Method for managing classroom internet surfing of students

Abstract

The invention discloses a method for managing classroom internet access of students, which comprises the following steps of: in a training stage, starting a training mode on a teacher terminal, accessing all network resources required to be accessed in teaching once, collecting destination IP addresses accessed by the network resources in a training process through a wireless control point, generating a plurality of ACLs (Access Control Lists), and then issuing the ACLs to a wireless strategy execution point; in the control stage, the network access behavior of the teacher is executed according to an original strategy of a school, the network access behavior of the student is matched with the ACL on a wireless strategy execution point to realize screening, and unmatched network messages are discarded, so that the access of the student to network resources is limited; in the releasing stage, the wireless control point revokes the ACL issued by the class, and the student internet access control recovers to the original state. According to the system and the method, the network access behaviors of the students in the class through the campus Wi-Fi network can be managed, so that the teachers in each class can conveniently formulate the network access management strategy of the class, and the network access management strategy takes effect in real time.

Description

Technical Field

[0001] This invention relates to the field of data communication networks, and more specifically, to a method for managing students' access to the network in the classroom via a campus Wi-Fi network. Background Technology

[0002] To manage student access to the campus Wi-Fi network, there are currently two approaches: the traditional NAC (Network Access Control) solution and the service-based approach. The traditional NAC solution implements access control by issuing VLANs and ACLs (Access Control Lists) to authentication point devices. The policy technologies mainly include local static ACL policies and dynamic ACL policies authorized by the admission server. The essence of locally configured static ACL policies is to map user policies to the user's IP address, and then plan ACL rules based on the IP address to control user permissions. For large and medium-sized campuses, dynamic ACL policies authorized by the admission server are used. This avoids the need for strong binding between terminals and IP / VLAN information, and the planning of IP and VLANs is relatively flexible.

[0003] The "Service Follow-up" solution refers to a technical approach that controls user network access permissions through topology-independent security groups. It uses a natural language approach for configuring user policies, eliminating the need for users to worry about network concepts like IP addresses and VLANs. Furthermore, policies are centrally deployed by the controller, making maintenance easy. Service Follow-up ensures that users receive the same network access policies regardless of their location or IP address within a campus network. When configuring policies, administrators don't need to concern themselves with the IP address ranges of different user types; they only need to focus on the logical access relationships between various users and the server.

[0004] These two methods can address the general scenario management of user access to Wi-Fi networks. However, because they only focus on user identity, they cannot manage students' fine-grained internet access behavior during class. In school, students often access specific websites based on teaching needs. To prevent students from accessing the internet at will and affecting teaching effectiveness, it's necessary to restrict their internet access to network resources designated by the teacher. In this scenario, the traditional NAC and business-as-you-go solutions mentioned above are inadequate. Traditional NAC solutions require pre-configuring numerous ACL policies to specify which websites are accessible and which are not, resulting in a huge workload for administrators. Furthermore, classroom internet access needs can change from lesson to lesson, making the configuration too laborious to meet timely teaching requirements. Business-as-you-go solutions decouple user internet access permissions from IP addresses, simplifying the administrator's configuration workload. However, because teaching units are at the class level and teaching needs change frequently, user groups need to be refined to the class level, and internet access permissions for user groups still need to be modified at the granularity of each lesson. The configuration workload remains very large and cannot meet timely teaching needs. Summary of the Invention

[0005] To address the aforementioned problems, this invention provides a method for managing students' internet access in the classroom. This method can manage students' internet access behavior via the campus Wi-Fi network during class, allowing teachers to easily formulate internet management strategies for each class, which take effect in real time.

[0006] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0007] A method for managing students' internet access in class, which divides the entire class time into a training phase, a control phase, and a deactivation phase;

[0008] During the training phase, from a few minutes before class (e.g., 10 minutes) until a few minutes after class begins, the teacher activates training mode on their terminal and accesses all network resources needed for the lesson. The teacher's network activity is forwarded to the wireless control point. Upon detecting the activation of training mode, the wireless control point forwards the network packets sent by the teacher's terminal to the network as normal, completing the network resource access. Simultaneously, it collects the destination IP addresses of network resource accesses during the training process (only those from the teacher's terminal to the network), generates several ACLs, and then distributes these ACLs to the wireless policy enforcement point. After accessing the network resources, the teacher deactivates training mode. Specifically, the training phase includes the following steps:

[0009] S1. Teachers start the training mode on their own terminals through the training terminal provided by the system.

