, the DNS server resolves the DNS request and determines the IP address corresponding to domain name 1.

[0110] It should be understood that DNS servers are the infrastructure on the Internet used to translate domain names into IP addresses. As a distributed database system, it allows devices on the network to access other devices or resources via domain names without having to remember difficult-to-remember IP addresses. The main function of a DNS server is to resolve easily remembered domain names (such as www.example.com) into IP addresses used by computers (such as 192.168.1.1).

[0111] In S65, the DNS server returns a query response (also known as a DNS response) to the mobile phone through the router. This response includes domain name 1 and IP address 1.

[0112] S66: If the mobile phone finds IP1 corresponding to domain 1 in the domain cache, or if it receives a DNS response that includes domain 1 and IP1, it generates a connection request (which carries IP1).

[0113] It should be understood that before a mobile phone can transmit data to a network (such as an application's server), it needs to establish a network connection with the application's server, and then transmit data based on that network connection. This network connection can be a Transmission Control Protocol (TCP) connection or a User Datagram Protocol (UDP) connection.

[0114] It should also be understood that TCP is a connection-oriented protocol, meaning that a logical connection must be established between the two endpoints of the communication before data transmission begins, such as establishing a logical connection between a mobile phone and an application server. Establishing a TCP connection typically involves a three-way handshake to ensure that both parties are ready to exchange data. UDP, on the other hand, is a connectionless protocol; data transmission does not require a pre-established connection.

[0115] Similarly, it is understandable that since an IP address is a unique identifier for a device in a network, it defines the source and destination addresses of data packets in the network. Therefore, whether it is a TCP connection or a UDP connection, it is necessary to use the IP address to determine the source and destination of data transmission.

[0116] It should be noted that Figure 6 S66 to S68 in the diagram illustrate a TCP connection. The connection request in S66 can refer to a TCP connection request.

[0117] Figure 6 The TCP connection process shown here is only a simplified illustration. In actual implementation, a TCP connection requires a three-way handshake to be established, which is not described in detail here.

[0118] In S67, the mobile phone sends a connection request to the application's server through the router.

[0119] In S68, the application's server returns a connection response to the phone via the router to establish a network connection.

[0120] S69, the mobile phone transmits message 1 (carrying IP1 address) to the application server through the router based on the established network connection.

[0121] It should be understood that in other embodiments, the message may also be referred to as data, data packet, data stream, data frame, etc., and the embodiments of this application do not limit it in this way.

[0122] It should also be understood that although a network connection has been established between the mobile phone and the server, IP addresses are still needed to determine the destination address of data packets when they are transmitted over the network. Routers can use these IP addresses to decide how to correctly route data packets to their destination.

[0123] Part Two: Implementation of the equipment control methods in the relevant scheme.

[0124] For example, please refer to Figure 7 , Figure 7 This is a schematic diagram of a device control method provided in a related solution.

[0125] Figure 7 The implementation process of S61 to S69 shown can be referred to in the above embodiment, where... Figure 7 Steps S631 to S635 are described below.

[0126] S631, the router intercepts the domain name query request and obtains domain name 1 from the domain name query request.

[0127] S632, the router queries domain name 1 in the domain name management list.

[0128] It should be understood that, in the relevant schemes, when configuring the domain name management list to be managed, due to the difficulty and high cost of obtaining multiple domain names for a single server, only a small number of domain names for a single server are typically configured. For example, server A may deploy domain names 1 through 10, but the domain name management list may only include domain name 1 and domain name 2 for server A.

[0129] In practice, if the router does not find domain name 1 in the domain name management list, it will not process the subsequent steps and will execute steps S64 to S69 normally.

[0130] If the router finds domain name 1 in the domain name management list, it can intercept the S65's query response and modify it to generate a modified query response. The modified query response is used to inform the mobile phone's DNS server that resolving domain name 1 failed. For example, the modified query response may include the field "no such name".

[0131] S633: If the router does not find domain name 1 in the domain name management list, it intercepts the query response from S65, modifies the query response, and generates a modified query response.

[0132] S634, the router sends a modified query response to the mobile phone.

[0133] After receiving the query response, the S635 phone displays an error notification, such as "Unable to connect to the server. Please check your network connection and try reconnecting."

[0134] Part Three: Implementation of the device control method provided in the embodiments of this application.

[0135] For example, please refer to Figure 8 , Figure 8 This is a schematic diagram of a device control method provided in an embodiment of this application.

[0136] Figure 8 The implementation process of S61 to S69 shown can be referred to in the above embodiment, where... Figure 8 Steps S651 to S654 and steps 691 to 694 are described below.

[0137] S651, router in Figure 6 During step S65 (the DNS server returns a query response to the mobile phone via the router), the query response is intercepted, and the domain name 1 and IP address in the query response are obtained.

[0138] It should be understood that in the embodiments of this application, a hook point can be configured in the protocol stack in the kernel space of the router, and a first processing module is mounted on the hook point. The first processing module is used to listen to the query response (DNS response). After listening to the query response, the query response can be intercepted and the domain name 1 and IP 1 carried in the query response can be obtained.

