Network monitoring method, apparatus and electronic device

Abstract

The application relates to a network monitoring method and device and electronic equipment, the method comprising the following steps: in the case that a terminal device is authenticated by an authentication, authorization and accounting (AAA) module, sending an address of a target domain name server (DNS) module to the terminal device, and configuring the terminal device to send a DNS resolution request to the target DNS module; in the case that the terminal device sends the DNS resolution request to the target DNS module, intercepting, by the target DNS module, a transmission layer security (TLS) handshake request sent by the terminal device to a server; resolving, by the target DNS module, a server name indication (SNI) field in the TLS handshake request, the SNI field comprising a first domain name to be accessed by the terminal device; and in the case that the first domain name belongs to a forbidden access domain name list corresponding to the terminal device, prohibiting the terminal device from connecting to the server.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and in particular to a network monitoring method, apparatus, and electronic device. Background Technology

[0002] In the application scenarios of 5G industry private networks, it is necessary to support the compatibility and use of human network cards and IoT cards, as well as multiple network access modes such as simultaneous access to internal and external networks and access to internal networks only. Furthermore, it is essential to provide mobile internet access behavior protection services for operator-contracted users without requiring changes to the SIM card, phone number, or terminal device. The core role of network monitoring of user access behavior is to ensure network security, regulate usage order, and optimize resource allocation. However, traditional network monitoring heavily relies on monitoring and hijacking plaintext Domain Name System (DNS) queries. The widespread adoption of encrypted DNS technologies such as Domain Name System over HyperText Transfer Protocol (DoH) and Domain Name System over Transport Layer Security (DoT) has resulted in the encryption and hiding of DNS query content. This prevents the system from resolving the domain names accessed by the terminal, leading to the failure of control functions and reduced network security. Summary of the Invention

[0003] The present invention aims to provide a network monitoring method, device, and electronic device to address the shortcomings of the prior art. The technical problem to be solved by the present invention is achieved through the following technical solutions.

[0004] According to a first aspect of this disclosure, a network supervision method is provided, the method comprising:

[0005] When the terminal device is authenticated by the Authentication, Authorization, Accounting (AAA) module, the address of the target DNS server module is sent to the terminal device, and the terminal device is configured to redirect DNS resolution requests to the target DNS module.

[0006] When the terminal device redirects the DNS resolution request to the target DNS module, the target DNS module intercepts the Transport Layer Security Protocol (TLS) handshake request sent by the terminal device to the server.

[0007] The target DNS module resolves the Server Name Indication (SNI) field in the TLS handshake request, where the SNI field includes the first domain name to be accessed by the terminal device.

[0008] If the first domain name belongs to the list of prohibited domain names corresponding to the terminal device, the terminal device is prohibited from connecting to the server.

[0009] Furthermore, before prohibiting the terminal device from connecting to the server when the first domain name belongs to the list of prohibited domain names corresponding to the terminal device pre-stored by the target DNS module, the method further includes:

[0010] The source IP address of the terminal device is resolved by the target DNS module;

[0011] Based on the source IP address, the target DNS module is used to query the account opening information of the terminal device.

[0012] Based on the account opening information of the terminal device, the target DNS module retrieves the list of prohibited domain names corresponding to the terminal device.

[0013] Furthermore, the method also includes:

[0014] If the first domain name is not in the list of prohibited domain names corresponding to the terminal device that is pre-stored by the target DNS module, the first IP address corresponding to the first domain name is sent to the terminal device so that the terminal device can connect to the server through the first IP address.

[0015] Further, after sending the first IP address corresponding to the first domain name to the terminal device so that the terminal device can connect to the server through the first IP address, the method further includes:

[0016] When the AAA module determines that the terminal device needs to be subject to internet access time management, the AAA module receives the intermediate call detail record (CDR) corresponding to the terminal device from the core network device. The intermediate CDR includes the duration of internet access for the terminal device.

[0017] Based on the internet access time control policy corresponding to the terminal device and the internet access duration of the terminal device, the AAA module calculates the most recent timestamp at which the terminal device needs to disconnect from the server.

[0018] Get the current timestamp based on the preset timer period;

[0019] If the most recent timestamp at which the terminal device needs to disconnect from the server is less than or equal to the current timestamp, a network disconnection message is sent to the Session Management Function (SMF) so that the SMF disconnects the connection between the terminal and the server. The network disconnection message includes the identity identifier of the terminal device and the network session identifier of the terminal device.