[0010] S2. The system asks the teacher whether to specify a class time. If no class time is specified, it is assumed that the online training is to be conducted in the current class time and proceeds to step S3; otherwise, it proceeds to step S11.

[0011] S3. The system retrieves the current teacher's timetable from the school's timetable system and determines whether the teacher has a class at the moment. If the teacher has a class, proceed to step S4; otherwise, proceed to step S11.

[0012] S4. The system determines whether the AP currently connected to this teacher is consistent with the AP in the timetable of the classroom. If they are consistent, proceed to step S6; otherwise, proceed to step S5.

[0013] S5. The system prompts the teacher, "The current location is not in the classroom. Do you want to continue training?" If you want to continue training, proceed to step S6; otherwise, proceed to step S10.

[0014] S6. When the teacher clicks "Start Training," the system notifies the wireless controller to begin learning the teacher's internet browsing behavior, allowing the teacher to access network resources needed during the teaching process.

[0015] S7. When the teacher clicks "End Training," the system notifies the wireless controller to end the teacher's internet activity.

[0016] S8. The wireless controller generates ACLs based on the teacher's internet browsing behavior (which websites and URLs were visited);

[0017] S9. The wireless controller will send the generated ACL rules to the APs in the classroom corresponding to this class (if there are multiple APs in a classroom, the ACL will be sent to each AP in the classroom; the validity period of the ACL is the time period of the class, after which the ACL will be deleted by the wireless controller or AP).

[0018] S10, Training ends;

[0019] S11. Teachers designate class times;

[0020] S12. The system retrieves the class schedule for the current teacher's designated class time from the school's timetable system;

[0021] S13. Determine whether the teacher has a class during the specified time period. If the teacher has a class, proceed to step S14; otherwise, prompt the teacher that there is no class during the specified time period and proceed to step S11.

[0022] S14. The system prompts the teacher, "The current time is not the time of this class. Do you want to continue training?" If you want to continue training, proceed to step S6; otherwise, proceed to step S15.

[0023] S15. The system prompts the teacher "Do you want to reschedule the class time?". If the teacher reschedules the class time, proceed to step S11; otherwise, proceed to step S10.

[0024] During the control phase, starting from the end of the training phase, teachers' network access behavior is still executed according to the school's original policy, while students' network access behavior is filtered at the wireless policy execution point. Specifically, network packets generated by student terminals are matched with the ACL. Matching packets are forwarded to the network to complete access to network resources, while non-matching packets are discarded, thereby restricting students' access to network resources.

[0025] During the deactivation phase, starting from the end of class, the wireless control point cancels the ACL issued for this class, and the student's internet access control returns to its original state.

[0026] Furthermore, the wireless control point is the wireless controller of the campus network or the SDN controller in the campus network; the wireless policy enforcement point can be one or more wireless APs in the classroom (generally, one or more APs are deployed to provide Wi-Fi access services for the classroom depending on its size) or a firewall in the campus network.

[0027] The above solution eliminates the need for network administrators to configure students' access permissions to network resources via campus Wi-Fi. It allows for timely granting of appropriate network resource access permissions to students for each class based on the instructor's needs, thus satisfying teaching requirements while preventing students from accessing the internet at will during class. Attached Figure Description

[0028] Other features, objects, and advantages of the present invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings:

[0029] Figure 1 This is a timing diagram of a method for managing students' internet access in class, according to an embodiment of the present invention.

[0030] Figure 2 This is a flowchart of internet access behavior training in an embodiment of the present invention.

[0031] Figure 3 This is the classroom internet behavior training interface for teachers on their terminals in this embodiment of the invention.

[0032] Figure 4 This is a schematic ACL generated at the wireless control point in an embodiment of the present invention. Detailed Implementation

[0033] The present invention will now be described in detail with reference to specific embodiments. These embodiments will help those skilled in the art to further understand the present invention, but do not limit the invention in any way. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention. These all fall within the scope of protection of the present invention.

[0034] This invention manages network resource access within the Wi-Fi coverage area of ​​a specific classroom during class hours, based on the premise that campus Wi-Fi network users have already completed network access authentication. In a campus Wi-Fi wireless network, typically one or more access points (APs) are deployed in a classroom, depending on its size, to provide Wi-Fi access services for that classroom. The following describes... Figure 1 Taking a class period in a classroom as an example, the general process of using this invention will be explained.