[0139] For an explanation of the hook point and the first processing module, please refer to the above embodiment; it will not be repeated here.

[0140] After obtaining domain name 1 and IP address 1, the router matches domain name 1 based on the domain name control list.

[0141] It should be understood that the list of domain name control measures can be referenced from the data in Table 4 above.

[0142] In implementation, the router can match domain name 1 with multiple regular expressions included in the domain name control list. For example, it can match domain name 1 with regular expression 1 and regular expression 3 shown in Table 4. If domain name 1 matches one of the regular expressions in the domain name control list, then S653 is executed. If domain name 1 does not match any of the regular expressions in the domain name control list, then S654 is executed.

[0143] S653, the router stores the IP1 corresponding to domain name 1 in the IP address storage module.

[0144] S654, the router does not perform storage operations.

[0145] After step S654, normal execution continues. Figure 6 The steps S66 to S68 are shown.

[0146] Execute on mobile phone Figure 6 During step S69 (transmitting message 1 to the application server via the router based on the established network connection), step S691 is executed.

[0147] S691, the router intercepts packet 1 and obtains the IP address 1 from packet 1.

[0148] It should be understood that in the embodiments of this application, a hook point can be configured in the protocol stack in the kernel space of the router, and a second processing module can be mounted on the hook point. The second processing module is used to listen to packets. After listening to packet 1, it can intercept packet 1 and obtain the IP address carried in packet 1.

[0149] For an explanation of the hook point and the second processing module, please refer to the above embodiment; it will not be repeated here.

[0150] S692, the router queries IP1 from the data contained in the IP address storage module.

[0151] It should be understood that the IP address storage module stores the IP addresses corresponding to the domain names that need to be managed.

[0152] In implementation, the router can traverse each piece of data in the IP address storage module to query IP1. If IP1 is found, a blocking operation is performed to block the transmission of packet 1 to the server. If IP1 is not found, no blocking operation is performed.

[0153] For example, a blocking operation could involve a router sending an interference message to either the source or destination device. Upon receiving the interference message, the source or destination device would close its own socket connection to disconnect the network connection. For instance, the source device could be a second electronic device (a mobile phone), and the destination device could be an application server.

[0154] It should be understood that, as illustrated in the above embodiments, the network connection can be a TCP connection based on the TCP protocol or a UDP connection based on the UDP protocol. When the network connection is a TCP connection, the interfering message can be a TCP reset message (TCPRESET message), and when the network connection is a UDP connection, the interfering message can be an Internet Control Message Protocol (ICMP) unreachable message.

[0155] It should also be understood that a socket connection is used for bidirectional communication between a source device and a destination device. It is an abstraction layer between the application layer and the transport layer, providing a mechanism to create, manage, and terminate connections between two network endpoints. In computer networks, a socket typically refers to an endpoint, one end of a communication chain, that can send or receive data. Socket connections allow data to flow between applications, whether these applications are running on the same system or distributed across different machines. Socket connections can be based on different protocols, most commonly TCP and UDP. The general steps for creating a socket connection include: the destination device creates a socket and listens on a specific port for a connection from the source device. The source device creates a socket and initiates a connection request to the specified port on the destination device. The destination device accepts the connection request and establishes a socket connection to the source device. Data exchange begins between the source and destination devices. After the data exchange is complete, either party can close the connection.

[0156] A blocking operation can also be an operation that releases the memory occupied by the socket buffer associated with message 1.

[0157] It should be understood that the socket buffer (sk_buff), or simply buffer, is a data structure in the router's kernel space that stores network data packets.

[0158] It should also be understood that the sk_buff structure requires memory. In the router's kernel space, the sk_buff structure is dynamically allocated. When the router kernel needs to process network packets, it allocates an sk_buff to store this information. For example, when the router needs to transmit packet 1 to the server, it will allocate an sk_buff to store packet 1. If the memory occupied by the sk_buff is released, the router will be unable to transmit data to the server.

[0159] S693, the router performs a blocking operation, blocking the transmission of packet 1 to the server.

[0160] S694, the router does not perform a blocking operation.

[0161] From the above Figure 7 and Figure 8It is known that in the relevant solutions, although the domain name management list contains the domain names of the servers that need to be managed, the limited number of domain names in the list may lead to inaccurate identification of domain names that need to be managed as those that do not, thus rendering the router's domain name management function ineffective and impacting user experience. For example, server A deploys domain names including domain 1 to domain 10, all of which need to be managed. However, the domain name management list only contains domain names 1 and 2 of server A. Suppose the router intercepts the user's internet access using domain name 3, and identifies domain name 3 as not needing management through the domain name management list. However, domain name 3 is actually a domain that needs management, resulting in inaccurate identification of the managed domain name. The user can still access server A through domain name 3.