[0020] Furthermore, when there are multiple terminal devices, after calculating the most recent timestamp at which the terminal device needs to disconnect from the server using the AAA module based on the internet access time control policy corresponding to the terminal device and the internet access duration of the terminal device, the method further includes:

[0021] Construct a Redis sorted set. Each member of the Redis sorted set is based on the identity identifier of each terminal device, the network session identifier of each terminal device, and the internet access time control policy of each terminal device. The score of each member represents the most recent timestamp at which the corresponding terminal device needs to disconnect from its server.

[0022] When the most recent timestamp at which the terminal device needs to disconnect from the server is less than or equal to the current timestamp, sending a network disconnection message to the Session Management Function (SMF) includes:

[0023] Select target members from the Redis sorted set and send a network disconnect message to SMF. The target members are those whose scores are less than or equal to the current timestamp. The network disconnect message includes the identity identifier of the terminal device corresponding to the target member and the network session identifier of the terminal device corresponding to the target member.

[0024] Furthermore, after the SMF sends the network disconnection message, the method further includes:

[0025] Receive the disconnection success message sent by the SMF;

[0026] Based on the successful disconnection message, the target member is added to the cleanup set;

[0027] Traverse the set to be cleaned and delete the target member from the Redis sorted set.

[0028] According to a second aspect of this disclosure, a network monitoring device is provided, the device comprising:

[0029] The first sending module is used to send the address of the target domain name server (DNS) module to the terminal device when the terminal device is authenticated by the Authentication, Authorization and Accounting (AAA) module, and to configure the terminal device to redirect the DNS resolution request to the target DNS module.

[0030] The first interception module is used to intercept the Transport Layer Security Protocol (TLS) handshake request sent by the terminal device to the server through the target DNS module when the terminal device directs the DNS resolution request to the target DNS module.

[0031] The first resolution module is used to resolve the Server Name Indication (SNI) field in the TLS handshake request through the target DNS module. The SNI field includes the first domain name to be accessed by the terminal device.

[0032] The first blocking module is used to block the terminal device from connecting to the server if the first domain name belongs to the list of blocked domain names corresponding to the terminal device that is pre-stored by the target DNS module.

[0033] According to a third aspect of this disclosure, an electronic device is provided. The electronic device includes a memory and a processor, wherein a computer program is stored on the memory, and the processor executes the computer program to implement the method.

[0034] According to a fourth aspect of this disclosure, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the method.

[0035] According to a fifth aspect of this disclosure, a computer program product is provided, including computer instructions that, when executed by a processor, implement the method.

[0036] The embodiments of the present invention have the following advantages:

[0037] The network monitoring method, apparatus, and electronic device provided in this invention include the following steps: When a terminal device is authenticated by the Authentication, Authorization, and Accounting (AAA) module, the method sends the address of a target Domain Name Server (DNS) module to the terminal device and configures the terminal device to redirect DNS resolution requests to the target DNS module. When the terminal device redirects the DNS resolution request to the target DNS module, the method uses the target DNS module to intercept the Transport Layer Security (TLS) handshake request sent by the terminal device to the server. The method uses the target DNS module to parse the Server Name Indicator (SNI) field in the TLS handshake request, where the SNI field includes a first domain name that the terminal device intends to access. If the first domain name belongs to the prohibited domain name list corresponding to the terminal device, the method prohibits the terminal device from connecting to the server. Attached Figure Description

[0038] Figure 1 This is a flowchart illustrating the steps of an embodiment of the network monitoring method of the present invention;

[0039] Figure 2 This is a schematic diagram of the structure of an embodiment of the network monitoring device of the present invention;

[0040] Figure 3 This is a schematic diagram of the structure of an electronic device according to the present invention. Detailed Implementation

[0041] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0042] Figure 1 A flowchart of a network monitoring method 100 according to an embodiment of the present disclosure is shown. Specifically, the method 100 includes:

[0043] Step 101: If the terminal device is authenticated by the Authentication, Authorization and Accounting (AAA) module, send the address of the target DNS server module to the terminal device and configure the terminal device to redirect DNS resolution requests to the target DNS module.