[0035] For ease of explanation, from the perspective of network management, the entire class time is divided into a training phase, a control phase, and a deactivation phase. The training phase can start from a few minutes before class (e.g., 10 minutes) to a few minutes after class begins. The control phase begins at the end of the training phase, and the deactivation phase begins at the end of class. During the training phase, the teacher initiates training mode on their terminal and accesses all network resources needed for the lesson. The teacher's network activity is forwarded to the wireless control point. Upon detecting the initiation of training mode, the wireless control point forwards the network packets sent by the terminal to the network to complete resource access. Simultaneously, it collects the destination IP addresses of network resource accesses during the training process (only those from the teacher to the network) and generates several ACLs. These ACLs are then distributed to the wireless policy enforcement point. After accessing the network resources, the teacher closes the training mode. During the control phase, the teacher's network access continues according to the school's original policy. Students' network access is filtered at the wireless policy enforcement point. Specifically, network packets generated by the student's terminal are matched against the aforementioned ACLs. Matching packets are forwarded to the network to complete resource access, while unmatching packets are discarded, thus restricting student access to network resources. During the deactivation phase, the wireless control point revoks the ACLs issued for the lesson, and student internet access control returns to its original state.

[0036] In this invention, "training" can be a function of the network management software. After the training mode is activated, the network management software controls the wireless AP to forward network packets from the teacher terminal that has enabled training mode to the wireless control point, notifying the wireless control point to learn the destination IP addresses of the packets currently sent from the specified teacher terminal, and generate one or more ACLs using these destination IP addresses. Activating the training mode can also utilize the interface opened by the wireless control point, whereby the software on the teacher terminal notifies the wireless control point to learn the destination IP addresses of the packets currently sent from the specified teacher terminal, and generate one or more ACLs using these destination IP addresses. The workflow of the training mode is as follows: Figure 2 As shown:

[0037] S1. Teachers start the training mode on their own terminals through the training terminal provided by the system.

[0038] S2. The system asks the teacher whether to specify a class time. If no class time is specified, it is assumed that the online training is to be conducted in the current class time and proceeds to step S3; otherwise, it proceeds to step S11.

[0039] S3. The system retrieves the current teacher's timetable from the school's timetable system and determines whether the teacher has a class at the moment. If the teacher has a class, proceed to step S4; otherwise, proceed to step S11.

[0040] S4. The system determines whether the AP currently connected to this teacher is consistent with the AP in the timetable of the classroom. If they are consistent, proceed to step S6; otherwise, proceed to step S5.

[0041] S5. The system prompts the teacher, "The current location is not in the classroom. Do you want to continue training?" If you want to continue training, proceed to step S6; otherwise, proceed to step S10.

[0042] S6. When the teacher clicks "Start Training," the system notifies the wireless controller to begin learning the teacher's internet browsing behavior, allowing the teacher to access network resources needed during the teaching process.

[0043] S7. When the teacher clicks "End Training," the system notifies the wireless controller to end the teacher's internet activity.

[0044] S8. The wireless controller generates ACLs based on the teacher's internet browsing behavior (which websites and URLs were visited);

[0045] S9. The wireless controller will send the generated ACL rules to the APs in the classroom corresponding to this class (if there are multiple APs in a classroom, the ACL will be sent to each AP in the classroom; the validity period of the ACL is the time period of the class, after which the ACL will be deleted by the wireless controller or AP).

[0046] S10, Training End.

[0047] S11. Teachers designate class times;

[0048] S12. The system retrieves the class schedule for the current teacher's designated class time from the school's timetable system;

[0049] S13. Determine whether the teacher has a class during the specified time period. If the teacher has a class, proceed to step S14; otherwise, prompt the teacher that there is no class during the specified time period and proceed to step S11.

[0050] S14. The system prompts the teacher, "The current time is not the time of this class. Do you want to continue training?" If you want to continue training, proceed to step S6; otherwise, proceed to step S15.

[0051] S15. The system prompts the teacher "Do you want to reschedule the class time?". If the teacher reschedules the class time, proceed to step S11; otherwise, proceed to step S10.

[0052] Figure 3 This is the interface of classroom internet behavior training software running on the teacher's terminal. Teachers can choose on this terminal whether to train the current classroom's internet behavior or to train a specific class.

[0053] In this invention, ACL generation can be referenced in the following example. During the training phase, the teacher's terminal accesses three servers with IP addresses 10.40.210.16, 180.101.50.188, and 117.78.12.122 via HTTP protocol, and then generates ACLs as follows: Figure 4 The three ACLs.

[0054] Of course, network ACL rules are quite flexible; this is just an example. When using this invention, ACL configuration rules can be used to design network resource access ACL rules that adapt to the training results. Since ACL is a mature existing technology, this invention will not elaborate further.