[0162] In this application's embodiment, the domain name control list can be configured with regular expressions for the domain names of servers that need to be controlled. These regular expressions are then used to match the domain names used by users to access the internet, identifying whether a domain name requires control. If a match is successful, the domain name is identified as requiring control, and users can be restricted from accessing the corresponding server using domain name A. If a match fails, the domain name is identified as not requiring control, and users can access the corresponding server using domain name A. Since the domain name regular expression can be constructed based on the common parts of multiple domain names deployed on the server, even if the server requiring control deploys multiple domain names (each of which shares some content with other domain names), the regular expression corresponding to that domain name can still successfully match multiple domain names, thus identifying multiple domain names that require control. This improves the accuracy of domain name identification and control, reduces the probability of domain name control function failure, and enhances the user experience.

[0163] Furthermore, the proposed solution manages domain names by intercepting query requests sent from mobile phones to the server, obtaining the domain names included in the query requests, and then determining whether the domain name needs to be managed. If it is determined to be a domain name that needs to be managed, the solution modifies the query response sent from the server to the mobile phone so that the mobile phone cannot obtain the IP address corresponding to the domain name. However, there are two ways for a mobile phone to obtain the IP address corresponding to a domain name. The first way is that the mobile phone sends a query request to the server, and the server returns a query response to the mobile phone, which includes the IP address corresponding to the domain name. The second way is that the mobile phone obtains the IP address corresponding to the domain name from the domain name cache. The proposed solution can manage the first method but cannot manage the second method. In other words, when a user accesses a domain name that needs to be managed, they can obtain the IP address corresponding to the domain name that needs to be managed from the domain name cache through the second method, and then transmit a message to the server based on that IP address. The proposed solution cannot prevent the mobile phone from transmitting a message to the server based on the IP address obtained from the domain name cache, resulting in a failure of the management.

[0164] In this embodiment, after the router determines that the domain name is one that needs to be controlled, it can store the IP address corresponding to the domain name. Then, when a mobile phone transmits a message to the server using either the IP address obtained in the first method or the IP address obtained in the second method, the router can query the stored data (which includes the IP address corresponding to the domain name to be controlled) to find if the message contains an IP address. If the stored data contains the IP address from the message, the transmission of that message can be blocked. Compared to related solutions, this embodiment can block messages transmitted from the mobile phone using the IP address obtained in the second method to the server, improving blocking efficiency, reducing the probability of domain name control function failure, and improving user experience.

[0165] The following examples are combined Figure 2 The software structure shown illustrates the implementation process described in Part III above.

[0166] For example, please refer to Figure 9 , Figure 9 This is a timing diagram of a device control method provided in an embodiment of this application. Figure 9 For details on the implementation of each step, please refer to the above embodiment. Figure 9 This will not be elaborated upon further.

[0167] S91, the second electronic device (taking a mobile phone as an example) generates a domain name query request based on the triggering event (the request carries domain name 1).

[0168] The implementation method for this step can be referred to the above embodiment, and will not be repeated here.

[0169] S92: After generating a domain name query request, the mobile phone queries the domain name cache for the IP address corresponding to domain name 1.

[0170] The implementation method for this step can be referred to the above embodiment, and will not be repeated here.

[0171] S93: If the mobile phone does not find the IP1 corresponding to domain 1 in the domain cache, it sends a domain query request to the DNS server through the router's protocol stack (the domain query request carries domain 1).

[0172] The implementation method for this step can be referred to the above embodiment, and will not be repeated here.

[0173] S94. After receiving the DNS request, the DNS server resolves the DNS request and determines the IP address corresponding to domain name 1.

[0174] The implementation method for this step can be referred to the above embodiment, and will not be repeated here.

[0175] S95, the DNS server returns a query response (also called a DNS response) to the mobile phone through the router's protocol stack. This response includes domain name 1 and IP address 1.

[0176] The implementation method for this step can be referred to the above embodiment, and will not be repeated here.

[0177] In step S96, the first processing module in the router's protocol stack intercepts the query response during step S95 (the DNS server returns a query response to the mobile phone through the router) and obtains the domain name 1 and IP address 1 in the query response.

[0178] The implementation method for this step can be referred to the above embodiment, and will not be repeated here.

[0179] S97, the first processing module sends a loading instruction to the domain name control list storage module.

[0180] The implementation method for this step can be referred to the above embodiment, and will not be repeated here.

[0181] S98, the domain name control list storage module sends the data in the domain name control list storage module to the first processing module.

[0182] The implementation method for this step can be referred to the above embodiment, and will not be repeated here.

[0183] S99, after obtaining domain name 1 and IP address 1, the first processing module matches domain name 1 based on the data in the domain name control list.

[0184] The implementation method for this step can be referred to the above embodiment, and will not be repeated here.

[0185] S910, if a match is successful, the first processing module sends the IP address corresponding to domain name 1 to the IP address storage module in the router.

[0186] The implementation method for this step can be referred to the above embodiment, and will not be repeated here.

[0187] S911, the IP address storage module stores the IP1 corresponding to domain name 1 into the IP address storage module.

[0188] The implementation method for this step can be referred to the above embodiment, and will not be repeated here.