[0044] In this step, the terminal device must first pass the identity verification of the operator's Authentication, Authorization, Accounting (AAA) system to verify whether it is a contracted user, whether the Green Internet Protection service is activated, and whether the account status is normal. Only after successful authentication can the private network service be used. After successful authentication, the system automatically sends the target Domain Name Server (DNS) address to the terminal and forces all subsequent DNS resolution requests from the terminal device to be directed to this target DNS module, preventing them from being redirected to other public DNS. The target DNS module can be understood as a self-developed DNS, which is equivalent to setting a unique gateway for the terminal device's network access, preventing users from manually switching to DoH or DoT encrypted DNS to bypass control, thus blocking previous control blind spots from the source.

[0045] Step 102: If the terminal device sends the DNS resolution request to the target DNS module, the target DNS module intercepts the Transport Layer Security Protocol (TLS) handshake request sent by the terminal device to the server.

[0046] In this step, any encrypted application or website accessed by the terminal device requires DNS resolution first. Due to the redirection configuration in step 101, this resolution request is sent directly to the target DNS module. When the terminal initiates encrypted access, the target DNS module intercepts the Transport Layer Security (TLS) handshake request to obtain the Server Name Indication (SNI) field.

[0047] Step 103: The Server Name Indication (SNI) field in the TLS handshake request is resolved by the target DNS module. The SNI field includes the first domain name to be accessed by the terminal device.

[0048] In this step, the SNI field during the TLS handshake phase is used to inform the server terminal of the specific domain name to be accessed. This field itself is not encrypted; even with DoH or DoT encryption, the SNI field can still be resolved by the target DNS module. After intercepting the TLS handshake request, the target DNS module extracts the first domain name from the SNI field, which is the target domain name that the terminal ultimately wants to access, such as xxx.game.com or xxx.office.com.

[0049] Step 104: If the first domain name belongs to the list of prohibited domain names corresponding to the terminal device, prohibit the terminal device from connecting to the server.

[0050] In this step, if the first domain name is in the list of domain names that are blocked from accessing the terminal device, then the terminal device is prohibited from connecting to the server. Specifically, the access request of the terminal device can be redirected to a fixed error page, such as the website being blocked, so that the user cannot open the target page, and the control will take effect immediately.

[0051] In some embodiments, when the terminal device is authenticated by the Authentication, Authorization, and Accounting (AAA) module, the address of the target DNS server module is sent to the terminal device, and the terminal device is configured to redirect DNS resolution requests to the target DNS module. If the terminal device redirects the DNS resolution request to the target DNS module, the target DNS module intercepts the Transport Layer Security (TLS) handshake request sent by the terminal device to the server. The target DNS module parses the Server Name Indicator (SNI) field in the TLS handshake request, where the SNI field includes a first domain name that the terminal device intends to access. If the first domain name belongs to the prohibited domain name list corresponding to the terminal device, the connection between the terminal device and the server is prohibited.

[0052] In this embodiment, after authentication by the AAA module, the target DNS module is configured to lock all resolution request entry points, preventing terminal devices from bypassing the control. Then, the TLS handshake request between the terminal device and the target DNS module is intercepted, and the unencrypted SNI field is parsed to obtain the first domain name without decrypting the encrypted DNS query. Finally, by comparing with the list of prohibited domain names corresponding to the terminal device, the illegal connection of the terminal device can be blocked, thereby improving network security.

[0053] In some embodiments, before prohibiting the terminal device from connecting to the server when the first domain name belongs to the list of prohibited domain names corresponding to the terminal device pre-stored by the target DNS module, the method further includes:

[0054] The source IP address of the terminal device is resolved by the target DNS module;

[0055] Based on the source IP address, the target DNS module is used to query the account opening information of the terminal device.

[0056] Based on the account opening information of the terminal device, the target DNS module retrieves the list of prohibited domain names corresponding to the terminal device.

[0057] In the above embodiments, when a terminal device initiates a DNS resolution request, the target DNS module synchronously extracts the terminal's source IP address. This IP address is a unique network identifier assigned by the core network (Session Management Function, SMF) device when the terminal device accesses the private network. It is strongly bound to the terminal's physical device and user identity, and remains unchanged when the terminal device is offline, making it a key basis for locating the terminal device. The target DNS module uses the system's built-in source IP-account opening information mapping library, with the resolved source IP address as an index, to query the corresponding terminal account opening information. Based on the queried account opening information, the target DNS module accurately retrieves the exclusive list of prohibited domain names corresponding to the terminal device from its own stored rule base.