[0055] Preferably, in this invention, since teachers and students are in the same classroom, the wireless control point only distributes the learned ACL to the AP currently accessed by the teacher's terminal and other APs in the same classroom; or the teacher specifies one or more APs in the classroom through the terminal. (Note: Campus network administrators can mark all APs in each classroom on the wireless control point.) Therefore, the method provided by this invention only manages the network access behavior expected by the teacher for students attending classes in the same classroom. For network areas where this method is not enabled, students' network access behavior is still executed according to the school's established policies.

[0056] Wireless control points can be the wireless controllers of the campus network; wireless policy enforcement points can be one or more wireless access points (APs) in the classroom (generally, one or more APs are deployed depending on the size of the classroom to provide Wi-Fi access). Wireless control points can also be SDN controllers in the campus network. Wireless policy enforcement points can also be firewalls in the campus network.

[0057] The specific embodiments of the present invention have been described above. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art can make various modifications or variations within the scope of the claims, which do not affect the essence of the present invention.

Claims

1. A method for managing students' internet access in class, characterized in that: The entire class time is divided into a training phase, a control phase, and a release phase; among them... During the training phase, the training mode is started on the teacher terminal, and all network resources that need to be accessed in the teaching process are accessed. The network packets sent by the teacher terminal are forwarded to the network normally through the wireless control point to complete the network resource access. At the same time, the destination IP addresses of the network resource access during the training process are collected, several ACLs are generated, and then the ACLs are sent to the wireless policy enforcement point. After the network resource access is completed, the training mode is turned off. During the control phase, teachers' network access behavior is executed according to the school's original policy, while students' network access behavior is filtered at the wireless policy execution point. Specifically, the network packets generated by the student terminal are matched with the ACL. Matching network packets are forwarded to the network to complete access to network resources, while non-matching network packets are discarded, thereby restricting students' access to network resources. During the deactivation phase, the wireless control point cancels the ACL issued for this lesson, and student internet access control returns to its original state.

2. The method for managing students' internet access in class as described in claim 1, characterized in that: The wireless control point is the wireless controller of the campus network or the SDN controller in the campus network; the wireless policy enforcement point is one or more wireless APs in the classroom where the class is currently being held or a firewall in the campus network.

3. The method for managing students' internet access in class as described in claim 1, characterized in that: The training phase lasts from a few minutes before class to a few minutes after class begins, the control phase begins at the end of the training phase, and the deactivation phase begins at the end of class.

4. The method for managing students' internet access in class as described in claim 1, characterized in that: The training phase includes the following steps: S1. Teachers start the training mode on their own terminals through the training terminal provided by the system. S2. The system asks the teacher whether to specify a class time. If no class time is specified, it is assumed that the online training is to be conducted in the current class time and proceeds to step S3; otherwise, it proceeds to step S11. S3. The system retrieves the current teacher's timetable from the school's timetable system and determines whether the teacher has a class at the moment. If the teacher has a class, proceed to step S4; otherwise, proceed to step S11. S4. The system determines whether the AP currently connected to this teacher is consistent with the AP in the timetable of the classroom. If they are consistent, proceed to step S6; otherwise, proceed to step S5. S5. The system prompts the teacher, "The current location is not in the classroom. Do you want to continue training?" If you want to continue training, proceed to step S6; otherwise, proceed to step S10. S6. When the teacher clicks "Start Training," the system notifies the wireless controller to begin learning the teacher's internet browsing behavior, allowing the teacher to access network resources needed during the teaching process. S7. When the teacher clicks "End Training," the system notifies the wireless controller to end the teacher's internet activity. S8, the wireless controller generates ACLs based on the teacher's internet browsing behavior; S9. The wireless controller sends the generated ACL rules to the AP in the classroom corresponding to this lesson; S10, Training ends; S11. Teachers designate class times; S12. The system retrieves the class schedule for the current teacher's designated class time from the school's timetable system; S13. Determine whether the teacher has a class during the specified time period. If the teacher has a class, proceed to step S14; otherwise, prompt the teacher that there is no class during the specified time period and proceed to step S11. S14. The system prompts the teacher, "The current time is not the time of this class. Do you want to continue training?" If the teacher continues training, proceed to step S6; otherwise, proceed to step S15. S15. The system prompts the teacher "Do you want to reschedule the class time?". If the teacher reschedules the class time, proceed to step S11; otherwise, proceed to step S10.

Images