[0189] S912: When the mobile phone finds IP1 corresponding to domain 1 in the domain cache, or receives a DNS response that includes domain 1 and IP1, it generates a connection request (which carries IP1).

[0190] The implementation method for this step can be referred to the above embodiment, and will not be repeated here.

[0191] S913: The mobile phone sends a connection request to the application server through the router's protocol stack.

[0192] The implementation method for this step can be referred to the above embodiment, and will not be repeated here.

[0193] In S914, the application's server returns a connection response to the mobile phone through the router's protocol stack to establish a network connection.

[0194] The implementation method for this step can be referred to the above embodiment, and will not be repeated here.

[0195] S915: Based on the established network connection, the mobile phone transmits message 1 (carrying IP1 address) to the application server through the router's protocol stack.

[0196] The implementation method for this step can be referred to the above embodiment, and will not be repeated here.

[0197] S916, the second processing module in the router's protocol stack intercepts packet 1 and obtains the IP address from packet 1.

[0198] The implementation method for this step can be referred to the above embodiment, and will not be repeated here.

[0199] S917, the second processing module sends a read command to the router's IP address storage module.

[0200] The implementation method for this step can be referred to the above embodiment, and will not be repeated here.

[0201] S918, the IP address storage module sends the data contained in the IP address storage module to the second processing module.

[0202] The implementation method for this step can be referred to the above embodiment, and will not be repeated here.

[0203] S919, the second processing module queries IP1 from the data contained in the IP address storage module.

[0204] The implementation method for this step can be referred to the above embodiment, and will not be repeated here.

[0205] S920, if the query is successful, the second processing module performs a blocking operation, blocking the transmission of message 1 to the server.

[0206] In implementation, the second processing module can send a command to the router's protocol stack to perform a blocking operation. Upon receiving the command, the router's protocol stack performs the blocking operation. Alternatively, the second processing module can directly perform the blocking operation; this embodiment does not limit this approach.

[0207] The implementation method for this step can be referred to the above embodiment, and will not be repeated here.

[0208] S921, if no result is found, the second processing module does not perform the blocking operation.

[0209] The implementation method for this step can be referred to the above embodiment, and will not be repeated here.

[0210] The following section provides a summary description of the above embodiments.

[0211] Please refer to Figure 10 , Figure 10 This is a schematic flowchart illustrating a device control method provided in an embodiment of this application. The method can be... Figure 1 The method described herein can be executed by the first electronic device, or by a processor or chip within the first electronic device; this application embodiment does not impose any limitations. For ease of description, the method is illustrated using the first electronic device as an example. The method includes steps S1010 to S1020.

[0212] S1010, during the process of the second electronic device accessing the third electronic device through the first electronic device, the first electronic device obtains the response message returned by the domain name system server to the second electronic device after the second electronic device sends a query message to the domain name system server. The query message includes the first domain name of the third electronic device, and the response message includes the first domain name and the first IP address corresponding to the first domain name.

[0213] S1020, if the first electronic device determines that there is a first regular expression corresponding to the first domain name in the regular expression dataset, it restricts the second electronic device from accessing the third electronic device through the first IP address. The regular expression dataset includes regular expressions of multiple domain names under control. The regular expressions of multiple domain names include the first regular expression. The first regular expression is obtained based on the common features of the multiple domain names of the third electronic device.

[0214] It should be understood that the first electronic device can be a router, gateway, modem, or switch, for example, the router mentioned in the above embodiment. The second electronic device refers to a device that accesses the first electronic device to perform internet access services, such as a mobile phone, tablet, or laptop. The third electronic device refers to a server, server cluster, or cloud computing system accessed by the second electronic device through the first electronic device. For example, the third electronic device can be... servers Servers, etc. In this embodiment, the first electronic device is a router, the second electronic device is a mobile phone, and the third electronic device is... The server will be used as an example for illustration.

[0215] The process by which the first electronic device obtains the response message can be, for example, as described above. Figure 6 The data transmission process shown in the network communication diagram illustrates that: mobile phone access During the server process, the mobile phone first needs to send a query message (DNS request) to the Domain Name System server (DNS server) through the router. This query message includes... The DNS server receives the DNS request and can then use the domain name (first domain name) included in the DNS request to determine the DNS server's domain name (first domain name). The server queries the IP address corresponding to the domain name (the first IP address). Then, the DNS server returns a response message (DNS response) to the mobile phone through the router. This response message includes the first domain name and the first IP address corresponding to the first domain name.

[0216] From the above Figure 8 It can be seen that during the process of the DNS server returning a response message to the mobile phone through the router, the router can intercept the query response and obtain the first domain name and the first IP address in the query response.

[0217] It should also be understood that the regular expression dataset includes regular expressions for multiple controlled domains. For example, please refer to Table 4, which includes regular expressions for multiple controlled domains, such as regular expression 1 and regular expression 2.