[0058] In this embodiment, the strong association between source IP, account opening information, and exclusive list ensures that the retrieved prohibited list corresponds one-to-one with the terminal device, avoiding misjudgments caused by using other users' rules to judge the current terminal device's request.

[0059] In some embodiments, the method further includes:

[0060] If the first domain name is not in the list of prohibited domain names corresponding to the terminal device that is pre-stored by the target DNS module, the first IP address corresponding to the first domain name is sent to the terminal device so that the terminal device can connect to the server through the first IP address.

[0061] In the above embodiments, when the first domain name belongs to the list of prohibited domain names corresponding to the terminal device pre-stored by the target DNS module, the target DNS module performs a normal DNS resolution process based on the compliance verification result to query the IP address corresponding to the first domain name. This resolution process can be linked with the pre-configured upper-level DNS to ensure the accuracy and availability of the IP address and avoid affecting terminal access due to resolution errors. The target DNS module sends the resolved first IP address to the terminal device, and after receiving it, the terminal device can establish a network connection with the server through the IP address.

[0062] In this embodiment, only illegal domain names are blocked, while legitimate access is allowed through the normal process without additional redirection or delay, ensuring that core needs such as terminal office work and data transmission are met smoothly, and avoiding the impact of "one-size-fits-all" control on user experience.

[0063] In some embodiments, after sending the first IP address corresponding to the first domain name to the terminal device so that the terminal device can connect to the server through the first IP address, the method further includes:

[0064] When the AAA module determines that the terminal device needs to be subject to internet access time management, the AAA module receives the intermediate call detail record (CDR) corresponding to the terminal device from the core network device. The intermediate CDR includes the duration of internet access for the terminal device.

[0065] Based on the internet access time control policy corresponding to the terminal device and the internet access duration of the terminal device, the AAA module calculates the most recent timestamp at which the terminal device needs to disconnect from the server.

[0066] Get the current timestamp based on the preset timer period;

[0067] If the most recent timestamp at which the terminal device needs to disconnect from the server is less than or equal to the current timestamp, a network disconnection message is sent to the Session Management Function (SMF) so that the SMF disconnects the connection between the terminal and the server. The network disconnection message includes the identity identifier of the terminal device and the network session identifier of the terminal device.

[0068] In the above embodiments, the AAA module first needs to confirm that the terminal device has been bound to an internet access time control policy, such as a daily cumulative internet access time of 2 hours or prohibiting internet access after 6 PM on weekdays. During the period when the terminal is online and accessing the internet normally, the core network equipment will generate intermediate call detail records (CDRs) at fixed intervals (e.g., every minute) and send them to the AAA module. The intermediate CDR is not a complete bill, but a real-time status report containing key information such as the terminal device's internet access duration, identity identifier (phone number), and network session identifier, providing accurate data support for duration statistics.

[0069] After receiving the intermediate call detail records (CDRs), the AAA module extracts the internet access duration of the terminal device and, combined with the terminal's specific internet access time control policy, calculates the most recent timestamp that needs to be cut off using a built-in algorithm. For example, if the terminal's control policy is "allow 2 hours of internet access per day," and the intermediate CDR shows 1 hour and 59 minutes of internet access, the system will calculate the most recent cut-off timestamp as 1 minute later (e.g., timestamp 1755153660). If the policy is "prohibit internet access after 6 PM on weekdays," then the timestamp corresponding to 6 PM on that day, down to the second, will be used as the cut-off node. This timestamp is the core basis for determining "whether cut-off is necessary," ensuring that duration control is accurate to the second.

[0070] The system automatically obtains the current timestamp at preset time intervals (e.g., second-level intervals) to avoid timeouts due to delays. The AAA module compares the most recent disconnection timestamp with the current timestamp: if the disconnection timestamp is less than or equal to the current timestamp (i.e., the control time limit has been reached), it immediately sends a network disconnection message to the SMF. This message contains the terminal's identity identifier (e.g., mobile phone number) and network session identifier (e.g., sess_67890), ensuring that the SMF can accurately locate a specific terminal's internet session. As a key network element in the core network, the SMF directly terminates the connection between the terminal and the server at the network layer after receiving the message, without requiring additional cooperation from the terminal. This perfectly matches the scenario premise of "no change of SIM card, no change of number, no change of terminal," achieving the control goal of "must disconnect at the designated time."

[0071] In this embodiment, the cutoff timestamp is calculated based on the real-time online duration of the intermediate call detail record and the dedicated policy, avoiding the problems of discovering the cutoff only after the timeout in traditional management and control and the ambiguity of the cutoff time, which meets the refined operation needs of one policy per household.

[0072] In some embodiments, when there are multiple terminal devices, after calculating the most recent timestamp at which the terminal device needs to disconnect from the server through the AAA module based on the internet access time control policy corresponding to the terminal device and the internet access duration of the terminal device, the method further includes:

[0073] Construct a Redis sorted set. Each member of the Redis sorted set is based on the identity identifier of each terminal device, the network session identifier of each terminal device, and the internet access time control policy of each terminal device. The score of each member represents the most recent timestamp at which the corresponding terminal device needs to disconnect from its server.

[0074] When the most recent timestamp at which the terminal device needs to disconnect from the server is less than or equal to the current timestamp, sending a network disconnection message to the Session Management Function (SMF) includes:

[0075] Select target members from the Redis sorted set and send a network disconnect message to SMF. The target members are those whose scores are less than or equal to the current timestamp. The network disconnect message includes the identity identifier of the terminal device corresponding to the target member and the network session identifier of the terminal device corresponding to the target member.

[0076] In the above embodiments, when there are multiple terminals to be managed, tracking the cutoff timestamp of each terminal individually through the AAA module will lead to inefficient scheduling and inconsistent states under high concurrency. Therefore, after the AAA module calculates the most recent timestamp to be cut off for each terminal device, a Redis ordered set is introduced to centrally manage the management tasks of all terminals.

[0077] Each member of a Redis sorted set is composed of a terminal identity identifier, a network session identifier, and an internet access time control policy. The concatenation of these three elements uniquely identifies a specific internet access session for a particular terminal, preventing confusion between different terminals or multiple sessions from the same terminal and ensuring accurate disconnection. The most recent disconnection timestamp (e.g., a second-level timestamp like 1755154200) calculated by the AAA module is used as the score for each member. Redis automatically sorts members by their scores, eliminating the need for additional sorting logic and facilitating rapid filtering of terminals whose disconnection time has expired.

[0078] After obtaining the current timestamp at a preset time interval (e.g., seconds), the system no longer verifies all terminals one by one. Instead, it directly utilizes the characteristics of Redis sorted sets to quickly filter out members with scores ≤ 0, i.e., target members. This filtering operation can be completed in milliseconds with millions of data points, far exceeding the efficiency of traditional traversal methods. After filtering, the system extracts the terminal identity identifier and network session identifier from the target members, generates a standardized network disconnection message, and sends it to the SMF. Upon receiving the message, the SMF accurately locates the corresponding terminal's internet access link based on these two core identifiers and performs the disconnection action at the network layer.

[0079] In this embodiment, the Redis sorted set supports dynamic addition and deletion of millions of terminal members, matching the large-scale management and control requirements of multiple terminals in 5G private networks and solving the chaotic scheduling problem of traditional multi-terminal systems. Relying on Redis's ordered sorting and fast query capabilities, target member filtering can be completed in milliseconds, ensuring the real-time performance of timed management and control at the second level, without affecting the overall network performance.

[0080] In some embodiments, after the SMF sends a network disconnection message, the method further includes:

[0081] Receive the disconnection success message sent by the SMF;

[0082] Based on the successful disconnection message, the target member is added to the cleanup set;

[0083] Traverse the set to be cleaned and delete the target member from the Redis sorted set.

[0084] In the above embodiment, after SMF performs a network disconnection action on the terminal, it returns a disconnection success message to confirm that the connection between the terminal device and the server has been actually interrupted. Upon receiving the disconnection success message, the system adds the corresponding target member to a cleanup set. This set serves as a temporary buffer container to avoid operational chaos in high-concurrency scenarios caused by directly deleting Redis data, ensuring that the cleanup action is executed in an orderly manner. The system iterates through the cleanup set, extracts the unique identifier of each member, and precisely deletes the corresponding target member from the ordered Redis set based on this identifier. This completely removes redundant records that have already been disconnected, ensuring that the Redis set only retains terminal data whose disconnection time has not yet arrived.

[0085] In this embodiment, a buffer of the set to be cleaned ensures that the cleanup operations are carried out in an orderly manner under high concurrency, thereby reducing the system load.