[0218] The regular expression for a domain name is derived from the common characteristics of multiple domains on a server. For example, referring to Table 1, the common parts (or common characteristics) of domains 1, 2, and 3 in Table 1 are: specific services and file formats in the top-level domain, second-level domain, and subdomain. The differences lie in the identifier of the specific service in the subdomain; for example, domain 1 is f13, domain 2 is f1, and domain 3 is f4. Therefore, the specific pattern formed by domains 1, 2, and 3 based on these common characteristics is: pull-flv-identifier.douyincdn.com, which allows for the construction of... The regular expression for the server's domain name, for example, the constructed regular expression is ^pull-flv*.douyincdn\.com$ as shown in Table 1.

[0219] It should also be understood that the domain name's regular expression is pre-configured in the router. When pre-configuring the domain name's regular expression, the granularity of the domain name can be adjusted according to actual needs. The granularity of a regular expression typically refers to the fineness of the matching pattern. Higher granularity means more specific matching rules and more precise matching of specific patterns; lower granularity means broader matching rules and a wider matching range. For example, please refer to Table 1 and Expression 3 above. The regular expressions in Table 1 have a higher granularity than those in Table 3.

[0220] In implementation, after obtaining the first domain name and the first IP address in the query response, the router can determine whether the first regular expression corresponding to the first domain name exists in the regular expression dataset.

[0221] For example, if the first domain name is domain name 1, the router can match domain name 1 with multiple regular expressions included in the regular expression dataset. For instance, it can match domain name 1 with regular expression 1 and regular expression 3 shown in Table 4. If domain name 1 successfully matches one of the regular expressions in the regular expression dataset, such as matching regular expression 1 shown in Table 4, then it can be determined that the first regular expression corresponding to the first domain name exists in the regular expression dataset. If domain name 1 fails to match any of the multiple regular expressions included in the regular expression dataset, then it can be determined that the first regular expression corresponding to the first domain name does not exist in the regular expression dataset.

[0222] The router can also iterate through the regular expression dataset, searching for a regular expression that matches domain name 1. If a matching regular expression is found, the iteration stops to confirm that a first regular expression corresponding to the first domain name exists in the dataset. If no matching regular expression is found for domain name 1, the iteration continues until all data in the dataset has been traversed and a matching regular expression for domain name 1 is still not found. In this case, it is determined that a first regular expression corresponding to the first domain name does not exist in the dataset.

[0223] In this embodiment, if the router determines that a first regular expression corresponding to the first domain name exists in the regular expression dataset, it can restrict the second electronic device from accessing the third electronic device through the first IP address. For example, if the router determines that a first regular expression corresponding to the first domain name exists in the regular expression dataset, it can modify the query response to generate a modified query response. The modified query response is used to inform the mobile phone's DNS server that the domain name 1 has failed to be resolved. For example, the modified query response includes the field "no such name". After receiving the modified query response, the mobile phone cannot obtain the first IP address, so the mobile phone cannot establish a network connection with the third electronic device based on the first IP address, and the mobile phone cannot access the third electronic device based on the first IP address, thereby restricting the second electronic device from accessing the third electronic device through the first IP address.

[0224] For example, if a router determines that a regular expression corresponding to a first domain name exists in the regular expression dataset, it can store the first IP address corresponding to the first domain name in the IP address storage module. After the mobile phone receives the query response, during the process of the mobile phone sending a message to the third electronic device through the router based on the first IP address, the router can intercept the message and query the data included in the IP address storage module to see if it contains the first IP address included in the message. If the first IP address is not found, no blocking operation is performed. If the first IP address is found, a blocking operation is performed to block the transmission of message 1 to the third electronic device. In this way, the mobile phone cannot access the third electronic device based on the first IP address, thereby restricting the second electronic device from accessing the third electronic device through the first IP address.

[0225] It should also be understood that, in the embodiments of this application, a hook point can be configured in the protocol stack in the kernel space of the router, and a first processing module is mounted on the hook point. The first processing module is used to listen to the query response (DNS response). After listening to the query response, it can intercept the query response and obtain the first domain name and the first IP address carried in the query response.

[0226] Typically, a server deploys multiple domains to improve security and stability. While related solutions can implement domain management through a domain management list, the limited number of domains configured in the list can lead to inaccurate identification, where domains requiring management are mistakenly identified as unmanaged. This inaccurate identification can render the router's domain management function ineffective, impacting user experience. For example, server A deploys domains 1 through 10, all of which require management. However, the domain management list only includes domains 1 and 2. If the router intercepts a user's internet access using domain 3, the domain management list might identify domain 3 as unmanaged. However, domain 3 actually does require management, resulting in inaccurate identification. The user can still access server A through domain 3.

[0227] This application embodiment allows configuration of a regular expression dataset containing the domain names of servers (third electronic devices) that need to be controlled. It then determines whether a regular expression exists in this dataset corresponding to a domain name (first domain name) used by a user to access the internet. If a regular expression for the first domain name is found in the dataset, then that domain name is identified as needing control, and users can be restricted from accessing the corresponding server (third electronic device) using that first domain name. Since the regular expression dataset is derived from the common characteristics of multiple domain names of the third electronic device, even if the third electronic device to be controlled deploys multiple domain names (each domain name having some content identical to other domain names), regular expressions can still successfully match multiple domain names, thus identifying multiple domain names as needing control. This avoids misidentifying domain names that need control as uncontrollable ones, improving the accuracy of domain name identification and reducing the probability of domain name control function failure, thereby enhancing the user experience.

[0228] In some embodiments, in step S1020, if the first electronic device determines that a first regular expression corresponding to the first domain name exists in the regular expression dataset, restricting the second electronic device from accessing the third electronic device via the first IP address includes:

[0229] If the first electronic device determines that a first regular expression corresponding to the first domain name exists in the regular expression dataset, it stores the first IP address in the IP address dataset; it obtains the first message sent by the second electronic device to the third electronic device, the first message including the first IP address; if it determines that the first IP address in the first message exists in the IP address dataset, it restricts the second electronic device from accessing the third electronic device through the first IP address.

[0230] It should be understood that the IP address dataset is the data stored in the IP address storage module in the above embodiment.

[0231] In implementation, if the first electronic device determines that there is a first regular expression corresponding to the first domain name in the regular expression dataset, it can store the first IP address in the IP address dataset and use the IP address dataset to restrict the second electronic device from accessing the third electronic device through the first IP address.

[0232] The process by which a first electronic device restricts a second electronic device from accessing a third electronic device via a first IP address dataset can be, for example, as described above. Figure 8 As shown in the illustrated embodiment, the second electronic device (mobile phone) can connect to the third electronic device (mobile phone) via a router based on the established network connection. The server sends a first message (carrying a first IP address). During the process of the second electronic device sending the first message to the third electronic device, the first electronic device (router) can intercept the first message and obtain the first IP address from it. Then, the first electronic device queries the data contained in the IP address storage module for the first IP address. If the first electronic device finds the first IP address, it performs a blocking operation, preventing the first message from being transmitted to the third electronic device, thus restricting the second electronic device from accessing the third electronic device through the first IP address.

[0233] It should also be understood that, in the embodiments of this application, a hook point can be configured in the protocol stack in the kernel space of the router, and a second processing module can be mounted on the hook point. The second processing module is used to listen to the first packet. After listening to the first packet, it can intercept the first packet and obtain the first IP address carried in the first packet.

[0234] The existing solution manages domain names by intercepting query requests sent from mobile phones to the server, obtaining the domain names included in the query requests, and then determining whether the domain name needs to be managed. If it is determined to be a domain name that needs to be managed, the solution modifies the query response sent from the server to the mobile phone so that the mobile phone cannot obtain the IP address corresponding to the domain name. However, there are two ways for a mobile phone to obtain the IP address corresponding to a domain name. The first way is that the mobile phone sends a query request to the server, and the server returns a query response to the mobile phone that includes the IP address corresponding to the domain name. The second way is that the mobile phone obtains the IP address corresponding to the domain name from the domain name cache. The solution can manage the first method but not the second method. In other words, when a user accesses a domain name that needs to be managed, they can obtain the IP address corresponding to the domain name that needs to be managed from the domain name cache through the second method, and then transmit messages to the server based on that IP address. The solution cannot prevent the mobile phone from transmitting messages to the server based on the IP address obtained from the domain name cache, resulting in the failure of the management.

[0235] In this embodiment, after the router (first electronic device) determines that the domain name is a domain name that needs to be controlled, it can store the IP address corresponding to the domain name that needs to be controlled (store the first IP address in the IP address dataset). Then, when the mobile phone (second electronic device) transmits a message (first message) to the server (third electronic device) through the IP address obtained in the first method or the IP address obtained in the second method, the router can query the stored data (which includes the IP address corresponding to the domain name that needs to be controlled) to find that the message contains an IP address. If the stored data contains the IP address in the message, then the second electronic device can be restricted from accessing the third electronic device through the first IP address to block the transmission of the message. Compared with related solutions, this embodiment can block the message transmitted by the second electronic device to the third electronic device through the IP address obtained in the second method, which can improve the blocking efficiency, thereby reducing the probability of domain name control function failure and improving user experience.

[0236] In some embodiments, the first IP address in the first message is obtained based on the response message.

[0237] Implementation in progress, please refer to Figure 8 When a mobile phone accesses an application's server, it can send a DNS request (carrying the first domain name of the application's server) to the DNS service through a router. After receiving the DNS request, the DNS server resolves the DNS request and determines the first IP address corresponding to the first domain name. Then, the DNS server returns a DNS response to the mobile phone through the router (carrying the first domain name and the first IP address). The mobile phone establishes a network connection with the application's server based on the first IP address. After that, the mobile phone sends a first message (including the first IP address) to the application's server through the router based on this network connection.

[0238] As can be seen from the above process, the first IP address in the first message is obtained based on the DNS response (response message).

[0239] In some embodiments, the first IP address in the first message is obtained based on the first cache, which refers to the cache in which the second electronic device stores the first IP address in the response message.