[0086] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this disclosure is not limited to the described order of actions, because according to this disclosure, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily essential to this disclosure.

[0087] The above is an introduction to the method embodiments. The following describes the solution described in this disclosure further through device embodiments.

[0088] Figure 2 A block diagram of a network monitoring device 200 according to an embodiment of the present disclosure is shown. The device 200 includes:

[0089] The first sending module 201 is used to send the address of the target domain name server (DNS) module to the terminal device when the terminal device is authenticated by the Authentication, Authorization and Accounting (AAA) module, and configure the terminal device to redirect the DNS resolution request to the target DNS module.

[0090] The first interception module is used to intercept the Transport Layer Security Protocol (TLS) handshake request sent by the terminal device to the server through the target DNS module when the terminal device directs the DNS resolution request to the target DNS module.

[0091] The first resolution module is used to resolve the Server Name Indication (SNI) field in the TLS handshake request through the target DNS module. The SNI field includes the first domain name to be accessed by the terminal device.

[0092] The first blocking module is used to block the terminal device from connecting to the server if the first domain name belongs to the list of blocked domain names corresponding to the terminal device that is pre-stored by the target DNS module.

[0093] Furthermore, the device also includes:

[0094] The second resolution module is used to resolve the source IP address of the terminal device through the target DNS module;

[0095] The first query module is used to query the account opening information of the terminal device through the target DNS module based on the source IP address;

[0096] The first retrieval module is used to retrieve the list of prohibited domain names corresponding to the terminal device through the target DNS module based on the account opening information of the terminal device.

[0097] Furthermore, the device also includes:

[0098] The first sending module is configured to send a first IP address corresponding to the first domain name to the terminal device when the first domain name does not belong to the list of prohibited domain names corresponding to the terminal device pre-stored by the target DNS module, so that the terminal device can connect to the server through the first IP address.

[0099] Furthermore, the device also includes:

[0100] The first receiving module is used to receive, through the AAA module, the intermediate call detail record (CDR) corresponding to the terminal device sent by the core network device when the AAA module determines that the terminal device needs to be subject to internet access time management. The intermediate CDR includes the internet access time of the terminal device.

[0101] The first calculation module is used to calculate the most recent timestamp at which the terminal device needs to disconnect from the server based on the internet access time control policy corresponding to the terminal device and the internet access time already spent by the terminal device, through the AAA module.

[0102] The first acquisition module is used to acquire the current timestamp based on a preset time interval;

[0103] The second sending module is configured to send a network disconnection message to the Session Management Function (SMF) when the most recent timestamp at which the terminal device needs to disconnect from the server is less than or equal to the current timestamp, so that the SMF disconnects the connection between the terminal and the server. The network disconnection message includes the identity identifier of the terminal device and the network session identifier of the terminal device.

[0104] Furthermore, when there are multiple terminal devices, the device further includes:

[0105] The first construction module is used to construct a Redis ordered set. Each member of the Redis ordered set is composed of the identity identifier of each terminal device, the network session identifier of each terminal device, and the internet access time control policy of each terminal device. The score of each member represents the most recent timestamp at which the corresponding terminal device needs to disconnect from its server.

[0106] The second transmitting module includes:

[0107] The first sending unit is used to filter out target members from the Redis ordered set and send a network disconnection message to the SMF. The target member is a member whose score is less than or equal to the current timestamp. The network disconnection message includes the identity identifier of the terminal device corresponding to the target member and the network session identifier of the terminal device corresponding to the target member.

[0108] Furthermore, the device also includes:

[0109] The second receiving module is used to receive the disconnection success message sent by the SMF;

[0110] The first addition module is used to add the target member to the cleanup set based on the cut-off success message;

[0111] The first deletion module is used to traverse the set to be cleaned and delete the target member in the Redis sorted set.

[0112] Figure 3 This example illustrates a schematic diagram of the physical structure of an electronic device, which can be a smart terminal. Its internal structure diagram can be as follows: Figure 3As shown, the electronic device includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The network interface is used to communicate with external terminals via a network connection. When the computer program is executed by the processor, it implements the aforementioned network management method.

[0113] On the other hand, the present invention also provides a computer storage medium storing a computer program, which, when executed by a processor, implements the above-described network monitoring method.