[0240] It should be understood that the first cache may refer to the DNS cache mentioned in the above embodiments. The DNS cache is a temporary storage area in the second electronic device used to store the mapping relationship between domain names and their corresponding IP addresses. In this mapping relationship, multiple domain names correspond to multiple IP addresses, and one domain name corresponds to one IP address. In other embodiments, one domain name may also correspond to multiple IP addresses, or one IP address may correspond to multiple domain names, etc., and this application embodiment does not limit this.

[0241] DNS caches can exist in multiple places, including the phone's operating system, applications, routers, DNS servers, etc. This application example illustrates that the DNS cache is stored in the phone's operating system.

[0242] Each record in the DNS cache has a Time to Live (TTL), which can be 5 minutes, 10 minutes, etc. The TTL is obtained from the DNS response. Once the TTL expires, the record is deleted from the cache, and a new DNS request will retrieve the latest record. For example, when the record for IP address corresponding to domain name 1 in the DNS cache expires, and the mobile phone accesses domain name 1 again, it will initiate a new DNS request to update the cache.

[0243] Implementation in progress, please refer to Figure 8 When a mobile phone accesses an application's server, it can query the DNS cache for the first IP address corresponding to the application's server's domain name (first domain name). After finding the first IP address, the mobile phone establishes a network connection with the application's server based on the first IP address. Then, the mobile phone sends a first message (which includes the first IP address) to the application's server through a router based on this network connection.

[0244] As can be seen from the above process, the first IP address in the first message can be obtained based on the first cache.

[0245] In some embodiments, if the first electronic device determines that a first regular expression corresponding to a first domain name exists in the regular expression dataset, it restricts the second electronic device from accessing the third electronic device via a first IP address, including:

[0246] If the first electronic device determines that a first regular expression corresponding to the first domain name exists in the regular expression dataset, it releases the memory occupied by the first message sent by the second electronic device to the third electronic device, thereby restricting the second electronic device from accessing the third electronic device through the first IP address.

[0247] It should be understood that the memory occupied by the first message refers to the memory occupied by sk_buff associated with the first message. For an explanation of sk_buff, please refer to the above embodiment, which will not be repeated here.

[0248] It should also be understood that the `sk_buff` structure requires memory. In the router's kernel space, the `sk_buff` structure is dynamically allocated. When the router kernel needs to process network packets, it allocates an `sk_buff` to store this information. For example, when the router needs to transmit the first packet to the server, it allocates an `sk_buff` to store the first packet. If the router determines that the first regular expression corresponding to the first domain name exists in the regular expression dataset, the router can release the memory occupied by the `sk_buff`. Therefore, the mobile phone cannot transmit data to the application's server through the router, thus restricting the mobile phone's access to the application's server.

[0249] In this embodiment of the application, the first electronic device can restrict the second electronic device from accessing the third electronic device through the first IP address by releasing the memory occupied by the first message sent by the second electronic device to the third electronic device, thereby controlling the domain name of the third electronic device and improving the control efficiency of the domain name control function.

[0250] In some embodiments, in step S1020, if the first electronic device determines that a first regular expression corresponding to the first domain name exists in the regular expression dataset, restricting the second electronic device from accessing the third electronic device via the first IP address includes:

[0251] If the first electronic device determines that a first regular expression corresponding to the first domain name exists in the regular expression dataset, it sends an interference message to the second or third electronic device to restrict the second electronic device from accessing the third electronic device through the first IP address. The interference message is used to instruct the second electronic device to disconnect from the third electronic device.

[0252] In practice, the router can send interference messages to the mobile phone or the application's server. After receiving the interference messages, the mobile phone or the application's server can close its own socket connection to disconnect the network connection, thereby restricting the mobile phone from accessing the application's server through the first IP address corresponding to the first domain name.

[0253] Socket connections can be based on different protocols, most commonly TCP and UDP. The general steps for creating a socket connection include: the application's server creates a socket and listens on a specific port for connections from the phone. The phone creates a socket and initiates a connection request to the application's server on the specified port. The application's server accepts the connection request and establishes a socket connection to the phone. Data exchange begins between the phone and the application's server. After the data exchange is complete, either party can close the connection.

[0254] In this embodiment of the application, if the first electronic device determines that there is a first regular expression corresponding to the first domain name in the regular expression dataset, assuming that the network connection is based on the TCP protocol, the first electronic device can send a TCPRESET message (interference message) to the second electronic device or the third electronic device. After receiving the TCPRESET message, the second electronic device or the third electronic device can close its own socket connection to disconnect the network connection.

[0255] Assuming the network connection is based on the UDP protocol, the first electronic device can send an ICMP unreachable message (interference message) to the second or third electronic device. After receiving the TCPRESET message, the second or third electronic device can close its own socket connection to disconnect the network connection.

[0256] In this embodiment of the application, the first electronic device can disconnect the network connection between the second electronic device and the third electronic device by sending interference messages to the second electronic device or the third electronic device. This can achieve the purpose of restricting the second electronic device from accessing the third electronic device through the first IP address and thus controlling the domain name of the third electronic device, thereby improving the control efficiency of the domain name control function.