[0114] In another aspect, a computer program product or computer program is provided, which includes computer instructions stored in a computer-readable storage medium. A processor of an electronic device reads the computer instructions from the computer-readable storage medium, and when the processor executes the computer instructions, it implements the aforementioned network monitoring method.

[0115] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. This computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the methods described above. Any references to memory, storage, databases, or other media used in the embodiments provided by this invention can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory.

[0116] By way of illustration and not limitation, Random Access Memory (RAM) is available in a variety of forms, such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDRSDRAM), Enhanced SDRAM (ESDRAM), Synchlink DRAM (SLDRAM), Rambus Direct RAM (RDRAM), Direct Rambus Dynamic RAM (DRDRAM), and Rambus Dynamic RAM (RDRAM), etc.

[0117] It should be noted that the above detailed descriptions are exemplary and intended to provide further explanation of this application. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains.

[0118] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the exemplary embodiments according to this application. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0119] It should be noted that the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such terms can be used interchangeably where appropriate so that the embodiments of this application described herein can be implemented in sequences other than those illustrated or described herein.

[0120] Furthermore, the terms “comprising” and “having”, and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not necessarily limited to those steps or units that are explicitly listed, but may include other steps or units that are not explicitly listed or that are inherent to such process, method, product, or apparatus.

[0121] For ease of description, spatial relative terms such as "above," "on top of," "on the upper surface of," "above," etc., are used herein to describe the spatial positional relationship of a device or feature as shown in the figures to other devices or features. It should be understood that spatial relative terms are intended to encompass different orientations in use or operation beyond the orientation of the device as described in the figures. For example, if the device in the figures were inverted, a device described as "above" or "on top of" other devices or structures would subsequently be positioned as "below" or "under" other devices or structures. Thus, the exemplary term "above" can include both "above" and "below." The device may also be positioned in other different ways, such as rotated 90 degrees or in other orientations, and the spatial relative descriptions used herein will be interpreted accordingly.

[0122] In the detailed description above, reference has been made to the accompanying drawings, which form part of this document. In the drawings, similar symbols typically identify similar parts unless the context otherwise indicates otherwise. The illustrated embodiments described in the detailed specification, drawings, and claims are not intended to be limiting. Other embodiments may be used and other changes may be made without departing from the spirit or scope of the subject matter presented herein.

[0123] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A network monitoring method, characterized in that, The method includes: When the terminal device is authenticated by the Authentication, Authorization, Accounting (AAA) module, the address of the target DNS server module is sent to the terminal device, and the terminal device is configured to redirect DNS resolution requests to the target DNS module. When the terminal device redirects the DNS resolution request to the target DNS module, the target DNS module intercepts the Transport Layer Security Protocol (TLS) handshake request sent by the terminal device to the server. The target DNS module resolves the Server Name Indication (SNI) field in the TLS handshake request, where the SNI field includes the first domain name to be accessed by the terminal device. If the first domain name belongs to the list of prohibited domain names corresponding to the terminal device, the terminal device is prohibited from connecting to the server; If the first domain name is not in the list of prohibited domain names corresponding to the terminal device that is pre-stored by the target DNS module, the first IP address corresponding to the first domain name is sent to the terminal device so that the terminal device can connect to the server through the first IP address. Then, if the AAA module determines that the terminal device needs to be subject to Internet access time management, the AAA module receives the intermediate call detail record (CDR) corresponding to the terminal device sent by the core network device. The intermediate CDR includes the Internet access time of the terminal device. Based on the internet access time control policy corresponding to the terminal device and the internet access duration of the terminal device, the AAA module calculates the most recent timestamp at which the terminal device needs to disconnect from the server. Get the current timestamp based on the preset timer period; If the most recent timestamp at which the terminal device needs to disconnect from the server is less than or equal to the current timestamp, a network disconnection message is sent to the Session Management Function (SMF) so that the SMF disconnects the connection between the terminal and the server. The network disconnection message includes the identity identifier of the terminal device and the network session identifier of the terminal device. When there are multiple terminal devices, after calculating the most recent timestamp at which the terminal device needs to disconnect from the server using the AAA module based on the internet access time control policy corresponding to the terminal device and the internet access duration of the terminal device, the method further includes: Construct a Redis sorted set. Each member of the Redis sorted set is based on the identity identifier of each terminal device, the network session identifier of each terminal device, and the internet access time control policy of each terminal device. The score of each member represents the most recent timestamp at which the corresponding terminal device needs to disconnect from its server. When the most recent timestamp at which the terminal device needs to disconnect from the server is less than or equal to the current timestamp, sending a network disconnection message to the Session Management Function (SMF) includes: Select target members from the Redis sorted set and send a network disconnect message to SMF. The target members are those whose scores are less than or equal to the current timestamp. The network disconnect message includes the identity identifier of the terminal device corresponding to the target member and the network session identifier of the terminal device corresponding to the target member.

2. The network monitoring method according to claim 1, characterized in that, If the first domain name belongs to the list of prohibited domain names corresponding to the terminal device pre-stored by the target DNS module, before prohibiting the terminal device from connecting to the server, the method further includes: The source IP address of the terminal device is resolved by the target DNS module; Based on the source IP address, the target DNS module is used to query the account opening information of the terminal device. Based on the account opening information of the terminal device, the target DNS module retrieves the list of prohibited domain names corresponding to the terminal device.

3. The network monitoring method according to claim 1, characterized in that, After the SMF sends the network disconnection message, the method further includes: Receive the disconnection success message sent by the SMF; Based on the successful disconnection message, the target member is added to the cleanup set; Traverse the set to be cleaned and delete the target member from the Redis sorted set.

4. A network monitoring device, characterized in that, The device includes: The first sending module is used to send the address of the target domain name server (DNS) module to the terminal device when the terminal device is authenticated by the Authentication, Authorization and Accounting (AAA) module, and to configure the terminal device to redirect the DNS resolution request to the target DNS module. The first interception module is used to intercept the Transport Layer Security Protocol (TLS) handshake request sent by the terminal device to the server through the target DNS module when the terminal device directs the DNS resolution request to the target DNS module. The first resolution module is used to resolve the Server Name Indication (SNI) field in the TLS handshake request through the target DNS module. The SNI field includes the first domain name to be accessed by the terminal device. The first blocking module is used to block the terminal device from connecting to the server if the first domain name belongs to the list of blocked domain names corresponding to the terminal device that is pre-stored by the target DNS module. The second sending module is used to send a first IP address corresponding to the first domain name to the terminal device when the first domain name does not belong to the list of prohibited domain names corresponding to the terminal device pre-stored by the target DNS module, so that the terminal device can connect to the server through the first IP address. The first receiving module is used to receive, through the AAA module, the intermediate call detail record (CDR) corresponding to the terminal device sent by the core network device when the AAA module determines that the terminal device needs to be subject to internet access time management. The intermediate CDR includes the internet access time of the terminal device. The first calculation module is used to calculate the most recent timestamp at which the terminal device needs to disconnect from the server based on the internet access time control policy corresponding to the terminal device and the internet access time already spent by the terminal device, through the AAA module. The first acquisition module is used to acquire the current timestamp based on a preset time interval; The third sending module is used to send a network disconnection message to the Session Management Function (SMF) when the most recent timestamp at which the terminal device needs to disconnect from the server is less than or equal to the current timestamp, so that the SMF disconnects the connection between the terminal and the server. The network disconnection message includes the identity identifier of the terminal device and the network session identifier of the terminal device. When there are multiple terminal devices, the device further includes: The first construction module is used to construct a Redis ordered set. Each member of the Redis ordered set is composed of the identity identifier of each terminal device, the network session identifier of each terminal device, and the internet access time control policy of each terminal device. The score of each member represents the most recent timestamp at which the corresponding terminal device needs to disconnect from its server. The third sending module includes: The first sending unit is used to filter out target members from the Redis ordered set and send a network disconnection message to the SMF. The target member is a member whose score is less than or equal to the current timestamp. The network disconnection message includes the identity identifier of the terminal device corresponding to the target member and the network session identifier of the terminal device corresponding to the target member. The device further includes: The second receiving module is used to receive the disconnection success message sent by the SMF; The first addition module is used to add the target member to the cleanup set based on the cut-off success message; The first deletion module is used to traverse the set to be cleaned and delete the target member in the Redis sorted set.

5. An electronic device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the network monitoring method as described in any one of claims 1 to 3.

6. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the network monitoring method as described in any one of claims 1 to 3.

7. A computer program product, characterized in that, It includes computer instructions that, when executed by a processor, implement the steps of the network monitoring method as described in any one of claims 1 to 3.

Images