[0257] It should be noted that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0258] This application provides a computer program product that, when run on an electronic device, causes the electronic device to execute the technical solutions described in the above embodiments. Its implementation principle and technical effects are similar to those of the related embodiments described above, and will not be repeated here.

[0259] This application provides a readable storage medium containing instructions that, when executed by an electronic device, cause the electronic device to perform the technical solution described in the above embodiments. The implementation principle and technical effects are similar and will not be repeated here.

[0260] This application provides a chip for executing instructions. When the chip is running, it executes the technical solutions described in the above embodiments. Its implementation principle and technical effects are similar and will not be repeated here.

[0261] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center that integrates one or more available media. The available media may be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., high-density digital video discs (DVDs)), or semiconductor media (e.g., solid-state disks (SSDs)).

[0262] It should be understood that the term "embodiment" used throughout the specification means that a specific feature, structure, or characteristic related to an embodiment is included in at least one embodiment of this application. Therefore, various embodiments throughout the specification do not necessarily refer to the same embodiment. Furthermore, these specific features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. It should be understood that in the various embodiments of this application, the sequence numbers of the above processes do not imply a sequential order of execution; the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0263] Those skilled in the art will understand that the various numerical designations such as "first," "second," etc., involved in this application are merely for the convenience of description and are not intended to limit the scope of the embodiments of this application, nor do they indicate the order of sequence.

[0264] In this application, the use of singular pronouns to denote "one or more" rather than "one and only one," unless otherwise specified. In this application, unless otherwise specified, "at least one" is intended to mean "one or more," and "more than" is intended to mean "two or more."

[0265] In this article, the term "and / or" is merely a description of the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can represent three cases: A exists alone, A and B exist simultaneously, and B exists alone. Here, A can be singular or plural, and B can be singular or plural.

[0266] In this document, the term "at least one of..." means all or any combination of the listed items. For example, "at least one of A, B and C" can mean: A exists alone, B exists alone, C exists alone, A and B exist simultaneously, B and C exist simultaneously, and A, B and C exist simultaneously. A can be singular or plural, B can be singular or plural, and C can be singular or plural.

[0267] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0268] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0269] The same or similar parts between the various embodiments in this application can be referred to mutually. In the various embodiments of this application, and in the various implementation methods / methods / implementations within each embodiment, unless otherwise specified or logically conflicting, the terminology and / or descriptions between different embodiments and between the various implementation methods / methods / implementations within each embodiment are consistent and can be mutually referenced. The technical features in different embodiments and the various implementation methods / methods / implementations within each embodiment can be combined according to their inherent logical relationships to form new embodiments, implementation methods, methods, or implementation approaches. The above-described embodiments of this application do not constitute a limitation on the scope of protection of this application.

[0270] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of protection of the claims. In conclusion, the above description is merely a preferred embodiment of the technical solution of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A method for controlling equipment, characterized in that, Applied to a first electronic device, the method includes: During the process of the second electronic device accessing the third electronic device through the first electronic device, the first processing module mounted on the protocol stack in the kernel space of the first electronic device obtains the response message returned by the domain name system server to the second electronic device after the second electronic device sends a query message to the domain name system server. The query message includes the first domain name of the third electronic device, and the response message includes the first domain name and the first IP address corresponding to the first domain name. When the first processing module determines that a first regular expression corresponding to the first domain name exists in the regular expression dataset, it stores the first IP address in the IP address dataset. The regular expression dataset includes regular expressions for multiple domain names under control. The regular expressions for multiple domain names include the first regular expression. The first regular expression is obtained based on the common features of multiple domain names of the third electronic device. The second processing module mounted on the protocol stack in the kernel space of the first electronic device obtains the first message sent by the second electronic device to the third electronic device, the first message including the first IP address; If the second processing module determines that the first IP address in the first packet exists in the IP address dataset, it can restrict the second electronic device from accessing the third electronic device through the first IP address by releasing the socket buffer memory occupied by the first packet or sending an interference message. The interference message is used to instruct the second electronic device to disconnect from the third electronic device.

2. The method according to claim 1, characterized in that, The first IP address in the first message is obtained based on the response message.

3. The method according to claim 1, characterized in that, The first IP address in the first message is obtained based on the first cache, which refers to the cache in which the second electronic device stores the first IP address in the response message.

4. The method according to claim 1, characterized in that, The interference messages include Transmission Control Protocol Reset messages or Internet Control Message Protocol Unreachable messages.

5. An electronic device, characterized in that, include: One or more processors; One or more memory units; The one or more memories store one or more computer programs, the one or more computer programs including instructions that, when executed by the one or more processors, cause the electronic device to perform the method as described in any one of claims 1 to 4.

6. A computer-readable storage medium, characterized in that, Includes computer instructions that, when executed on an electronic device, cause the electronic device to perform the method as described in any one of claims 1 to 4.

7. A chip, characterized in that, The chip includes: Memory, used to store instructions; A processor for retrieving and executing the instructions from the memory, causing an electronic device on which the chip is mounted to perform the method as described in any one of claims 1 to 4.

Images